Cades

CAdES stands for CMS Advanced Electronic Signatures. It is a family of standards defined by ETSI to extend the Cryptographic Message Syntax (CMS) for advanced electronic signatures. The objective is to provide long-term validity and interoperability for signatures applied to data protected with CMS.

Implementation: CAdES signatures are created within a CMS SignedData structure. They add signed attributes to SignerInfo, including the signing time, the signer's certificate chain, and references to revocation data (such as OCSP responses or CRLs). They may also embed or reference time-stamp tokens from trusted authorities. The result is a signature that can be verified later even after the original signing certificate has expired, provided the appropriate validation data is preserved.

Profiles: The CAdES family defines multiple profiles to address different needs. Basic electronic signature (CAdES-BES) covers minimal signature data; time-stamped forms (CAdES-T) add a timestamp; extended validation variants (such as CAdES-X, CAdES-X-L) bundle long-term validation data, including certificates, revocation data, and timestamp tokens; archival (CAdES-A) signatures carry all required data to enable verification far into the future.

Impact and use: CAdES is widely used in Europe, aligned with EU eIDAS for cross-border electronic signing, and supported by many PKI solutions for government and enterprise use. It enables durable signatures suitable for legal and regulatory requirements.