---
name: "libressl-PKCS7_add_attribute"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-PKCS7_add_attribute"
---

# libressl-PKCS7\_add\_attribute(3)

attributes of SignerInfo objects

## NAME

**PKCS7\_add\_attribute**, **PKCS7\_set\_attributes**, **PKCS7\_get\_attribute**, **PKCS7\_add\_signed\_attribute**, **PKCS7\_set\_signed\_attributes**, **PKCS7\_get\_signed\_attribute**, **PKCS7\_add\_attrib\_content\_type**, **PKCS7\_add1\_attrib\_digest**, **PKCS7\_add0\_attrib\_signing\_time**, **PKCS7\_add\_attrib\_smimecap** – attributes of SignerInfo objects

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/pkcs7.h\>**

*int*\

**PKCS7\_add\_attribute**(*PKCS7\_SIGNER\_INFO \*si*, *int nid*, *int attrtype*, *void \*value*);

*int*\

**PKCS7\_set\_attributes**(*PKCS7\_SIGNER\_INFO \*si*, *STACK\_OF(X509\_ATTRIBUTE) \*sk*);

*ASN1\_TYPE* *\**\

**PKCS7\_get\_attribute**(*PKCS7\_SIGNER\_INFO \*si*, *int nid*);

*int*\

**PKCS7\_add\_signed\_attribute**(*PKCS7\_SIGNER\_INFO \*si*, *int nid*, *int attrtype*, *void \*value*);

*int*\

**PKCS7\_set\_signed\_attributes**(*PKCS7\_SIGNER\_INFO \*si*, *STACK\_OF(X509\_ATTRIBUTE) \*sk*);

*ASN1\_TYPE* *\**\

**PKCS7\_get\_signed\_attribute**(*PKCS7\_SIGNER\_INFO \*si*, *int nid*);

*int*\

**PKCS7\_add\_attrib\_content\_type**(*PKCS7\_SIGNER\_INFO \*si*, *ASN1\_OBJECT \*coid*);

*int*\

**PKCS7\_add1\_attrib\_digest**(*PKCS7\_SIGNER\_INFO \*si*, *const unsigned char \*md*, *int mdlen*);

*int*\

**PKCS7\_add0\_attrib\_signing\_time**(*PKCS7\_SIGNER\_INFO \*si*, *ASN1\_TIME \*t*);

*int*\

**PKCS7\_add\_attrib\_smimecap**(*PKCS7\_SIGNER\_INFO \*si*, *STACK\_OF(X509\_ALGOR) \*cap*);

## DESCRIPTION

**PKCS7\_add\_attribute**() appends a new attribute of type *nid* to the *unauthenticatedAttributes* list of *si*, and it adds a new ASN.1 ANY object of type *attrtype* with the given *value* to the new attribute. Ownership of the *value* is transferred into the new attribute object, so the calling code must not [free(3)](/free/3.md) the *value*. If the list already contains an unauthenticated attribute of type *nid* before the call, the new attribute replaces the old one instead of being appended to the end of the list.

**PKCS7\_set\_attributes**() frees the *unauthenticatedAttributes* list of *si* and all the attributes contained in it and replaces it with a deep copy of *sk*.

**PKCS7\_get\_attribute**() retrieves the first ASN.1 ANY member of the attribute of type *nid* from the *unauthenticatedAttributes* list of *si*.

The behaviour of **PKCS7\_add\_signed\_attribute**(), **PKCS7\_set\_signed\_attributes**(), and **PKCS7\_get\_signed\_attribute**() is identical except that they operate on the list of *authenticatedAttributes*.

The normal way to use **PKCS7\_add\_signed\_attribute**() is to first create a *SignedInfo* object with PKCS7\_sign(3) using the PKCS7\_PARTIAL or PKCS7\_STREAM flag, retrieve the *PKCS7\_SIGNER\_INFO* object with PKCS7\_get\_signer\_info(3) or add an additional one with PKCS7\_sign\_add\_signer(3), call **PKCS7\_add\_signed\_attribute**() for each desired additional attribute, then do the signing with PKCS7\_final(3) or with another finalizing function.

The four remaining functions are wrappers around **PKCS7\_add\_signed\_attribute**().

**PKCS7\_add\_attrib\_content\_type**() sets the NID\_pkcs9\_contentType attribute to *coid*, which specifies the content type of the *ContentInfo* value to be signed. This attribute is mandatory and automatically added by PKCS7\_sign(3) and PKCS7\_sign\_add\_signer(3) unless the PKCS7\_NOATTR flag is present. Objects suitable as *coid* arguments can for example be obtained with OBJ\_nid2obj(3). If *coid* is NULL, the content type defaults to NID\_pkcs7\_data.

**PKCS7\_add1\_attrib\_digest**() sets or replaces the NID\_pkcs9\_messageDigest attribute, which is the message digest of the contents octets of the DER-encoding of the content field of the *ContentInfo* value being signed, to a copy of *md*, which is assumed to be *mdlen* bytes long. If *mdlen* is -1, then **strlen**(*md*) is used instead of *mdlen*. This attribute is mandatory and automatically added by PKCS7\_dataFinal(3) and PKCS7\_final(3).

