Create detached evidence with CAdES

Not all evidence is a PDF or JSON. Datasets, images, model weights, database exports, event records, ZIP archives, binaries — anything your system can hash deterministically can carry detached evidence. The universal format is CAdES (RFC 5126 on CMS): a compact, detached .p7s artifact that travels alongside the content and verifies against it, with standard tooling, forever.

The flow

Hash-only by default — the file never leaves your machine:

from sigill_sdk import SigillClient

client = SigillClient(api_key="sigill_...")

data = open("q2-dataset.parquet", "rb").read()
p7s = client.seal_cades(data, certificate_id=CERT_ID, label="q2-dataset.parquet")
open("q2-dataset.parquet.p7s", "wb").write(p7s)

# Later — verification is hash-only too:
result = client.verify_cades(data, p7s)
assert result.is_valid
print(result.signer, result.gen_time)   # who sealed it, and when (RFC 3161)

.NET: SealCadesAsync / VerifyCadesAsync, identical shape. Direct API: POST /seal/sign-hash with the SHA-256 digest — see the API reference.

The seal binds three things in one artifact: the exact bytes (integrity), your organisation's certificate (origin), and an embedded RFC 3161 timestamp (existence in time — qualified if you ask for it). When the certificate chain supports it, revocation evidence is embedded too (CAdES X-L), so the seal stays verifiable long after today's infrastructure is gone — see Evidence that outlives the infrastructure.

The pairing rule

Detached means verification always needs both the original file and the .p7s, and the file must be byte-identical to what was sealed. Store them together, treat the pair as immutable. If verification reports a hash mismatch, the first suspect is a re-exported or re-compressed file, not a broken seal.

Post-quantum, one flag

For material with a long horizon, pqc=True adds an ML-DSA-87 signer (NIST FIPS 204) alongside the classical one — a single .p7s, two independently verifiable signatures:

p7s = client.seal_cades(data, certificate_id=CERT_ID, pqc=True)

Choosing CAdES vs the other formats

• File is a PDF humans will open → embedded PAdES usually serves recipients better; a PDF can take a detached CAdES seal instead — that's also how a PDF gets post-quantum protection today.
• Content is JSON → JAdES speaks the ecosystem's language.
• Everything else → CAdES. The full decision rule: Choosing a seal format.

CAdES and JAdES sealing are available on Business and Scale plans. Verification — like all verification — is free for anyone.