THPDFCertificateAlgorithmPolicy Record
Configures which certificate key and signature algorithms certificate path validation accepts
Declaration
THPDFCertificateAlgorithmPolicy= record
MinimumRSAKeyBits: Integer;
MinimumECDSACurveBits: Integer;
SHA1SunsetTime: TDateTime;
RSAPKCS1v15SunsetTime: TDateTime;
AllowRSAPKCS1v15: boolean;
AllowRSAPSS: boolean;
AllowECDSA: boolean;
AllowEdDSA: boolean;
RequirePSSSaltAtLeastHashLength: boolean;
class function Default: THPDFCertificateAlgorithmPolicy; static;
end;Unit
HPDFSignVerify
Fields
| Field | Purpose |
|---|---|
MinimumRSAKeyBits | Smallest RSA key size accepted for certificates in the path; 0 disables the check; default 2048 |
MinimumECDSACurveBits | Smallest ECDSA curve size accepted for certificates in the path; 0 disables the check; default 256 |
SHA1SunsetTime | Evaluation time at or after which SHA-1 certificate signatures are rejected; 0 disables the sunset; default 2016-01-01 |
RSAPKCS1v15SunsetTime | Evaluation time at or after which RSA PKCS#1 v1.5 certificate signatures are rejected; 0 disables the sunset; default 0 |
AllowRSAPKCS1v15 | Whether RSA PKCS#1 v1.5 certificate signatures are accepted at all; default true |
AllowRSAPSS | Whether RSA-PSS certificate signatures are accepted at all; default true |
AllowECDSA | Whether ECDSA certificate keys and signatures are accepted at all; default true |
AllowEdDSA | Whether Ed25519 and Ed448 certificate keys are accepted at all; default true |
RequirePSSSaltAtLeastHashLength | Requires an RSA-PSS salt at least as long as the signature hash output; default true |
Default | Class function returning the policy with the defaults listed above |
Usage notes
- Attach the policy through
THPDFCertificateValidationOptions.AlgorithmPolicy; a violation fails the path withcvsAlgorithmRejectedand fillsAlgorithmConstraintIssue - Key size checks cover every certificate in the path, while signature scheme checks skip the trust anchor whose signature nothing verifies
- The diagnostics in
THPDFCertificateValidationInforeport the weakest RSA and ECDSA sizes found and whether any certificate used SHA-1