security/nss/doc/signver.xml@b8a032363ba2 (annotated)
security/nss/doc/signver.xml
Thu, 22 Jan 2015 13:21:57 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Thu, 22 Jan 2015 13:21:57 +0100
- branch
- TOR_BUG_9701
- changeset 15
- b8a032363ba2
- permissions
- -rw-r--r--
Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6
| michael@0 | 1 | <?xml version="1.0" encoding="UTF-8"?> |
| michael@0 | 2 | <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" |
| michael@0 | 3 | "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [ |
| michael@0 | 4 | <!ENTITY date SYSTEM "date.xml"> |
| michael@0 | 5 | <!ENTITY version SYSTEM "version.xml"> |
| michael@0 | 6 | ]> |
| michael@0 | 7 | |
| michael@0 | 8 | <refentry id="signver"> |
| michael@0 | 9 | |
| michael@0 | 10 | <refentryinfo> |
| michael@0 | 11 | <date>&date;</date> |
| michael@0 | 12 | <title>NSS Security Tools</title> |
| michael@0 | 13 | <productname>nss-tools</productname> |
| michael@0 | 14 | <productnumber>&version;</productnumber> |
| michael@0 | 15 | </refentryinfo> |
| michael@0 | 16 | |
| michael@0 | 17 | <refmeta> |
| michael@0 | 18 | <refentrytitle>SIGNVER</refentrytitle> |
| michael@0 | 19 | <manvolnum>1</manvolnum> |
| michael@0 | 20 | </refmeta> |
| michael@0 | 21 | |
| michael@0 | 22 | <refnamediv> |
| michael@0 | 23 | <refname>signver</refname> |
| michael@0 | 24 | <refpurpose>Verify a detached PKCS#7 signature for a file.</refpurpose> |
| michael@0 | 25 | </refnamediv> |
| michael@0 | 26 | |
| michael@0 | 27 | <refsynopsisdiv> |
| michael@0 | 28 | <cmdsynopsis> |
| michael@0 | 29 | <command>signtool</command> |
| michael@0 | 30 | <group choice="plain"> |
| michael@0 | 31 | <arg choice="plain">-A</arg> |
| michael@0 | 32 | <arg choice="plain">-V</arg> |
| michael@0 | 33 | </group> |
| michael@0 | 34 | <arg choice="plain">-d <replaceable>directory</replaceable></arg> |
| michael@0 | 35 | <arg>-a</arg> |
| michael@0 | 36 | <arg>-i <replaceable>input_file</replaceable></arg> |
| michael@0 | 37 | <arg>-o <replaceable>output_file</replaceable></arg> |
| michael@0 | 38 | <arg>-s <replaceable>signature_file</replaceable></arg> |
| michael@0 | 39 | <arg>-v</arg> |
| michael@0 | 40 | </cmdsynopsis> |
| michael@0 | 41 | </refsynopsisdiv> |
| michael@0 | 42 | |
| michael@0 | 43 | <refsection> |
| michael@0 | 44 | <title>STATUS</title> |
| michael@0 | 45 | <para>This documentation is still work in progress. Please contribute to the initial review in <ulink url="https://bugzilla.mozilla.org/show_bug.cgi?id=836477">Mozilla NSS bug 836477</ulink> |
| michael@0 | 46 | </para> |
| michael@0 | 47 | </refsection> |
| michael@0 | 48 | |
| michael@0 | 49 | <refsection id="description"> |
| michael@0 | 50 | <title>Description</title> |
| michael@0 | 51 | |
| michael@0 | 52 | <para>The Signature Verification Tool, <command>signver</command>, is a simple command-line utility that unpacks a base-64-encoded PKCS#7 signed object and verifies the digital signature using standard cryptographic techniques. The Signature Verification Tool can also display the contents of the signed object.</para> |
| michael@0 | 53 | </refsection> |
| michael@0 | 54 | |
| michael@0 | 55 | <refsection id="options"> |
| michael@0 | 56 | <title>Options</title> |
| michael@0 | 57 | <variablelist> |
| michael@0 | 58 | <varlistentry> |
| michael@0 | 59 | <term>-A</term> |
| michael@0 | 60 | <listitem><para>Displays all of the information in the PKCS#7 signature.</para></listitem> |
| michael@0 | 61 | </varlistentry> |
| michael@0 | 62 | <varlistentry> |
