title: Contents of p7s files
body: <p>Does anyone out there know the content of the p7s file?</p>
  <p>At least one digital signature is located in the file, and I can locate that pretty easily, but I want to catch the part of the file that contains the section encrypted with the private key  -  i.e., the non-repudiation part of the digital signature.</p>
  <p>Does anyone know where a simple copy of the general file format can be found?</p>
  <p><strong>SUPPLEMENT ON EDIT:</strong></p>
  <p>The general format of the files I am working with is:</p>
  <p>byte offset           Record Type</p>
  <hr />
  <p>0                     x509 cert (or so the program says)</p>
  <p>0                     version</p>
  <p>1                     8x (information type)</p>
  <p>3                     1 offset to next information (length of file - 4)</p>
  <p>52                    x509 cert (embedded, collection member:  <strong>ROOT CA</strong>)</p>
  <p>56                    x509 cert (embedded, collection member:  <strong>ROOT CA</strong>)</p>
  <p>(1 offset)            x509 cert (new, subject identifier:  <strong>Email</strong>)</p>
  <p>(1 offset +4)         x509 cert (embedded, collection memeber: <strong>Email</strong> )</p>
  <p>(varies)              x509 cert (new, enhanced key usage: <strong>Digital Signature, Non-Repudiation</strong>)</p>
  <p>(varies+4)            x509 cert (embedded, collection member: <strong>Digital Signature, Non-Repudiation</strong>))</p>
  <p>(varies)              x509 cert (new, certificate authority info: <strong>CA EMAIL</strong>)</p>
  <p>(varies+4)            x509 cert (embedded, collection member: <strong>CA EMAIL</strong>)</p>
  <p>(varies)              crosscertificate pair information, unknown class type</p>
  <p>(varies)              certificate of unknown class type (padded with trailing zeros, if needed)</p>
  <p>I do know that this file does not contain a message digest, and is not unique except it is original to the certificate holder (i.e., a different certificate will product different results, but different messages all have the same p7s file attached to them).</p>
  <p>I believe the message digest is stripped from the files when they are sent to a system that does not support encryption/decryption of emails (such as gmail or yahoo).  That would be my explanation for the lack of distinct contents for the p7s files.</p>
  <p>The files are not damaged other than the likelihood that the message digest has been stripped from them.  They will not open with ASN.  Regular certificate files will open with ASN (cer files).</p>
  <hr />
  <p>I wrote a program that analyzes the files by brute force, essentially.</p>
  <p>I check the file byte by byte, and copy the bytes into the input for an X509Certificate2 class instantiation in a try-catch loop.</p>
  <p>Whether it aborts or not, I move one byte and check again.</p>
  <p>If the check is successful, I add the resulting cert to a collection.</p>
  <p>At the end, I examine the certs in the collection and dump both hex and formatted ascii with the file offset into a report file.</p>
  <p>The p7s files I am referring to are detached from the original file, and apparently do not contain any signed information.  That is apparently stripped when the signature is sent to an email address that does not have the capability of encrypting/decrypting information.</p>