summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorschwarze <>2016-09-05 10:43:42 +0000
committerschwarze <>2016-09-05 10:43:42 +0000
commit8bc3352bee3f743c2b8f9fd9c743fca60706336c (patch)
tree8ddbb216e39c4571145c2d202a95596f977cdfe0 /src
parentde12fbc1ebd942810e5ca1e55d7a6e213023f318 (diff)
downloadopenbsd-8bc3352bee3f743c2b8f9fd9c743fca60706336c.tar.gz
openbsd-8bc3352bee3f743c2b8f9fd9c743fca60706336c.tar.bz2
openbsd-8bc3352bee3f743c2b8f9fd9c743fca60706336c.zip
remove CMS manuals; beck@ agress with the general idea
Diffstat (limited to 'src')
-rw-r--r--src/lib/libcrypto/doc/PEM_write_bio_CMS_stream.pod41
-rw-r--r--src/lib/libcrypto/doc/SMIME_read_CMS.pod70
-rw-r--r--src/lib/libcrypto/doc/SMIME_write_CMS.pod64
-rw-r--r--src/lib/libcrypto/doc/X509_STORE_set_verify_cb_func.pod1
-rw-r--r--src/lib/libcrypto/doc/i2d_CMS_bio_stream.pod44
-rw-r--r--src/lib/libcrypto/man/BIO_new_CMS.383
-rw-r--r--src/lib/libcrypto/man/CMS_add0_cert.3127
-rw-r--r--src/lib/libcrypto/man/CMS_add1_recipient_cert.3115
-rw-r--r--src/lib/libcrypto/man/CMS_add1_signer.3161
-rw-r--r--src/lib/libcrypto/man/CMS_compress.3110
-rw-r--r--src/lib/libcrypto/man/CMS_decrypt.3127
-rw-r--r--src/lib/libcrypto/man/CMS_encrypt.3152
-rw-r--r--src/lib/libcrypto/man/CMS_final.348
-rw-r--r--src/lib/libcrypto/man/CMS_get0_RecipientInfos.3251
-rw-r--r--src/lib/libcrypto/man/CMS_get0_SignerInfos.3119
-rw-r--r--src/lib/libcrypto/man/CMS_get0_type.395
-rw-r--r--src/lib/libcrypto/man/CMS_get1_ReceiptRequest.3143
-rw-r--r--src/lib/libcrypto/man/CMS_sign.3199
-rw-r--r--src/lib/libcrypto/man/CMS_sign_receipt.361
-rw-r--r--src/lib/libcrypto/man/CMS_uncompress.370
-rw-r--r--src/lib/libcrypto/man/CMS_verify.3188
-rw-r--r--src/lib/libcrypto/man/CMS_verify_receipt.355
-rw-r--r--src/lib/libcrypto/man/Makefile24
23 files changed, 1 insertions, 2347 deletions
diff --git a/src/lib/libcrypto/doc/PEM_write_bio_CMS_stream.pod b/src/lib/libcrypto/doc/PEM_write_bio_CMS_stream.pod
deleted file mode 100644
index f9946adebf..0000000000
--- a/src/lib/libcrypto/doc/PEM_write_bio_CMS_stream.pod
+++ /dev/null
@@ -1,41 +0,0 @@
1=pod
2
3=head1 NAME
4
5PEM_write_bio_CMS_stream - output CMS_ContentInfo structure in PEM format.
6
7=head1 SYNOPSIS
8
9 #include <openssl/cms.h>
10 #include <openssl/pem.h>
11
12 int PEM_write_bio_CMS_stream(BIO *out, CMS_ContentInfo *cms, BIO *data, int flags);
13
14=head1 DESCRIPTION
15
16PEM_write_bio_CMS_stream() outputs a CMS_ContentInfo structure in PEM format.
17
18It is otherwise identical to the function SMIME_write_CMS().
19
20=head1 NOTES
21
22This function is effectively a version of the PEM_write_bio_CMS() supporting
23streaming.
24
25=head1 RETURN VALUES
26
27PEM_write_bio_CMS_stream() returns 1 for success or 0 for failure.
28
29=head1 SEE ALSO
30
31L<ERR_get_error(3)|ERR_get_error(3)>, L<CMS_sign(3)|CMS_sign(3)>,
32L<CMS_verify(3)|CMS_verify(3)>, L<CMS_encrypt(3)|CMS_encrypt(3)>
33L<CMS_decrypt(3)|CMS_decrypt(3)>,
34L<SMIME_write_CMS(3)|SMIME_write_CMS(3)>,
35L<i2d_CMS_bio_stream(3)|i2d_CMS_bio_stream(3)>
36
37=head1 HISTORY
38
39PEM_write_bio_CMS_stream() was added to OpenSSL 1.0.0
40
41=cut
diff --git a/src/lib/libcrypto/doc/SMIME_read_CMS.pod b/src/lib/libcrypto/doc/SMIME_read_CMS.pod
deleted file mode 100644
index acc5524c14..0000000000
--- a/src/lib/libcrypto/doc/SMIME_read_CMS.pod
+++ /dev/null
@@ -1,70 +0,0 @@
1=pod
2
3=head1 NAME
4
5 SMIME_read_CMS - parse S/MIME message.
6
7=head1 SYNOPSIS
8
9 #include <openssl/cms.h>
10
11 CMS_ContentInfo *SMIME_read_CMS(BIO *in, BIO **bcont);
12
13=head1 DESCRIPTION
14
15SMIME_read_CMS() parses a message in S/MIME format.
16
17B<in> is a BIO to read the message from.
18
19If cleartext signing is used then the content is saved in a memory bio which is
20written to B<*bcont>, otherwise B<*bcont> is set to NULL.
21
22The parsed CMS_ContentInfo structure is returned or NULL if an
23error occurred.
24
25=head1 NOTES
26
27If B<*bcont> is not NULL then the message is clear text signed. B<*bcont> can
28then be passed to CMS_verify() with the B<CMS_DETACHED> flag set.
29
30Otherwise the type of the returned structure can be determined
31using CMS_get0_type().
32
33To support future functionality if B<bcont> is not NULL B<*bcont> should be
34initialized to NULL. For example:
35
36 BIO *cont = NULL;
37 CMS_ContentInfo *cms;
38
39 cms = SMIME_read_CMS(in, &cont);
40
41=head1 BUGS
42
43The MIME parser used by SMIME_read_CMS() is somewhat primitive. While it will
44handle most S/MIME messages more complex compound formats may not work.
45
46The parser assumes that the CMS_ContentInfo structure is always base64 encoded
47and will not handle the case where it is in binary format or uses quoted
48printable format.
49
50The use of a memory BIO to hold the signed content limits the size of message
51which can be processed due to memory restraints: a streaming single pass option
52should be available.
53
54=head1 RETURN VALUES
55
56SMIME_read_CMS() returns a valid B<CMS_ContentInfo> structure or B<NULL>
57if an error occurred. The error can be obtained from ERR_get_error(3).
58
59=head1 SEE ALSO
60
61L<ERR_get_error(3)|ERR_get_error(3)>, L<CMS_type(3)|CMS_type(3)>
62L<SMIME_read_CMS(3)|SMIME_read_CMS(3)>, L<CMS_sign(3)|CMS_sign(3)>,
63L<CMS_verify(3)|CMS_verify(3)>, L<CMS_encrypt(3)|CMS_encrypt(3)>
64L<CMS_decrypt(3)|CMS_decrypt(3)>
65
66=head1 HISTORY
67
68SMIME_read_CMS() was added to OpenSSL 0.9.8
69
70=cut
diff --git a/src/lib/libcrypto/doc/SMIME_write_CMS.pod b/src/lib/libcrypto/doc/SMIME_write_CMS.pod
deleted file mode 100644
index 04bedfb429..0000000000
--- a/src/lib/libcrypto/doc/SMIME_write_CMS.pod
+++ /dev/null
@@ -1,64 +0,0 @@
1=pod
2
3=head1 NAME
4
5 SMIME_write_CMS - convert CMS structure to S/MIME format.
6
7=head1 SYNOPSIS
8
9 #include <openssl/cms.h>
10
11 int SMIME_write_CMS(BIO *out, CMS_ContentInfo *cms, BIO *data, int flags);
12
13=head1 DESCRIPTION
14
15SMIME_write_CMS() adds the appropriate MIME headers to a CMS
16structure to produce an S/MIME message.
17
18B<out> is the BIO to write the data to. B<cms> is the appropriate
19B<CMS_ContentInfo> structure. If streaming is enabled then the content must be
20supplied in the B<data> argument. B<flags> is an optional set of flags.
21
22=head1 NOTES
23
24The following flags can be passed in the B<flags> parameter.
25
26If B<CMS_DETACHED> is set then cleartext signing will be used, this option only
27makes sense for SignedData where B<CMS_DETACHED> is also set when CMS_sign() is
28called.
29
30If the B<CMS_TEXT> flag is set MIME headers for type B<text/plain> are added to
31the content, this only makes sense if B<CMS_DETACHED> is also set.
32
33If the B<CMS_STREAM> flag is set streaming is performed. This flag should only
34be set if B<CMS_STREAM> was also set in the previous call to a CMS_ContentInfo
35creation function.
36
37If cleartext signing is being used and B<CMS_STREAM> not set then the data must
38be read twice: once to compute the signature in CMS_sign() and once to output
39the S/MIME message.
40
41If streaming is performed the content is output in BER format using indefinite
42length constructed encoding except in the case of signed data with detached
43content where the content is absent and DER format is used.
44
45=head1 BUGS
46
47SMIME_write_CMS() always base64 encodes CMS structures, there should be an
48option to disable this.
49
50=head1 RETURN VALUES
51
52SMIME_write_CMS() returns 1 for success or 0 for failure.
53
54=head1 SEE ALSO
55
56L<ERR_get_error(3)|ERR_get_error(3)>, L<CMS_sign(3)|CMS_sign(3)>,
57L<CMS_verify(3)|CMS_verify(3)>, L<CMS_encrypt(3)|CMS_encrypt(3)>
58L<CMS_decrypt(3)|CMS_decrypt(3)>
59
60=head1 HISTORY
61
62SMIME_write_CMS() was added to OpenSSL 0.9.8
63
64=cut
diff --git a/src/lib/libcrypto/doc/X509_STORE_set_verify_cb_func.pod b/src/lib/libcrypto/doc/X509_STORE_set_verify_cb_func.pod
index f9602b3e77..754512341c 100644
--- a/src/lib/libcrypto/doc/X509_STORE_set_verify_cb_func.pod
+++ b/src/lib/libcrypto/doc/X509_STORE_set_verify_cb_func.pod
@@ -43,7 +43,6 @@ a value.
