TSHA1Digest = array[0..19] of Byte;
TSHA1Context = record
State: array[0..4] of Cardinal;
Buffer: array[0..63] of Byte;
BufCnt: Cardinal;
Length: UInt64;
end;
procedure SHA1Init(out Ctx: TSHA1Context);
procedure SHA1Update(var Ctx: TSHA1Context; const Buf; BufLen: Cardinal);
procedure SHA1Final(var Ctx: TSHA1Context; out Digest: TSHA1Digest);
function SHA1Bytes(const B: TBytes): TSHA1Digest;
function SHA1Of(const Buf; BufLen: Cardinal): TSHA1Digest;
function SHA1Hex(const Digest: TSHA1Digest): string;
FPdfSha1 implements SHA-1 in pure Pascal, with no dependency beyond SysUtils, so the library stays self-contained on every supported compiler. The compression function follows FIPS 180-4 6.1, and the padding rule of FIPS 180-4 5.1.1 pads the message to 56 mod 64 bytes before eight bytes of big-endian bit length. Loads and stores are byte-explicit big-endian, which keeps results identical on every CPU the library targets
The incremental SHA1Init / SHA1Update / SHA1Final API hashes input presented in chunks. SHA1Update passes whole 64-byte blocks straight to the transform and buffers only the remainder in TSHA1Context, so feeding one large block and feeding the same bytes a few at a time produce the same digest
SHA1Bytes and SHA1Of are one-shot helpers over a byte array or an untyped buffer of a given length; an empty TBytes is accepted and hashes as the empty message. SHA1Hex renders a TSHA1Digest as a lowercase 40-character hex string, which is the form a certificate thumbprint is normally compared in
| Function | Description |
|---|---|
SHA1Init | Initializes a hashing context to the FIPS 180-4 5.3.1 initial state and clears its buffer and counters |
SHA1Update | Feeds BufLen bytes of an untyped buffer into an open context; a zero length is a no-op |
SHA1Final | Applies the padding and length block, then returns the 20-byte digest |
SHA1Bytes | One-shot hash of a byte array |
SHA1Of | One-shot hash of an untyped buffer of a given length |
SHA1Hex | Formats a digest as a lowercase 40-character hex string |
| Type | Description |
|---|---|
TSHA1Digest | 20-byte SHA-1 digest, the result type of every hashing entry point in the unit |
TSHA1Context | Incremental hashing context: State holds the five working words, Buffer holds the partial 64-byte message block, BufCnt counts the bytes currently in that buffer, and Length accumulates the total message length in bytes |
SHA-1 is not a signing digest in this library and must not become one. The PAdES stack signs SHA-256 throughout, for the message digest, the signed attributes and the timestamp request alike. Nothing in the signing path should be moved onto this unit
FPdfSha1 exists for one job: matching a certificate against the SHA-1 thumbprint that TPadesSignerOptions carries. A token backend receives certificate DER and has to do that comparison itself, so it hashes the DER with SHA1Bytes and compares SHA1Hex against the configured thumbprint, case-insensitively. On Windows the certificate store resolves the thumbprint during the certificate lookup, so the Windows backend never needed an implementation of its own
If you are looking for a hash for new code, this is not the general-purpose choice. SHA-1 is unsuitable wherever collision resistance matters, including document digests, signed attributes and integrity checks. Use FPdfSha256 instead, or FPdfSha512 or FPdfSha3 where a longer or a different digest family is wanted