security/nss/doc/nroff/signver.1@b8a032363ba2 (annotated)
security/nss/doc/nroff/signver.1
Thu, 22 Jan 2015 13:21:57 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Thu, 22 Jan 2015 13:21:57 +0100
- branch
- TOR_BUG_9701
- changeset 15
- b8a032363ba2
- permissions
- -rw-r--r--
Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6
| michael@0 | 1 | '\" t |
| michael@0 | 2 | .\" Title: SIGNVER |
| michael@0 | 3 | .\" Author: [see the "Authors" section] |
| michael@0 | 4 | .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/> |
| michael@0 | 5 | .\" Date: 5 June 2014 |
| michael@0 | 6 | .\" Manual: NSS Security Tools |
| michael@0 | 7 | .\" Source: nss-tools |
| michael@0 | 8 | .\" Language: English |
| michael@0 | 9 | .\" |
| michael@0 | 10 | .TH "SIGNVER" "1" "5 June 2014" "nss-tools" "NSS Security Tools" |
| michael@0 | 11 | .\" ----------------------------------------------------------------- |
| michael@0 | 12 | .\" * Define some portability stuff |
| michael@0 | 13 | .\" ----------------------------------------------------------------- |
| michael@0 | 14 | .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| michael@0 | 15 | .\" http://bugs.debian.org/507673 |
| michael@0 | 16 | .\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html |
| michael@0 | 17 | .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| michael@0 | 18 | .ie \n(.g .ds Aq \(aq |
| michael@0 | 19 | .el .ds Aq ' |
| michael@0 | 20 | .\" ----------------------------------------------------------------- |
| michael@0 | 21 | .\" * set default formatting |
| michael@0 | 22 | .\" ----------------------------------------------------------------- |
| michael@0 | 23 | .\" disable hyphenation |
| michael@0 | 24 | .nh |
| michael@0 | 25 | .\" disable justification (adjust text to left margin only) |
| michael@0 | 26 | .ad l |
| michael@0 | 27 | .\" ----------------------------------------------------------------- |
| michael@0 | 28 | .\" * MAIN CONTENT STARTS HERE * |
| michael@0 | 29 | .\" ----------------------------------------------------------------- |
| michael@0 | 30 | .SH "NAME" |
| michael@0 | 31 | signver \- Verify a detached PKCS#7 signature for a file\&. |
| michael@0 | 32 | .SH "SYNOPSIS" |
| michael@0 | 33 | .HP \w'\fBsigntool\fR\ 'u |
| michael@0 | 34 | \fBsigntool\fR \-A | \-V \-d\ \fIdirectory\fR [\-a] [\-i\ \fIinput_file\fR] [\-o\ \fIoutput_file\fR] [\-s\ \fIsignature_file\fR] [\-v] |
| michael@0 | 35 | .SH "STATUS" |
| michael@0 | 36 | .PP |
| michael@0 | 37 | This documentation is still work in progress\&. Please contribute to the initial review in |
| michael@0 | 38 | \m[blue]\fBMozilla NSS bug 836477\fR\m[]\&\s-2\u[1]\d\s+2 |
| michael@0 | 39 | .SH "DESCRIPTION" |
| michael@0 | 40 | .PP |
| michael@0 | 41 | The Signature Verification Tool, |
| michael@0 | 42 | \fBsignver\fR, is a simple command\-line utility that unpacks a base\-64\-encoded PKCS#7 signed object and verifies the digital signature using standard cryptographic techniques\&. The Signature Verification Tool can also display the contents of the signed object\&. |
