Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

pkcs7

package module

Go to main page

Versions in this module

v0

v0.2.2

Mar 26, 2026

v0.2.1

Mar 26, 2026

Changes in this version

+ var OIDCurveP256 = asn1.ObjectIdentifier

+ var OIDCurveP384 = asn1.ObjectIdentifier

+ var OIDCurveP521 = asn1.ObjectIdentifier

+ var OIDEncryptionAlgorithmECDSAWithSHA256 = asn1.ObjectIdentifier

+ var OIDEncryptionAlgorithmECDSAWithSHA384 = asn1.ObjectIdentifier

+ var OIDEncryptionAlgorithmECDSAWithSHA512 = asn1.ObjectIdentifier

+ var OIDEncryptionAlgorithmECPUBLICKEY = asn1.ObjectIdentifier

+ var OIDEncryptionAlgorithmEd25519 = asn1.ObjectIdentifier

+ func DigestOIDForSignatureAlgorithm(digestAlg x509.SignatureAlgorithm) (asn1.ObjectIdentifier, error)

+ func HashForOID(oid asn1.ObjectIdentifier) (crypto.Hash, error)

+ func OIDForEncryptionAlgorithm(pkey crypto.PrivateKey, OIDDigestAlg asn1.ObjectIdentifier) (asn1.ObjectIdentifier, error)

+ type ESSCertID struct

+ CertHash []byte

+ IssuerAndSerialNumber issuerAndSerial

+ type ESSCertIDv2 struct

+ CertHash []byte

+ HashAlgorithm pkix.AlgorithmIdentifier

+ IssuerAndSerialNumber issuerAndSerial

+ type SigningCertificate struct

+ Certs []ESSCertID

+ type SigningCertificateV2 struct

+ Certs []ESSCertIDv2

v0.2.0

Apr 21, 2025

Changes in this version

+ var OIDEncryptionAlgorithmRSAPSS = asn1.ObjectIdentifier

+ func CheckSignature(cert *x509.Certificate, signer SignerInfo, content []byte) error

+ func GetCertFromCertsByIssuerAndSerial(certs []*x509.Certificate, ias issuerAndSerial) *x509.Certificate

+ func VerifyCertChain(ee *x509.Certificate, certs []*x509.Certificate, truststore *x509.CertPool, ...) (chains [][]*x509.Certificate, err error)

+ func VerifyMessageDigestDetached(signer SignerInfo, signedData []byte) error

+ func VerifyMessageDigestEmbedded(digest, signedData []byte) error

+ func VerifyMessageDigestTSToken(oidHashAlg asn1.ObjectIdentifier, digest, signedData []byte) error

type PKCS7

+ ContentType asn1.ObjectIdentifier

+ type SignerInfo struct

+ AuthenticatedAttributes []attribute

+ DigestAlgorithm pkix.AlgorithmIdentifier

+ DigestEncryptionAlgorithm pkix.AlgorithmIdentifier

+ EncryptedDigest []byte

+ IssuerAndSerialNumber issuerAndSerial

+ UnauthenticatedAttributes []attribute

+ Version int

+ func (si *SignerInfo) SetUnauthenticatedAttributes(extraUnsignedAttrs []Attribute) error

v0.1.0

Mar 24, 2025

Changes in this version

+ const EncryptionAlgorithmAES128CBC

+ const EncryptionAlgorithmAES128GCM

+ const EncryptionAlgorithmAES256CBC

+ const EncryptionAlgorithmAES256GCM

+ const EncryptionAlgorithmDESCBC

+ var ContentEncryptionAlgorithm = EncryptionAlgorithmDESCBC

+ var EC2IdentityDocumentFixture = ...

+ var ErrNotEncryptedContent = errors.New("pkcs7: content data is a decryptable data type")

+ var ErrPSKNotProvided = errors.New("pkcs7: cannot encrypt content: PSK not provided")

+ var ErrUnsupportedAlgorithm = errors.New(...)

+ var ErrUnsupportedContentType = errors.New("pkcs7: cannot parse data: unimplemented content type")

+ var ErrUnsupportedEncryptionAlgorithm = errors.New("pkcs7: cannot encrypt content: only DES-CBC, AES-CBC, and AES-GCM supported")

