Glossary

Cachet signs PDF documents in batches. It can apply three kinds of mark: a cryptographic signature made with your Belgian eID card (beid), a cryptographic signature made with your personal certificate held in Azure Key Vault (azure), or a simple pasted image with no legal value (image). For the two cryptographic modes it follows the European PAdES standard and, after signing, re-checks each file and tells you exactly what was achieved. The terms below explain what those checks and labels mean.

Electronic signature

• A legally recognised way to sign a document electronically. Unlike a scanned handwritten signature, a cryptographic electronic signature also proves WHO signed and that the file has not changed since.

SES / AES / QES

• The three eIDAS tiers, weakest to strongest. SES (simple) is just "an electronic mark". AES (advanced) is uniquely linked to the signer and detects any later change. QES (qualified) is an AES made with a qualified certificate and secure device, and is legally equal to a handwritten signature. eID = QES, Azure = AES, image = none.

eIDAS

• The EU regulation that defines electronic signatures, trust services and the SES/AES/QES tiers, so a signature made in one EU country is recognised across the others.

PAdES

• "PDF Advanced Electronic Signatures" — the ETSI standard (EN 319 142-1) for embedding signatures inside PDF files. Cachet writes PAdES signatures so any compliant reader (e.g. Adobe) can verify them.

CMS

• The low-level container format (Cryptographic Message Syntax) that actually holds the signature bytes, certificates and timestamps inside the PDF. PAdES is a PDF-specific profile built on top of CMS.

Digest / hash

• A short fixed-length fingerprint computed from the document. Change one byte and the fingerprint changes completely. The signature is made over this fingerprint, which is why only the digest, never the full file, is sent to Azure.

Certificate

• An electronic identity card for a cryptographic key: it binds a public key to a person or service and is itself signed by a Certificate Authority. Yours proves the signature really came from you.

CA / certificate chain

• A Certificate Authority (CA) issues certificates. Verifying a signature means following the chain from your certificate up through one or more CAs to a trusted root. If the whole chain checks out, the signature is trusted.

eID / non-repudiation certificate

• A Belgian eID card carries two certificates; Cachet uses the "non-repudiation" one, which is reserved for legally binding signatures (as opposed to the "authentication" certificate used only to log in).

RRN

• The Belgian National Register Number. It is embedded in every eID signature. Anyone who receives a signed PDF can read it, so share signed files carefully.

PKCS#11

• The standard software interface Cachet uses to talk to the eID card through the card-reader middleware. It lets the app use the card's key without the key ever leaving the card.

PIN

• The secret code that unlocks your eID card's signing key. The card never reveals the key; it only signs when the PIN is correct. In beid mode Cachet asks for it once PER DOCUMENT.

Azure Key Vault

• A Microsoft cloud service that stores your personal certificate and key so the key cannot be exported. Signing happens inside the vault: only the document digest is sent there, and the signed result comes back.

Microsoft Entra ID

• Microsoft's identity and login service (formerly Azure Active Directory). In azure mode you log in once PER BATCH to prove you may use your key in the vault.

UPN

• User Principal Name — your sign-in identity in Entra ID, usually in the form name@organisation. It is how the app knows which vault account is yours.

RFC 3161 timestamp / TSA

• A trusted, dated stamp proving the signature existed at a given moment. It comes from a Time-Stamping Authority (TSA) over the network and protects the signature even after the signing certificate later expires.

Qualified vs free timestamp

• A free timestamp (Cachet's default, from DigiCert) is technically valid and widely trusted. A qualified timestamp comes from an eIDAS-qualified TSA and carries stronger legal weight. Both prove "when"; only the qualified one is "qualified".

LTV

• Long-Term Validation — enough proof is stored inside the PDF that it can still be verified years later, even after the certificates have expired or the issuing CA has gone offline.

DSS

• The Document Security Store — the area inside the PDF where LTV evidence (certificates and revocation data) is kept so the file is self-contained.

OCSP

• A live online check asking the CA "is this certificate still valid right now, or was it revoked?". The answer is saved in the DSS for LTV.

CRL

• Certificate Revocation List — a published list of certificates the CA has cancelled. An alternative to OCSP for proving a certificate was still good when used; also stored for LTV.

EU Trusted List (LOTL)

• The official EU list of trusted qualified providers (the List of Trusted Lists). eID (QES) trust ultimately traces here. Azure (AES) does NOT: it is trusted via your organisation's internal CA instead.

Internal CA

• Your organisation's own Certificate Authority. In azure mode, trust and LTV are anchored on this internal CA chain (a PEM file you provide), not on the EU Trusted List.

Vignette

• The small visible stamp Cachet draws on the page in eID and Azure modes: the cardholder's photo (eID only), "Signed by:", the name and the date. It is the human-readable face of an otherwise invisible cryptographic signature. You choose its position by clicking on the page preview; without a click it goes bottom-right on the last page.

Template validation

• A safety check — before signing, every input PDF is compared to a model ("template") and must have the same page count and identical page sizes. This guarantees the signature lands in the right spot on every file in the batch. When some files have a DIFFERENT page count (e.g. scanned annexes were added), a first/last-page selector appears at the validation step and at the top of the placement step: every such file is then signed on its own first or last page — that page must still have exactly the template's page size, so the position you pick is guaranteed to fit.

B-LTA renewal

• B-LTA (the default level) adds an archival timestamp chain so the evidence stays provable for decades. "Renewal" means that, every few years, a fresh archive timestamp must be added before the previous one's protection weakens.