| michael@0 | 43 | .SH "OPTIONS" |
| michael@0 | 44 | .PP |
| michael@0 | 45 | \-A |
| michael@0 | 46 | .RS 4 |
| michael@0 | 47 | Displays all of the information in the PKCS#7 signature\&. |
| michael@0 | 48 | .RE |
| michael@0 | 49 | .PP |
| michael@0 | 50 | \-V |
| michael@0 | 51 | .RS 4 |
| michael@0 | 52 | Verifies the digital signature\&. |
| michael@0 | 53 | .RE |
| michael@0 | 54 | .PP |
| michael@0 | 55 | \-d [sql:]\fIdirectory\fR |
| michael@0 | 56 | .RS 4 |
| michael@0 | 57 | Specify the database directory which contains the certificates and keys\&. |
| michael@0 | 58 | .sp |
| michael@0 | 59 | \fBsignver\fR |
| michael@0 | 60 | supports two types of databases: the legacy security databases (cert8\&.db, |
| michael@0 | 61 | key3\&.db, and |
| michael@0 | 62 | secmod\&.db) and new SQLite databases (cert9\&.db, |
| michael@0 | 63 | key4\&.db, and |
| michael@0 | 64 | pkcs11\&.txt)\&. If the prefix |
| michael@0 | 65 | \fBsql:\fR |
| michael@0 | 66 | is not used, then the tool assumes that the given databases are in the old format\&. |
| michael@0 | 67 | .RE |
| michael@0 | 68 | .PP |
| michael@0 | 69 | \-a |
| michael@0 | 70 | .RS 4 |
| michael@0 | 71 | Sets that the given signature file is in ASCII format\&. |
| michael@0 | 72 | .RE |
| michael@0 | 73 | .PP |
| michael@0 | 74 | \-i \fIinput_file\fR |
| michael@0 | 75 | .RS 4 |
| michael@0 | 76 | Gives the input file for the object with signed data\&. |
| michael@0 | 77 | .RE |
| michael@0 | 78 | .PP |
| michael@0 | 79 | \-o \fIoutput_file\fR |
| michael@0 | 80 | .RS 4 |
| michael@0 | 81 | Gives the output file to which to write the results\&. |
| michael@0 | 82 | .RE |
| michael@0 | 83 | .PP |
| michael@0 | 84 | \-s \fIsignature_file\fR |
| michael@0 | 85 | .RS 4 |
| michael@0 | 86 | Gives the input file for the digital signature\&. |
| michael@0 | 87 | .RE |
| michael@0 | 88 | .PP |
| michael@0 | 89 | \-v |
| michael@0 | 90 | .RS 4 |
| michael@0 | 91 | Enables verbose output\&. |
| michael@0 | 92 | .RE |
| michael@0 | 93 | .SH "EXTENDED EXAMPLES" |
| michael@0 | 94 | .SS "Verifying a Signature" |
| michael@0 | 95 | .PP |
| michael@0 | 96 | The |
| michael@0 | 97 | \fB\-V\fR |
| michael@0 | 98 | option verifies that the signature in a given signature file is valid when used to sign the given object (from the input file)\&. |
| michael@0 | 99 | .sp |
| michael@0 | 100 | .if n \{\ |
| michael@0 | 101 | .RS 4 |
| michael@0 | 102 | .\} |
| michael@0 | 103 | .nf |
| michael@0 | 104 | signver \-V \-s \fIsignature_file\fR \-i \fIsigned_file\fR \-d sql:/home/my/sharednssdb |
| michael@0 | 105 | |
| michael@0 | 106 | signatureValid=yes |
| michael@0 | 107 | .fi |
| michael@0 | 108 | .if n \{\ |
| michael@0 | 109 | .RE |
| michael@0 | 110 | .\} |
| michael@0 | 111 | .SS "Printing Signature Data" |
| michael@0 | 112 | .PP |
| michael@0 | 113 | The |
| michael@0 | 114 | \fB\-A\fR |
| michael@0 | 115 | option prints all of the information contained in a signature file\&. Using the |
