Convert PKCS#7 / CMS data to JOSE

Inspect a PKCS#7 / CMS file to learn what converting it needs, then convert it to JOSE: signed data becomes a JWS, enveloped data a JWE, and signed-and-enveloped data a JWE whose plaintext is a JWS. The conversion changes the container, not the algorithms; classical algorithms are kept, and CBC content encryption becomes GCM.

Who can do it

An application authenticated as a cryptographic actor of your tenant:

• Analysis needs the scope migration.analyzePkcs7. It decrypts nothing and uses no key.
• Conversion needs the scope migration.convertPkcs7, plus Capability Grants on the keys involved: REENCRYPT over the decrypting key and each recipient key, and RESIGN over each signer's key.

No console role performs these operations.

Before you start

• The application can obtain a token. See Get an access token for an application.
• For a conversion, every signer and every recipient of the file has a key in your tenant whose certificate carries that actor's issuer and serial number. Every signer needs its private key imported. The recipient you decrypt with needs a key that can decrypt and encrypt; every other recipient a key that can encrypt. A certificate imported alone is verify-only and is refused for every signer and recipient.

Steps

1. Analyze the file first:
   • Java SDK: sdk.analyzePkcs7(request) with a Pkcs7AnalysisRequest, or sdk.analyzePkcs7Stream(file) for a large file.
   • Crypto CLI: AnkaSecureCLI analyze-pkcs7 --input-file <file>, or analyze-pkcs7-stream for a large file; --output-file keeps the report.
   • API: POST /api/v3/migration/analyze-pkcs7 with the Base64 file in pkcs7Data, or POST /api/v3/migration/stream/analyze-pkcs7 with a multipart/form-data body, metadata before file.
2. Read the report: supportStatus says whether the structure can be converted, and recommendations.requiredKeys names, by issuer and serial number, every key the conversion needs.
3. Import any missing key, then convert:
   • Java SDK: sdk.convertPkcs7ToJose(request) with a Pkcs7ConversionRequest, or sdk.convertPkcs7ToJoseStream(metadata, inputFile, outputFile) for a large file.
   • Crypto CLI: AnkaSecureCLI convert-pkcs7 --input-file <file> --output-file <file>, with --decrypt-kid <kid> to choose the recipient to decrypt with, --serialization and --target-format; convert-pkcs7-stream for a large file.
   • API: POST /api/v3/migration/convert-pkcs7-to-jose, or POST /api/v3/migration/stream/convert-pkcs7-to-jose for a large file.
4. Choose the serialization: AUTO (the default) produces the compact form for at most one signer and one recipient and the General JSON form otherwise; COMPACT and JSON force one.

What you see when it worked

The analysis lists every signer and recipient, the algorithms and certificates, the JOSE form a conversion would produce, and every key it needs.

The conversion returns the JOSE token with one signature per signer key and one recipient per recipient key, and maps each original signer and recipient to the key identifier that now stands for it. Every CMS signature is verified before it is re-signed. The streaming conversion writes a detached JWS for signed data and a multipart JWE for enveloped data.

If it fails

Without the console

These operations have no console screen.

Related

• PKCS#7 / CMS analysis with the SDK
• PKCS#7 to JOSE migration with the SDK
• Crypto CLI commands