43=head1 SEE ALSO 43=head1 SEE ALSO
44 44
45L<X509_STORE_CTX_set_verify_cb(3)|X509_STORE_CTX_set_verify_cb(3)> 45L<X509_STORE_CTX_set_verify_cb(3)|X509_STORE_CTX_set_verify_cb(3)>
46L<CMS_verify(3)|CMS_verify(3)>
47 46
48=head1 HISTORY 47=head1 HISTORY
49 48
diff --git a/src/lib/libcrypto/doc/i2d_CMS_bio_stream.pod b/src/lib/libcrypto/doc/i2d_CMS_bio_stream.pod
deleted file mode 100644
index 558bdd0812..0000000000
--- a/src/lib/libcrypto/doc/i2d_CMS_bio_stream.pod
+++ /dev/null
@@ -1,44 +0,0 @@
1=pod
2
3=head1 NAME
4
5 i2d_CMS_bio_stream - output CMS_ContentInfo structure in BER format.
6
7=head1 SYNOPSIS
8
9 #include <openssl/cms.h>
10
11 int i2d_CMS_bio_stream(BIO *out, CMS_ContentInfo *cms, BIO *data, int flags);
12
13=head1 DESCRIPTION
14
15i2d_CMS_bio_stream() outputs a CMS_ContentInfo structure in BER format.
16
17It is otherwise identical to the function SMIME_write_CMS().
18
19=head1 NOTES
20
21This function is effectively a version of the i2d_CMS_bio() supporting
22streaming.
23
24=head1 BUGS
25
26The prefix "i2d" is arguably wrong because the function outputs BER format.
27
28=head1 RETURN VALUES
29
30i2d_CMS_bio_stream() returns 1 for success or 0 for failure.
31
32=head1 SEE ALSO
33
34L<ERR_get_error(3)|ERR_get_error(3)>, L<CMS_sign(3)|CMS_sign(3)>,
35L<CMS_verify(3)|CMS_verify(3)>, L<CMS_encrypt(3)|CMS_encrypt(3)>
36L<CMS_decrypt(3)|CMS_decrypt(3)>,
37L<SMIME_write_CMS(3)|SMIME_write_CMS(3)>,
38L<PEM_write_bio_CMS_stream(3)|PEM_write_bio_CMS_stream(3)>
39
40=head1 HISTORY
41
42i2d_CMS_bio_stream() was added to OpenSSL 1.0.0
43
44=cut
diff --git a/src/lib/libcrypto/man/BIO_new_CMS.3 b/src/lib/libcrypto/man/BIO_new_CMS.3
deleted file mode 100644
index 312c39ad1c..0000000000
--- a/src/lib/libcrypto/man/BIO_new_CMS.3
+++ /dev/null
@@ -1,83 +0,0 @@
1.Dd $Mdocdate: September 9 2015 $
2.Dt BIO_NEW_CMS 3
3.Os
4.Sh NAME
5.Nm BIO_new_CMS
6.Nd CMS streaming filter BIO
7.Sh SYNOPSIS
8.In openssl/cms.h
9.Ft BIO *
10.Fo BIO_new_CMS
11.Fa "BIO *out"
12.Fa "CMS_ContentInfo *cms"
13.Fc
14.Sh DESCRIPTION
15.Fn BIO_new_CMS
16returns a streaming filter BIO chain based on
17.Fa cms .
18The output of the filter is written to
19.Fa out .
20Any data written to the chain is automatically translated
21to a BER format CMS structure of the appropriate type.
22.Sh RETURN VALUES
23.Fn BIO_new_CMS
24returns a BIO chain when successful or
25.Dv NULL
26if an error occurred.
27The error can be obtained from
28.Xr ERR_get_error 3 .
29.Sh NOTES
30The chain returned by this function behaves like a standard filter BIO.
31It supports non blocking I/O.
32Content is processed and streamed on the fly and not all held in memory
33at once: so it is possible to encode very large structures.
34After all content has been written through the chain
35.Xr BIO_flush 3
36must be called to finalise the structure.
37.Pp
38The
39.Dv CMS_STREAM
40flag must be included in the corresponding
41.Fa flags
42parameter of the
43.Fa cms
44creation function.
45.Pp
46If an application wishes to write additional data to
47.Fa out ,
48BIOs should be removed from the chain using
49.Xr BIO_pop 3
50and freed with
51.Xr BIO_free 3
52until
53.Fa out
54is reached.
55If no additional data needs to be written,
56.Xr BIO_free_all 3
57can be called to free up the whole chain.
58.Pp
59Any content written through the filter is used verbatim:
60no canonical translation is performed.
61.Pp
62It is possible to chain multiple BIOs to, for example,
63create a triple wrapped signed, enveloped, signed structure.
64In this case it is the application's responsibility
65to set the inner content type of any outer
66.Vt CMS_ContentInfo
67structures.
68.Pp
69Large numbers of small writes through the chain should be avoided as this
70will produce an output consisting of lots of OCTET STRING structures.
71Prepending a
72.Xr BIO_f_buffer 3
73buffering BIO will prevent this.
74.Sh SEE ALSO
75.Xr CMS_encrypt 3 ,
76.Xr CMS_sign 3 ,
77.Xr ERR_get_error 3
78.Sh HISTORY
79.Fn BIO_new_CMS
80was added to OpenSSL 1.0.0.
81.Sh BUGS
82There is currently no corresponding inverse BIO
83which can decode a CMS structure on the fly.
diff --git a/src/lib/libcrypto/man/CMS_add0_cert.3 b/src/lib/libcrypto/man/CMS_add0_cert.3
deleted file mode 100644
index b02eb06673..0000000000
--- a/src/lib/libcrypto/man/CMS_add0_cert.3
+++ /dev/null
@@ -1,127 +0,0 @@
1.Dd $Mdocdate: November 11 2015 $
2.Dt CMS_ADD0_CERT 3
3.Os
4.Sh NAME
5.Nm CMS_add0_cert ,
6.Nm CMS_add1_cert ,
7.Nm CMS_get1_certs ,
8.Nm CMS_add0_crl ,
9.Nm CMS_add1_crl ,
10.Nm CMS_get1_crls
11.Nd CMS certificate and CRL utility functions
12.Sh SYNOPSIS
13.In openssl/cms.h
14.Ft int
15.Fo CMS_add0_cert
16.Fa "CMS_ContentInfo *cms"
17.Fa "X509 *cert"
18.Fc
19.Ft int
20.Fo CMS_add1_cert
21.Fa "CMS_ContentInfo *cms"
22.Fa "X509 *cert"
23.Fc
24.Ft STACK_OF(X509) *
25.Fo CMS_get1_certs
26.Fa "CMS_ContentInfo *cms"
27.Fc
28.Ft int
29.Fo CMS_add0_crl
30.Fa "CMS_ContentInfo *cms"
31.Fa "X509_CRL *crl"
32.Fc
33.Ft int
34.Fo CMS_add1_crl
35.Fa "CMS_ContentInfo *cms"
36.Fa "X509_CRL *crl"
37.Fc
38.Ft STACK_OF(X509_CRL) *
39.Fo CMS_get1_crls
40.Fa "CMS_ContentInfo *cms"
41.Fc
42.Sh DESCRIPTION
43.Fn CMS_add0_cert
44and
45.Fn CMS_add1_cert
46add certificate
47.Fa cert
48to
49.Fa cms .
50.Fa cms
51must be of type signed data or enveloped data.
52.Pp
53.Fn CMS_get1_certs
54returns all certificates in
55.Fa cms .
56.Pp
57.Fn CMS_add0_crl
58and
59.Fn CMS_add1_crl
60add CRL
61.Fa crl
62to
63.Fa cms .
64.Fn CMS_get1_crls
65returns any CRLs in
66.Fa cms .
67.Sh NOTES
68The
69.Vt CMS_ContentInfo
70structure
71.Fa cms
72must be of type signed data or enveloped data or an error will be
73returned.
74.Pp
75For signed data, certificates and CRLs are added to the
76.Fa certificates
77and
78.Fa crls
79fields of the SignedData structure.
80For enveloped data, they are added to
81.Fa OriginatorInfo .
82.Pp
83As the
84.Sq 0
85implies,
86.Fn CMS_add0_cert
87adds
88.Fa cert
89internally to
90.Fa cms
91and it must not be freed up after the call, as opposed to
92.Fn CMS_add1_cert
93where
94.Fa cert
95must be freed up.
96.Pp
97The same certificate or CRL must not be added to the same cms structure
98more than once.
99.Sh RETURN VALUES
100.Fn CMS_add0_cert ,
101.Fn CMS_add1_cert ,
102.Fn CMS_add0_crl ,
103and
104.Fn CMS_add1_crl
105return 1 for success and 0 for failure.
106.Pp
107.Fn CMS_get1_certs
108and
109.Fn CMS_get1_crls
110return the STACK of certificates or CRLs or
111.Dv NULL
112if there are none or an error occurs.
113The only error which will occur in practice is if the
114.Fa cms
115type is invalid.
116.Sh SEE ALSO
117.Xr CMS_encrypt 3 ,
118.Xr CMS_sign 3 ,
119.Xr ERR_get_error 3
120.Sh HISTORY
121.Fn CMS_add0_cert ,
122.Fn CMS_add1_cert ,
123.Fn CMS_get1_certs ,
124.Fn CMS_add0_crl
125and
126.Fn CMS_get1_crls
127were all first added to OpenSSL 0.9.8.
diff --git a/src/lib/libcrypto/man/CMS_add1_recipient_cert.3 b/src/lib/libcrypto/man/CMS_add1_recipient_cert.3
deleted file mode 100644
index 4e848446a6..0000000000
--- a/src/lib/libcrypto/man/CMS_add1_recipient_cert.3
+++ /dev/null
@@ -1,115 +0,0 @@
1.Dd $Mdocdate: November 11 2015 $
2.Dt CMS_ADD1_RECIPIENT_CERT 3
3.Os
4.Sh NAME
5.Nm CMS_add1_recipient_cert ,
6.Nm CMS_add0_recipient_key
7.Nd add recipients to a CMS enveloped data structure
8.Sh SYNOPSIS
9.In openssl/cms.h
10.Ft CMS_RecipientInfo *
11.Fo CMS_add1_recipient_cert
12.Fa "CMS_ContentInfo *cms"
13.Fa "X509 *recip"
14.Fa "unsigned int flags"
15.Fc
16.Ft CMS_RecipientInfo *
17.Fo CMS_add0_recipient_key
18.Fa "CMS_ContentInfo *cms"
19.Fa "int nid"
20.Fa "unsigned char *key"
21.Fa "size_t keylen"
22.Fa "unsigned char *id"
23.Fa "size_t idlen"
24.Fa "ASN1_GENERALIZEDTIME *date"
25.Fa "ASN1_OBJECT *otherTypeId"
26.Fa "ASN1_TYPE *otherType"
27.Fc
28.Sh DESCRIPTION
29.Fn CMS_add1_recipient_cert
30adds recipient
31.Fa recip
32to the
33.Vt CMS_ContentInfo
34enveloped data structure
35.Fa cms
36as a KeyTransRecipientInfo structure.
