使用 Mimekit 验证数字签名失败

Question

我们正在尝试使用 MimeKit 来验证数字签名的电子邮件 (.p7m) 签名。当我调用signature.Verify(); 时，它会抛出错误消息：

{"验证数字签名失败：非空集 必需\r\n参数名称：值"}。

但同一封邮件已被 Limilabs.Mail 成功验证。

我正在使用下面的代码来验证签名。

if (message.Body is MultipartSigned)
{
    var signed = (MultipartSigned)message.Body;
    foreach (var signature in signed.Verify())
    {
        try
        {
            bool valid = signature.Verify();

            // If valid is true, then it signifies that the signed content
            // has not been modified since this particular signer signed the
            // content.
            // However, if it is false, then it indicates that the signed
            // content has been modified.
        }
        catch (DigitalSignatureVerifyException)
        {
            // There was an error verifying the signature.
        }
    }
}

任何人都可以帮助我解决为什么我收到错误吗？

Answer 1

这里的问题是，默认情况下，当开发人员没有明确提供用于 MultipartSigned.Verify() 方法调用的上下文并且也没有注册替代方案时，MimeKit 默认使用 S/MIME 的 DefaultSecureMimeContext 后端使用 CryptographyContext.Register() 的 S/MIME 上下文。

由于DefaultSecureMimeContext 从一个空的 S/MIME 证书数据库开始，它没有受信任的锚点（也称为根证书颁发机构证书），因此在为验证签名时的 S/MIME 签名者。

您可以通过导入一些根证书颁发机构证书（最好包括为所述签名者构建证书链所需的证书）或使用WindowsSecureMimeContext 来解决此问题：

if (message.Body is MultipartSigned)
{
    var signed = (MultipartSigned)message.Body;

    using (var ctx = new WindowsSecureMimeContext ()) {
        foreach (var signature in signed.Verify(ctx))
        {
            try
            {
                bool valid = signature.Verify();

                // If valid is true, then it signifies that the signed content
                // has not been modified since this particular signer signed the
                // content.
                // However, if it is false, then it indicates that the signed
                // content has been modified.
            }
            catch (DigitalSignatureVerifyException)
            {
                // There was an error verifying the signature.
            }
        }
    }
}