DCMTK Version 3.7.0 OFFIS DICOM Toolkit

dcmsign: a digital signature library and utility apps

This module contains classes to create digital signatures in DICOM data sets, to verify and to remove signatures. Signatures are conforming to the DICOM "Digital Signatures" extension (formerly Supplement 41). This module requires the external OpenSSL library.

The main interface classes are:

- DcmSignature
- DcmSignatureHelper
- SiSecurityProfile
- SiCertificate
- SiPrivateKey
- SiMAC

# Tools

This module contains the following command line tool:

- dcmsign: Sign and Verify DICOM Files

# Examples

The following example shows how to verify all signatures in a DICOM file:

DcmFileFormat fileformat;
if (fileformat.loadFile("test.dcm").good())
{
// Load a root Certification Authority certificate from "ca_cert.pem"
// and declare it as trusted. All certificates issued by this CA will
// be considered trustworthy (if within their validity time).
SiCertificateVerifier certVerifier;
if (certVerifier.addTrustedCertificateFile("ca_cert.pem",
X509_FILETYPE_PEM).bad())
{
cerr << "unable to load CA certificate" << endl;
return;
}
// Verify all signatures in the dataset, and verify the signer
// certificate against the root CA defined above.
// Fail if no signature is present in the dataset, but do not require
// any specific DICOM signature profile. Verify a secure timestamp
// if present, but do not fail signature verification if no timestamp
// is there.
int result = DcmSignatureHelper::do_verify(fileformat.getDataset(),
certVerifier, ESVP_requireSignature, ETVP_verifyTSIfPresent);
if (result == 0)
std::cerr << "signature(s) found and successfully verified" << endl;
else
std::cerr << "signature absent or verification failed" << endl;
}
DcmFileFormat
a class handling the DICOM file format (with meta header)
Definition: dcfilefo.h:42
DcmFileFormat::loadFile
virtual OFCondition loadFile(const OFFilename &fileName, const E_TransferSyntax readXfer=EXS_Unknown, const E_GrpLenEncoding groupLength=EGL_noChange, const Uint32 maxReadLength=DCM_MaxReadLength, const E_FileReadMode readMode=ERM_autoDetect)
load object from a DICOM file.
DcmFileFormat::getDataset
DcmDataset * getDataset()
get dataset part of the fileformat
DcmSignatureHelper::do_verify
static int do_verify(DcmItem *dataset, SiCertificateVerifier &certVerifier, E_SignatureVerificationPolicy verificationPolicy, E_TimestampVerificationPolicy timstampPolicy)
verify all signatures in the given dataset and print results to stdout.
OFCondition::bad
OFBool bad() const
check if the status is not OK, i.e. error or failure.
Definition: ofcond.h:322
OFCondition::good
OFBool good() const
check if the status is OK.
Definition: ofcond.h:313
SiCertificateVerifier
a class representing X.509 public key certificates.
Definition: sicertvf.h:44
SiCertificateVerifier::addTrustedCertificateFile
virtual OFCondition addTrustedCertificateFile(const char *fileName, int fileType)
loads a certificate from a file and adds it to the pool of trusted certificates.
ESVP_requireSignature
@ ESVP_requireSignature
fail if no signature is present at all but do not check any signature profile
Definition: sitypes.h:125
ETVP_verifyTSIfPresent
@ ETVP_verifyTSIfPresent
verify timestamp if present, pass otherwise
Definition: sitypes.h:144

The following example shows how to sign a DICOM file:

DcmFileFormat fileformat;
if (fileformat.loadFile("test.dcm").good())
{
// dataset to be signed
DcmDataset *dataset = fileformat.getDataset();
// select transfer syntax in which digital signature will be created
E_TransferSyntax xfer = dataset->getOriginalXfer();
// use Little Endian Explicit for uncompressed files
if ((xfer == EXS_LittleEndianImplicit) ||
(xfer == EXS_BigEndianExplicit))
xfer = EXS_LittleEndianExplicit;
SiCreatorProfile profile; // use the "RSA Creator Profile"
SiRIPEMD160 mac; // use RIPEMD160 as MAC algorithm
SiCertificate cert; // our certificate
if (cert.loadCertificate("certificate.pem", X509_FILETYPE_PEM).bad())
{
cerr << "unable to load certificate" << endl;
return;
}
SiPrivateKey key; // private key, must be unencrypted here
if (key.loadPrivateKey("privkey.pem", X509_FILETYPE_PEM).bad())
{
cerr << "unable to load private key" << endl;
return;
}
// list of attributes to be signed. It can remain empty here
// since we're using the RSA Creator Profile to determine the
// list of attributes that needs to be signed
DcmAttributeTag tags;
// now create the signature
int result = DcmSignatureHelper::do_sign(dataset,
key, cert, &mac, &profile, &tags, xfer, NULL,
SiSignaturePurpose::ESP_none, NULL);
if (result == 0)
std::cerr << "signature successfully created" << endl;
else
std::cerr << "signature creation failed" << endl;
}
DcmAttributeTag
a class representing the DICOM value representation 'Attribute Tag' (AT)
Definition: dcvrat.h:38
DcmDataset
a class handling the DICOM dataset format (files without meta header)
Definition: dcdatset.h:42
DcmDataset::getOriginalXfer
E_TransferSyntax getOriginalXfer() const
return the transfer syntax in which this dataset was originally read or created.
DcmSignatureHelper::do_sign
static int do_sign(DcmItem *dataset, SiPrivateKey &key, SiCertificate &cert, SiMAC *opt_mac, SiSecurityProfile *opt_profile, DcmAttributeTag *opt_tagList, E_TransferSyntax opt_signatureXfer, FILE *dumpFile, SiSignaturePurpose::E_SignaturePurposeType opt_sigPurpose, SiTimeStamp *timeStamp=NULL)
perform a signature operation on a given dataset
SiCertificate
a class representing X.509 public key certificates.
Definition: sicert.h:47
SiCertificate::loadCertificate
OFCondition loadCertificate(const char *filename, int filetype)
loads an X.509 certificate from file.
SiCreatorProfile
Creator RSA Digital Signature Profile.
Definition: sicreapr.h:37
SiPrivateKey
a class representing a private key.
Definition: siprivat.h:44
SiPrivateKey::loadPrivateKey
OFCondition loadPrivateKey(const char *filename, int filetype)
loads a private key from file.
SiSignaturePurpose::ESP_none
@ ESP_none
no signature purpose specified
Definition: sipurpos.h:51
E_TransferSyntax
E_TransferSyntax
enumeration of all DICOM transfer syntaxes known to the toolkit
Definition: dcxfer.h:38
EXS_LittleEndianExplicit
@ EXS_LittleEndianExplicit
Explicit VR Little Endian.
Definition: dcxfer.h:46
EXS_LittleEndianImplicit
@ EXS_LittleEndianImplicit
Implicit VR Little Endian.
Definition: dcxfer.h:42
EXS_BigEndianExplicit
@ EXS_BigEndianExplicit
Explicit VR Big Endian.
Definition: dcxfer.h:48

Generated on Mon Dec 15 2025 for DCMTK Version 3.7.0 by Doxygen 1.9.1