How to get a list of algorithms supported by the certificate

Question

Here's the code to create a digital signature:

ContentInfo contentInfo = new ContentInfo(msg);
SignedCms signedCms = new SignedCms(contentInfo);
CmsSigner cmsSigner = new CmsSigner(signerCert);            
signedCms.ComputeSignature(cmsSigner, false);

How can I get a list of algorithms supported by the certificate? And how to create a digital signature using the specified algorithm from list?

Here are some examples of screenshots of one of the proprietary software designed to create a digital signature:

List of algorithms from first Certificate:

enter image description here

List of algorithms from second Certificate:

enter image description here

What library contains the `ContentInfo`? Please indicate in the tags as well! — Maarten Bodewes, Oct 20 '14 at 18:29
System.Security.Cryptography.Pkcs.ContentInfo ? This is standart "Cryptography" .NET library — HowToRsa, Oct 21 '14 at 09:09

score 0 · Answer 1 · answered Oct 21 '14 at 17:05

Normally you can use any kind of hash over the data. This hash is then put into the SignedInfo structure. That SignedInfo structure in itself is then signed using the signature algorithm identifier for the given algorithm, which also includes the hash algorithm. It seems you cannot directly specify the signature algorithm, but the underlying hash algorithm however can be specified using SignerInfo.DigestAlgorithm. I can only presume that it is also used for the hash over the actual data that is put in the SignedInfo.

This hash algorithm has to be usable within the signature generation algorithm, but it is not specified within an X509 certificate.

GOST R is specific to Russia, so I can only guess that that option is only present for specific Russian certificates (possibly this is linked to the signature algorithm or some kind of certificate extension).

I hope that helps a bit, it could be more clear but neither Microsoft nor Russia are not the most transparent entities that have ever existed. — Maarten Bodewes, Oct 21 '14 at 17:07

score 0 · Answer 2 · edited Oct 07 '21 at 13:33

What Maarten says is correct. Certificate contains digital signature for the public key, which is produced according to some algorithm. In case of first ceritificate signature is GOST R 34.10-2001 and in second one it's the most likely RSA. Any hash can be used for signing data, but GOST R 34.10-2001 clearly states that GOST R 34.11-94 hash should be used as the only hash algorithm. Just to sum it up: list of allowed hash algorithms is optionally defined in the standard, which defines digital signature scheme.

How to get a list of algorithms supported by the certificate

2 Answers2