<!--
{
  "documentType" : "article",
  "framework" : "Security",
  "identifier" : "/documentation/Security/cryptographic-message-syntax-services",
  "metadataVersion" : "0.1.0",
  "role" : "collectionGroup",
  "title" : "Cryptographic Message Syntax Services"
}
-->

# Cryptographic Message Syntax Services

Cryptographically sign and encrypt S/MIME messages.

## Discussion

When you want to exchange data securely using the Multipurpose Internet Mail Extensions (MIME) protocol, you use the version of the protocol known as S/MIME defined in [RFC 3851](https://tools.ietf.org/html/rfc3851). This allows you to, among other things, ensure data integrity through digital signatures and data confidentiality through encryption. S/MIME in turn relies on the Cryptographic Message Syntax (CMS) protocol defined in [RFC 3852](https://tools.ietf.org/html/rfc3852) to carry out these operations.

Cryptographic message syntax services provides encoder objects that perform encryption using the CMS protocol’s enveloped-data content type and sign using the signed-data content type. When a message is both signed and encrypted, the enveloped data content contains the signed data content. That is, the message is first signed and then the signed content is encrypted.

## Topics

### The Encoder

[`CMSEncoderCreate(_:)`](/documentation/Security/CMSEncoderCreate(_:))

Creates a CMSEncoder reference.

[`CMSEncoder`](/documentation/Security/CMSEncoder)

Opaque reference to a CMS encoder object.

[`CMSEncoderGetTypeID()`](/documentation/Security/CMSEncoderGetTypeID())

Returns the type identifier for the CMSEncoder opaque type.

### Message Creation

[`CMSEncoderAddSigners(_:_:)`](/documentation/Security/CMSEncoderAddSigners(_:_:))

Specifies signers of the message.

[`CMSEncoderAddRecipients(_:_:)`](/documentation/Security/CMSEncoderAddRecipients(_:_:))

Specifies a message is to be encrypted and specifies the recipients of the message.

[`CMSEncoderSetHasDetachedContent(_:_:)`](/documentation/Security/CMSEncoderSetHasDetachedContent(_:_:))

Specifies whether the signed data is to be separate from the message.

[`CMSEncoderSetEncapsulatedContentTypeOID(_:_:)`](/documentation/Security/CMSEncoderSetEncapsulatedContentTypeOID(_:_:))

Specifies an object identifier for the encapsulated data of a signed message.

[`CMSEncoderSetEncapsulatedContentType`](/documentation/Security/CMSEncoderSetEncapsulatedContentType)

Specifies an object identifier for the encapsulated data of a signed message.

[`CMSEncoderAddSupportingCerts(_:_:)`](/documentation/Security/CMSEncoderAddSupportingCerts(_:_:))

Adds certificates to a message.

[`CMSEncoderAddSignedAttributes(_:_:)`](/documentation/Security/CMSEncoderAddSignedAttributes(_:_:))

Specifies attributes for a signed message.

[`CMSSignedAttributes`](/documentation/Security/CMSSignedAttributes)

Optional attributes you can add to a signed message.

[`CMSEncoderSetCertificateChainMode(_:_:)`](/documentation/Security/CMSEncoderSetCertificateChainMode(_:_:))

Specifies which certificates to include in a signed CMS message.

[`CMSCertificateChainMode`](/documentation/Security/CMSCertificateChainMode)

Constants that can be set to specify what certificates to include in a signed message.

[`CMSEncoderSetSignerAlgorithm(_:_:)`](/documentation/Security/CMSEncoderSetSignerAlgorithm(_:_:))

Sets the digest algorithm to use for the signer.

### Message Characteristics

[`CMSEncoderCopySigners(_:_:)`](/documentation/Security/CMSEncoderCopySigners(_:_:))

Obtains the array of signers specified with the `CMSEncoderAddSigners` function.

[`CMSEncoderCopyRecipients(_:_:)`](/documentation/Security/CMSEncoderCopyRecipients(_:_:))

Obtains the array of recipients specified with the `CMSEncoderAddRecipients` function.

[`CMSEncoderGetHasDetachedContent(_:_:)`](/documentation/Security/CMSEncoderGetHasDetachedContent(_:_:))

Indicates whether the message is to have detached content.

[`CMSEncoderCopyEncapsulatedContentType(_:_:)`](/documentation/Security/CMSEncoderCopyEncapsulatedContentType(_:_:))

Obtains the object identifier for the encapsulated data of a signed message.

[`CMSEncoderCopySupportingCerts(_:_:)`](/documentation/Security/CMSEncoderCopySupportingCerts(_:_:))

Obtains the certificates added to a message with `CMSEncoderAddSupportingCerts`.

[`CMSEncoderGetCertificateChainMode(_:_:)`](/documentation/Security/CMSEncoderGetCertificateChainMode(_:_:))

Obtains a constant that indicates which certificates are to be included in a signed CMS message.

### Encoding

[`CMSEncoderUpdateContent(_:_:_:)`](/documentation/Security/CMSEncoderUpdateContent(_:_:_:))

Feeds content bytes into the encoder.

