PAdES vs CAdES vs XAdES: Which e-Signature Format When?
PAdES embeds the signature in a PDF, XAdES in XML; CAdES signs any file. The differences, levels from B-B to B-LTA, and which one fits which job.
PAdES, CAdES and XAdES do the same job: they produce an advanced electronic signature that proves who signed a document, when, and that the document has not changed since it was signed. The difference is where the signature sits and which type of document it suits. All three belong to the AdES (Advanced Electronic Signature) family of ETSI, the European standards body.
Short answer
| Format | Standard | Where does the signature sit? | Best suited for |
|---|---|---|---|
| PAdES | ETSI EN 319 142 | Inside the PDF file | Documents people will open and read: contracts, reports, petitions |
| CAdES | ETSI EN 319 122 | In an envelope wrapping the document or in a separate .p7s file | Any type of file; official e-correspondence |
| XAdES | ETSI EN 319 132 | Inside or next to the XML document | Machine-to-machine documents: XML such as UBL-TR e-Fatura |
| ASiC | ETSI EN 319 162 | In a ZIP container carrying the document and the signature together | Signing several files in a single package |
What is PAdES?
PAdES (PDF Advanced Electronic Signatures) embeds the signature in the PDF file's own structure. The signed document is still a PDF: the recipient opens it with a PDF reader such as Adobe Acrobat Reader without needing any extra program, and sees in the signature panel who signed it and whether the document has changed. It can also carry a visible signature field on the page.
Because PDF allows incremental updates, several people can sign a document one after another; each signature preserves the version before it. That makes it a practical choice for contracts with an approval chain. Its limit comes from the same place: PAdES signs only PDFs.
What is CAdES?
CAdES (CMS Advanced Electronic Signatures) is based on the CMS (RFC 5652) structure and does not care about the file type: Word, Excel, images, ZIP — anything can be signed. The signature is carried in one of two ways: as an envelope containing the document, or as a separate file (.p7s) sitting next to the document.
The drawback is on the recipient's side: opening a signed file in envelope form and verifying the signature requires an e-signature application. In Turkey, CAdES is the most common format for e-signed official correspondence.
What is XAdES?
XAdES (XML Advanced Electronic Signatures) is built on the W3C XML signature standard (XMLDSig) and is meant for XML documents. The signature can be embedded inside the XML (enveloped), wrap the XML (enveloping) or stand apart (detached). It is designed for cases where the document will be read by software rather than a person; it is used in XML-based documents such as e-Fatura (Turkey's e-invoice) in UBL-TR format.
What is ASiC for?
ASiC (Associated Signature Containers) carries the signed document and its signature together in a single ZIP container. ASiC-S is for a single document, ASiC-E for more than one. The signature inside can be CAdES or XAdES; ASiC is not a new signature type but a way of transporting it.
Levels: B-B, B-T, B-LT, B-LTA
The format answers the question "where does the signature sit"; the level answers "how long can the signature be verified". ETSI's baseline profiles have four levels:
- B-B (Basic): the signature, the signer's certificate and the signed attributes. It verifies while the certificate is valid.
- B-T (Timestamp): a trusted timestamp is added; it proves the latest moment at which the signature was made.
- B-LT (Long-Term): the certificate chain and revocation status (CRL, OCSP) are embedded in the signature; even if the certificate later expires, the validation data stays with the document.
- B-LTA (Long-Term Archive): an archive timestamp is added and can be renewed; even if the cryptographic algorithms used become outdated, the signature keeps its evidential value.
In the older ETSI naming the same steps appear as BES, EPES, T, C, X, XL and A; many applications and documents in Turkey still use these names. For a document that will be kept for years (contract, archive, payroll) choose at least B-LT, preferably B-LTA; for a routine, short-lived approval B-T is usually enough.
Which one should you choose?
- If a person will open and read the document and it is a PDF: PAdES. The recipient installs no extra program.
- If the document is XML and software will process it: XAdES.
- If the file is neither PDF nor XML, or the other party asks for CAdES: CAdES.
- If several files are to be signed in a single package: ASiC-E.
- If an official letter is going to a public institution: the format is not your choice; the rules of the e-Yazışma (Turkey's official e-correspondence) package decide.
Does legal validity depend on the format?
No. In Turkey, under Electronic Signature Law No. 5070, a secure electronic signature has the same legal effect as a handwritten signature. What determines this is less the format than the fact that the signature was made with a qualified electronic certificate and a secure signature creation device (smart card, token, HSM or mobile signature). PAdES, CAdES and XAdES are different containers carrying that signature.
On the ELPO side
For users who want to sign on the desktop without writing code, İmzacı signs PDF and XML with a smart card, prepares e-Yazışma packages and does folder-based batch signing. For teams that want to build signing into their own software, the eSignature e-signature library produces and verifies CAdES, XAdES, PAdES and ASiC formats up to the long-term archive level; since each format is a separate package, only what is used goes into the project. The general introduction to both products is on the e-İmza page.