| michael@0 | 63 | <term>-V</term> |
| michael@0 | 64 | <listitem><para>Verifies the digital signature.</para></listitem> |
| michael@0 | 65 | </varlistentry> |
| michael@0 | 66 | <varlistentry> |
| michael@0 | 67 | <term>-d [sql:]<emphasis>directory</emphasis></term> |
| michael@0 | 68 | <listitem><para>Specify the database directory which contains the certificates and keys.</para> |
| michael@0 | 69 | <para><command>signver</command> supports two types of databases: the legacy security databases (<filename>cert8.db</filename>, <filename>key3.db</filename>, and <filename>secmod.db</filename>) and new SQLite databases (<filename>cert9.db</filename>, <filename>key4.db</filename>, and <filename>pkcs11.txt</filename>). If the prefix <command>sql:</command> is not used, then the tool assumes that the given databases are in the old format.</para></listitem> |
| michael@0 | 70 | </varlistentry> |
| michael@0 | 71 | <varlistentry> |
| michael@0 | 72 | <term>-a</term> |
| michael@0 | 73 | <listitem><para>Sets that the given signature file is in ASCII format.</para></listitem> |
| michael@0 | 74 | </varlistentry> |
| michael@0 | 75 | <varlistentry> |
| michael@0 | 76 | <term>-i <emphasis>input_file</emphasis></term> |
| michael@0 | 77 | <listitem><para>Gives the input file for the object with signed data.</para></listitem> |
| michael@0 | 78 | </varlistentry> |
| michael@0 | 79 | <varlistentry> |
| michael@0 | 80 | <term>-o <emphasis>output_file</emphasis></term> |
| michael@0 | 81 | <listitem><para>Gives the output file to which to write the results.</para></listitem> |
| michael@0 | 82 | </varlistentry> |
| michael@0 | 83 | <varlistentry> |
| michael@0 | 84 | <term>-s <emphasis>signature_file</emphasis></term> |
| michael@0 | 85 | <listitem><para>Gives the input file for the digital signature.</para></listitem> |
| michael@0 | 86 | </varlistentry> |
| michael@0 | 87 | <varlistentry> |
| michael@0 | 88 | <term>-v</term> |
| michael@0 | 89 | <listitem><para>Enables verbose output.</para></listitem> |
| michael@0 | 90 | </varlistentry> |
| michael@0 | 91 | </variablelist> |
| michael@0 | 92 | </refsection> |
| michael@0 | 93 | |
| michael@0 | 94 | <refsection id="examples"> |
| michael@0 | 95 | <title>Extended Examples</title> |
| michael@0 | 96 | <refsection><title>Verifying a Signature</title> |
| michael@0 | 97 | <para>The <option>-V</option> option verifies that the signature in a given signature file is valid when used to sign the given object (from the input file).</para> |
| michael@0 | 98 | <programlisting>signver -V -s <replaceable>signature_file</replaceable> -i <replaceable>signed_file</replaceable> -d sql:/home/my/sharednssdb |
| michael@0 | 99 | |
| michael@0 | 100 | signatureValid=yes</programlisting> |
| michael@0 | 101 | </refsection> |
| michael@0 | 102 | |
| michael@0 | 103 | <refsection><title>Printing Signature Data</title> |
| michael@0 | 104 | <para> |
| michael@0 | 105 | The <option>-A</option> option prints all of the information contained in a signature file. Using the <option>-o</option> option prints the signature file information to the given output file rather than stdout. |
| michael@0 | 106 | </para> |
| michael@0 | 107 | <programlisting>signver -A -s <replaceable>signature_file</replaceable> -o <replaceable>output_file</replaceable></programlisting> |
| michael@0 | 108 | </refsection> |
| michael@0 | 109 | </refsection> |
| michael@0 | 110 | |
| michael@0 | 111 | <refsection id="databases"><title>NSS Database Types</title> |
