Class DeferredSigningSession

Namespace

SimpleSign.PAdES.Signing

Assembly

SimpleSign.PAdES.dll

Serializable state for a deferred (two-phase) signing operation. Created by PrepareAsync(CancellationToken) and consumed by CompleteAsync(byte[], CancellationToken) after Resume(byte[], byte[]). Store this in Redis, a database, or any persistent storage between HTTP requests.

public sealed class DeferredSigningSession

Inheritance

object

DeferredSigningSession

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Properties

ArchiveTimestampEndpoint

Dedicated archive TSA endpoint for B-LTA, when configured.

public string? ArchiveTimestampEndpoint { get; init; }

Property Value

string

ByteRangeLength1

Length of the first byte range.

public required long ByteRangeLength1 { get; init; }

Property Value

long

ByteRangeLength2

Length of the second byte range.

public required long ByteRangeLength2 { get; init; }

Property Value

long

ByteRangeOffset1

Start offset of the first byte range (always 0 for PAdES).

public required long ByteRangeOffset1 { get; init; }

Property Value

long

ByteRangeOffset2

Start offset of the second byte range.

public required long ByteRangeOffset2 { get; init; }

Property Value

long

CertificateDer

DER-encoded signer certificate (public key only).

public required byte[] CertificateDer { get; init; }

Property Value

byte[]

ContentsHexOffset

Byte offset where the hex-encoded CMS should be written.

public required long ContentsHexOffset { get; init; }

Property Value

long

ContentsReservedBytes

Number of bytes reserved for the CMS (half the hex character count).

public required int ContentsReservedBytes { get; init; }

Property Value

int

DigestOid

Digest algorithm OID (e.g., "2.16.840.1.101.3.4.2.1" for SHA-256).

public required string DigestOid { get; init; }

Property Value

string

ExtraCertificatesDer

DER-encoded extra certificates (chain). Null if no chain was provided.

public byte[][]? ExtraCertificatesDer { get; init; }

Property Value

byte[][]

Hmac

HMAC-SHA256 over the session payload, keyed with a server-side secret.

public byte[]? Hmac { get; set; }

Property Value

byte[]

LevelFailureBehavior

Strict or best-effort policy selected for the deferred operation.

public SigningLevelFailureBehavior LevelFailureBehavior { get; init; }

Property Value

SigningLevelFailureBehavior

PreparedPdf

The prepared PDF bytes with signature placeholder.

public required byte[] PreparedPdf { get; init; }

Property Value

byte[]

RequestedLevel

Requested baseline level persisted for phase two. HTTP providers are runtime dependencies and are intentionally not serialized with the session.

public AdesBaselineLevel RequestedLevel { get; init; }

Property Value

AdesBaselineLevel

SigDictObjectNumber

PDF object number of the signature dictionary.

public required int SigDictObjectNumber { get; init; }

Property Value

int

SignatureAlgorithmOid

Signature algorithm OID (e.g., "1.2.840.113549.1.1.11" for RSA-SHA256).

public required string SignatureAlgorithmOid { get; init; }

Property Value

string

SignedAttributes

DER-encoded signed attributes — the data that was (or will be) signed externally.

public required byte[] SignedAttributes { get; init; }

Property Value

byte[]

SigningTime

UTC signing time embedded in the signed attributes.

public required DateTimeOffset SigningTime { get; init; }

Property Value

DateTimeOffset

TimestampEndpoint

Signature TSA endpoint for B-T and higher, when requested.

public string? TimestampEndpoint { get; init; }

Property Value

string

Methods

Deserialize(byte[], byte[])

Deserializes a session from a byte array after verifying mandatory HMAC integrity.

public static DeferredSigningSession Deserialize(byte[] data, byte[] hmacKey)

Parameters

data byte[]

Serialized session bytes.

hmacKey byte[]

Server-owned HMAC key used during serialization.

Returns

DeferredSigningSession

The verified session.

Deserialize(ReadOnlySpan<byte>, byte[])

Deserializes a session from a read-only span after verifying mandatory HMAC integrity.

public static DeferredSigningSession Deserialize(ReadOnlySpan<byte> data, byte[] hmacKey)

Parameters

data ReadOnlySpan<byte>

Serialized session bytes.

hmacKey byte[]

Server-owned HMAC key used during serialization.

Returns

DeferredSigningSession

The verified session.

Serialize(byte[])

Serializes this session to a byte array for storage (JSON UTF-8) and signs it with HMAC-SHA256.

public byte[] Serialize(byte[] hmacKey)

Parameters

hmacKey byte[]

Server-owned HMAC key with at least 256 bits of entropy.

Returns

byte[]

The integrity-protected serialized session.

Exceptions

ArgumentException

Thrown when hmacKey is shorter than 32 bytes.