gchq/CyberChef

Operation request: PKCS7 Parser

Open

#863 opened on Oct 30, 2019

View on GitHub
 (0 comments) (6 reactions) (0 assignees)JavaScript (34,843 stars) (3,944 forks)batch import
help wantedoperation

Description

Summary

Tool to parse PKCS7 envelope both signature and encryption.

Example Input

-----BEGIN PKCS7----- MIICQgYJKoZIhvcNAQcDoIICMzCCAi8CAQAxggG/MIIBuwIBADB0MGwxCzAJBgNV BAYTAlVUMREwDwYDVQQIEwh1bml0dGVzdDERMA8GA1UEBxMIdW5pdHRlc3QxETAP BgNVBAoTCHVuaXR0ZXN0MREwDwYDVQQLEwh1bml0dGVzdDERMA8GA1UEAxMIdW5p dHRlc3QCBBKHyTkwPAYJKoZIhvcNAQEHMC+gDzANBglghkgBZQMEAgEFAKEcMBoG CSqGSIb3DQEBCDANBglghkgBZQMEAgEFAASCAQBZGu0PoXCtMJlRzRh0HQkTQyzM AGH2eeagrT6hlmHgVuQ0a0Oam5R/vm0+xj8LUJvL5oCUwUGiuGC3suQJ1HrtVcIm kEPcwluU57nEIwQ22UV5ozFi2H6zCHMYIKy0kmiyLnOpXis6tC4otKMNCa+mA0Qy SHpmv9iNitDeiXv65hem0E+Sbr/ko53i/Js5KUQfO8E1eGX4YNdJdGaKSoNS+pl8 oxnwIp3CannaKc6Uh1nl8B5f+CTz2nYYh7ewiePcDc6D6986cKDbVJFoW5Wd/Mfc cRETN5TBIEjs9F+vwXKNhSUsiz/CQMPsyYo+PqX3wBwQl6n0ZY4wNbGgTU4nMGcG CSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMplCpx7SrPHxUL++xAgEQgDoPMD9Z 8VEvTl8eVCw/YFZDG6fpRdEKURXyNkm//iIw3T35JkWoW8gV9FvouPBcZnObvg+d Uq4wUFIK -----END PKCS7-----

