c# - How to create an pkcs7 block for key exchange only (bouncy castle) -

i trying create file containing pkcs 7 block. in container, need public key , signer info (no signed data!!!). have tried several alternatives without luck. code:

first signature info:

 list<x509certificate> certs = new list<x509certificate> { cert };  ix509store x509certs = x509storefactory.create(       "certificate/collection",       new x509collectionstoreparameters(certs));   var ias = new issuerandserialnumber(cert.issuerdn, cert.serialnumber);  signeridentifier sid = new signeridentifier(ias);  algorithmidentifier algodigid = new algorithmidentifiercmssignedgenerator.digestsha1);  algorithmidentifier algocryptid = new algorithmidentifier(cmssignedgenerator.encryptionrsa);   signerinfo si = new signerinfo(sid, algodigid, null, algocryptid,                                       new deroctetstring(contentsignature), null); 

the contentsignature byte[] contains signed digest info.

now, when try create signeddata, goes down

  var signedcontent = new contentinfo(cmsobjectidentifiers.data, dernull.instance);   cmssigneddata csd = new cmssigneddata(signedcontent); 

i not trying send info, key exchange , verification purposes. believe valid scenario somehow not work.

thanks help.

update:

more context.

i trying sign jar .net executable. have pretty done rest of process jarsigner creates pkcs7 file with:

• contentinfo set type data , no content. far, making new contentinfo( cmsobjectidentifiers.data, null) throws exception while adding content info cmsdata

• a signerinfo added, signerinfo includes signature derived jar's content.

as question related signing apk / jar file, answer in context.

assuming that:

you have performed following setup steps:

1. generated valid manifest.mf
2. generated valid cert.sf
3. have valid pfx file loaded x509certificate2 variable named "cert"
4. have binary contents of cert.sf file in byte array named "manifestsfbytes"

the following code generate valid detached pkcs7 signature cert.rsa content:

string oid_data = "1.2.840.113549.1.7.1";  // setup data sign contentinfo content = new contentinfo( new oid( oid_data ), manifestsfbytes ); signedcms signedcms = new signedcms( content, true ); cmssigner signer = new cmssigner( subjectidentifiertype.issuerandserialnumber, cert );  // create signature signedcms.computesignature( signer ); byte[] data = signedcms.encode(); 

this code relies on system.security.cryptography.pkcs namespace , not require bouncycastle.

what going on here raw content (signature file binary data) hashed , signed in 1 go computesignature() call.

therefore no "null contentinfo" tricks necessary i.e. contentinfo contains raw data signed , hashed unlike java implementation signs , hashes content prior pkcs7 generation.

hth

-(e)