TCmsSignerIdKind = (sidIssuerAndSerial, sidSubjectKeyIdentifier);
TCmsSignerId = record
Kind: TCmsSignerIdKind;
IssuerDer: TBytes;
SerialDer: TBytes;
SubjectKeyId: TBytes;
end;
ICmsSigner = interface
function GetDigestAlgorithmOid: AnsiString;
function GetSignatureAlgorithmOid: AnsiString;
function GetSignatureAlgorithmParams: TBytes;
function GetSignerId: TCmsSignerId;
function SignSignedAttrsDigest(const Digest: TSHA256Digest): TBytes;
end;
TCmsBuildOptions = record
SigningTimeUtc: TDateTime;
CommitmentTypeOid: AnsiString;
SignaturePolicyOid: AnsiString;
SignaturePolicyHash: TBytes;
SignaturePolicyUri: AnsiString;
SignaturePolicyDocument: TBytes;
class function Default: TCmsBuildOptions; static;
end;
function CertKeyAlgorithmOid(const CertDer: TBytes): AnsiString;
function ExtractIssuerAndSerial(const CertDer: TBytes;
out IssuerTlv, SerialTlv: TBytes): Boolean;
function EcDsaP1363ToDer(const Raw: TBytes): TBytes;
function VerifyCmsSignaturePolicyDocument(const Options: TCmsBuildOptions;
const PolicyDocument: TBytes; out ErrorText: string): Boolean;
function BuildSignedData(const DetachedDigest: TSHA256Digest;
const Signer: ICmsSigner; const SignerCertDer: TBytes;
const ChainCertDer: array of TBytes;
const Options: TCmsBuildOptions): TBytes;
function ExtractSignatureValue(const CmsDer: TBytes;
out SignatureValueOctets: TBytes): Boolean;
procedure AddSignatureTimestampToCms(var CmsDer: TBytes;
const TimestampTokenDer: TBytes);
FPdfCms is the low-level CMS builder consumed internally by the PAdES signature path. It lets a power user assemble a CMS SignedData value from a SHA-256 message digest of the signed attributes, a signer abstraction, the signer certificate, and an optional certificate chain
The ICmsSigner interface is the crypto-backend contract: the caller supplies the digest and signature algorithm OIDs, the signer identifier, and performs the actual private-key operation over the signed-attributes digest. This decouples CMS encoding from any specific crypto provider
TCmsBuildOptions can add signing time, commitment type, and an explicit signature policy identifier with SHA-256 policy hash, URI, and optional in-memory policy document
ExtractSignatureValue pulls the raw signature octets out of a finished CMS value so they can be sent to a timestamp authority; AddSignatureTimestampToCms then embeds the returned timestamp token as an unsigned attribute, producing the B-T/B-LTA compliant form
| Method | Description |
|---|---|
GetDigestAlgorithmOid | Returns the OID of the hash algorithm used over the signed attributes (for example 2.16.840.1.101.3.4.2.1 for SHA-256) |
GetSignatureAlgorithmOid | Returns the OID of the signature algorithm applied to the digest |
GetSignatureAlgorithmParams | Returns algorithm parameters (often empty for ECDSA; carries the RSA-PSS parameters blob for PSS) |
GetSignerId | Returns the TCmsSignerId identifying the signer by issuer/serial or by subject key identifier |
SignSignedAttrsDigest | Performs the private-key signature over the supplied digest and returns the signature octets |
| Routine | Description |
|---|---|
CertKeyAlgorithmOid | Reads the SubjectPublicKeyInfo algorithm OID out of a certificate, which is what decides between an RSA and an ECDSA signature algorithm; every signing backend needs it, so it lives here rather than inside one of them |
ExtractIssuerAndSerial | Extracts the raw issuer and serialNumber TLVs that a SignerIdentifier carries, into IssuerTlv and SerialTlv |
EcDsaP1363ToDer | Wraps a raw P1363 r||s ECDSA signature into the DER SEQUENCE of two INTEGERs that CMS expects; tokens and platform crypto APIs hand back the raw form |
VerifyCmsSignaturePolicyDocument | Requires a non-empty SignaturePolicyOid and a 32-byte SignaturePolicyHash, then verifies the supplied policy document with SHA-256 and returns diagnostic text on failure |
BuildSignedData | Builds a complete detached RFC 5652 CMS ContentInfo with one CAdES SignerInfo, signer certificate, optional chain, and configured signed attributes |
ExtractSignatureValue | Extracts the raw SignerInfo signature octets used as the RFC 3161 timestamp message imprint input |
AddSignatureTimestampToCms | Adds a full RFC 3161 TimeStampToken as the signature-time-stamp unsigned attribute and re-encodes enclosing lengths |
| Type | Description |
|---|---|
TCmsSignerIdKind | sidIssuerAndSerial selects issuer Name plus serial TLV and sidSubjectKeyIdentifier selects raw subject-key-identifier octets |
TCmsSignerId | Kind, IssuerDer, SerialDer, and SubjectKeyId carry the selected SignerInfo identifier form |
TCmsBuildOptions | SigningTimeUtc, CommitmentTypeOid, SignaturePolicyOid, SignaturePolicyHash, SignaturePolicyUri, and SignaturePolicyDocument configure signed attributes; Default clears every optional value |
TSHA256Digest is provided by the FPdfSha256 unitBuildSignedData takes the certificate chain as an open array of DER-encoded certificates, signer first is not required; ordering follows the CMS EncapsulatedCertificateSet