Skip to content
Cachet

Signature levels

PAdES b-b, b-t, b-lt and b-lta — what each level adds, and which ones need network access.

PAdES baseline levels, as defined by ETSI EN 319 142-1. Each builds on the one before it, and Cachet defaults to the strongest.

LevelAddsNetwork
b-bThe basic signature: who signed, and that nothing changed sinceNone — fully offline
b-tA trusted RFC 3161 timestamp, proving whenTimestamp authority
b-ltRevocation data and CA certificates embedded in the document (LTV)Timestamp authority, trusted list, OCSP/CRL
b-ltaDefaultAn archival timestamp chain, so the evidence itself keeps proving outTimestamp authority, trusted list, OCSP/CRL

PAdES LEVELS

PAdES levels (ETSI EN 319 142-1) describe how durable and verifiable your signature is. Each level builds on the one before it. Cachet uses b-lta by default and never silently drops to a lower level if the network fails.

  • B-B (basic)

    The core signature: it proves who signed and that the document has not changed. Works fully offline. Pick it only for quick internal drafts where long-term proof and a trusted time do not matter.

  • B-T (+ timestamp)

    Adds a trusted timestamp from a time-stamping authority (TSA), proving WHEN you signed. Needs network access. Pick it when the signing date must be provable but long-term archiving is not required.

  • B-LT (+ long-term validation)

    Embeds the revocation data (OCSP/CRL) and CA certificates inside the PDF (LTV). The signature stays verifiable even after the certificates expire. Needs network access. Pick it for documents you must keep and check years later.

  • B-LTA (+ archival, DEFAULT)

    Adds an archival timestamp chain so the proof itself survives for decades (the chain is renewed every few years). Needs network access. This is the default because it gives the strongest, longest-lasting guarantee for official records.

PAdES LEVELS, AT A GLANCE

  • B-B

    basic signature, fully offline.

  • B-T

    adds a trusted timestamp (network needed).

  • B-LT

    adds revocation info and CA certs (LTV).

  • B-LTA

    adds the archival timestamp chain (default).

Cachet never silently downgrades these levels. If the network is unavailable and the requested level cannot be reached, it tells you rather than quietly producing a weaker signature.