What is PAdES?

How PAdES works

A PDF signature sits in a signature dictionary inside the file. It covers a defined byte range, which is the whole file except the space reserved for the signature itself. The signature value is a CMS (Cryptographic Message Syntax) structure holding the hash of those bytes, the signer's certificate and other attributes.

Because PDF supports incremental updates, later signatures or timestamps can be added without disturbing earlier ones. That is how multi-signature PDFs and long-term validation work.

The baseline levels

ETSI EN 319 142-1 defines four baseline levels, each adding to the one before:

• B-B: a basic signature with the signer's certificate
• B-T: adds a trusted timestamp, proving the signature existed at a given time
• B-LT: adds validation data such as certificate chains and revocation status
• B-LTA: adds document timestamps so the signature can be re-protected as algorithms age

PAdES and eIDAS

The name says 'advanced', but PAdES is a format, not a legal status. A PAdES signature is an advanced electronic signature under eIDAS only if it meets Article 26, which depends on who holds the key and how they were identified. The same format is used for qualified signatures, advanced signatures and platform seals.

PAdES replaced the earlier ETSI TS 102 778 series. Adobe Acrobat and most PDF readers can validate PAdES signatures and show whether the file changed after signing.

What 'PAdES-style' means for Sign PDF

When a Sign PDF document is complete, we seal the whole file, including the certificate of completion, with a digital signature embedded in the PDF the PAdES way and carrying an RFC 3161 timestamp from DigiCert's timestamp authority. That is close to what the standard calls B-T.

We describe it as PAdES-style rather than claiming formal conformance to every clause of EN 319 142. The seal is applied with Sign PDF's key, so it protects the document's integrity; it does not turn the signers' simple electronic signatures into advanced ones.