Example Output

0:d=0 hl=2 l=inf cons: SEQUENCE 2:d=1 hl=2 l= 9 prim: OBJECT :pkcs7-envelopedData 13:d=1 hl=2 l=inf cons: cont [ 0 ] 15:d=2 hl=2 l=inf cons: SEQUENCE 17:d=3 hl=2 l= 1 prim: INTEGER :00 20:d=3 hl=4 l= 447 cons: SET 24:d=4 hl=4 l= 443 cons: SEQUENCE 28:d=5 hl=2 l= 1 prim: INTEGER :00 31:d=5 hl=2 l= 116 cons: SEQUENCE 33:d=6 hl=2 l= 108 cons: SEQUENCE 35:d=7 hl=2 l= 11 cons: SET 37:d=8 hl=2 l= 9 cons: SEQUENCE 39:d=9 hl=2 l= 3 prim: OBJECT :countryName 44:d=9 hl=2 l= 2 prim: PRINTABLESTRING :UT 48:d=7 hl=2 l= 17 cons: SET 50:d=8 hl=2 l= 15 cons: SEQUENCE 52:d=9 hl=2 l= 3 prim: OBJECT :stateOrProvinceName 57:d=9 hl=2 l= 8 prim: PRINTABLESTRING :unittest 67:d=7 hl=2 l= 17 cons: SET 69:d=8 hl=2 l= 15 cons: SEQUENCE 71:d=9 hl=2 l= 3 prim: OBJECT :localityName 76:d=9 hl=2 l= 8 prim: PRINTABLESTRING :unittest 86:d=7 hl=2 l= 17 cons: SET 88:d=8 hl=2 l= 15 cons: SEQUENCE 90:d=9 hl=2 l= 3 prim: OBJECT :organizationName 95:d=9 hl=2 l= 8 prim: PRINTABLESTRING :unittest 105:d=7 hl=2 l= 17 cons: SET 107:d=8 hl=2 l= 15 cons: SEQUENCE 109:d=9 hl=2 l= 3 prim: OBJECT :organizationalUnitName 114:d=9 hl=2 l= 8 prim: PRINTABLESTRING :unittest 124:d=7 hl=2 l= 17 cons: SET 126:d=8 hl=2 l= 15 cons: SEQUENCE 128:d=9 hl=2 l= 3 prim: OBJECT :commonName 133:d=9 hl=2 l= 8 prim: PRINTABLESTRING :unittest 143:d=6 hl=2 l= 4 prim: INTEGER :1287C939 149:d=5 hl=2 l= 60 cons: SEQUENCE 151:d=6 hl=2 l= 9 prim: OBJECT :rsaesOaep 162:d=6 hl=2 l= 47 cons: SEQUENCE 164:d=7 hl=2 l= 15 cons: cont [ 0 ] 166:d=8 hl=2 l= 13 cons: SEQUENCE 168:d=9 hl=2 l= 9 prim: OBJECT :sha256 179:d=9 hl=2 l= 0 prim: NULL 181:d=7 hl=2 l= 28 cons: cont [ 1 ] 183:d=8 hl=2 l= 26 cons: SEQUENCE 185:d=9 hl=2 l= 9 prim: OBJECT :mgf1 196:d=9 hl=2 l= 13 cons: SEQUENCE 198:d=10 hl=2 l= 9 prim: OBJECT :sha256 209:d=10 hl=2 l= 0 prim: NULL 211:d=5 hl=4 l= 256 prim: OCTET STRING [HEX DUMP]:591AED0FA170AD309951CD18741D0913432CCC0061F679E6A0AD3EA19661E056E4346B439A9B947FBE6D3EC63F0B509BCBE68094C141A2B860B7B2E409D47AED55C2269043DCC25B94E7B9C4230436D94579A33162D87EB308731820ACB49268B22E73A95E2B3AB42E28B4A30D09AFA6034432487A66BFD88D8AD0DE897BFAE617A6D04F926EBFE4A39DE2FC9B3929441F3BC1357865F860D74974668A4A8352FA997CA319F0229DC26A79DA29CE948759E5F01E5FF824F3DA761887B7B089E3DC0DCE83EBDF3A70A0DB5491685B959DFCC7DC7111133794C12048ECF45FAFC1728D85252C8B3FC240C3ECC98A3E3EA5F7C01C1097A9F4658E3035B1A04D4E27 471:d=3 hl=2 l=inf cons: SEQUENCE 473:d=4 hl=2 l= 9 prim: OBJECT :pkcs7-data 484:d=4 hl=2 l= 30 cons: SEQUENCE 486:d=5 hl=2 l= 9 prim: OBJECT :aes-256-gcm 497:d=5 hl=2 l= 17 cons: SEQUENCE 499:d=6 hl=2 l= 12 prim: OCTET STRING [HEX DUMP]:A650A9C7B4AB3C7C542FEFB1 513:d=6 hl=2 l= 1 prim: INTEGER :10 516:d=4 hl=2 l=inf cons: cont [ 0 ] 518:d=5 hl=2 l= 58 prim: OCTET STRING [HEX DUMP]:0F303F59F1512F4E5F1E542C3F6056431BA7E945D10A5115F23649BFFE2230DD3DF92645A85BC815F45BE8B8F05C66739BBE0F9D52AE3050520A 578:d=5 hl=2 l= 0 prim: EOC 580:d=4 hl=2 l= 0 prim: EOC 582:d=3 hl=2 l= 0 prim: EOC 584:d=2 hl=2 l= 0 prim: EOC 586:d=1 hl=2 l= 0 prim: EOC

Additional Info

Above data is parsed by using openssl command openssl asn1parse -inform pem -in encrypted_pem.p7 where encrypted_pem.p7 contain same data as mentioned in example input. Also it is possible that encrypted envelope is in DER format. For that openssl command will be openssl asn1parse -inform der -in encrypted_der.p7

Additional Request

It would be nice if UI can make reading easy by provding data in easy to read section with names. e.g. in above example output. 211:d=5 hl=4 l= 256 prim: OCTET STRING [HEX DUMP]: can be sectioned as encrypted_key 518:d=5 hl=2 l= 58 prim: OCTET STRING [HEX DUMP]: can be sectioned as encrypted_content

Contributor guide

Tech stack
javascript
Domain
frontendsecurity
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
4
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
over 1 week
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
Understanding of ASN.1 encodingKnowledge of PKCS7 standardFamiliarity with CyberChef's operation API
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
10
Research direction
Start by examining existing operations in CyberChef (e.g., 'Parse ASN.1 hex string') to understand the pattern. Utilize a JavaScript ASN.1 library like asn1.js to decode the PKCS7 structure. Implement a new operation that accepts PEM or DER input and outputs a parsed tree with named sections like 'encrypted key'. Refer to the OpenSSL command output provided for expected format. Ensure the operation handles both signed and encrypted envelopes. Consider using the project's existing async helpers if needed.