THPDFCMSVerifyOptions Record
Configures CMS signature verification limits, external providers, signature-policy pinning and timestamp re-verification
Declaration
THPDFCMSVerifyOptions= record
SignatureProvider: THPDFSignatureProvider;
AllowMLDSA: boolean;
OpenSSLLibraryPath: string;
MaxSignerCount: Integer;
MaxCounterSignatureDepth: Integer;
// Policy pinning is applied to primary SignerInfo values. Empty
// expected fields do not constrain the corresponding policy field
RequireSignaturePolicy: boolean;
ExpectedSignaturePolicyOID: AnsiString;
ExpectedSignaturePolicyHash: TBytes;
SignaturePolicyDocument: TBytes;
// Set this flag to hash an intentionally empty policy document
VerifySignaturePolicyDocumentHash: boolean;
RejectUnknownSignaturePolicyHash: boolean;
// Batch validation sets this when a shared timestamp cache already
// holds the verdict for the embedded signature timestamp token: token
// re-verification is skipped and the caller restores the cached
// THPDFTimestampInfo afterwards. Document timestamps (ETSI.RFC3161)
// never take this path because the token is the primary signature
SkipSignatureTimestampVerification: boolean;
class function Default: THPDFCMSVerifyOptions; static;
end;Unit
HPDFSignVerify
Fields
| Field | Purpose |
|---|---|
SignatureProvider | Optional external THPDFSignatureProvider used for sign and verify primitives; nil selects the built-in implementation |
AllowMLDSA | Permits ML-DSA signatures during verification |
OpenSSLLibraryPath | Directory holding the OpenSSL libraries when verification goes through the OpenSSL backend |
MaxSignerCount | Upper bound on primary signers processed; Default sets 256 |
MaxCounterSignatureDepth | Nesting limit for counter-signatures; Default sets 8 |
RequireSignaturePolicy | When True, signatures without a signature policy fail |
ExpectedSignaturePolicyOID | Policy OID a primary SignerInfo must present; empty does not constrain |
ExpectedSignaturePolicyHash | Expected policy digest to pin; empty does not constrain |
SignaturePolicyDocument | Policy document bytes used for hash comparison |
VerifySignaturePolicyDocumentHash | Hash an intentionally empty policy document when True |
RejectUnknownSignaturePolicyHash | Fails verification when the embedded policy hash matches no expected value |
SkipSignatureTimestampVerification | Trusts a cached verdict for the embedded signature timestamp token during batch validation |
Default | Class function returning a zeroed record with MaxSignerCount 256 and MaxCounterSignatureDepth 8 |
Usage notes
- Always start from
THPDFCMSVerifyOptions.Defaultinstead of a zeroed local so the signer and depth limits actually take effect - Policy pinning fields apply to primary SignerInfo values only; empty expected fields leave the corresponding policy check unconstrained
- Batch validation sets
SkipSignatureTimestampVerificationwhen a shared timestamp cache already holds the token verdict; document timestamps never go down that path