ades-rs 0.2.0

AdES digital signatures (CAdES, PAdES, XAdES, JAdES) for the eIDAS 2.0 ecosystem
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64

# ades

[![CI](https://github.com/lfern/eidas-rs/actions/workflows/ci.yml/badge.svg)](https://github.com/lfern/eidas-rs/actions/workflows/ci.yml)
[![crates.io](https://img.shields.io/crates/v/ades-rs.svg)](https://crates.io/crates/ades-rs)
[![docs.rs](https://docs.rs/ades-rs/badge.svg)](https://docs.rs/ades-rs)
[![License: MIT OR Apache-2.0](https://img.shields.io/badge/license-MIT%20OR%20Apache--2.0-blue.svg)](https://github.com/lfern/eidas-rs)

AdES digital signatures (CAdES, PAdES, XAdES, JAdES) for the eIDAS 2.0 ecosystem, written in pure Rust.

All signature formats are validated by the [EU DSS validator](https://dss.nowina.lu/validation).

## Supported formats

| Format | B-B | B-T | B-LT |
|--------|-----|-----|------|
| CAdES  | ✅  | ✅  | ✅   |
| PAdES  | ✅  | ✅  | ✅   |
| XAdES  | ✅  | ✅  | ✅   |
| JAdES  | ✅  | ✅  | ✅   |

- **B-B** — baseline signature with embedded certificate
- **B-T** — adds an RFC 3161 timestamp from a TSA
- **B-LT** — adds OCSP revocation data

## Quick start

```toml
[dependencies]
ades-rs = "0.1"
```

```rust
use ades::{cades, signer::SoftSigner};

let signer = SoftSigner::generate(2048)?;
let data = b"hello world";
let signature = cades::sign(data, &signer)?;
```

## Features

| Feature  | Default | Description |
|----------|---------|-------------|
| `cades`  | ✅      | CAdES signatures (CMS/PKCS#7) |
| `pades`  | ✅      | PAdES signatures (PDF) |
| `soft`   | ✅      | Software RSA/ECDSA key generation for testing |
| `xades`  |         | XAdES signatures (XML) |
| `jades`  |         | JAdES signatures (JSON/JWS) |
| `tsp`    |         | RFC 3161 timestamp client (B-T, B-LT levels) |
| `ocsp`   |         | RFC 6960 OCSP client (B-LT level) |
| `pkcs11` |         | PKCS#11 backend for hardware tokens (DNIe, HSM) |

## Signing backends

The `Signer` trait abstracts the private key:

- **`soft`** — `SoftSigner`: RSA/ECDSA keys in memory (testing)
- **`pkcs11`** — `Pkcs11Signer`: hardware tokens via PKCS#11 (DNIe, HSM)

The private key never leaves the device.

## License

Licensed under either of [MIT](LICENSE-MIT) or [Apache-2.0](LICENSE-APACHE) at your option.