37.Pp
38.Fn CMS_add0_recipient_key
39adds the symmetric key
40.Fa key
41of length
42.Fa keylen
43using the wrapping algorithm
44.Fa nid ,
45identifier
46.Fa id
47of length
48.Fa idlen
49and optional values
50.Fa date ,
51.Fa otherTypeId ,
52and
53.Fa otherType
54to the
55.Vt CMS_ContentInfo
56enveloped data structure
57.Fa cms
58as a KEKRecipientInfo structure.
59.Pp
60The
61.Vt CMS_ContentInfo
62structure should be obtained from an initial call to
63.Xr CMS_encrypt 3
64with the flag
65.Dv CMS_PARTIAL
66set.
67.Sh NOTES
68The main purpose of this function is to provide finer control over a CMS
69enveloped data structure where the simpler
70.Xr CMS_encrypt 3
71function defaults are not appropriate.
72For example if one or more KEKRecipientInfo structures need to be added.
73New attributes can also be added using the returned
74.Vt CMS_RecipientInfo
75structure and the CMS attribute utility functions.
76.Pp
77OpenSSL will by default identify recipient certificates using issuer
78name and serial number.
79If
80.Dv CMS_USE_KEYID
81is set, it will use the subject key identifier value instead.
82An error occurs if all recipient certificates do not have a subject key
83identifier extension.
84.Pp
85Currently only AES based key wrapping algorithms are supported for
86.Fa nid ,
87specifically:
88.Dv NID_id_aes128_wrap ,
89.Dv NID_id_aes192_wrap ,
90and
91.Dv NID_id_aes256_wrap .
92If
93.Fa nid
94is set to
95.Dv NID_undef ,
96then an AES wrap algorithm will be used consistent with
97.Fa keylen .
98.Sh RETURN VALUES
99.Fn CMS_add1_recipient_cert
100and
101.Fn CMS_add0_recipient_key
102return an internal pointer to the
103.Vt CMS_RecipientInfo
104structure just added or
105.Dv NULL
106if an error occurs.
107.Sh SEE ALSO
108.Xr CMS_decrypt 3 ,
109.Xr CMS_final 3 ,
110.Xr ERR_get_error 3
111.Sh HISTORY
112.Fn CMS_add1_recipient_cert
113and
114.Fn CMS_add0_recipient_key
115were added to OpenSSL 0.9.8.
diff --git a/src/lib/libcrypto/man/CMS_add1_signer.3 b/src/lib/libcrypto/man/CMS_add1_signer.3
deleted file mode 100644
index 403ec5b8e3..0000000000
--- a/src/lib/libcrypto/man/CMS_add1_signer.3
+++ /dev/null
@@ -1,161 +0,0 @@
1.Dd $Mdocdate: November 11 2015 $
2.Dt CMS_SIGN_ADD1_SIGNER 3
3.Os
4.Sh NAME
5.Nm CMS_add1_signer ,
6.Nm CMS_SignerInfo_sign
7.Nd add a signer to a CMS_ContentInfo signed data structure
8.Sh SYNOPSIS
9.In openssl/cms.h
10.Ft CMS_SignerInfo *
11.Fo CMS_add1_signer
12.Fa "CMS_ContentInfo *cms"
13.Fa "X509 *signcert"
14.Fa "EVP_PKEY *pkey"
15.Fa "const EVP_MD *md"
16.Fa "unsigned int flags"
17.Fc
18.Ft int
19.Fo CMS_SignerInfo_sign
20.Fa "CMS_SignerInfo *si"
21.Fc
22.Sh DESCRIPTION
23.Fn CMS_add1_signer
24adds a signer with certificate
25.Fa signcert
26and private key
27.Fa pkey
28using message digest
29.Fa md
30to the
31.Vt CMS_ContentInfo
32SignedData structure
33.Fa cms .
34.Pp
35The
36.Vt CMS_ContentInfo
37structure should be obtained from an initial call to
38.Xr CMS_sign 3
39with the flag
40.Dv CMS_PARTIAL
41set or in the case or re-signing a valid
42.Vt CMS_ContentInfo
43SignedData structure.
44.Pp
45If the
46.Fa md
47parameter is
48.Dv NULL ,
49then the default digest for the public key algorithm will be used.
50.Pp
51Unless the
52.Dv CMS_REUSE_DIGEST
53flag is set, the returned
54.Vt CMS_ContentInfo
55structure is not complete and must be finalized either by streaming
56(if applicable) or a call to
57.Xr CMS_final 3 .
58.Pp
59The
60.Fn CMS_SignerInfo_sign
61function will explicitly sign a
62.Vt CMS_SignerInfo
63structure, its main use is when
64.Dv CMS_REUSE_DIGEST
65and
66.Dv CMS_PARTIAL
67flags are both set.
68.Sh NOTES
69The main purpose of
70.Fn CMS_add1_signer
71is to provide finer control over a CMS signed data structure where the
72simpler
73.Xr CMS_sign 3
74function defaults are not appropriate.
75For example if multiple signers or non default digest algorithms are
76needed.
77New attributes can also be added using the returned
78.Vt CMS_SignerInfo
79structure and the CMS attribute utility functions or the CMS signed
80receipt request functions.
81.Pp
82Any of the following flags (OR'ed together) can be passed in the
83.Fa flags
84parameter.
85.Pp
86If
87.Dv CMS_REUSE_DIGEST
88is set, then an attempt is made to copy the content digest value from the
89.Dv CMS_ContentInfo
90structure: to add a signer to an existing structure.
91An error occurs if a matching digest value cannot be found to copy.
92The returned
93.Dv CMS_ContentInfo
94structure will be valid and finalized when this flag is set.
95.Pp
96If
97.Dv CMS_PARTIAL
98is set in addition to
99.Dv CMS_REUSE_DIGEST
100then the
101.Vt CMS_SignerInfo
102structure will not be finalized so additional attributes can be added.
103In this case an explicit call to
104.Fn CMS_SignerInfo_sign
105is needed to finalize it.
106.Pp
107If
108.Dv CMS_NOCERTS
109is set, the signer's certificate will not be included in the
110.Vt CMS_ContentInfo
111structure, the signer's certificate must still be supplied in the
112.Fa signcert
113parameter though.
114This can reduce the size of the signature if the signers certificate can
115be obtained by other means: for example a previously signed message.
116.Pp
117The SignedData structure includes several CMS signedAttributes including
118the signing time, the CMS content type and the supported list of ciphers
119in an SMIMECapabilities attribute.
120If
121.Dv CMS_NOATTR
122is set, then no signedAttributes will be used.
123If
124.Dv CMS_NOSMIMECAP
125is set, then just the SMIMECapabilities are omitted.
126.Pp
127OpenSSL will by default identify signing certificates using issuer name
128and serial number.
129If
130.Dv CMS_USE_KEYID
131is set, it will use the subject key identifier value instead.
132An error occurs if the signing certificate does not have a subject key
133identifier extension.
134.Pp
135If present, the SMIMECapabilities attribute indicates support for the
136following algorithms in preference order: 256 bit AES, Gost R3411-94,
137Gost 28147-89, 192 bit AES, 128 bit AES, triple DES, 128 bit RC2, 64 bit
138RC2, DES and 40 bit RC2.
139If any of these algorithms is not available then it will not be
140included: for example the GOST algorithms will not be included if
141the GOST ENGINE is not loaded.
142.Pp
143.Fn CMS_add1_signer
144returns an internal pointer to the
145.Dv CMS_SignerInfo
146structure just added.
147This can be used to set additional attributes before it is finalized.
148.Sh RETURN VALUES
149.Fn CMS_add1_signer
150returns an internal pointer to the
151.Vt CMS_SignerInfo
152structure just added or
153.Dv NULL
154if an error occurs.
155.Sh SEE ALSO
156.Xr CMS_final 3 ,
157.Xr CMS_sign 3 ,
158.Xr ERR_get_error 3
159.Sh HISTORY
160.Fn CMS_add1_signer
161was added to OpenSSL 0.9.8.
diff --git a/src/lib/libcrypto/man/CMS_compress.3 b/src/lib/libcrypto/man/CMS_compress.3
deleted file mode 100644
index 1330464441..0000000000
--- a/src/lib/libcrypto/man/CMS_compress.3
+++ /dev/null
@@ -1,110 +0,0 @@
1.Dd $Mdocdate: November 11 2015 $
2.Dt CMS_COMPRESS 3
3.Os
4.Sh NAME
5.Nm CMS_compress
6.Nd create a CMS CompressedData structure
7.Sh SYNOPSIS
8.In openssl/cms.h
9.Ft CMS_ContentInfo *
10.Fo CMS_compress
11.Fa "BIO *in"
12.Fa "int comp_nid"
13.Fa "unsigned int flags"
14.Fc
15.Sh DESCRIPTION
16.Fn CMS_compress
17creates and returns a CMS CompressedData structure.
18.Fa comp_nid
19is the compression algorithm to use or
20.Dv NID_undef
21to use the default algorithm (zlib compression).
22.Fa in
23is the content to be compressed.
24.Fa flags
25is an optional set of flags.
26.Sh NOTES
27The only currently supported compression algorithm is zlib using the NID
28.Dv NID_zlib_compression .
29.Pp
30If zlib support is not compiled into OpenSSL then
31.Fn CMS_compress
32will return an error.
33.Pp
34If the
35.Dv CMS_TEXT
36flag is set, MIME headers for type
37.Sy text/plain
38are prepended to the data.
39.Pp
40Normally the supplied content is translated into MIME canonical format
41(as required by the S/MIME specifications); if
42.Dv CMS_BINARY
43is set, no translation occurs.
44This option should be used if the supplied data is in binary format;
45otherwise the translation will corrupt it.
46If
47.Dv CMS_BINARY
48is set then
49.Dv CMS_TEXT
50is ignored.
51.Pp
52If the
53.Dv CMS_STREAM
54flag is set a partial
55.Vt CMS_ContentInfo
56structure is returned suitable for streaming I/O: no data is read from
57the
58.Vt BIO
59.Fa in .
60.Pp
61The compressed data is included in the
62.Vt CMS_ContentInfo
63structure, unless
64.Dv CMS_DETACHED
65is set, in which case it is omitted.
66This is rarely used in practice and is not supported by
67.Xr SMIME_write_CMS 3 .
68.Sh NOTES
69If the flag
70.Dv CMS_STREAM
71is set, the returned
72.Vt CMS_ContentInfo
73structure is
74.Em not
75complete and outputting its contents via a function that does not
76properly finalize the
77.Vt CMS_ContentInfo
78structure will give unpredictable results.
79.Pp
80Several functions including
81.Xr SMIME_write_CMS 3 ,
82.Xr i2d_CMS_bio_stream 3 ,
83.Xr PEM_write_bio_CMS_stream 3
84finalize the structure.
85Alternatively finalization can be performed by obtaining the streaming
86ASN1
87.Vt BIO
88directly using
89.Xr BIO_new_CMS 3 .
90.Pp
91Additional compression parameters such as the zlib compression level
92cannot currently be set.
