How is PKCS a syntax to digitally sign, digest, authenticate, or encrypt arbitrary message content I am really confused over PKCS. I saw this question but I do not have enough reputation to leave a comment so I am asking a new question to clarify.

I am trying to understand what exactly PKCS and in extension what CMS is. I have stumbled on the line from the RFC mentioned in the aforementioned question.


  This syntax is used to digitally sign, digest, authenticate, or encrypt arbitrary message content.


How can a syntax be used to digitally sign stuff?!! I can understand if it states it is a syntax used to describe digitally signed stuff...but signing? how can a syntax be used to sign?

This all tie into my confusion with PKCS/CMS and x509. I understand that x509 is a standard that describes what should make up a certificate, how is this different from PKCS/CMS?

Edit

The Wikipedia entry for CMS does not also help. For example it says:


  It [CMS] can be used by cryptographic schemes and protocols to
  digitally sign, digest, authenticate or encrypt any form of digital
  data.


Okay is CMS an encryption algorithm like RSA? No!! so why then say it is a protocol used to digitally sign or encrypt stuff?
PKCS stands for Public Key Cryptography Standards. The name was part of RSA Laboratories that managed to create and publish a very long list of standards, including:


PKCS#1 : RSA with various schemes for encryption + signature generation and schemes
PKCS#5 : Password Based Encryption or PBE
PKCS#7 : The Cryptographic Message Syntax or CMS
PKCS#8 : A scheme for storing / describing and and encrypting private keys
PKCS#11 : Cryptoki, a C based API for HSM's
PKCS#12 : A key &amp; trust store format


PKCS in itself is not a scheme though. Many of these schemes use a language called ASN.1 that is used to describe data structures. It originated in the telco industries. For cryptographic purposes those data structures can be encoded using BER / DER binary encoding.

As RSA Labs was acquired by blood sucking capitalists, most of these standards have been supplanted by RFCs by now, including CMS, although you still see many mentions of PKCS#7.



As the name implies, CMS is a structure of cryptographic messages, described in ASN.1. As such it doesn't describe a method of creating signatures, it just describes how to store signatures and the signed content. Or indeed, how to store encrypted messages, possibly after signing them. CMS is a so called container format that describes what's inside, a bit like an archive or zip file but for cryptographic use.

Furthermore, it also describes how you can store X.509 certificates with the message that can be used to verify it. Verifying parties may not have the leaf / user certificate that was used to sign the document, but they may have a trusted CA certificate that can be used to create a certificate chain. X.509 certificates use a different structure also defined using ASN.1. Since certificates are basically also signed documents there are of course many similarities with CMS.



So no, CMS is not an algorithm, it is a container format for cryptographic messages. Those messages may be encrypted or signed using RSA, in which case CMS will reference the RSA algorithm. You can use the command openssl asn1parse or openssl -cmsout -print to view what the structure is and what's stored inside. You may have to use -inform DER if the input is binary instead of a textual PEM file (header, base 64 and footer).