uses ...
  JwaWinCrypt, JwaCryptUIApi;

const
  szOID_CP_GOST_R3411 = '1.2.643.2.2.9';
  szOID_SHA1RSA = '1.2.840.113549.1.1.5';

  // tc26
  id_tc26_gost3410_12_256 = '1.2.643.7.1.1.1.1'; //алгоритм подписи ГОСТ Р 34.10-2012 с ключом 256
  id_tc26_gost3410_12_512 = '1.2.643.7.1.1.1.2'; //алгоритм подписи ГОСТ Р 34.10-2012 с ключом 512

  id_tc26_gost3411_12_256 = '1.2.643.7.1.1.2.2'; //алгоритм хэширования ГОСТ Р 34.11-12 с ключом 256
  id_tc26_gost3411_12_512 = '1.2.643.7.1.1.2.3'; //алгоритм хэширования ГОСТ Р 34.11-12 с ключом 51
  MY_ENCODING_TYPE = (PKCS_7_ASN_ENCODING or X509_ASN_ENCODING);


function CryptSignMessage(pSignPara: PCRYPT_SIGN_MESSAGE_PARA;
  fDetachedSignature: BOOL; cToBeSigned: DWORD; rgpbToBeSigned: PByte;
  rgcbToBeSigned: Pointer; pbSignedBlob: PByte; var pcbSignedBlob: DWORD): BOOL;
  stdcall; external 'Crypt32.dll';

procedure SignStream(SignerCert: PCCERT_CONTEXT; ASourceStream: TStream;
  ADestStream: TStream; DetachedSignature: Boolean);
var
  SignPara: CRYPT_SIGN_MESSAGE_PARA;
  bToBeSigned: array of PByte;
  cToBeSigned: array of DWORD;
  pMsgCrl: array of PCCERT_CONTEXT;
  pbSignedBlob: PByte;
  cbSignedBlob: DWORD;
begin
  SetLength(bToBeSigned, 1);
  SetLength(cToBeSigned, 1);
  SetLength(pMsgCrl, 1);
  bToBeSigned[0] := GetMemory(ASourceStream.Size);
  cToBeSigned[0] := ASourceStream.Size;
  pMsgCrl[0] := SignerCert;
  cbSignedBlob := 0;
  try
    ASourceStream.Read(bToBeSigned[0]^, ASourceStream.Size);
    ZeroMemory(@SignPara, SizeOf(CRYPT_SIGN_MESSAGE_PARA));
    SignPara.cbSize := SizeOf(CRYPT_SIGN_MESSAGE_PARA);
    SignPara.dwMsgEncodingType := MY_ENCODING_TYPE;
    SignPara.pSigningCert := SignerCert;
    SignPara.HashAlgorithm.pszObjId := PAnsiChar(szOID_CP_GOST_R3411);
    SignPara.HashAlgorithm.Parameters.cbData := 0;
    SignPara.HashAlgorithm.Parameters.pbData := nil;
    SignPara.cMsgCert := 1;
    SignPara.rgpMsgCert := Pointer(pMsgCrl);

    if not(CryptSignMessage(@SignPara, DetachedSignature, 1,
      Pointer(bToBeSigned), Pointer(cToBeSigned), nil, cbSignedBlob)) then
      RaiseLastOSError;
    pbSignedBlob := GetMemory(cbSignedBlob);
    try
      if not CryptSignMessage(@SignPara, DetachedSignature, 1,
        Pointer(bToBeSigned), Pointer(cToBeSigned), pbSignedBlob,
        cbSignedBlob) then
        RaiseLastOSError;
      ADestStream.Write(pbSignedBlob^, cbSignedBlob);
    finally
      FreeMemory(pbSignedBlob);
    end;
  finally
    FreeMemory(bToBeSigned[0]);
  end;
end;