93.Sh RETURN VALUES
94.Fn CMS_compress
95returns either a
96.Vt CMS_ContentInfo
97structure or
98.Dv NULL
99if an error occurred.
100The error can be obtained from
101.Xr ERR_get_error 3 .
102.Sh SEE ALSO
103.Xr CMS_uncompress 3 ,
104.Xr ERR_get_error 3
105.Sh HISTORY
106.Fn CMS_compress
107was added to OpenSSL 0.9.8.
108The
109.Dv CMS_STREAM
110flag was first supported in OpenSSL 1.0.0.
diff --git a/src/lib/libcrypto/man/CMS_decrypt.3 b/src/lib/libcrypto/man/CMS_decrypt.3
deleted file mode 100644
index 3a34f10783..0000000000
--- a/src/lib/libcrypto/man/CMS_decrypt.3
+++ /dev/null
@@ -1,127 +0,0 @@
1.Dd $Mdocdate: November 11 2015 $
2.Dt CMS_DECRYPT 3
3.Os
4.Sh NAME
5.Nm CMS_decrypt
6.Nd decrypt content from a CMS envelopedData structure
7.Sh SYNOPSIS
8.In openssl/cms.h
9.Ft int
10.Fo CMS_decrypt
11.Fa "CMS_ContentInfo *cms"
12.Fa "EVP_PKEY *pkey"
13.Fa "X509 *cert"
14.Fa "BIO *dcont"
15.Fa "BIO *out"
16.Fa "unsigned int flags"
17.Fc
18.Sh DESCRIPTION
19.Fn CMS_decrypt
20extracts and decrypts the content from a CMS EnvelopedData structure.
21.Fa pkey
22is the private key of the recipient,
23.Fa cert
24is the recipient's certificate,
25.Fa out
26is a
27.Vt BIO
28to write the content to and
29.Fa flags
30is an optional set of flags.
31.Pp
32The
33.Fa dcont
34parameter is used in the rare case where the encrypted content is
35detached.
36It will normally be set to
37.Dv NULL .
38.Sh NOTES
39.Xr OpenSSL_add_all_algorithms 3
40(or equivalent) should be called before using this function or errors
41about unknown algorithms will occur.
42.Pp
43Although the recipients certificate is not needed to decrypt the data it
44is needed to locate the appropriate (of possible several) recipients in
45the CMS structure.
46.Pp
47If
48.Fa cert
49is set to
50.Dv NULL ,
51all possible recipients are tried.
52This case however is problematic.
53To thwart the MMA attack (Bleichenbacher's attack on PKCS #1 v1.5 RSA
54padding) all recipients are tried whether they succeed or not.
55If no recipient succeeds then a random symmetric key is used to decrypt
56the content: this will typically output garbage and may (but is not
57guaranteed to) ultimately return a padding error only.
58If
59.Fn CMS_decrypt
60just returned an error when all recipient encrypted keys failed to
61decrypt an attacker could use this in a timing attack.
62If the special flag
63.Dv CMS_DEBUG_DECRYPT
64is set then the above behaviour is modified and an error
65.Em is
66returned if no recipient encrypted key can be decrypted
67.Em without
68generating a random content encryption key.
69Applications should use this flag with
70.Sy extreme caution
71especially in automated gateways as it can leave them open to attack.
72.Pp
73It is possible to determine the correct recipient key by other means
74(for example looking them up in a database) and setting them in the CMS
75structure in advance using the CMS utility functions such as
76.Xr CMS_set1_pkey 3 .
77In this case both
78.Fa cert
79and
80.Fa pkey
81should be set to
82.Dv NULL .
83.Pp
84To process KEKRecipientInfo types
85.Xr CMS_set1_key 3
86or
87.Xr CMS_RecipientInfo_set0_key 3
88and
89.Xr CMS_ReceipientInfo_decrypt 3
90should be called before
91.Fn CMS_decrypt
92and
93.Fa cert
94and
95.Fa pkey
96set to
97.Dv NULL .
98.Pp
99The following flags can be passed in the
100.Fa flags
101parameter:
102.Pp
103If the
104.Dv CMS_TEXT
105flag is set MIME headers for type
106.Sy text/plain
107are deleted from the content.
108If the content is not of type
109.Sy text/plain
110then an error is returned.
111.Sh RETURN VALUES
112.Fn CMS_decrypt
113returns either 1 for success or 0 for failure.
114The error can be obtained from
115.Xr ERR_get_error 3 .
116.Sh BUGS
117The lack of single pass processing and the need to hold all data in
118memory as mentioned in
119.Xr CMS_verify 3
120also applies to
121.Fn CMS_decrypt .
122.Sh SEE ALSO
123.Xr CMS_encrypt 3 ,
124.Xr ERR_get_error 3
125.Sh HISTORY
126.Fn CMS_decrypt
127was added to OpenSSL 0.9.8.
diff --git a/src/lib/libcrypto/man/CMS_encrypt.3 b/src/lib/libcrypto/man/CMS_encrypt.3
deleted file mode 100644
index 5d7b0bf470..0000000000
--- a/src/lib/libcrypto/man/CMS_encrypt.3
+++ /dev/null
@@ -1,152 +0,0 @@
1.Dd $Mdocdate: November 11 2015 $
2.Dt CMS_ENCRYPT 3
3.Os
4.Sh NAME
5.Nm CMS_encrypt
6.Nd create a CMS envelopedData structure
7.Sh SYNOPSIS
8.In openssl/cms.h
9.Ft CMS_ContentInfo *
10.Fo CMS_encrypt
11.Fa "STACK_OF(X509) *certs"
12.Fa "BIO *in"
13.Fa "const EVP_CIPHER *cipher"
14.Fa "unsigned int flags"
15.Fc
16.Sh DESCRIPTION
17.Fn CMS_encrypt
18creates and returns a CMS EnvelopedData structure.
19.Fa certs
20is a list of recipient certificates.
21.Fa in
22is the content to be encrypted.
23.Fa cipher
24is the symmetric cipher to use.
25.Fa flags
26is an optional set of flags.
27.Sh NOTES
28Only certificates carrying RSA keys are supported so the recipient
29certificates supplied to this function must all contain RSA public keys,
30though they do not have to be signed using the RSA algorithm.
31.Pp
32The algorithm passed in the
33.Fa cipher
34parameter must support ASN1 encoding of its parameters.
35.Pp
36Many browsers implement a "sign and encrypt" option which is simply an
37S/MIME envelopedData containing an S/MIME signed message.
38This can be readily produced by storing the S/MIME signed message in a
39memory BIO and passing it to
40.Fn CMS_encrypt .
41.Pp
42The following flags can be passed in the
43.Fa flags
44parameter:
45.Pp
46If the
47.Dv CMS_TEXT
48flag is set, MIME headers for type
49.Sy text/plain
50are prepended to the data.
51.Pp
52Normally the supplied content is translated into MIME canonical format
53(as required by the S/MIME specifications); if
54.Dv CMS_BINARY
55is set, no translation occurs.
56This option should be used if the supplied data is in binary format;
57otherwise the translation will corrupt it.
58If
59.Dv CMS_BINARY
60is set then
61.Dv CMS_TEXT
62is ignored.
63.Pp
64OpenSSL will by default identify recipient certificates using issuer
65name and serial number.
66If
67.Dv CMS_USE_KEYID
68is set, it will use the subject key identifier value instead.
69An error occurs if all recipient certificates do not have a subject key
70identifier extension.
71.Pp
72If the
73.Dv CMS_STREAM
74flag is set, a partial
75.Vt CMS_ContentInfo
76structure is returned suitable for streaming I/O: no data is read from the
77.Vt BIO
78.Fa in .
79.Pp
80If the
81.Dv CMS_PARTIAL
82flag is set, a partial
83.Vt CMS_ContentInfo
84structure is returned to which additional recipients and attributes can
85be added before finalization.
86.Pp
87The data being encrypted is included in the
88.Vt CMS_ContentInfo
89structure, unless
90.Dv CMS_DETACHED
91is set, in which case it is omitted.
92This is rarely used in practice and is not supported by
93.Xr SMIME_write_CMS 3 .
94.Pp
95If the flag
96.Dv CMS_STREAM
97is set, the returned
98.Vt CMS_ContentInfo
99structure is
100.Em not
101complete and outputting its contents via a function that does not
102properly finalize the
103.Vt CMS_ContentInfo
104structure will give unpredictable results.
105.Pp
106Several functions including
107.Xr SMIME_write_CMS 3 ,
108.Xr i2d_CMS_bio_stream 3 ,
109.Xr PEM_write_bio_CMS_stream 3
110finalize the structure.
111Alternatively finalization can be performed by obtaining the streaming
112ASN1
113.Vt BIO
114directly using
115.Xr BIO_new_CMS 3 .
116.Pp
117The recipients specified in
118.Fa certs
119use a CMS KeyTransRecipientInfo info structure.
120KEKRecipientInfo is also supported using the flag
121.Dv CMS_PARTIAL
122and
123.Xr CMS_add0_recipient_key 3 .
124.Pp
125The parameter
126.Fa certs
127may be
128.Dv NULL
129if
130.Dv CMS_PARTIAL
131is set and recipients are added later using
132.Xr CMS_add1_recipient_cert 3
133or
134.Xr CMS_add0_recipient_key 3 .
135.Sh RETURN VALUES
136.Fn CMS_encrypt
137returns either a
138.Vt CMS_ContentInfo
139structure or
140.Dv NULL
141if an error occurred.
142The error can be obtained from
143.Xr ERR_get_error 3 .
144.Sh SEE ALSO
145.Xr CMS_decrypt 3 ,
146.Xr ERR_get_error 3
147.Sh HISTORY
148.Fn CMS_encrypt
149was added to OpenSSL 0.9.8.
150The
151.Dv CMS_STREAM
152flag was first supported in OpenSSL 1.0.0.
diff --git a/src/lib/libcrypto/man/CMS_final.3 b/src/lib/libcrypto/man/CMS_final.3
deleted file mode 100644
index 4e7912a4e0..0000000000
--- a/src/lib/libcrypto/man/CMS_final.3
+++ /dev/null
@@ -1,48 +0,0 @@
1.Dd $Mdocdate: November 11 2015 $
2.Dt CMS_FINAL 3
3.Os
4.Sh NAME
5.Nm CMS_final
6.Nd finalise a CMS_ContentInfo structure
7.Sh SYNOPSIS
8.In openssl/cms.h
9.Ft int
10.Fo CMS_final
11.Fa "CMS_ContentInfo *cms"
12.Fa "BIO *data"
13.Fa "BIO *dcont"
14.Fa "unsigned int flags"
15.Fc
16.Sh DESCRIPTION
17.Fn CMS_final
18finalises the structure
19.Fa cms .
20Its purpose is to perform any operations necessary on
21.Fa cms
22(digest computation for example) and set the appropriate fields.
23The parameter
24.Fa data
25contains the content to be processed.
26The
27.Fa dcont
28parameter contains a
29.Vt BIO
30to write content to after processing: this is
31only used with detached data and will usually be set to
32.Dv NULL .
