PAdES

PAdES was developed by the European Telecommunications Standards Institute (ETSI). It was first published in the ETSI TS 102 778 series, and its current baseline profiles are defined in ETSI EN 319 142. It builds on the signature framework of the PDF standard ISO 32000. The signature is embedded in the PDF file as a CMS/CAdES structure covering every byte except the signature field itself. The signed document therefore needs no separate signature file, opens in standard PDF readers and can display its signature status on the page.

The standard defines four baseline levels. B-B is the basic signature with the signer's certificate. B-T adds a trusted timestamp that proves the signature existed at a given time. B-LT is the long-term level, embedding validation data such as the certificate chain and CRL/OCSP revocation responses. B-LTA is the archival level, protected by a document timestamp that can be renewed periodically. Documents that must be verifiable years later should use B-LT or B-LTA, so the signature can be proven valid at signing time even after the signer's certificate has expired.

Thanks to PDF incremental updates, several signatures can be added to the same document one after another, each preserving the version before it. The first signer can specify which later changes are permitted (form filling, further signatures, annotations). Any change outside those permissions makes the signatures show as invalid. Academic research into attacks on PDF signature validation has underlined the importance of keeping validation software up to date.

In Türkiye, a PAdES-signed PDF created with an NES and meeting the technical criteria carries a secure electronic signature under Law No. 5070. The common alternatives are CAdES (such as the .imz files used in UYAP) and XAdES (for XML documents such as e-invoices). Compared with them, PAdES has the advantage that the signed document remains a single PDF anyone can open. PAdES is also among the signature formats recognised under the EU eIDAS Regulation.