RSA-PSS Signing

HotPDF can create SHA-2 and SHA-3 RSASSA-PSS signatures through its portable RSA implementation, a caller-supplied signing callback, a signature provider, or a CNG-backed Windows certificate private key

CMS options

Options := HPDFCMSDefaultOptions;
Options.DigestAlgorithm := cmsdaSHA3_384;
Options.SignatureScheme := cmsRSAPSS;
Options.PSSSaltLength := 48;

HPDFCMSBuildSignedDataEx writes the complete RSASSA-PSS parameter set, including the selected digest, matching MGF1 digest, selected salt length, and trailer field 1

The SignDigest callback receives the selected digest of the encoded signed attributes and must return a signature that matches DigestAlgorithm, SignatureScheme, and PSSSaltLength

Windows certificate signing

SignPDFWithSystemCertificate forwards the selected SHA-2 or SHA-3 digest and RSA-PSS options to CNG private keys without exporting private-key material

The requested digest must be implemented by the Windows version and the selected CNG key-storage provider

Legacy CryptoAPI keys reject RSA-PSS explicitly because that provider path cannot represent PSS padding parameters safely

Portable RSA helpers

• HPDFRSABuildEMSAPSS creates a deterministic EMSA-PSS encoded message for a selected THPDFRSAHashAlgorithm from a caller-supplied salt
• HPDFRSASignPSSWithSalt supports reproducible fixtures and specialized signer integrations across SHA-2 and SHA-3
• HPDFRSASignPSS obtains salt from the platform cryptographic random source
• The SHA256-suffixed helpers remain compatibility wrappers

Related APIs

• THotPDF.VerifyLoadedSignature
• THotPDF.EnumerateSystemCertificates