PKCS#7 and CMS sit underneath signed firmware, S/MIME, signed SBOMs and certificate enrollment with SCEP and EST. Over the past months we reworked large parts of the PKCS#7 code in wolfCrypt with one goal: decode what other implementations actually send, encode what enrollment servers need, and fail loudly instead of quietly. Below is a summary of these improvements.
Certificate Enrollment
- Certificates-only SignedData can be encoded through the public API, as used by EST /cacerts and SCEP GetCACert (#10760).
- SignedData without eContent is supported, as required for SCEP CertRep PENDING and FAILURE (#10804).
- Any number of signed attributes, instead of a fixed limit that broke SCEP CertRep (#10760).
- No silent truncation: a certificate bundle larger than MAX_PKCS7_CERTS is now rejected instead of losing certificates, and the default limit goes from 4 to 8 (#11655).
Interoperability
- Go SCEP servers: RSA signatures with a mismatched DigestInfo encoding and definite-length constructed ciphertext now verify and decrypt (#10928).
- OpenSSL cms -stream output: fragmented, indefinite-length EnvelopedData and AuthEnvelopedData now decode correctly (#11554).
- RSA-PSS certificates can now be EnvelopedData and AuthEnvelopedData recipients (#9854).
- Subject key identifier signer IDs are encoded with the implicit tagging RFC 5652 requires, which strict parsers such as OpenSSL rejected before (#10937).
- Streamed SignedData with a precomputed hash no longer drops the content (#10904).
- Multiple recipients: any recipient can open a message encrypted to several, including AuthEnvelopedData, which never worked before (#11350).
- Chunked input: streaming decode now works no matter where a chunk boundary falls (#11350, #11554, #11484).
Hardening
A thorough security review of the PKCS#7 code added bounds checks throughout the decoder, binds the signer identifier to the certificate that verified the signature, rejects truncated AES-GCM tags, wipes key material, and fixes a leak, an infinite loop and a use-after-free on object reuse (#9871, #9945, #10039, #10102, #10116, #10203, #10209, #10636, #10702, #10833, #11017, #11490, #11655). We recommend that every user of the PKCS#7 API update to the latest wolfSSL release.
Zephyr
The Zephyr module gains a CONFIG_WOLFSSL_PKCS7 Kconfig option, so enrollment clients no longer need their own settings file (#11542).
What’s Next
This builds on the recently added ML-DSA and RSA-PSS SignedData support. Next up is post-quantum encryption with ML-KEM KEMRecipientInfo for CNSA 2.0 S/MIME.
Questions? Contact us at facts@wolfssl.com or +1 425 245 8247, or support@wolfssl.com for technical support.
Download wolfSSL Now