| michael@0 | 112 | <para>NSS originally used BerkeleyDB databases to store security information. |
| michael@0 | 113 | The last versions of these <emphasis>legacy</emphasis> databases are:</para> |
| michael@0 | 114 | <itemizedlist> |
| michael@0 | 115 | <listitem> |
| michael@0 | 116 | <para> |
| michael@0 | 117 | cert8.db for certificates |
| michael@0 | 118 | </para> |
| michael@0 | 119 | </listitem> |
| michael@0 | 120 | <listitem> |
| michael@0 | 121 | <para> |
| michael@0 | 122 | key3.db for keys |
| michael@0 | 123 | </para> |
| michael@0 | 124 | </listitem> |
| michael@0 | 125 | <listitem> |
| michael@0 | 126 | <para> |
| michael@0 | 127 | secmod.db for PKCS #11 module information |
| michael@0 | 128 | </para> |
| michael@0 | 129 | </listitem> |
| michael@0 | 130 | </itemizedlist> |
| michael@0 | 131 | |
| michael@0 | 132 | <para>BerkeleyDB has performance limitations, though, which prevent it from being easily used by multiple applications simultaneously. NSS has |
| michael@0 | 133 | some flexibility that allows applications to use their own, independent database engine while keeping a shared database and working around the access issues. Still, NSS |
| michael@0 | 134 | requires more flexibility to provide a truly shared security database.</para> |
| michael@0 | 135 | |
| michael@0 | 136 | <para>In 2009, NSS introduced a new set of databases that are SQLite databases rather than |
| michael@0 | 137 | BerkleyDB. These new databases provide more accessibility and performance:</para> |
| michael@0 | 138 | <itemizedlist> |
| michael@0 | 139 | <listitem> |
| michael@0 | 140 | <para> |
| michael@0 | 141 | cert9.db for certificates |
| michael@0 | 142 | </para> |
| michael@0 | 143 | </listitem> |
| michael@0 | 144 | <listitem> |
| michael@0 | 145 | <para> |
| michael@0 | 146 | key4.db for keys |
| michael@0 | 147 | </para> |
| michael@0 | 148 | </listitem> |
| michael@0 | 149 | <listitem> |
| michael@0 | 150 | <para> |
| michael@0 | 151 | pkcs11.txt, which is listing of all of the PKCS #11 modules contained in a new subdirectory in the security databases directory |
| michael@0 | 152 | </para> |
| michael@0 | 153 | </listitem> |
| michael@0 | 154 | </itemizedlist> |
| michael@0 | 155 | |
| michael@0 | 156 | <para>Because the SQLite databases are designed to be shared, these are the <emphasis>shared</emphasis> database type. The shared database type is preferred; the legacy format is included for backward compatibility.</para> |
| michael@0 | 157 | |
| michael@0 | 158 | <para>By default, the tools (<command>certutil</command>, <command>pk12util</command>, <command>modutil</command>) assume that the given security databases follow the more common legacy type. |
| michael@0 | 159 | Using the SQLite databases must be manually specified by using the <command>sql:</command> prefix with the given security directory. For example:</para> |
| michael@0 | 160 | |
| michael@0 | 161 | <programlisting># signver -A -s <replaceable>signature</replaceable> -d sql:/home/my/sharednssdb</programlisting> |
| michael@0 | 162 | |
| michael@0 | 163 | <para>To set the shared database type as the default type for the tools, set the <envar>NSS_DEFAULT_DB_TYPE</envar> environment variable to <envar>sql</envar>:</para> |
| michael@0 | 164 | <programlisting>export NSS_DEFAULT_DB_TYPE="sql"</programlisting> |
| michael@0 | 165 | |
| michael@0 | 166 | <para>This line can be added to the <filename>~/.bashrc</filename> file to make the change permanent for the user.</para> |
| michael@0 | 167 | |