+ var OIDAttributeContentType = asn1.ObjectIdentifier

+ var OIDAttributeMessageDigest = asn1.ObjectIdentifier

+ var OIDAttributeSigningTime = asn1.ObjectIdentifier

+ var OIDData = asn1.ObjectIdentifier

+ var OIDDigestAlgorithmDSA = asn1.ObjectIdentifier

+ var OIDDigestAlgorithmDSASHA1 = asn1.ObjectIdentifier

+ var OIDDigestAlgorithmECDSASHA1 = asn1.ObjectIdentifier

+ var OIDDigestAlgorithmECDSASHA256 = asn1.ObjectIdentifier

+ var OIDDigestAlgorithmECDSASHA384 = asn1.ObjectIdentifier

+ var OIDDigestAlgorithmECDSASHA512 = asn1.ObjectIdentifier

+ var OIDDigestAlgorithmSHA1 = asn1.ObjectIdentifier

+ var OIDDigestAlgorithmSHA256 = asn1.ObjectIdentifier

+ var OIDDigestAlgorithmSHA384 = asn1.ObjectIdentifier

+ var OIDDigestAlgorithmSHA512 = asn1.ObjectIdentifier

+ var OIDEncryptedData = asn1.ObjectIdentifier

+ var OIDEncryptionAlgorithmAES128CBC = asn1.ObjectIdentifier

+ var OIDEncryptionAlgorithmAES128GCM = asn1.ObjectIdentifier

+ var OIDEncryptionAlgorithmAES256CBC = asn1.ObjectIdentifier

+ var OIDEncryptionAlgorithmAES256GCM = asn1.ObjectIdentifier

+ var OIDEncryptionAlgorithmDESCBC = asn1.ObjectIdentifier

+ var OIDEncryptionAlgorithmDESEDE3CBC = asn1.ObjectIdentifier

+ var OIDEncryptionAlgorithmECDSAP256 = asn1.ObjectIdentifier

+ var OIDEncryptionAlgorithmECDSAP384 = asn1.ObjectIdentifier

+ var OIDEncryptionAlgorithmECDSAP521 = asn1.ObjectIdentifier

+ var OIDEncryptionAlgorithmRSA = asn1.ObjectIdentifier

+ var OIDEncryptionAlgorithmRSASHA1 = asn1.ObjectIdentifier

+ var OIDEncryptionAlgorithmRSASHA256 = asn1.ObjectIdentifier

+ var OIDEncryptionAlgorithmRSASHA384 = asn1.ObjectIdentifier

+ var OIDEncryptionAlgorithmRSASHA512 = asn1.ObjectIdentifier

+ var OIDEnvelopedData = asn1.ObjectIdentifier

+ var OIDSignedData = asn1.ObjectIdentifier

+ func DegenerateCertificate(cert []byte) ([]byte, error)

+ func Encrypt(content []byte, recipients []*x509.Certificate) ([]byte, error)

+ func EncryptUsingPSK(content []byte, key []byte) ([]byte, error)

+ func TestDSASignWithOpenSSLAndVerify(t *testing.T)

+ func TestVerifyEC2(t *testing.T)

+ type Attribute struct

+ Type asn1.ObjectIdentifier

+ Value interface{}

+ type DSATestFixture struct

+ Certificate *x509.Certificate

+ Input []byte

+ func UnmarshalDSATestFixture(testPEMBlock string) DSATestFixture

+ type MessageDigestMismatchError struct

+ ActualDigest []byte

+ ExpectedDigest []byte

+ func (err *MessageDigestMismatchError) Error() string

+ type PKCS7 struct

+ CRLs []pkix.CertificateList

+ Certificates []*x509.Certificate

+ Content []byte

+ Signers []signerInfo

+ func Parse(data []byte) (p7 *PKCS7, err error)

+ func (p7 *PKCS7) Decrypt(cert *x509.Certificate, pkey crypto.PrivateKey) ([]byte, error)

+ func (p7 *PKCS7) DecryptUsingPSK(key []byte) ([]byte, error)

+ func (p7 *PKCS7) GetOnlySigner() *x509.Certificate

+ func (p7 *PKCS7) UnmarshalSignedAttribute(attributeType asn1.ObjectIdentifier, out interface{}) error

+ func (p7 *PKCS7) Verify() (err error)

+ func (p7 *PKCS7) VerifyWithChain(truststore *x509.CertPool) (err error)

+ func (p7 *PKCS7) VerifyWithChainAtTime(truststore *x509.CertPool, currentTime time.Time) (err error)

+ type SignedData struct

+ func NewSignedData(data []byte) (*SignedData, error)

+ func (sd *SignedData) AddCertificate(cert *x509.Certificate)

+ func (sd *SignedData) AddSigner(ee *x509.Certificate, pkey crypto.PrivateKey, config SignerInfoConfig) error

+ func (sd *SignedData) AddSignerChain(ee *x509.Certificate, pkey crypto.PrivateKey, parents []*x509.Certificate, ...) error

+ func (sd *SignedData) Detach()

+ func (sd *SignedData) Finish() ([]byte, error)

+ func (sd *SignedData) GetSignedData() *signedData

+ func (sd *SignedData) RemoveAuthenticatedAttributes()

+ func (sd *SignedData) RemoveUnauthenticatedAttributes()

+ func (sd *SignedData) SetDigestAlgorithm(d asn1.ObjectIdentifier)

+ func (sd *SignedData) SetEncryptionAlgorithm(d asn1.ObjectIdentifier)

+ func (sd *SignedData) SignWithoutAttr(ee *x509.Certificate, pkey crypto.PrivateKey, config SignerInfoConfig) error

+ type SignerInfoConfig struct

+ ExtraSignedAttributes []Attribute

+ ExtraUnsignedAttributes []Attribute