33.Sh NOTES
34This function will normally be called when the
35.Dv CMS_PARTIAL
36flag is used.
37It should only be used when streaming is not performed because the
38streaming I/O functions perform finalisation operations internally.
39.Sh RETURN VALUES
40.Fn CMS_final
41returns 1 for success or 0 for failure.
42.Sh SEE ALSO
43.Xr CMS_encrypt 3 ,
44.Xr CMS_sign 3 ,
45.Xr ERR_get_error 3
46.Sh HISTORY
47.Fn CMS_final
48was added to OpenSSL 0.9.8.
diff --git a/src/lib/libcrypto/man/CMS_get0_RecipientInfos.3 b/src/lib/libcrypto/man/CMS_get0_RecipientInfos.3
deleted file mode 100644
index 4db69b57b8..0000000000
--- a/src/lib/libcrypto/man/CMS_get0_RecipientInfos.3
+++ /dev/null
@@ -1,251 +0,0 @@
1.Dd $Mdocdate: November 11 2015 $
2.Dt CMS_GET0_RECIPIENTINFOS 3
3.Os
4.Sh NAME
5.Nm CMS_get0_RecipientInfos ,
6.Nm CMS_RecipientInfo_type ,
7.Nm CMS_RecipientInfo_ktri_get0_signer_id ,
8.Nm CMS_RecipientInfo_ktri_cert_cmp ,
9.Nm CMS_RecipientInfo_set0_pkey ,
10.Nm CMS_RecipientInfo_kekri_get0_id ,
11.Nm CMS_RecipientInfo_kekri_id_cmp ,
12.Nm CMS_RecipientInfo_set0_key ,
13.Nm CMS_RecipientInfo_decrypt ,
14.Nm CMS_RecipientInfo_encrypt
15.Nd CMS envelopedData RecipientInfo routines
16.Sh SYNOPSIS
17.In openssl/cms.h
18.Ft STACK_OF(CMS_RecipientInfo) *
19.Fo CMS_get0_RecipientInfos
20.Fa "CMS_ContentInfo *cms"
21.Fc
22.Ft int
23.Fo CMS_RecipientInfo_type
24.Fa "CMS_RecipientInfo *ri"
25.Fc
26.Ft int
27.Fo CMS_RecipientInfo_ktri_get0_signer_id
28.Fa "CMS_RecipientInfo *ri"
29.Fa "ASN1_OCTET_STRING **keyid"
30.Fa "X509_NAME **issuer"
31.Fa "ASN1_INTEGER **sno"
32.Fc
33.Ft int
34.Fo CMS_RecipientInfo_ktri_cert_cmp
35.Fa "CMS_RecipientInfo *ri"
36.Fa "X509 *cert"
37.Fc
38.Ft int
39.Fo CMS_RecipientInfo_set0_pkey
40.Fa "CMS_RecipientInfo *ri"
41.Fa "EVP_PKEY *pkey"
42.Fc
43.Ft int
44.Fo CMS_RecipientInfo_kekri_get0_id
45.Fa "CMS_RecipientInfo *ri"
46.Fa "X509_ALGOR **palg"
47.Fa "ASN1_OCTET_STRING **pid"
48.Fa "ASN1_GENERALIZEDTIME **pdate"
49.Fa "ASN1_OBJECT **potherid"
50.Fa "ASN1_TYPE **pothertype"
51.Fc
52.Ft int
53.Fo CMS_RecipientInfo_kekri_id_cmp
54.Fa "CMS_RecipientInfo *ri"
55.Fa "const unsigned char *id"
56.Fa "size_t idlen"
57.Fc
58.Ft int
59.Fo CMS_RecipientInfo_set0_key
60.Fa "CMS_RecipientInfo *ri"
61.Fa "unsigned char *key"
62.Fa "size_t keylen"
63.Fc
64.Ft int
65.Fo CMS_RecipientInfo_decrypt
66.Fa "CMS_ContentInfo *cms"
67.Fa "CMS_RecipientInfo *ri"
68.Fc
69.Sh DESCRIPTION
70The function
71.Fn CMS_get0_RecipientInfos
72returns all the
73.Vt CMS_RecipientInfo
74structures associated with a CMS EnvelopedData structure.
75.Pp
76.Fn CMS_RecipientInfo_type
77returns the type of the
78.Vt CMS_RecipientInfo
79structure
80.Fa ri .
81It will currently return
82.Dv CMS_RECIPINFO_TRANS ,
83.Dv CMS_RECIPINFO_AGREE ,
84.Dv CMS_RECIPINFO_KEK ,
85.Dv CMS_RECIPINFO_PASS ,
86or
87.Dv CMS_RECIPINFO_OTHER .
88.Pp
89.Fn CMS_RecipientInfo_ktri_get0_signer_id
90retrieves the certificate recipient identifier associated with a
91specific
92.Vt CMS_RecipientInfo
93structure
94.Fa ri ,
95which must be of type
96.Dv CMS_RECIPINFO_TRANS .
97Either the keyidentifier will be set in
98.Fa keyid
99or
100.Em both
101issuer name and serial number in
102.Fa issuer
103and
104.Fa sno .
105.Pp
106.Fn CMS_RecipientInfo_ktri_cert_cmp
107compares the certificate
108.Fa cert
109against the
110.Vt CMS_RecipientInfo
111structure
112.Fa ri ,
113which must be of type
114.Dv CMS_RECIPINFO_TRANS .
115It returns zero if the
116comparison is successful and non zero if not.
117.Pp
118.Fn CMS_RecipientInfo_set0_pkey
119associates the private key
120.Fa pkey
121with the
122.Vt CMS_RecipientInfo
123structure
124.Fa ri ,
125which must be of type
126.Dv CMS_RECIPINFO_TRANS .
127.Pp
128.Fn CMS_RecipientInfo_kekri_get0_id
129retrieves the key information from the
130.Vt CMS_RecipientInfo
131structure
132.Fa ri
133which must be of type
134.Dv CMS_RECIPINFO_KEK .
135Any of the remaining parameters can be
136.Dv NULL
137if the application is not interested in the value of a field.
138Where a field is optional and absent,
139.Dv NULL
140will be written to the corresponding parameter.
141The
142.Sy keyEncryptionAlgorithm
143field is written to
144.Fa palg ,
145the
146.Sy keyIdentifier
147field is written to
148.Fa pid ,
149the
150.Sy date
151field if present is written to
152.Fa pdate ,
153if the
154.Sy other
155field is present the components
156.Sy keyAttrId
157and
158.Sy keyAttr
159are written to the parameters
160.Fa potherid
161and
162.Fa pothertype .
163.Pp
164.Fn CMS_RecipientInfo_kekri_id_cmp
165compares the ID in the
166.Fa id
167and
168.Fa idlen
169parameters against the
170.Sy keyIdentifier
171.Vt CMS_RecipientInfo
172structure
173.Fa ri ,
174which must be of type
175.Dv CMS_RECIPINFO_KEK .
176It returns zero if the comparison is successful and non zero if not.
177.Pp
178.Fn CMS_RecipientInfo_set0_key
179associates the symmetric key
180.Fa key
181of length
182.Fa keylen
183with the
184.Vt CMS_RecipientInfo
185structure
186.Fa ri ,
187which must be of type
188.Dv CMS_RECIPINFO_KEK .
189.Pp
190.Fn CMS_RecipientInfo_decrypt
191attempts to decrypt the
192.Vt CMS_RecipientInfo
193structure
194.Fa ri
195in structure
196.Fa cms .
197A key must have been associated with the structure first.
198.Sh NOTES
199The main purpose of these functions is to enable an application to
200lookup recipient keys using any appropriate technique when the simpler
201method of
202.Xr CMS_decrypt 3
203is not appropriate.
204.Pp
205In typical usage, an application will retrieve all
206.Vt CMS_RecipientInfo
207structures using
208.Fn CMS_get0_RecipientInfos
209and check the type of each using
210.Fn CMS_RecipientInfo_type .
211Depending on the type, the
212.Vt CMS_RecipientInfo
213structure can be ignored or its key identifier data retrieved using
214an appropriate function.
215Then if the corresponding secret or private key can be obtained by any
216appropriate means it can then associated with the structure and
217.Xr CMS_RecpientInfo_decrypt 3
218called.
219If successful,
220.Xr CMS_decrypt 3
221can be called with a
222.Dv NULL
223key to decrypt the enveloped content.
224.Sh RETURN VALUES
225.Fn CMS_get0_RecipientInfos
226returns all
227.Vt CMS_RecipientInfo
228structures, or
229.Dv NULL
230if an error occurs.
231.Pp
232.Fn CMS_RecipientInfo_ktri_get0_signer_id ,
233.Fn CMS_RecipientInfo_set0_pkey ,
234.Fn CMS_RecipientInfo_kekri_get0_id ,
235.Fn CMS_RecipientInfo_set0_key ,
236and
237.Fn CMS_RecipientInfo_decrypt
238return 1 for success or 0 if an error occurs.
239.Pp
240.Fn CMS_RecipientInfo_ktri_cert_cmp
241and
242.Fn CMS_RecipientInfo_kekri_id_cmp
243return 0 for a successful comparison and non zero otherwise.
244.Pp
245Any error can be obtained from
246.Xr ERR_get_error 3 .
247.Sh SEE ALSO
248.Xr CMS_decrypt 3 ,
249.Xr ERR_get_error 3
250.Sh HISTORY
251These functions were first was added to OpenSSL 0.9.8.
diff --git a/src/lib/libcrypto/man/CMS_get0_SignerInfos.3 b/src/lib/libcrypto/man/CMS_get0_SignerInfos.3
deleted file mode 100644
index 99aab48193..0000000000
--- a/src/lib/libcrypto/man/CMS_get0_SignerInfos.3
+++ /dev/null
@@ -1,119 +0,0 @@
1.Dd $Mdocdate: November 11 2015 $
2.Dt CMS_GET0_SIGNERINFOS 3
3.Os
4.Sh NAME
5.Nm CMS_get0_SignerInfos ,
6.Nm CMS_SignerInfo_get0_signer_id ,
7.Nm CMS_SignerInfo_cert_cmp ,
8.Nm CMS_set1_signer_certs
9.Nd CMS signedData signer functions
10.Sh SYNOPSIS
11.In openssl/cms.h
12.Ft STACK_OF(CMS_SignerInfo) *
13.Fo CMS_get0_SignerInfos
14.Fa "CMS_ContentInfo *cms"
15.Fc
16.Ft int
17.Fo CMS_SignerInfo_get0_signer_id
18.Fa "CMS_SignerInfo *si"
19.Fa "ASN1_OCTET_STRING **keyid"
20.Fa "X509_NAME **issuer"
21.Fa "ASN1_INTEGER **sno"
22.Fc
23.Ft int
24.Fo CMS_SignerInfo_cert_cmp
25.Fa "CMS_SignerInfo *si"
26.Fa "X509 *cert"
27.Fc
28.Ft void
29.Fo CMS_SignerInfo_set1_signer_cert
30.Fa "CMS_SignerInfo *si"
31.Fa "X509 *signer"
32.Fc
33.Sh DESCRIPTION
34The function
35.Fn CMS_get0_SignerInfos
36returns all the
37.Vt CMS_SignerInfo
38structures associated with a CMS signedData structure.
