Glossary

A quick reference for the vocabulary used across these docs, grounded in how Mudrit uses each term. Skim it once, then come back whenever a word looks unfamiliar. New to all of this? Start with What Is a Digital Signature? first.

A

AATL — the Adobe Approved Trust List, the set of certificate-authority roots that Adobe Acrobat / Reader trust out of the box. If your signing certificate chains up to an AATL root, Adobe shows a green check; otherwise it shows "validity unknown". Mudrit does not manage trust — that lives in the viewer.

AES-128 / AES-256 — the symmetric ciphers Mudrit uses to password-protect a signed output. AES-128 (AESV2, encryption V4) is the default; AES-256 (AESV3, V5, revision R6) is stronger. Pick one with Cipher. See Encryption.

Approval vs. Certifying signature — an approval (ordinary) signature attests to the document and still allows later signatures. A certifying signature must be the first one and declares what changes stay allowed afterwards (Certify::Locked / FormsAndSignatures / FormsSignaturesAndAnnotations). See Certifying.

B

ByteRange — the /ByteRange array in the signature dictionary records exactly which spans of the PDF the signature covers: everything except the /Contents placeholder that holds the signature itself. Computing it is why Mudrit reads the whole document into memory before signing.

C

CA (Certificate Authority) — an organisation that issues certificates and vouches for the identity named in them. Trust flows from a root CA, down through intermediate CAs, to your leaf (signing) certificate.

CAdES — CMS Advanced Electronic Signatures, the CMS signature profile that PAdES builds on. Selecting a PadesLevel switches the SubFilter to ETSI.CAdES.detached and adds the ESS signing-certificate-v2 signed attribute.

Certificate — a small file binding a public key to an identity (common name, organisation), itself signed by a CA so it can't be forged. Mudrit reads the leaf certificate as DER bytes from the Signer. See Certificates.

CMS / PKCS#7 — Cryptographic Message Syntax (formerly PKCS#7), the standard container that packages the signature value together with the signer's certificate(s). This is the "detached CMS" blob Mudrit writes into /Contents.

CRL — Certificate Revocation List, a CA-published list of certificates that have been revoked early. Mudrit fetches and embeds it in the DSS as part of LTV. See LTV.

/Contents — the placeholder byte-string in the signature dictionary where the CMS blob is written. It is the one region excluded from the ByteRange; its reserved size is set by SigSize.

D

Detached signature — a signature stored separately from the data it covers: the PDF's bytes stay intact and the CMS sits in /Contents. Mudrit uses SubFilter adbe.pkcs7.detached (legacy) or ETSI.CAdES.detached (PAdES).

Digest (SHA-256 / SHA-384 / SHA-512) — a fixed-size fingerprint (hash) of the signed bytes. The signer signs the digest, not the whole document. Which digest is used is bound to the SignatureAlgorithm variant you choose. See Algorithms.

DocMDP — Document Modification Detection and Prevention, the mechanism behind a certifying signature. Its /P level (1 = no changes, 2 = forms + signing, 3 = + annotations) declares what edits remain allowed. See Certifying.

DocTimeStamp — a standalone timestamp revision (SubFilter ETSI.RFC3161) that stamps the whole document — the archive stamp PAdES B-LTA adds. It is re-appliable to renew long-term validity. Produced by add_document_timestamp. See Document timestamps.

DSC — Digital Signature Certificate, the everyday term (especially in India) for the private key plus certificate a person signs with, usually held on a USB token. In Mudrit a DSC is reached through a Signer (typically the PKCS#11 or Windows-store backend).

DSS — Document Security Store, the PDF dictionary where Mudrit writes LTV material: the certificate chain, CRL responses, OCSP responses, and a /VRI entry. Viewers read it to validate a signature offline. See LTV.

E

ECDSA (P-256 / P-384 / P-521) — the Elliptic-Curve Digital Signature Algorithm, an alternative to RSA with smaller keys. Its signature is a DER SEQUENCE { r, s }. The curves P-256 / P-384 / P-521 pair with SHA-256 / SHA-384 / SHA-512. PfxSigner does all three in pure Rust; tokens and the Windows store do them if the device supports the curve. See Algorithms.

F

FieldMDP — a field lock that freezes specific form fields against change after signing (as opposed to DocMDP, which governs the whole document). Used by add_locked_signature.

