Modern Signature Providers

HPDFSignatureProvider separates CMS parsing and encoding from private-key storage and platform cryptography

Verification algorithms

HPDFVerifyCMSSignatureEx verifies Ed25519 and Ed448 pure-mode CMS signatures through THPDFPlatformSignatureProvider or a caller-supplied provider and records the exact signature OID in THPDFSignatureInfo.SignatureAlgorithmOID

ML-DSA-44, ML-DSA-65, and ML-DSA-87 use the platform provider when available, but loaded-document verification enables them only when the Catalog declares the HotPDF PDF 2.0 developer extension

Signing providers

THPDFCallbackSignatureProvider adapts application callbacks, THPDFRemoteSignatureProvider applies bounded retry, cancellation, input, and signature limits around a remote transport, and THPDFPKCS11SignatureProvider serializes RSA operations against a caller-owned authenticated PKCS#11 session and private-key handle

HPDFCMSBuildSignedDataWithProvider builds detached CMS from a document SHA-256 digest, while HPDFCMSSignPDFStreamWithProvider signs an existing PDF signature placeholder and preserves the standard /ByteRange pipeline

Provider request contract

THPDFSignatureProviderRequest carries the signature algorithm and OID, digest OID, message or digest input kind, PSS salt length, public key or certificate, key identifier, operation identifier, signature, and algorithm context

A signing provider returns spsValid with a non-empty signature, while verification providers use spsValid or spsInvalid; unsupported, malformed, provider-error, and cancelled results remain distinct