39.Pp
40.Fn CMS_SignerInfo_get0_signer_id
41retrieves the certificate signer identifier associated with a specific
42.Vt CMS_SignerInfo
43structure
44.Fa si .
45Either the keyidentifier will be set in
46.Fa keyid
47or
48.Em both
49issuer name and serial number in
50.Fa issuer
51and
52.Fa sno .
53.Pp
54.Fn CMS_SignerInfo_cert_cmp
55compares the certificate
56.Fa cert
57against the signer identifier
58.Fa si .
59It returns zero if the comparison is successful and non zero if not.
60.Pp
61.Fn CMS_SignerInfo_set1_signer_cert
62sets the signers certificate of
63.Fa si
64to
65.Fa signer .
66.Sh NOTES
67The main purpose of these functions is to enable an application to
68lookup signers certificates using any appropriate technique when the
69simpler method of
70.Xr CMS_verify 3
71is not appropriate.
72.Pp
73In typical usage and application will retrieve all
74.Vt CMS_SignerInfo
75structures using
76.Fn CMS_get0_SignerInfo
77and retrieve the identifier information using CMS.
78It will then obtain the signer certificate by some unspecified means
79(or return and error if it cannot be found) and set it using
80.Fn CMS_SignerInfo_set1_signer_cert .
81.Pp
82Once all signer certificates have been set,
83.Xr CMS_verify 3
84can be used.
85.Pp
86Although
87.Fn CMS_get0_SignerInfos
88can return
89.Dv NULL
90if an error occur
91.Em or
92if there are no signers, this is not a problem in practice because the
93only error which can occur is if the
94.Fa cms
95structure is not of type signedData due to application error.
96.Sh RETURN VALUES
97.Fn CMS_get0_SignerInfos
98returns all
99.Vt CMS_SignerInfo
100structures, or
101.Dv NULL
102if there are no signers or an error occurs.
103.Pp
104.Fn CMS_SignerInfo_get0_signer_id
105returns 1 for success and 0 for failure.
106.Pp
107.Fn CMS_SignerInfo_cert_cmp
108returns 0 for a successful comparison and non zero otherwise.
109.Pp
110.Fn CMS_SignerInfo_set1_signer_cert
111does not return a value.
112.Pp
113Any error can be obtained from
114.Xr ERR_get_error 3 .
115.Sh SEE ALSO
116.Xr CMS_verify 3 ,
117.Xr ERR_get_error 3
118.Sh HISTORY
119These functions were first was added to OpenSSL 0.9.8.
diff --git a/src/lib/libcrypto/man/CMS_get0_type.3 b/src/lib/libcrypto/man/CMS_get0_type.3
deleted file mode 100644
index e77dd655e6..0000000000
--- a/src/lib/libcrypto/man/CMS_get0_type.3
+++ /dev/null
@@ -1,95 +0,0 @@
1.Dd $Mdocdate: November 11 2015 $
2.Dt CMS_GET0_TYPE 3
3.Os
4.Sh NAME
5.Nm CMS_get0_type ,
6.Nm CMS_set1_eContentType ,
7.Nm CMS_get0_eContentType
8.Nd get and set CMS content types
9.Sh SYNOPSIS
10.In openssl/cms.h
11.Ft const ASN1_OBJECT *
12.Fo CMS_get0_type
13.Fa "CMS_ContentInfo *cms"
14.Fc
15.Ft int
16.Fo CMS_set1_eContentType
17.Fa "CMS_ContentInfo *cms"
18.Fa "const ASN1_OBJECT *oid"
19.Fc
20.Ft const ASN1_OBJECT *
21.Fo CMS_get0_eContentType
22.Fa "CMS_ContentInfo *cms"
23.Fc
24.Sh DESCRIPTION
25.Fn CMS_get0_type
26returns the content type of a
27.Vt CMS_ContentInfo
28structure as an
29.Vt ASN1_OBJECT
30pointer.
31An application can then decide how to process the
32.Vt CMS_ContentInfo
33structure based on this value.
34.Pp
35.Fn CMS_set1_eContentType
36sets the embedded content type of a
37.Vt CMS_ContentInfo
38structure.
39It should be called with CMS functions with the
40.Dv CMS_PARTIAL
41flag and
42.Em before
43the structure is finalised, otherwise the results are undefined.
44.Pp
45.Fn CMS_get0_eContentType
46returns a pointer to the embedded content type.
47.Sh NOTES
48As the
49.Sq 0
50implies,
51.Fn CMS_get0_type
52and
53.Fn CMS_get0_eContentType
54return internal pointers which should
55.Em not
56be freed up.
57.Fn CMS_set1_eContentType
58copies the supplied OID and it
59.Em should
60be freed up after use.
61.Pp
62The
63.Vt ASN1_OBJECT
64values returned can be converted to an integer NID value using
65.Xr OBJ_obj2nid 3 .
66For the currently supported content types the following values are
67returned:
68.Bd -unfilled -offset indent
69.Dv NID_pkcs7_data
70.Dv NID_pkcs7_signed
71.Dv NID_pkcs7_digest
72.Dv NID_id_smime_ct_compressedData
73.Dv NID_pkcs7_encrypted
74.Dv NID_pkcs7_enveloped
75.Ed
76.Sh RETURN VALUES
77.Fn CMS_get0_type
78and
79.Fn CMS_get0_eContentType
80return an
81.Vt ASN1_OBJECT
82structure.
83.Pp
84.Fn CMS_set1_eContentType
85returns 1 for success or 0 if an error occurred.
86The error can be obtained from
87.Xr ERR_get_error 3 .
88.Sh SEE ALSO
89.Xr ERR_get_error 3
90.Sh HISTORY
91.Fn CMS_get0_type ,
92.Fn CMS_set1_eContentType ,
93and
94.Fn CMS_get0_eContentType
95were all first added to OpenSSL 0.9.8.
diff --git a/src/lib/libcrypto/man/CMS_get1_ReceiptRequest.3 b/src/lib/libcrypto/man/CMS_get1_ReceiptRequest.3
deleted file mode 100644
index ab19f87fab..0000000000
--- a/src/lib/libcrypto/man/CMS_get1_ReceiptRequest.3
+++ /dev/null
@@ -1,143 +0,0 @@
1.Dd $Mdocdate: November 11 2015 $
2.Dt CMS_GET1_RECEIPTREQUEST 3
3.Os
4.Sh NAME
5.Nm CMS_ReceiptRequest_create0 ,
6.Nm CMS_add1_ReceiptRequest ,
7.Nm CMS_get1_ReceiptRequest ,
8.Nm CMS_ReceiptRequest_get0_values
9.Nd CMS signed receipt request functions
10.Sh SYNOPSIS
11.In openssl/cms.h
12.Ft CMS_ReceiptRequest *
13.Fo CMS_ReceiptRequest_create0
14.Fa "unsigned char *id"
15.Fa "int idlen"
16.Fa "int allorfirst"
17.Fa "STACK_OF(GENERAL_NAMES) *receiptList"
18.Fa "STACK_OF(GENERAL_NAMES) *receiptsTo"
19.Fc
20.Ft int
21.Fo CMS_add1_ReceiptRequest
22.Fa "CMS_SignerInfo *si"
23.Fa "CMS_ReceiptRequest *rr"
24.Fc
25.Ft int
26.Fo CMS_get1_ReceiptRequest
27.Fa "CMS_SignerInfo *si"
28.Fa "CMS_ReceiptRequest **prr"
29.Fc
30.Ft void
31.Fo CMS_ReceiptRequest_get0_values
32.Fa "CMS_ReceiptRequest *rr"
33.Fa "ASN1_STRING **pcid"
34.Fa "int *pallorfirst"
35.Fa "STACK_OF(GENERAL_NAMES) **plist"
36.Fa "STACK_OF(GENERAL_NAMES) **prto"
37.Fc
38.Sh DESCRIPTION
39.Fn CMS_ReceiptRequest_create0
40creates a signed receipt request structure.
41The
42.Sy signedContentIdentifier
43field is set using
44.Fa id
45and
46.Fa idlen ,
47or it is set to 32 bytes of pseudo random data if
48.Fa id
49is
50.Dv NULL .
51If
52.Fa receiptList
53is
54.Dv NULL ,
55the
56.Sy allOrFirstTier
57option in
58.Sy receiptsFrom
59is used and set to the value of the
60.Fa allorfirst
61parameter.
62If
63.Fa receiptList
64is not
65.Dv NULL ,
66the
67.Sy receiptList
68option in
69.Sy receiptsFrom
70is used.
71The
72.Fa receiptsTo
73parameter specifies the
74.Sy receiptsTo
75field value.
76.Pp
77The
78.Fn CMS_add1_ReceiptRequest
79function adds a signed receipt request
80.Fa rr
81to the
82.Vt CMS_SignerInfo
83structure
84.Fa si .
85.Pp
86.Fn CMS_get1_ReceiptRequest
87looks for a signed receipt request in
88.Fa si .
89If any is found, it is decoded and written to
90.Fa prr .
91.Pp
92.Fn CMS_ReceiptRequest_get0_values
93retrieves the values of a receipt request.
94The signedContentIdentifier is copied to
95.Fa pcid .
96If the
97.Sy allOrFirstTier
98option of
99.Sy receiptsFrom
100is used, its value is copied to
101.Fa pallorfirst ;
102otherwise the
103.Sy receiptList
104field is copied to
105.Fa plist .
106The
107.Sy receiptsTo
108parameter is copied to
109.Fa prto .
110.Sh NOTES
111For more details of the meaning of the fields see RFC2634.
112.Pp
113The contents of a signed receipt should only be considered meaningful if
114the corresponding
115.Vt CMS_ContentInfo
116structure can be successfully verified using
117.Xr CMS_verify 3 .
118.Sh RETURN VALUES
119.Fn CMS_ReceiptRequest_create0
120returns a signed receipt request structure or
121.Dv NULL
122if an error occurred.
123.Pp
124.Fn CMS_add1_ReceiptRequest
125returns 1 for success or 0 is an error occurred.
126.Pp
127.Fn CMS_get1_ReceiptRequest
128returns 1 is a signed receipt request is found and decoded.
129It returns 0 if a signed receipt request is not present and -1 if it is
130present but malformed.
