Why can't I detect digital signature time stamps for .NET 4.8 by WinCrypt

Reus Weijie Hu 1

I cannot use WinCrypt to read the time stamps of digital signatures in.NET 4.8 files, I would like to ask is this Microsoft mechanism?

else if (unsignedAttribute.Oid.Value == WinCrypt.szOID_RSA_counterSign_USA)

{

foreach (var signedAttribute in signerInfo.UnsignedAttributes)

{

if (signedAttribute.Oid.Value == WinCrypt.szOID_RSA_signingTime_USA)

{

Pkcs9AttributeObject obj = new Pkcs9AttributeObject(signedAttribute.Values[0]);

SignedCms rfcTimestampMessage = new SignedCms();

rfcTimestampMessage.Decode(obj.RawData);

rfcTimestampMessage.CheckSignature(true);

foreach(var timeStampSignerInfo in rfcTimestampMessage.SignerInfos)

{

foreach(var timeStampAttribute in timeStampSignerInfo.SignedAttributes)

{

if (timeStampAttribute.Oid.Value == WinCrypt.szOID_RSA_signingTime)

{

Pkcs9SigningTime signingTime1 = (Pkcs9SigningTime)timeStampAttribute.Values[0];

strTimeStamp = signingTime1.SigningTime.ToLocalTime().ToString();

}

timeStampAttribute. Oid. Value = = WinCrypt. SzOID_RSA_signingTime

this statement can never be true, because no signingTime timeStampAttribute this Value. However, a timestamp is already shown in the file.

timeStampSignerInfo.SignedAttributes contains the values 1.2.840.113549.1.9.3 and 1.2.840.113549.1.9.4 but does not have 1.2.840.113549.1.9.5

2024-11-11_17-09-05

Jiale Xue - MSFT 47,661 Microsoft Vendor

Hi @Reus Weijie Hu , Welcome to Microsoft Q&A,

This may be due to the timestamping authority not explicitly including a signingTime property when issuing the timestamp. Some digital signatures include a timestamp in the countersignature. This is a SignedCms object nested in the primary signature, which can sometimes provide a timestamp value within the validity period of the countersigning certificate.

foreach (var timeStampSignerInfo in rfcTimestampMessage.SignerInfos)
{
    foreach (var timeStampAttribute in timeStampSignerInfo.SignedAttributes)
    {
        if (timeStampAttribute.Oid.Value == WinCrypt.szOID_RSA_signingTime)
        {
            Pkcs9SigningTime signingTime1 = (Pkcs9SigningTime)timeStampAttribute.Values[0];
            strTimeStamp = signingTime1.SigningTime.ToLocalTime().ToString();
            break;
        }
    }

    // Fall back to certificate validity period if signingTime not found
    if (string.IsNullOrEmpty(strTimeStamp))
    {
        var cert = timeStampSignerInfo.Certificate;
        if (cert != null)
        {
            strTimeStamp = cert.NotBefore.ToLocalTime().ToString();
        }
    }
}

Reus Weijie Hu 1 Reputation point

2024-11-13T08:54:26.9766667+00:00

Thank you for your kind answer. I would like to ask why I could get signingTime property before, but I cannot get it recently. Is this a change made by Microsoft?
Jiale Xue - MSFT 47,661 Reputation points Microsoft Vendor

2024-11-13T09:25:33.14+00:00

Are you referring to any previous comparison? Are you using the same version of the API? Are you reading the same file?This API is deprecated. New and existing software should start using Cryptography Next Generation APIs. Microsoft may remove this API in future releases.

Share via

Why can't I detect digital signature time stamps for .NET 4.8 by WinCrypt

Your answer