CAdES (CMS Advanced Electronic Signature)

CAdES wraps a signed document inside a binary container based on the CMS syntax.

Definition

CAdES (CMS Advanced Electronic Signature) is an advanced electronic signature profile built on the Cryptographic Message Syntax (CMS), the successor to PKCS#7.

Unlike XAdES, which signs XML, CAdES signs arbitrary data (binary or text) and produces a signed container that encapsulates both the document and the signature.

How it works

The output is usually a file with the .p7m extension (sometimes .p7s for a detached signature) containing the original document, the signature and the associated certificates.

Like XAdES, CAdES offers increasing levels — B, T (timestamp), LT and LTA — to support long-term validation regardless of certificate expiry.

Example

In Italy, electronic invoices flowing through the SDI system were long signed in CAdES format, producing a FatturaPA file wrapped in a .p7m container.

CAdES is preferred when a non-XML file must be signed — for example a PDF, an archive or a batch of aggregated documents.