H

HSM — Hardware Security Module, a device that stores keys and signs with them without ever exposing the private key. Mudrit has no built-in HSM backend, but you can reach one by implementing the Signer trait yourself. See Signing backends.

I

Incremental update / revision — appending changes to the end of a PDF instead of rewriting it, so earlier signatures stay valid. This is how Mudrit adds a second signature or a document timestamp to an already-signed file. See Signing flow.

K

KeyStore — Mudrit's Java-style discovery trait. It lists the KeyEntrys in a container (a .pfx, a PKCS#11 token, the Windows store), then hands back a Signer for a chosen alias. It sits one level above Signer. See KeyStore reference.

L

LTV — Long-Term Validation: embedding enough material (the certificate chain plus revocation info) into the document so a signature still validates after the certificate expires or the CA's servers go offline. Enabled with .ltv(true) or implied by PAdES B-LT / B-LTA. See LTV.

O

OCSP — Online Certificate Status Protocol, a live "is this certificate revoked right now?" check. The responder's answer is embedded in the DSS for LTV, as a companion or alternative to a CRL.

P

PAdES (B-B / B-T / B-LT / B-LTA) — PDF Advanced Electronic Signatures (ETSI EN 319 142), a set of cumulative baseline levels: B-B is the baseline, B-T adds a signature Timestamp, B-LT adds Long-Term validation material (DSS), and B-LTA adds an Archive document timestamp. See PAdES.

PDF/A — an ISO 19005 profile for archival PDFs. Mudrit can assert PDF/A-2B markers on the output (.pdfa(PdfaLevel::A2b)); it does not convert an arbitrary PDF, and it cannot be combined with output encryption. See PDF/A.

Permissions — access flags (print / copy / modify / annotate / …) enforced under the owner password of an encrypted output. Build them from Permissions::all() or Permissions::none(). See Encryption.

PFX / P12 — a PKCS#12 file (.pfx / .p12) holding a private key plus its certificate chain, unlocked with a password. The PfxSigner backend reads it. See Signing backends.

PKCS#11 — the standard C API for talking to crypto tokens and smart cards. The Pkcs11Signer backend loads a vendor module (a .dll / .so) and signs on the token. See PKCS#11 tokens.

Prelude — the prelude module each crate ships, which pulls the common API into scope with one use mudrit::prelude::*;. See Architecture.

R

RSA PKCS#1 v1.5 — the classic, deterministic RSA signature padding. It is Mudrit's default and what every Indian DSC uses today, available on every backend.

RSA-PSS — a randomised RSA padding scheme (RSASSA-PSS) using the same RSA key. PfxSigner always supports it; a token or the Windows store only if the device does — Mudrit self-verifies the result and fails loud rather than silently downgrading to PKCS#1. See Algorithms.

S

Seed value (/SV) — constraints a document author places on a signature field (a mandated digest, SubFilter, reason, TSA, or a requirement to embed LTV). Mudrit writes the /SV dictionary; enforcing it is the job of the consuming viewer or re-signer. See Seed values.

Signer (trait) — the single contract between the key layer and the PDF engine. A Signer exposes its certificate(), its chain(), and a sign(data) method. Implement it and any key source flows through the whole pipeline unchanged. See KeyStore reference.

SubFilter — the entry that names a signature's format. Mudrit writes adbe.pkcs7.detached (the legacy Adobe CMS format, the default) or ETSI.CAdES.detached (PAdES / CAdES, when you pick a PadesLevel). See Standards.

T

TSA / RFC-3161 — a Timestamp Authority is a trusted service that stamps a signature with a time per the RFC-3161 standard, proving the signature existed by then. Attach one with .timestamp(Timestamp::url(url)). See Timestamps.

Trust / validity icon — the dynamic overlay (a green check when trusted, a "?" otherwise) that a viewer draws on a layered ("Acro6") appearance. Mudrit builds the layered appearance (the trust_icon flag); the icon itself is chosen by the viewer based on whether it trusts the certificate.

V

VRI — Validation-Related Information, a DSS entry keyed to one specific signature that points to the validation material (chain, CRL, OCSP) for it. Mudrit writes a /VRI as part of LTV / PAdES B-LT.

W

Windows store (CSP/KSP) — the Windows "MY" certificate store, where Windows keeps user certificates and their keys (behind a CSP or KSP provider). The WinStoreSigner backend signs through it with a native Windows PIN prompt. See Signing backends.

Next