| michael@0 | 116 | \fB\-o\fR |
| michael@0 | 117 | option prints the signature file information to the given output file rather than stdout\&. |
| michael@0 | 118 | .sp |
| michael@0 | 119 | .if n \{\ |
| michael@0 | 120 | .RS 4 |
| michael@0 | 121 | .\} |
| michael@0 | 122 | .nf |
| michael@0 | 123 | signver \-A \-s \fIsignature_file\fR \-o \fIoutput_file\fR |
| michael@0 | 124 | .fi |
| michael@0 | 125 | .if n \{\ |
| michael@0 | 126 | .RE |
| michael@0 | 127 | .\} |
| michael@0 | 128 | .SH "NSS DATABASE TYPES" |
| michael@0 | 129 | .PP |
| michael@0 | 130 | NSS originally used BerkeleyDB databases to store security information\&. The last versions of these |
| michael@0 | 131 | \fIlegacy\fR |
| michael@0 | 132 | databases are: |
| michael@0 | 133 | .sp |
| michael@0 | 134 | .RS 4 |
| michael@0 | 135 | .ie n \{\ |
| michael@0 | 136 | \h'-04'\(bu\h'+03'\c |
| michael@0 | 137 | .\} |
| michael@0 | 138 | .el \{\ |
| michael@0 | 139 | .sp -1 |
| michael@0 | 140 | .IP \(bu 2.3 |
| michael@0 | 141 | .\} |
| michael@0 | 142 | cert8\&.db for certificates |
| michael@0 | 143 | .RE |
| michael@0 | 144 | .sp |
| michael@0 | 145 | .RS 4 |
| michael@0 | 146 | .ie n \{\ |
| michael@0 | 147 | \h'-04'\(bu\h'+03'\c |
| michael@0 | 148 | .\} |
| michael@0 | 149 | .el \{\ |
| michael@0 | 150 | .sp -1 |
| michael@0 | 151 | .IP \(bu 2.3 |
| michael@0 | 152 | .\} |
| michael@0 | 153 | key3\&.db for keys |
| michael@0 | 154 | .RE |
| michael@0 | 155 | .sp |
| michael@0 | 156 | .RS 4 |
| michael@0 | 157 | .ie n \{\ |
| michael@0 | 158 | \h'-04'\(bu\h'+03'\c |
| michael@0 | 159 | .\} |
| michael@0 | 160 | .el \{\ |
| michael@0 | 161 | .sp -1 |
| michael@0 | 162 | .IP \(bu 2.3 |
| michael@0 | 163 | .\} |
| michael@0 | 164 | secmod\&.db for PKCS #11 module information |
| michael@0 | 165 | .RE |
| michael@0 | 166 | .PP |
| michael@0 | 167 | BerkeleyDB has performance limitations, though, which prevent it from being easily used by multiple applications simultaneously\&. NSS has some flexibility that allows applications to use their own, independent database engine while keeping a shared database and working around the access issues\&. Still, NSS requires more flexibility to provide a truly shared security database\&. |
| michael@0 | 168 | .PP |
| michael@0 | 169 | In 2009, NSS introduced a new set of databases that are SQLite databases rather than BerkleyDB\&. These new databases provide more accessibility and performance: |
| michael@0 | 170 | .sp |
| michael@0 | 171 | .RS 4 |
| michael@0 | 172 | .ie n \{\ |
| michael@0 | 173 | \h'-04'\(bu\h'+03'\c |
| michael@0 | 174 | .\} |
| michael@0 | 175 | .el \{\ |
| michael@0 | 176 | .sp -1 |
| michael@0 | 177 | .IP \(bu 2.3 |
| michael@0 | 178 | .\} |
| michael@0 | 179 | cert9\&.db for certificates |
| michael@0 | 180 | .RE |
| michael@0 | 181 | .sp |
| michael@0 | 182 | .RS 4 |
| michael@0 | 183 | .ie n \{\ |
| michael@0 | 184 | \h'-04'\(bu\h'+03'\c |
| michael@0 | 185 | .\} |
| michael@0 | 186 | .el \{\ |
