Decrypt apple-app-site-association in browser

Question

I'm building a tool to verify deep links set up with Apple's apple-app-site-association files. In some cases, these files are pkcs7-mime encrypted.

Is there any way currently to decrypt these files entirely on the client? I've researched WebCrypto and similar tools but I can't find a solution.

Essentially, I'd like to replicate the following openssl command in JS:

openssl smime -verify -inform DER -noverify -in apple-app-site-association.p7m

This should successfully output valid JSON, such as:

{
"applinks": {
    "apps": [],
    "details": [
        {
            "appID": "4MU37S3E4Q.com.couchsurfing.CouchSurfing",
            "paths": [
                        "NOT /people/*/*",
                        "NOT /users/*/*",
                        "NOT /events/*/*",
                        "NOT /events/past",
                        "NOT /events/attending",
                        "NOT /events/organizing",
                        "NOT /events/featured",
                        "NOT /users/confirmation",
                        "/users/*",
                        "/people/*",
                        "/events/*",
                        "/get_verified",
                        "/messages/*",
                        "/hosting",
                        "/mobile-hangouts"
                     ]
        }
    ]
}
}

Any help is much appreciated!

Answer 1

You can use PKIjs . This is a pure JavaScript library implementing the formats that are used in PKI applications (signing, encryption, certificate requests, OCSP and TSP requests/responses). It is built on WebCrypto (Web Cryptography API) and requires no plug-ins to work in modern browsers.

Here is an example of decoding CMS/PKCS#7 files:

• Demo
• Source