attaching a signature

[RLessmann]

I'm trying to attach a signature to a PE file. The authenticode digest was externally signed PKCS#1, but I belief you will need a PKCS#7 signature for attaching. Any idea how this could be achieved?

[olszomal]

Just to clarify — when you say the Authenticode digest was “externally signed PKCS#1” do you mean a full PKCS#1 signature (i.e., the digest encrypted with the private RSA key), or are you referring to just the raw hash of the file?

To create a proper PKCS#7 signature that could be attached to a PE file, you would need:

• The PKCS#1 signature itself (encrypted digest).
• The signer’s X.509 certificate.
• Optionally, any intermediate certificates to complete the trust chain.
• Optionally, the raw digest of the file, if you want the PKCS#7 to include the digest directly instead of being detached.

With these components, it would be possible to implement functionality to wrap the PKCS#1 signature in a PKCS#7 container suitable for attaching to a PE file.

[RLessmann]

I solved the problem right now without osslsigncode. I'm using the MS signtool instead with the flags /dg (digest generation) /di (digest injection).
Will get back to osslsigncode later. However I still noticed that the digest generation looks quite different when using osslsigncode and the MS signtool. In both case I'm able to extract the PKCS7 SignedData block. However the MS signtool prepopulates the optional element certificates for me, on osslcodesign I have to do it my own. Also some differences for the PKCS7 SignerInfo block. Osslcodesign leaves it empty, but MS signtool creates it but leaves it unsigned.
This isn't actually a big deal, but the SignerInfo contains a section authenticated attributes. MS signtool prepopulates them, but not osslcodesign and it is difficult to understand what needs to go in here.
Overall I apologize in case I cause trouble or disruption. I'm kind of new to this topic and do not know if mey questions are relevant or even make sense. Thanks

[mtrojnar]

Are you saying that signtool selects the certificate chain automatically, while osslsigncode needs providing the chain for the signing certificate? The ease of use vs degree of control is indeed a tradeoff.

[RLessmann]

The certificates are not a problem. They are easy to add. But the authenticated attributes are problematic. To my understanding microsoft does requires certain attributes, but the field is optional in the PKCS7 sequence and as a user of osslsigncode, I do not know what to add here

[olszomal]

@RLessmann You might want to try osslsigncode extract‑data — it extracts the PKCS#7 data to be signed, similar to signtool’s /dg and /di workflow. You can then sign it externally and attach the signature with attach‑signature.

See the related discussion here: #356

[mtrojnar]

To my understanding microsoft does requires certain attributes

Which attributes unsupported by osslsigncode does Microsoft require?