SetPAdESSignatureTimeStampToken

Security and Signatures

Description

Validates a DER-encoded RFC 3161 TimeStampToken and injects it as an id-aa-signatureTimeStampToken unsigned attribute on the selected CMS SignerInfo

The method verifies the token signature, requires the sole critical extended key usage to be timeStamping, checks an encoded TSA name when present, and compares the token message imprint with the configured digest of the signer signatureValue

Existing signature timestamp attributes on the selected signer are replaced, unrelated unsigned attributes are preserved, and the rebuilt attribute set is DER sorted

Syntax

Delphi

Function TPDFlib.SetPAdESSignatureTimeStampToken(STSProcessID: Integer;
  Const TimeStampTokenDER: AnsiString; SignerIndex: Integer= 0): Integer;

Parameters

STSProcessID	Value returned by one of the `NewPAdESSignatureTimeStampProcessFrom*` functions
TimeStampTokenDER	Complete DER-encoded RFC 3161 TimeStampToken returned by the TSA
SignerIndex	Zero-based CMS signer index, defaulting to the first signer

Returns

0	The process identifier is invalid
1	The token was validated and injected
11	The token, CMS, selected signer, TSA constraints, or message imprint is invalid
Other	The source PDF or selected signature could not be prepared, as reported by `GetPAdESSignatureTimeStampProcessResult`

Workflow

Reserve enough signature contents space with SetSignProcessReserveContentsBytes before creating the original signature
Create a timestamp process and select the signature field and digest algorithm
Call GetPAdESSignatureValueHashHex and send that message imprint to the TSA
Pass the returned TimeStampToken to this method
Finish with an EndPAdESSignatureTimeStampProcessTo* method

The library validates and rewrites CMS but does not perform the TSA HTTP request