If you have any concerns or questions, please contact us
We will answer your questions, find a date that suits you and an advisor in Gdansk, Gdynia, Krakow, Warsaw or Wroclaw.
You can also write an email from us [email protected].
We earlier post We discussed the two basic formats of electronic signatures— XAdES and PAdES – most commonly used for qualified electronic signatures. Continuing on this topic, we will now address another important issue: internal and external signatures.
Whether an electronic signature is embedded in a file or saved as a separate file is of great practical importance - especially when signing a large files or working with complex data communications systems.
In this article, we explain what qualified internal and external signatures are and what they mean in the context of various formats (PAdES, XAdES, CAdES). We'll outline their main pros and cons, and suggest when it's best to use each of these solutions.
Internal signature is one that is incorporated directly into the document being signed. To put it simply: when you sign a file with an internal signature, you get a single file containing both the content of the document and the signature information (certificate, timestamp, etc.). The internal signature type is available in standards, among others PAdES and XAdES - both allow you to embed the e-signature inside the file being signed. For example, the PAdES signature always saves the signature together with the PDF in a single file, while XAdES can embed the signature as an element in the XML structure of the original document.
External signature while it is a separate file - after signing the document, you get two (or more) files: the original document and a separate file with the digital signature. This external file (e.g., with an extension of .xades or .sig) contains cryptographic data confirming the signature, but does not contain the contents of the original document. Such qualified external signatures can be created in XAdES or CAdES formats. In practice, this means that to verify the signature and content, the recipient must have both parts - the document and the signature file. The absence of either will make it impossible to verify the authenticity of the signature and the contents of the document.
Difference between internal and external signatures boils down to how the signature is placed - either inside the signed file or as a separate companion file.
However, it is important to emphasize that In legal terms, both types are equivalent. Both qualified internal and external signatures meet the requirements of the regulation eIDAS and are considered legally binding. The choice of signature type therefore mainly affects technical and practical considerations—such as the ease of storing, verifying, or transmitting documents—rather than the legal validity of the e-signature itself.
Both types of signatures support add-ons like timestamps, signature policy, etc., increasing long-term security.
PAdES (PDF Advanced Electronic Signature) is a qualified signature format designed for for PDF files only. In this standard, the electronic signature (and the signer's certificate) becomes embedded into a PDF structure - it becomes an integral part of the document. This puts everything needed for verification in a single file that can be opened in popular programs like Adobe Reader. What's more, PAdES makes it possible to add a visual representation of the signature on the document page (e.g., a graphic seal or signature information), which increases readability and makes the e-signature more similar to a handwritten signature on paper.
XAdES (XML Advanced Electronic Signature) is a universal electronic signature format based on the XML standard. Its zbutta is flexibility - With XAdES you can sign virtually any type of file: from text documents (DOCX, ODT), to PDF, images (JPEG, PNG), spreadsheets, ZIP files, to binary or XML data. In the case of structured data (XML), XAdES is even preferred because it allows computer systems to both verify the signature and automatically parse the contents of the document. For this reason, XAdES is sometimes required for electronic submission of forms and applications to institutions (e.g., PIT tax returns, Social Security applications), where data from the document is to be loaded into the computer system.
XAdES offers both internal and external signature modes. If you are signing an XML file, the XAdES signature can be embedded as an element inside that file (internal/external signature). On the other hand, for other file types (e.g., PDF, DOCX, JPG), an external XAdES signature is usually used - the signing will result in the original file plus a separate .xades file containing the signature. This separation causes some inconveniences: when signing, for example, a PDF in XAdES format, you must always provide the recipient with two files and make sure it verifies the signature along with the document. Omitting the signature file or incorrectly associating it with the document will result in the signature not being considered valid. It is true that it is possible to create a single .xades file containing both the signature and the encoded content (e.g., a PDF in binary form) - this is known as a surrounding signature - but such a file is not directly readable by the user (you have to extract the original document from it first), so it is not very convenient in practice.
Continued - In the second part of this article, we will discuss the format CAdES As well as practical tips for choosing the type of signature.
You are welcome!
If you have any concerns or questions, please contact us
We will answer your questions, find a date that suits you and an advisor in Gdansk, Gdynia, Krakow, Warsaw or Wroclaw.
You can also write an email from us [email protected].
