PAdES, timestamps, and long-term PDF validation

Electronic signatures and digital signatures solve different layers

An electronic signing workflow records a person’s action and intent. A PDF digital signature uses cryptography to protect a defined byte range in the file and associate that protection with a signing certificate. A strong system can use both: workflow evidence for the human transaction and PAdES evidence for document integrity.

ETSI EN 319 142-1 defines PAdES baseline signatures for PDF documents. The profiles build on PDF signatures and add standardized signed and unsigned attributes for interoperable business and government use cases.

Choose the baseline level from the retention requirement

PAdES baseline levels are cumulative. B-B contains the basic signed attributes. B-T adds trusted time evidence. B-LT incorporates validation material such as certificate and revocation evidence. B-LTA adds archive timestamps intended to support validation over longer periods.

Do not select the highest label by default. Start with how long a document must remain verifiable, what trust services are available, and whether your validation process can refresh evidence before algorithms or certificates age out.

A timestamp proves existence, not business approval

RFC 3161 describes a Time-Stamp Authority that binds a digest to a time and provides proof that the datum existed at that instant. This can help show that a signature existed before a certificate was revoked.

A timestamp does not prove that the signer had authority, understood the agreement, or completed the surrounding workflow. Keep the timestamp token and the application audit trail, because they answer different questions.

Build validation as a repeatable pipeline

A production verifier should parse the PDF safely, identify signed byte ranges, verify the CMS signature value, build and evaluate the certificate chain, inspect signing and timestamp attributes, and report available revocation and long-term validation evidence.

Return structured results instead of a single green check. Teams need to distinguish an intact signature from an untrusted chain, an expired certificate, missing revocation evidence, or a malformed timestamp.

• Document integrity and modification status.
• Signer certificate subject, issuer, validity, and chain result.
• Claimed signing time versus trusted timestamp time.
• Revocation evidence and the time at which it was evaluated.
• PAdES profile and any validation warnings.