THPDFCMSVerifyOptions Record
設定 CMS 簽章驗證限制、外部提供者、簽章原則釘選與時間戳記重新驗證
宣告
THPDFCMSVerifyOptions= record
SignatureProvider: THPDFSignatureProvider;
AllowMLDSA: boolean;
OpenSSLLibraryPath: string;
MaxSignerCount: Integer;
MaxCounterSignatureDepth: Integer;
// Policy pinning is applied to primary SignerInfo values. Empty
// expected fields do not constrain the corresponding policy field
RequireSignaturePolicy: boolean;
ExpectedSignaturePolicyOID: AnsiString;
ExpectedSignaturePolicyHash: TBytes;
SignaturePolicyDocument: TBytes;
// Set this flag to hash an intentionally empty policy document
VerifySignaturePolicyDocumentHash: boolean;
RejectUnknownSignaturePolicyHash: boolean;
// Batch validation sets this when a shared timestamp cache already
// holds the verdict for the embedded signature timestamp token: token
// re-verification is skipped and the caller restores the cached
// THPDFTimestampInfo afterwards. Document timestamps (ETSI.RFC3161)
// never take this path because the token is the primary signature
SkipSignatureTimestampVerification: boolean;
class function Default: THPDFCMSVerifyOptions; static;
end;單元
HPDFSignVerify
欄位
| 欄位 | 用途 |
|---|---|
SignatureProvider | 選用的外部 THPDFSignatureProvider,用於簽署與驗證原語;nil 表示使用內建實作 |
AllowMLDSA | 允許驗證期間接受 ML-DSA 簽章 |
OpenSSLLibraryPath | 驗證走 OpenSSL 後端時,存放 OpenSSL 程式庫的目錄 |
MaxSignerCount | 處理的主要簽署者數量上限;Default 設為 256 |
MaxCounterSignatureDepth | 副署的巢狀深度限制;Default 設為 8 |
RequireSignaturePolicy | 為 True 時,不帶簽章原則的簽章會失敗 |
ExpectedSignaturePolicyOID | 主要 SignerInfo 必須出示的原則 OID;留空則不約束 |
ExpectedSignaturePolicyHash | 釘選用的預期原則摘要;留空則不約束 |
SignaturePolicyDocument | 供雜湊比較使用的原則文件位元組 |
VerifySignaturePolicyDocumentHash | 為 True 時,對刻意留空的原則文件也計算雜湊 |
RejectUnknownSignaturePolicyHash | 內嵌原則雜湊不符合任何預期值時,驗證失敗 |
SkipSignatureTimestampVerification | 批次驗證期間,對內嵌簽章時間戳記權杖採信快取判定 |
Default | 類別函式,傳回歸零 record,並設 MaxSignerCount 256 與 MaxCounterSignatureDepth 8 |
使用說明
- 務必從
THPDFCMSVerifyOptions.Default出發,不要用歸零的區域變數,簽署者與深度限制才會真正生效 - 原則釘選欄位只套用於主要 SignerInfo 值;預期欄位留空時,對應的原則檢查不受約束
- 共用時間戳記快取已持有權杖判定時,批次驗證會設定
SkipSignatureTimestampVerification;文件時間戳記絕不走這條路徑