[`CMSEncoderCopyEncodedContent(_:_:)`](/documentation/Security/CMSEncoderCopyEncodedContent(_:_:))

Finishes encoding the message and obtains the encoded result.

[`CMSEncodeContent(_:_:_:_:_:_:_:_:)`](/documentation/Security/CMSEncodeContent(_:_:_:_:_:_:_:_:))

Encodes a message and obtains the result in one high-level function call.

[`CMSEncode`](/documentation/Security/CMSEncode)

Encodes a message and obtains the result in one high-level function call.

### The Decoder

[`CMSDecoderCreate(_:)`](/documentation/Security/CMSDecoderCreate(_:))

Creates a CMSDecoder reference.

[`CMSDecoder`](/documentation/Security/CMSDecoder)

An opaque reference to a CMS decoder object.

[`CMSDecoderGetTypeID()`](/documentation/Security/CMSDecoderGetTypeID())

Returns the type identifier for the CMSDecoder opaque type.

### Decoding

[`CMSDecoderUpdateMessage(_:_:_:)`](/documentation/Security/CMSDecoderUpdateMessage(_:_:_:))

Feeds raw bytes of the message to be decoded into the decoder.

[`CMSDecoderFinalizeMessage(_:)`](/documentation/Security/CMSDecoderFinalizeMessage(_:))

Indicates that there is no more data to decode.

[`CMSDecoderSetDetachedContent(_:_:)`](/documentation/Security/CMSDecoderSetDetachedContent(_:_:))

Specifies the message’s detached content, if any.

[`CMSDecoderCopyDetachedContent(_:_:)`](/documentation/Security/CMSDecoderCopyDetachedContent(_:_:))

Obtains the detached content specified with the `CMSDecoderSetDetachedContent` function.

### Signature Verification

[`CMSDecoderSetSearchKeychain(_:_:)`](/documentation/Security/CMSDecoderSetSearchKeychain(_:_:))

Specifies the keychains to search for intermediate certificates to be used in verifying a signed message’s signer certificates.

[`CMSDecoderGetNumSigners(_:_:)`](/documentation/Security/CMSDecoderGetNumSigners(_:_:))

Obtains the number of signers of a message.

[`CMSDecoderCopySignerEmailAddress(_:_:_:)`](/documentation/Security/CMSDecoderCopySignerEmailAddress(_:_:_:))

Obtains the email address of the specified signer of a CMS message.

[`CMSDecoderCopySignerCert(_:_:_:)`](/documentation/Security/CMSDecoderCopySignerCert(_:_:_:))

Obtains the certificate of the specified signer of a CMS message.

[`CMSDecoderCopySignerStatus(_:_:_:_:_:_:_:)`](/documentation/Security/CMSDecoderCopySignerStatus(_:_:_:_:_:_:_:))

Obtains the status of a CMS message’s signature.

[`CMSSignerStatus`](/documentation/Security/CMSSignerStatus)

The constants that indicate the status of the signature and signer information in a signed message.

### Message Content

[`CMSDecoderIsContentEncrypted(_:_:)`](/documentation/Security/CMSDecoderIsContentEncrypted(_:_:))

Determines whether a CMS message was encrypted.

[`CMSDecoderCopyEncapsulatedContentType(_:_:)`](/documentation/Security/CMSDecoderCopyEncapsulatedContentType(_:_:))

Obtains the object identifier for the encapsulated data of a signed message.

[`CMSDecoderCopyAllCerts(_:_:)`](/documentation/Security/CMSDecoderCopyAllCerts(_:_:))

Obtains an array of all of the certificates in a message.

[`CMSDecoderCopyContent(_:_:)`](/documentation/Security/CMSDecoderCopyContent(_:_:))

Obtains the message content, if any.

### Timestamps

[`CMSDecoderCopySignerSigningTime(_:_:_:)`](/documentation/Security/CMSDecoderCopySignerSigningTime(_:_:_:))

Obtains the signing time of a CMS message, if present.

[`CMSDecoderCopySignerTimestamp(_:_:_:)`](/documentation/Security/CMSDecoderCopySignerTimestamp(_:_:_:))

Returns the timestamp of a signer of a CMS message, if present.

[`CMSDecoderCopySignerTimestampCertificates(_:_:_:)`](/documentation/Security/CMSDecoderCopySignerTimestampCertificates(_:_:_:))

Returns an array containing the certificates from a timestamp response.

[`CMSDecoderCopySignerTimestampWithPolicy(_:_:_:_:)`](/documentation/Security/CMSDecoderCopySignerTimestampWithPolicy(_:_:_:_:))

Returns the timestamp of a signer of a CMS message using a given policy, if present.

[`CMSEncoderCopySignerTimestamp(_:_:_:)`](/documentation/Security/CMSEncoderCopySignerTimestamp(_:_:_:))

Returns the timestamp of a signer of a CMS message, if present.

[`CMSEncoderCopySignerTimestampWithPolicy(_:_:_:_:)`](/documentation/Security/CMSEncoderCopySignerTimestampWithPolicy(_:_:_:_:))

Returns the timestamp of a signer of a CMS message using a particular policy, if present.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)