| michael@0 | 187 | .sp -1 |
| michael@0 | 188 | .IP \(bu 2.3 |
| michael@0 | 189 | .\} |
| michael@0 | 190 | key4\&.db for keys |
| michael@0 | 191 | .RE |
| michael@0 | 192 | .sp |
| michael@0 | 193 | .RS 4 |
| michael@0 | 194 | .ie n \{\ |
| michael@0 | 195 | \h'-04'\(bu\h'+03'\c |
| michael@0 | 196 | .\} |
| michael@0 | 197 | .el \{\ |
| michael@0 | 198 | .sp -1 |
| michael@0 | 199 | .IP \(bu 2.3 |
| michael@0 | 200 | .\} |
| michael@0 | 201 | pkcs11\&.txt, which is listing of all of the PKCS #11 modules contained in a new subdirectory in the security databases directory |
| michael@0 | 202 | .RE |
| michael@0 | 203 | .PP |
| michael@0 | 204 | Because the SQLite databases are designed to be shared, these are the |
| michael@0 | 205 | \fIshared\fR |
| michael@0 | 206 | database type\&. The shared database type is preferred; the legacy format is included for backward compatibility\&. |
| michael@0 | 207 | .PP |
| michael@0 | 208 | By default, the tools (\fBcertutil\fR, |
| michael@0 | 209 | \fBpk12util\fR, |
| michael@0 | 210 | \fBmodutil\fR) assume that the given security databases follow the more common legacy type\&. Using the SQLite databases must be manually specified by using the |
| michael@0 | 211 | \fBsql:\fR |
| michael@0 | 212 | prefix with the given security directory\&. For example: |
| michael@0 | 213 | .sp |
| michael@0 | 214 | .if n \{\ |
| michael@0 | 215 | .RS 4 |
| michael@0 | 216 | .\} |
| michael@0 | 217 | .nf |
| michael@0 | 218 | # signver \-A \-s \fIsignature\fR \-d sql:/home/my/sharednssdb |
| michael@0 | 219 | .fi |
| michael@0 | 220 | .if n \{\ |
| michael@0 | 221 | .RE |
| michael@0 | 222 | .\} |
| michael@0 | 223 | .PP |
| michael@0 | 224 | To set the shared database type as the default type for the tools, set the |
| michael@0 | 225 | \fBNSS_DEFAULT_DB_TYPE\fR |
| michael@0 | 226 | environment variable to |
| michael@0 | 227 | \fBsql\fR: |
| michael@0 | 228 | .sp |
| michael@0 | 229 | .if n \{\ |
| michael@0 | 230 | .RS 4 |
| michael@0 | 231 | .\} |
| michael@0 | 232 | .nf |
| michael@0 | 233 | export NSS_DEFAULT_DB_TYPE="sql" |
| michael@0 | 234 | .fi |
| michael@0 | 235 | .if n \{\ |
| michael@0 | 236 | .RE |
| michael@0 | 237 | .\} |
| michael@0 | 238 | .PP |
| michael@0 | 239 | This line can be added to the |
| michael@0 | 240 | ~/\&.bashrc |
| michael@0 | 241 | file to make the change permanent for the user\&. |
| michael@0 | 242 | .PP |
| michael@0 | 243 | Most applications do not use the shared database by default, but they can be configured to use them\&. For example, this how\-to article covers how to configure Firefox and Thunderbird to use the new shared NSS databases: |
| michael@0 | 244 | .sp |
| michael@0 | 245 | .RS 4 |
| michael@0 | 246 | .ie n \{\ |
| michael@0 | 247 | \h'-04'\(bu\h'+03'\c |
| michael@0 | 248 | .\} |
| michael@0 | 249 | .el \{\ |
| michael@0 | 250 | .sp -1 |
| michael@0 | 251 | .IP \(bu 2.3 |
| michael@0 | 252 | .\} |
| michael@0 | 253 | https://wiki\&.mozilla\&.org/NSS_Shared_DB_Howto |