| michael@0 | 168 | <para>Most applications do not use the shared database by default, but they can be configured to use them. For example, this how-to article covers how to configure Firefox and Thunderbird to use the new shared NSS databases:</para> |
| michael@0 | 169 | <itemizedlist> |
| michael@0 | 170 | <listitem> |
| michael@0 | 171 | <para> |
| michael@0 | 172 | https://wiki.mozilla.org/NSS_Shared_DB_Howto</para> |
| michael@0 | 173 | </listitem> |
| michael@0 | 174 | </itemizedlist> |
| michael@0 | 175 | <para>For an engineering draft on the changes in the shared NSS databases, see the NSS project wiki:</para> |
| michael@0 | 176 | <itemizedlist> |
| michael@0 | 177 | <listitem> |
| michael@0 | 178 | <para> |
| michael@0 | 179 | https://wiki.mozilla.org/NSS_Shared_DB |
| michael@0 | 180 | </para> |
| michael@0 | 181 | </listitem> |
| michael@0 | 182 | </itemizedlist> |
| michael@0 | 183 | </refsection> |
| michael@0 | 184 | |
| michael@0 | 185 | <refsection id="seealso"> |
| michael@0 | 186 | <title>See Also</title> |
| michael@0 | 187 | <para>signtool (1)</para> |
| michael@0 | 188 | |
| michael@0 | 189 | <para>The NSS wiki has information on the new database design and how to configure applications to use it.</para> |
| michael@0 | 190 | <itemizedlist> |
| michael@0 | 191 | <listitem> |
| michael@0 | 192 | <para>Setting up the shared NSS database</para> |
| michael@0 | 193 | <para>https://wiki.mozilla.org/NSS_Shared_DB_Howto</para> |
| michael@0 | 194 | </listitem> |
| michael@0 | 195 | <listitem> |
| michael@0 | 196 | <para> |
| michael@0 | 197 | Engineering and technical information about the shared NSS database |
| michael@0 | 198 | </para> |
| michael@0 | 199 | <para> |
| michael@0 | 200 | https://wiki.mozilla.org/NSS_Shared_DB |
| michael@0 | 201 | </para> |
| michael@0 | 202 | </listitem> |
| michael@0 | 203 | </itemizedlist> |
| michael@0 | 204 | </refsection> |
| michael@0 | 205 | |
| michael@0 | 206 | <!-- don't change --> |
| michael@0 | 207 | <refsection id="resources"> |
| michael@0 | 208 | <title>Additional Resources</title> |
| michael@0 | 209 | <para>For information about NSS and other tools related to NSS (like JSS), check out the NSS project wiki at <ulink url="http://www.mozilla.org/projects/security/pki/nss/">http://www.mozilla.org/projects/security/pki/nss/</ulink>. The NSS site relates directly to NSS code changes and releases.</para> |
| michael@0 | 210 | <para>Mailing lists: https://lists.mozilla.org/listinfo/dev-tech-crypto</para> |
| michael@0 | 211 | <para>IRC: Freenode at #dogtag-pki</para> |
| michael@0 | 212 | </refsection> |
| michael@0 | 213 | |
| michael@0 | 214 | <!-- fill in your name first; keep the other names for reference --> |
| michael@0 | 215 | <refsection id="authors"> |
| michael@0 | 216 | <title>Authors</title> |
| michael@0 | 217 | <para>The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google.</para> |
| michael@0 | 218 | <para> |
| michael@0 | 219 | Authors: Elio Maldonado <emaldona@redhat.com>, Deon Lackey <dlackey@redhat.com>. |
| michael@0 | 220 | </para> |
| michael@0 | 221 | </refsection> |
| michael@0 | 222 | |
| michael@0 | 223 | <!-- don't change --> |
| michael@0 | 224 | <refsection id="license"> |
| michael@0 | 225 | <title>LICENSE</title> |
| michael@0 | 226 | <para>Licensed under the Mozilla Public License, v. 2.0. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/. |
| michael@0 | 227 | </para> |
| michael@0 | 228 | </refsection> |
| michael@0 | 229 | |
| michael@0 | 230 | </refentry> |