131.Sh SEE ALSO
132.Xr CMS_sign 3 ,
133.Xr CMS_sign_receipt 3 ,
134.Xr CMS_verify 3 ,
135.Xr CMS_verify_receipt 3 ,
136.Xr ERR_get_error 3
137.Sh HISTORY
138.Fn CMS_ReceiptRequest_create0 ,
139.Fn CMS_add1_ReceiptRequest ,
140.Fn CMS_get1_ReceiptRequest ,
141and
142.Fn CMS_ReceiptRequest_get0_values
143were added to OpenSSL 0.9.8.
diff --git a/src/lib/libcrypto/man/CMS_sign.3 b/src/lib/libcrypto/man/CMS_sign.3
deleted file mode 100644
index af75a20d6b..0000000000
--- a/src/lib/libcrypto/man/CMS_sign.3
+++ /dev/null
@@ -1,199 +0,0 @@
1.Dd $Mdocdate: November 11 2015 $
2.Dt CMS_SIGN 3
3.Os
4.Sh NAME
5.Nm CMS_sign
6.Nd create a CMS SignedData structure
7.Sh SYNOPSIS
8.In openssl/cms.h
9.Ft CMS_ContentInfo *
10.Fo CMS_sign
11.Fa "X509 *signcert"
12.Fa "EVP_PKEY *pkey"
13.Fa "STACK_OF(X509) *certs"
14.Fa "BIO *data"
15.Fa "unsigned int flags"
16.Fc
17.Sh DESCRIPTION
18.Fn CMS_sign
19creates and returns a CMS SignedData structure.
20.Fa signcert
21is the certificate to sign with,
22.Fa pkey
23is the corresponding private key.
24.Fa certs
25is an optional additional set of certificates to include in the CMS
26structure (for example any intermediate CAs in the chain).
27Any or all of these parameters can be
28.Dv NULL ,
29see
30.Sx NOTES
31below.
32.Pp
33The data to be signed is read from
34.Fa data .
35.Pp
36.Fa flags
37is an optional set of flags.
38.Sh NOTES
39Any of the following flags (OR'ed together) can be passed in the
40.Fa flags
41parameter.
42.Pp
43Many S/MIME clients expect the signed content to include valid MIME
44headers.
45If the
46.Dv CMS_TEXT
47flag is set, MIME headers for type
48.Sy text/plain
49are prepended to the data.
50.Pp
51If
52.Dv CMS_NOCERTS
53is set, the signer's certificate will not be included in the
54.Vt CMS_ContentInfo
55structure, the signer's certificate must still be supplied in the
56.Fa signcert
57parameter though.
58This can reduce the size of the signature if the signers certificate can
59be obtained by other means: for example a previously signed message.
60.Pp
61The data being signed is included in the
62.Vt CMS_ContentInfo
63structure, unless
64.Dv CMS_DETACHED
65is set, in which case it is omitted.
66This is used for
67.Vt CMS_ContentInfo
68detached signatures which are used in S/MIME plaintext signed
69messages for example.
70.Pp
71Normally the supplied content is translated into MIME canonical format
72(as required by the S/MIME specifications); if
73.Dv CMS_BINARY
74is set, no translation occurs.
75This option should be used if the supplied data is in binary format;
76otherwise the translation will corrupt it.
77.Pp
78The SignedData structure includes several CMS signedAttributes including
79the signing time, the CMS content type and the supported list of ciphers
80in an SMIMECapabilities attribute.
81If
82.Dv CMS_NOATTR
83is set, then no signedAttributes will be used.
84If
85.Dv CMS_NOSMIMECAP
86is set, then just the SMIMECapabilities are omitted.
87.Pp
88If present, the SMIMECapabilities attribute indicates support for the
89following algorithms in preference order: 256 bit AES, Gost R3411-94,
90Gost 28147-89, 192 bit AES, 128 bit AES, triple DES, 128 bit RC2, 64 bit
91RC2, DES and 40 bit RC2.
92If any of these algorithms is not available, then it will not be
93included: for example the GOST algorithms will not be included if
94the GOST ENGINE is not loaded.
95.Pp
96OpenSSL will by default identify signing certificates using issuer name
97and serial number.
98If
99.Dv CMS_USE_KEYID
100is set, it will use the subject key identifier value instead.
101An error occurs if the signing certificate does not have a subject key
102identifier extension.
103.Pp
104If the flag
105.Dv CMS_STREAM
106is set, then the returned
107.Vt CMS_ContentInfo
108structure is just initialized ready to perform the signing operation.
109The signing is however
110.Em not
111performed and the data to be signed is not read from the
112.Fa data
113parameter.
114Signing is deferred until after the data has been written.
115In this way, data can be signed in a single pass.
116.Pp
117If the
118.Dv CMS_PARTIAL
119flag is set, a partial
120.Vt CMS_ContentInfo
121structure is output to which additional signers and capabilities can be
122added before finalization.
123.Pp
124If the flag
125.Dv CMS_STREAM
126is set, the returned
127.Vt CMS_ContentInfo
128structure is
129.Em not
130complete and outputting its contents via a function that does not
131properly finalize the
132.Vt CMS_ContentInfo
133structure will give unpredictable results.
134.Pp
135Several functions including
136.Xr SMIME_write_CMS 3 ,
137.Xr i2d_CMS_bio_stream 3 ,
138.Xr PEM_write_bio_CMS_stream 3
139finalize the structure.
140Alternatively finalization can be performed by obtaining the streaming
141ASN1
142.Vt BIO
143directly using
144.Xr BIO_new_CMS 3 .
145.Pp
146If a signer is specified, it will use the default digest for the signing
147algorithm.
148This is SHA1 for both RSA and DSA keys.
149.Pp
150If
151.Fa signcert
152and
153.Fa pkey
154are
155.Dv NULL ,
156then a certificates only CMS structure is output.
157.Pp
158The function
159.Fn CMS_sign
160is a basic CMS signing function whose output will be suitable for many
161purposes.
162For finer control of the output format the
163.Fa certs ,
164.Fa signcert
165and
166.Fa pkey
167parameters can all be
168.Dv NULL
169and the
170.Dv CMS_PARTIAL
171flag set.
172Then one or more signers can be added using the function
173.Xr CMS_sign_add1_signer 3 ,
174non default digests can be used and custom attributes added.
175.Xr CMS_final 3
176must then be called to finalize the structure if streaming is not
177enabled.
178.Sh RETURN VALUES
179.Fn CMS_sign
180returns either a valid
181.Vt CMS_ContentInfo
182structure or
183.Dv NULL
184if an error occurred.
185The error can be obtained from
186.Xr ERR_get_error 3 .
187.Sh SEE ALSO
188.Xr CMS_verify 3 ,
189.Xr ERR_get_error 3
190.Sh HISTORY
191.Fn CMS_sign
192was added to OpenSSL 0.9.8.
193.Pp
194The
195.Dv CMS_STREAM
196flag is only supported for detached data in OpenSSL 0.9.8.
197It is supported for embedded data in OpenSSL 1.0.0 and later.
198.Sh BUGS
199Some attributes such as counter signatures are not supported.
diff --git a/src/lib/libcrypto/man/CMS_sign_receipt.3 b/src/lib/libcrypto/man/CMS_sign_receipt.3
deleted file mode 100644
index de7a8c0e10..0000000000
--- a/src/lib/libcrypto/man/CMS_sign_receipt.3
+++ /dev/null
@@ -1,61 +0,0 @@
1.Dd $Mdocdate: November 11 2015 $
2.Dt CMS_SIGN_RECEIPT 3
3.Os
4.Sh NAME
5.Nm CMS_sign_receipt
6.Nd create a CMS signed receipt
7.Sh SYNOPSIS
8.In openssl/cms.h
9.Ft CMS_ContentInfo *
10.Fo CMS_sign_receipt
11.Fa "CMS_SignerInfo *si"
12.Fa "X509 *signcert"
13.Fa "EVP_PKEY *pkey"
14.Fa "STACK_OF(X509) *certs"
15.Fa "unsigned int flags"
16.Fc
17.Sh DESCRIPTION
18.Fn CMS_sign_receipt
19creates and returns a CMS signed receipt structure.
20.Fa si
21is the
22.Vt CMS_SignerInfo
23structure containing the signed receipt request.
24.Fa signcert
25is the certificate to sign with,
26.Fa pkey
27is the corresponding private key.
28.Fa certs
29is an optional additional set of certificates to include in the CMS
30structure (for example any intermediate CAs in the chain).
31.Pp
32.Fa flags
33is an optional set of flags.
34.Sh NOTES
35This functions behaves in a similar way to
36.Xr CMS_sign 3
37except the flag values
38.Dv CMS_DETACHED ,
39.Dv CMS_BINARY ,
40.Dv CMS_NOATTR ,
41.Dv CMS_TEXT ,
42and
43.Dv CMS_STREAM
44are not supported, since they do not make sense in the context of
45signed receipts.
46.Sh RETURN VALUES
47.Fn CMS_sign_receipt
48returns either a valid
49.Vt CMS_ContentInfo
50structure or
51.Dv NULL
52if an error occurred.
53The error can be obtained from
54.Xr ERR_get_error 3 .
55.Sh SEE ALSO
56.Xr CMS_sign 3 ,
57.Xr CMS_verify_receipt 3 ,
58.Xr ERR_get_error 3
59.Sh HISTORY
60.Fn CMS_sign_receipt
61was added to OpenSSL 0.9.8.
diff --git a/src/lib/libcrypto/man/CMS_uncompress.3 b/src/lib/libcrypto/man/CMS_uncompress.3
deleted file mode 100644
index c651f24de2..0000000000
--- a/src/lib/libcrypto/man/CMS_uncompress.3
+++ /dev/null
@@ -1,70 +0,0 @@
1.Dd $Mdocdate: November 11 2015 $
2.Dt CMS_UNCOMPRESS 3
3.Os
4.Sh NAME
5.Nm CMS_uncompress
6.Nd uncompress a CMS CompressedData structure
7.Sh SYNOPSIS
8.In openssl/cms.h
9.Ft int
10.Fo CMS_uncompress
11.Fa "CMS_ContentInfo *cms"
12.Fa "BIO *dcont"
13.Fa "BIO *out"
14.Fa "unsigned int flags"
15.Fc
16.Sh DESCRIPTION
17.Fn CMS_uncompress
18extracts and uncompresses the content from a CMS CompressedData
19structure
20.Fa cms .
21.Fa data
22is a
23.Vt BIO
24to write the content to and
25.Fa flags
26is an optional set of flags.
27.Pp
28The
29.Fa dcont
30parameter is used in the rare case where the compressed content is
31detached.
32It will normally be set to
33.Dv NULL .
34.Sh NOTES
35The only currently supported compression algorithm is zlib: if the
36structure indicates the use of any other algorithm, an error is returned.
37.Pp
38If zlib support is not compiled into OpenSSL, then
39.Fn CMS_uncompress
40will always return an error.
41.Pp
42The following flags can be passed in the
43.Fa flags
44parameter:
45.Pp
46If the
47.Dv CMS_TEXT
48flag is set, MIME headers for type
49.Sy text/plain
50are deleted from the content.
51If the content is not of type
52.Sy text/plain ,
53then an error is returned.
54.Sh RETURN VALUES
55.Fn CMS_uncompress
56returns either 1 for success or 0 for failure.