**PKCS7\_add0\_attrib\_signing\_time**() sets or replaces the optional NID\_pkcs9\_signingTime attribute to *t*, specifying the time at which the signer performed the signing process. Ownership of *t* is transferred into the new attribute object, so the calling code must not [free(3)](/free/3.md) *t*. If *t* is NULL, a new *ASN1\_TIME* structure is allocated. This attribute is automatically added by PKCS7\_dataFinal(3) and PKCS7\_final(3).

**PKCS7\_add\_attrib\_smimecap**() sets or replaces the optional NID\_SMIMECapabilities attribute, indicating algorithms the sender is prepared to handle. The *cap* pointer is not stored in the new attribute object and can be passed to **sk\_X509\_ALGOR\_pop\_free**() after the call. This attribute is automatically added by PKCS7\_sign(3) and PKCS7\_sign\_add\_signer(3) unless the PKCS7\_NOATTR or PKCS7\_NOSMIMECAP flag is present.

## RETURN VALUES

**PKCS7\_add\_attribute**(), **PKCS7\_set\_attributes**(), **PKCS7\_add\_signed\_attribute**(), **PKCS7\_set\_signed\_attributes**(), **PKCS7\_add\_attrib\_content\_type**(), **PKCS7\_add1\_attrib\_digest**(), **PKCS7\_add0\_attrib\_signing\_time**(), and **PKCS7\_add\_attrib\_smimecap**() return 1 on success or 0 on failure. The most common reason for failure is lack of memory. **PKCS7\_add\_attribute**() and **PKCS7\_add\_signed\_attribute**() also fail if *nid* is invalid, and **PKCS7\_add\_attrib\_content\_type**() if *si* already contains an authenticated attribute of type NID\_pkcs9\_contentType.

**PKCS7\_get\_attribute**() and **PKCS7\_get\_signed\_attribute**() return an internal pointer to an ASN.1 ANY object or NULL on failure. They fail if *nid* is invalid, if the respective list in *si* contains no attribute of the requested type, or if an invalid element is found in the list before finding the attribute of the requested type.

## SEE ALSO

ASN1\_TIME\_new(3), ASN1\_TYPE\_new(3), OBJ\_nid2obj(3), PKCS7\_final(3), PKCS7\_get\_signer\_info(3), PKCS7\_new(3), PKCS7\_sign(3), PKCS7\_sign\_add\_signer(3), STACK\_OF(3), X509\_ALGOR\_new(3), X509\_ATTRIBUTE\_new(3)

## STANDARDS

RFC 2315: PKCS #7: Cryptographic Message Syntax Version 1.5, section 9.2: SignerInfo type

RFC 2985: PKCS #9: Selected Object Classes and Attribute Types Version 2.0, section 5.3: Attribute types for use in PKCS #7 data and section 5.6: Attributes defined in S/MIME

RFC 5652: Cryptographic Message Syntax (CMS), section 5.3: SignerInfo Type and section 11: Useful Attributes

RFC 8551: Secure/Multipurpose Internet Mail Extensions (S/MIME) Version 4.0 Message Specification, section 2.5.2: SMIMECapabilities Attribute

## HISTORY

**PKCS7\_add\_attribute**(), **PKCS7\_set\_attributes**(), **PKCS7\_get\_attribute**(), **PKCS7\_add\_signed\_attribute**(), **PKCS7\_set\_signed\_attributes**(), and **PKCS7\_get\_signed\_attribute**() first appeared in OpenSSL 0.9.1 and have been available since OpenBSD 2.6.

**PKCS7\_add\_attrib\_smimecap**() first appeared in OpenSSL 0.9.5 and has been available since OpenBSD 2.7.

**PKCS7\_add\_attrib\_content\_type**(), **PKCS7\_add1\_attrib\_digest**(), and **PKCS7\_add0\_attrib\_signing\_time**() first appeared in OpenSSL 1.0.0 and have been available since OpenBSD 4.9.

## CAVEATS

**PKCS7\_set\_signed\_attributes**() does not validate that *sk* contains the PKCS #9 content type and message digest attributes required by RFC 2315. It succeeds even when *sk* is empty, leaving *si* in a state that violates the standard.

**PKCS7\_add0\_attrib\_signing\_time**() does not validate *t* beyond checking that it is well-formed per RFC 5652, section 11.3. In particular, it may set the signing time to the future or to the remote past.

## BUGS

A function to remove individual attributes from these lists does not appear to exist. A program desiring to do that might have to manually iterate the fields *auth\_attr* and *unauth\_attr* of *si*, which are both of type *STACK\_OF(X509\_ATTRIBUTE)*, using the facilities described in STACK\_OF(3) and OPENSSL\_sk\_new(3).