PAdES

A European Telecommunications Standards Institute (ETSI) profile for embedding a certificate-based signature inside a Portable Document Format (PDF) file. Recipients still open a normal .pdf. The cryptographic evidence travels with the document instead of in a detached envelope.

The profile builds on International Standards Organization (ISO) 32000-1 PDF signatures. A Signature Dictionary records the ByteRange (every byte of the file except the signature value) and stores a Cryptographic Message Syntax SignedData object in Contents. Baseline requirements live in ETSI EN 319 142-1.

The container is independent of the legal grade. The same file can hold a Simple Electronic Signature (SES), an Advanced Electronic Signature (AES), or a Qualified Electronic Signature (QES) under Electronic Identification, Authentication and Trust Services (eIDAS). A weak identity check still yields a weak signature even when the file is a valid PAdES baseline.

How a PAdES Signature Is Built

ISO 32000 already defines how a PDF carries a digital signature. PAdES constrains that model so verifiers can reconstruct who signed, what bytes were covered, and (at higher baseline levels) whether the certificate was valid at signing time.

• Signature Dictionary: Filter, SubFilter, ByteRange, and Contents. Baseline profiles typically use the ETSI.CAdES.detached SubFilter.
• Public Key Infrastructure (PKI): SignedData carries the signing certificate. Verifiers walk the chain to a trusted Certificate Authority (CA) root.
• Incremental Updates: Extra signatures, validation data, and document time-stamps are appended. Rewriting earlier bytes invalidates signatures already in the file.
• Document Security Store: Certificates plus Certificate Revocation List (CRL) data and Online Certificate Status Protocol (OCSP) responses, so later checks do not depend on those services remaining online.
• Optional Appearance: A visible stamp or handwritten facsimile for people reading the page. Cryptographic validity is in Contents, not in the drawing.

Baseline Signature Levels

EN 319 142-1 defines four baseline levels. Each level includes every requirement of the levels below it.

Level	What It Adds	What a Verifier Can Prove
B-B	Signed attributes and the signing certificate	Integrity and signer identity while the certificate is valid
B-T	A trusted time-stamp on the signature	The signature existed at a specific time
B-LT	Certificates, CRLs, and OCSP responses stored in the file	Offline validation after issuing services disappear
B-LTA	A document time-stamp over the file and the validation data	Archive integrity as algorithms age

Legal Effect and Viewer Trust

A QES adds a qualified certificate from a Qualified Trust Service Provider (QTSP) and a Qualified Electronic Signature Creation Device (QSCD). In the European Union (EU) a QES has the same legal effect as a handwritten signature.

Adobe Acrobat and Reader treat many signing certificates as trusted when the issuer appears on the Adobe Approved Trust List (AATL). That list is a viewer convenience. It is not a substitute for eIDAS qualified status.

In the United States, the Electronic Signatures in Global and National Commerce Act (ESIGN) makes electronic signatures usable in interstate commerce. It does not require this PDF profile. Teams that already archive PDFs still use it because one file can hold the contract and the proof.