57The error can be obtained from
58.Xr ERR_get_error 3 .
59.Sh SEE ALSO
60.Xr CMS_compress 3 ,
61.Xr ERR_get_error 3
62.Sh HISTORY
63.Fn CMS_uncompress
64was added to OpenSSL 0.9.8.
65.Sh BUGS
66The lack of single pass processing and the need to hold all data in
67memory as mentioned in
68.Xr CMS_verify 3
69also applies to
70.Xr CMS_decompress 3 .
diff --git a/src/lib/libcrypto/man/CMS_verify.3 b/src/lib/libcrypto/man/CMS_verify.3
deleted file mode 100644
index 0ab1baf6b3..0000000000
--- a/src/lib/libcrypto/man/CMS_verify.3
+++ /dev/null
@@ -1,188 +0,0 @@
1.Dd $Mdocdate: November 11 2015 $
2.Dt CMS_VERIFY 3
3.Os
4.Sh NAME
5.Nm CMS_verify ,
6.Nm CMS_get0_signers
7.Nd verify a CMS SignedData structure
8.Sh SYNOPSIS
9.In openssl/cms.h
10.Ft int
11.Fo CMS_verify
12.Fa "CMS_ContentInfo *cms"
13.Fa "STACK_OF(X509) *certs"
14.Fa "X509_STORE *store"
15.Fa "BIO *indata"
16.Fa "BIO *out"
17.Fa "unsigned int flags"
18.Fc
19.Ft STACK_OF(X509) *
20.Fo CMS_get0_signers
21.Fa "CMS_ContentInfo *cms"
22.Fc
23.Sh DESCRIPTION
24.Fn CMS_verify
25verifies a CMS SignedData structure.
26.Fa cms
27is the
28.Vt CMS_ContentInfo
29structure to verify.
30.Fa certs
31is a set of certificates in which to search for the signing
32certificate(s).
33.Fa store
34is a trusted certificate store used for chain verification.
35.Fa indata
36is the detached content if the content is not present in
37.Fa cms .
38The content is written to
39.Fa out
40if it is not
41.Dv NULL .
42.Pp
43.Fa flags
44is an optional set of flags, which can be used to modify the verify
45operation.
46.Pp
47.Fn CMS_get0_signers
48retrieves the signing certificate(s) from
49.Fa cms ,
50it must be called after a successful
51.Fn CMS_verify
52operation.
53.Sh VERIFY PROCESS
54Normally the verify process proceeds as follows.
55.Pp
56Initially some sanity checks are performed on
57.Fa cms .
58The type of
59.Fa cms
60must be SignedData.
61There must be at least one signature on the data and if the content is
62detached
63.Fa indata
64cannot be
65.Dv NULL .
66.Pp
67An attempt is made to locate all the signing certificate(s), first
68looking in the
69.Fa certs
70parameter (if it is not
71.Dv NULL )
72and then looking in any certificates contained in the
73.Fa cms
74structure itself.
75If no signing certificate can be located, the operation fails.
76.Pp
77Each signing certificate is chain verified using the
78.Sy smimesign
79purpose and the supplied trusted certificate store.
80Any internal certificates in the message are used as untrusted CAs.
81If CRL checking is enabled in
82.Fa store ,
83any internal CRLs are used in addition to attempting to look them up in
84.Fa store .
85If any chain verify fails, an error code is returned.
86.Pp
87Finally the signed content is read (and written to
88.Fa out
89is it is not
90.Dv NULL )
91and the signature is checked.
92.Pp
93If all signatures verify correctly, then the function is successful.
94.Pp
95Any of the following flags (OR'ed together) can be passed in the
96.Fa flags
97parameter to change the default verify behaviour.
98.Pp
99If
100.Dv CMS_NOINTERN
101is set, the certificates in the message itself are not searched when
102locating the signing certificate(s).
103This means that all the signing certificates must be in the
104.Fa certs
105parameter.
106.Pp
107If
108.Dv CMS_NOCRL
109is set, and CRL checking is enabled in
110.Fa store ,
111then any CRLs in the message itself are ignored.
112.Pp
113If the
114.Dv CMS_TEXT
115flag is set, MIME headers for type
116.Sy text/plain
117are deleted from the content.
118If the content is not of type
119.Sy text/plain ,
120then an error is returned.
121.Pp
122If
123.Dv CMS_NO_SIGNER_CERT_VERIFY
124is set, the signing certificates are not verified.
125.Pp
126If
127.Dv CMS_NO_ATTR_VERIFY
128is set, the signed attributes signature is not verified.
129.Pp
130If
131.Dv CMS_NO_CONTENT_VERIFY
132is set, then the content digest is not checked.
133.Sh NOTES
134One application of
135.Dv CMS_NOINTERN
136is to only accept messages signed by a small number of certificates.
137The acceptable certificates would be passed in the
138.Fa certs
139parameter.
140In this case, if the signer is not one of the certificates supplied in
141.Fa certs ,
142then the verify will fail because the signer cannot be found.
143.Pp
144In some cases the standard techniques for looking up and validating
145certificates are not appropriate: for example an application may wish to
146lookup certificates in a database or perform customised verification.
147This can be achieved by setting and verifying the signers certificates
148manually using the signed data utility functions.
149.Pp
150Care should be taken when modifying the default verify behaviour, for
151example setting
152.Dv CMS_NO_CONTENT_VERIFY
153will totally disable all content verification and any modified content
154will be considered valid.
155This combination is however useful if one merely wishes to write the
156content to
157.Fa out
158and its validity is not considered important.
159.Pp
160Chain verification should arguably be performed using the signing time
161rather than the current time.
162However since the signing time is supplied by the signer it cannot be
163trusted without additional evidence (such as a trusted timestamp).
164.Sh RETURN VALUES
165.Fn CMS_verify
166returns 1 for a successful verification and zero if an error occurred.
167.Pp
168.Fn CMS_get0_signers
169returns all signers or
170.Dv NULL
171if an error occurred.
172.Pp
173The error can be obtained from
174.Xr ERR_get_error 3 .
175.Sh SEE ALSO
176.Xr CMS_sign 3 ,
177.Xr ERR_get_error 3
178.Sh HISTORY
179.Fn CMS_verify
180was added to OpenSSL 0.9.8.
181.Sh BUGS
182The trusted certificate store is not searched for the signing
183certificate, this is primarily due to the inadequacies of the current
184.Vt X509_STORE
185functionality.
186.Pp
187The lack of single pass processing means that the signed content must
188all be held in memory if it is not detached.
diff --git a/src/lib/libcrypto/man/CMS_verify_receipt.3 b/src/lib/libcrypto/man/CMS_verify_receipt.3
deleted file mode 100644
index 0977f267bc..0000000000
--- a/src/lib/libcrypto/man/CMS_verify_receipt.3
+++ /dev/null
@@ -1,55 +0,0 @@
1.Dd $Mdocdate: November 11 2015 $
2.Dt CMS_VERIFY_RECEIPT 3
3.Os
4.Sh NAME
5.Nm CMS_verify_receipt
6.Nd verify a CMS signed receipt
7.Sh SYNOPSIS
8.In openssl/cms.h
9.Ft int
10.Fo CMS_verify_receipt
11.Fa "CMS_ContentInfo *rcms"
12.Fa "CMS_ContentInfo *ocms"
13.Fa "STACK_OF(X509) *certs"
14.Fa "X509_STORE *store"
15.Fa "unsigned int flags"
16.Fc
17.Sh DESCRIPTION
18.Fn CMS_verify_receipt
19verifies a CMS signed receipt.
20.Fa rcms
21is the signed receipt to verify.
22.Fa ocms
23is the original SignedData structure containing the receipt request.
24.Fa certs
25is a set of certificates in which to search for the signing certificate.
26.Fa store
27is a trusted certificate store (used for chain verification).
28.Pp
29.Fa flags
30is an optional set of flags, which can be used to modify the verify
31operation.
32.Sh NOTES
33This functions behaves in a similar way to
34.Xr CMS_verify 3
35except the flag values
36.Dv CMS_DETACHED ,
37.Dv CMS_BINARY ,
38.Dv CMS_TEXT ,
39and
40.Dv CMS_STREAM
41are not supported since they do not make sense in the context of signed
42receipts.
43.Sh RETURN VALUES
44.Fn CMS_verify_receipt
45returns 1 for a successful verification and zero if an error occurred.
46.Pp
47The error can be obtained from
48.Xr ERR_get_error 3 .
49.Sh SEE ALSO
50.Xr CMS_sign_receipt 3 ,
51.Xr CMS_verify 3 ,
52.Xr ERR_get_error 3
53.Sh HISTORY
54.Fn CMS_verify_receipt
55was added to OpenSSL 0.9.8.
diff --git a/src/lib/libcrypto/man/Makefile b/src/lib/libcrypto/man/Makefile
index e74a6d56bf..1dfcf8700d 100644
--- a/src/lib/libcrypto/man/Makefile
+++ b/src/lib/libcrypto/man/Makefile
@@ -1,4 +1,4 @@
1# $OpenBSD: Makefile,v 1.33 2016/09/03 12:42:47 beck Exp $ 1# $OpenBSD: Makefile,v 1.34 2016/09/05 10:43:42 schwarze Exp $
2 2
3.include <bsd.own.mk> # for NOMAN 3.include <bsd.own.mk> # for NOMAN
4 4
@@ -21,7 +21,6 @@ MAN= \
21 BIO_f_null.3 \ 21 BIO_f_null.3 \
22 BIO_find_type.3 \ 22 BIO_find_type.3 \
23 BIO_new.3 \ 23 BIO_new.3 \
24 BIO_new_CMS.3 \
25 BIO_push.3 \ 24 BIO_push.3 \
26 BIO_read.3 \ 25 BIO_read.3 \
27 BIO_s_accept.3 \ 26 BIO_s_accept.3 \
@@ -201,27 +200,6 @@ GENMAN= \
201 200
202MAN+= ${GENMAN} 201MAN+= ${GENMAN}
203 202
204#MAN+= CMS_add0_cert.3 \
205# CMS_add1_recipient_cert.3 \
206# CMS_add1_signer.3 \
207# CMS_compress.3 \
208# CMS_decrypt.3 \
209# CMS_encrypt.3 \
210# CMS_final.3 \
211# CMS_get0_RecipientInfos.3 \
212# CMS_get0_SignerInfos.3 \
213# CMS_get0_type.3 \
214# CMS_get1_ReceiptRequest.3 \
215# CMS_sign.3 \
216# CMS_sign_receipt.3 \
217# CMS_uncompress.3 \
218# CMS_verify.3 \
219# CMS_verify_receipt.3 \
220# PEM_write_bio_CMS_stream.3 \
221# SMIME_read_CMS.3 \
222# SMIME_write_CMS.3 \
223# i2d_CMS_bio_stream.3 \
224
225.include <bsd.man.mk> 203.include <bsd.man.mk>
226.else 204.else
227maninstall: 205maninstall:
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-23 18:15:41 +0000