как залезть в сертификат ключа через csptest я так и не нашел команду... »
CSPTEST key set manipulation options:
<globals>:
-silent Do not display any user interface
--cplevel[=<number>] Apply 0/1/2/3 as <number> to use Crypt/CP/CPC/Emu interfaces
--cpdll <Dll> Apply full path to dll as <Dll>
-threads <N> Create N threads
-passes <K> Make K passes in each thread
-provider <name> [optional] specify provider name or next abbreviation:
cp2001 ph2001
-provtype <type> [optional] specify provider type or next abbreviation:
gost2001
<commands>:
-newkeyset Create new container and a key set
-addkeypair Create new keypair in existing container
-deletekeyset Delete key set
-info Show provider's info
--check[=<mask>] Check container. Use bit mask (all tests by default):
1: remask check
2: keys and certs check
4: header check
8: cert license
-hash <hashalg> Hash in file data with hash
(SHA1, SHA256, SHA384, SHA512, MD5, MD2, MD4,
GOST12_256, GOST12_512, GOST94_256 - default)
-sign <hashalg> Sign in file with private key and hash
(SHA1, SHA256, SHA384, SHA512, MD5, MD2, MD4,
GOST12_256, GOST12_512, GOST94_256 - default)
-verify <hashalg> Verify file with signature file on imported key with hash
(SHA1, SHA256, SHA384, SHA512, MD5, MD2, MD4,
GOST12_256, GOST12_512, GOST94_256 - default)
-pkverify <alg> Verify file with signature file on private key with hash
(SHA1, SHA256, SHA384, SHA512, MD5, MD2, MD4
GOST12_256, GOST12_512, GOST94_256 - default)
-display Send hashed data into Reader/Carrier
Working only with GOST hash algorithm
-enum_containers Enumerate containers
-crc Calculate CRC16 of container name string
-encryptioncarrier Set container encryption carrier
-export <file> Export public key blob into file
-expcert <file> Save key certificate from container into file
-impcert <file> Load key certificate from file into container
-makecert Make self signed cert and put it in container
-fmakecert <file> Make self signed cert and put it in file
-loadext <file> Load container extensions from PKCS#7 file, keytype option
selects signature or exchange trust store extension
-saveext <file> Save container extensions to PKCS#7 file
-cleanext <OID> Clean out container extension
"*" means delete all extensions
-noext Do not show info about container extensions
-stress CP{Acquire/Relase}Context
-help Print this help
<options>:
-verifycontext Open context for verification only
-container <name> Specify container name. Use "default" for select dialog
-unique Output unique container name instead name
-fqcn Output FQCN (Fully Qualified Container Name)
-machinekeyset Open HKLM
-exportable Generate exportable key
-protected Generate protected key
-default_optional Set CRYPT_DEFAULT_CONTAINER_OPTIONAL flag
-pattern <string> Substring in unique container name
-keytype <type> Key type for creating key and certificate, signing or
exporting public key, intended signature verifying
on private key: signature, exchange, uec, none.
Default: signature and exchange
-hashout <file> Out hash value into filename
-in <file> Data filename to be signed, verified or hashed
-out <file> Save signature in file
-signature <file> In/out signature file name
-certificate <file> Cert file to import public key from
-import <file> Import public key from file (see also: "-pubkey" parameter)
-pubkey <file> Additional public key to be used in ImportKey() as hPubKey
(exchange private key will be used with import as hPubKey
if no file specified and keytype is exchange)
-hard_rng Use hardware RNG
-length <keylen> Set key length to 1024 / 512 bits
-password <pin> Open container with this password
-nullpasswd Set NULL password (i.e. clean from cache)
-counter <num> Number of Acquire/Release context iterations
-waitcarrier <t> Wait t seconds before releasing
encryption carrier container
покажите формат вывода контейнеров с ключами
csptest -keyset -enum_containers -fqcn -verifycontext