| michael@0 | 254 | .RE |
| michael@0 | 255 | .PP |
| michael@0 | 256 | For an engineering draft on the changes in the shared NSS databases, see the NSS project wiki: |
| michael@0 | 257 | .sp |
| michael@0 | 258 | .RS 4 |
| michael@0 | 259 | .ie n \{\ |
| michael@0 | 260 | \h'-04'\(bu\h'+03'\c |
| michael@0 | 261 | .\} |
| michael@0 | 262 | .el \{\ |
| michael@0 | 263 | .sp -1 |
| michael@0 | 264 | .IP \(bu 2.3 |
| michael@0 | 265 | .\} |
| michael@0 | 266 | https://wiki\&.mozilla\&.org/NSS_Shared_DB |
| michael@0 | 267 | .RE |
| michael@0 | 268 | .SH "SEE ALSO" |
| michael@0 | 269 | .PP |
| michael@0 | 270 | signtool (1) |
| michael@0 | 271 | .PP |
| michael@0 | 272 | The NSS wiki has information on the new database design and how to configure applications to use it\&. |
| michael@0 | 273 | .sp |
| michael@0 | 274 | .RS 4 |
| michael@0 | 275 | .ie n \{\ |
| michael@0 | 276 | \h'-04'\(bu\h'+03'\c |
| michael@0 | 277 | .\} |
| michael@0 | 278 | .el \{\ |
| michael@0 | 279 | .sp -1 |
| michael@0 | 280 | .IP \(bu 2.3 |
| michael@0 | 281 | .\} |
| michael@0 | 282 | Setting up the shared NSS database |
| michael@0 | 283 | .sp |
| michael@0 | 284 | https://wiki\&.mozilla\&.org/NSS_Shared_DB_Howto |
| michael@0 | 285 | .RE |
| michael@0 | 286 | .sp |
| michael@0 | 287 | .RS 4 |
| michael@0 | 288 | .ie n \{\ |
| michael@0 | 289 | \h'-04'\(bu\h'+03'\c |
| michael@0 | 290 | .\} |
| michael@0 | 291 | .el \{\ |
| michael@0 | 292 | .sp -1 |
| michael@0 | 293 | .IP \(bu 2.3 |
| michael@0 | 294 | .\} |
| michael@0 | 295 | Engineering and technical information about the shared NSS database |
| michael@0 | 296 | .sp |
| michael@0 | 297 | https://wiki\&.mozilla\&.org/NSS_Shared_DB |
| michael@0 | 298 | .RE |
| michael@0 | 299 | .SH "ADDITIONAL RESOURCES" |
| michael@0 | 300 | .PP |
| michael@0 | 301 | For information about NSS and other tools related to NSS (like JSS), check out the NSS project wiki at |
| michael@0 | 302 | \m[blue]\fBhttp://www\&.mozilla\&.org/projects/security/pki/nss/\fR\m[]\&. The NSS site relates directly to NSS code changes and releases\&. |
| michael@0 | 303 | .PP |
| michael@0 | 304 | Mailing lists: https://lists\&.mozilla\&.org/listinfo/dev\-tech\-crypto |
| michael@0 | 305 | .PP |
| michael@0 | 306 | IRC: Freenode at #dogtag\-pki |
| michael@0 | 307 | .SH "AUTHORS" |
| michael@0 | 308 | .PP |
| michael@0 | 309 | The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google\&. |
| michael@0 | 310 | .PP |
| michael@0 | 311 | Authors: Elio Maldonado <emaldona@redhat\&.com>, Deon Lackey <dlackey@redhat\&.com>\&. |
| michael@0 | 312 | .SH "LICENSE" |
| michael@0 | 313 | .PP |
| michael@0 | 314 | Licensed under the Mozilla Public License, v\&. 2\&.0\&. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla\&.org/MPL/2\&.0/\&. |
| michael@0 | 315 | .SH "NOTES" |
| michael@0 | 316 | .IP " 1." 4 |
| michael@0 | 317 | Mozilla NSS bug 836477 |
| michael@0 | 318 | .RS 4 |
| michael@0 | 319 | \%https://bugzilla.mozilla.org/show_bug.cgi?id=836477 |
| michael@0 | 320 | .RE |
