RSA-PSS Signing

HotPDF can create SHA-256 RSASSA-PSS signatures through its portable RSA implementation, a caller-supplied signing callback, or a CNG-backed Windows certificate private key

CMS options

Options := HPDFCMSDefaultOptions;
Options.SignatureScheme := cmsRSAPSS;
Options.PSSSaltLength := 32;

HPDFCMSBuildSignedDataEx writes the complete RSASSA-PSS parameter set, including SHA-256, MGF1 with SHA-256, the selected salt length, and trailer field 1

The SignDigest callback receives the SHA-256 digest of the encoded signed attributes and must return a signature that matches SignatureScheme and PSSSaltLength

Windows certificate signing

SignPDFWithSystemCertificate forwards RSA-PSS options to CNG private keys without exporting private-key material

Legacy CryptoAPI keys reject RSA-PSS explicitly because that provider path cannot represent PSS padding parameters safely

Portable RSA helpers

• HPDFRSABuildEMSAPSSSHA256 creates a deterministic EMSA-PSS encoded message from a caller-supplied salt
• HPDFRSASignPSSSHA256WithSalt supports reproducible fixtures and specialised signer integrations
• HPDFRSASignPSSSHA256 obtains salt from the platform cryptographic random source

Related APIs

• THotPDF.VerifyLoadedSignature
• THotPDF.EnumerateSystemCertificates