How is PKCS a syntax to digitally sign, digest, authenticate, or encrypt arbitrary message content
PKCS stands for Public Key Cryptography Standards. The name was part of RSA Laboratories that managed to create and publish a very long list of standards, including:


PKCS#1 : RSA with various schemes for encryption + signature generation and schemes
PKCS#5 : Password Based Encryption or PBE
PKCS#7 : The Cryptographic Message Syntax or CMS
PKCS#8 : A scheme for storing / describing and and encrypting private keys
PKCS#11 : Cryptoki, a C based API for HSM's
PKCS#12 : A key &amp; trust store format


PKCS in itself is not a scheme though. Many of these schemes use a language called ASN.1 that is used to describe data structures. It originated in the telco industries. For cryptographic purposes those data structures can be encoded using BER / DER binary encoding.

As RSA Labs was acquired by blood sucking capitalists, most of these standards have been supplanted by RFCs by now, including CMS, although you still see many mentions of PKCS#7.



As the name implies, CMS is a structure of cryptographic messages, described in ASN.1. As such it doesn't describe a method of creating signatures, it just describes how to store signatures and the signed content. Or indeed, how to store encrypted messages, possibly after signing them. CMS is a so called container format that describes what's inside, a bit like an archive or zip file but for cryptographic use.

Furthermore, it also describes how you can store X.509 certificates with the message that can be used to verify it. Verifying parties may not have the leaf / user certificate that was used to sign the document, but they may have a trusted CA certificate that can be used to create a certificate chain. X.509 certificates use a different structure also defined using ASN.1. Since certificates are basically also signed documents there are of course many similarities with CMS.



So no, CMS is not an algorithm, it is a container format for cryptographic messages. Those messages may be encrypted or signed using RSA, in which case CMS will reference the RSA algorithm. You can use the command openssl asn1parse or openssl -cmsout -print to view what the structure is and what's stored inside. You may have to use -inform DER if the input is binary instead of a textual PEM file (header, base 64 and footer).