#611743 openssl smime -verify can't verify binary messages without CRLF

Package:
openssl
Source:
openssl
Description:
Secure Sockets Layer toolkit - cryptographic utility
Submitter:
John Hughes
Date:
2025-12-23 10:59:01 UTC
Severity:
normal
#611743#5
Date:
2011-02-01 16:21:30 UTC
From:
To:
If I make a simple message:
BINARY DATA
---cut here 8><---

(note lines end in LF, not CRLF)

and sign it as so:

openssl smime -sign -binary -in zz-in -out zz-out \
	-signer as2.crt -inkey as2.key

(note I asked for -binary)

Then it is impossible to verify the message:

openssl smime -verify -binary -in zz-out -noverify \
	-certfile as2.crt -inform smime  | cat -vet
Verification failure
21148:error:21071065:PKCS7 routines:PKCS7_signatureVerify:digest failure:pk7_doit.c:948:
21148:error:21075069:PKCS7 routines:PKCS7_verify:signature failure:pk7_smime.c:312:
Content-Type: application/octet-stream^M$
Content-Transfer-Encoding: 8bit^M$
^M$
BINARY DATA^M$
^M$

It seems that the -verify code doesn't know how to do -binary.

If I sign without -binary and verify with or without -binary then the
verification works, but my binary data is corrupted by replacing all
LF's with CRLF.
#611743#10
Date:
2011-02-01 16:54:51 UTC
From:
To:
OpenSSL tickets:

http://rt.openssl.org/Ticket/Display.html?id=828

and

http://rt.openssl.org/Ticket/Display.html?id=1261

seem relevant.
#611743#15
Date:
2025-12-22 13:35:41 UTC
From:
To:

I'm seeing the same issue (with current OpenSSL versions), but these RT links are offline. Do you maybe have new ticket links?
#611743#25
Date:
2025-12-23 10:56:49 UTC
From:
To:
[...]

If understood correctly, they point to a patch which does more: support a "Content-Transfer-Encoding: binary|base64" header (and add a new -transferencoding param).

For the original issue ("openssl smime -verify -binary" has issues with non-CRLF line endings), I've created https://github.com/openssl/openssl/issues/29492.


Many thanks again!

Greetings,
Ulrich