Long-Term Validation LTV

Long-term validation is a way of making a signed document carry its own proof. The certificates, the record of whether they had been revoked and one or more time stamps are stored inside the file at signing or soon after. A validator that opens the file ten years later then has everything it needs in front of it. It does not have to ask a provider's servers about a certificate that expired long ago.

The term comes from technical standards and from PDF software, where a signature may be described as "LTV enabled". The eIDAS Regulation does not use it. The regulation speaks of preservation instead. Article 3(16) lists the preservation of electronic signatures, seals and their certificates among the trust services, and Article 34 sets the rule for the qualified form. Long-term validation describes what is put in the file. Preservation describes the service that keeps that evidence current.

It matters for any document that has to outlive the certificate behind its signature. Certificates are issued for a limited period, and a lease, a shareholder loan or a share transfer may be questioned long after it has ended.

A signature stops being verifiable because the evidence around it has a shelf life. The signature itself does not change. Article 32(1) of eIDAS asks whether the certificate was qualified and valid at the time of signing, so a later validator has to reconstruct that moment. Three things get in the way.

The first is expiry. Every qualified certificate states the beginning and the end of its period of validity (Annex I, point (e)). Unless something proves that the signature was made before that date, a validator cannot tell a signature made in time from one made afterwards with an old key.

The second is revocation data. A certificate can be revoked before it expires, for example when a phone is lost. Under Article 28(4) it loses its validity from the moment of revocation, so the validator must learn what the certificate's status was at signing. Qualified providers have to keep status information available beyond the validity period of the certificate (Article 24(4)). Even so, an answer fetched years later depends on a live service that may have moved, changed or closed. An answer captured at signing and stored in the file depends on none of that.

The third is the algorithms. Signatures and hashes rest on mathematical problems that today's computers cannot solve in a useful time. As computing power and attack methods improve, older algorithms and shorter keys are retired. A signature made with a retired algorithm is no longer proof on its own, because by then a forger with enough resources could produce one that looks the same.

Four layers of evidence are embedded, each building on the one before. The main European signature formats are published by ETSI: PAdES for PDF files, XAdES for XML and CAdES for data of any kind. They share the same four baseline levels. The table shows what each level adds and what a later validator can prove with it.

The step that matters most is from the second level to the third. A signature that has a time stamp alone still sends the validator out to the provider for the certificate's status. Once the chain and the revocation data are inside the file, the document can be checked from its own contents. PDF software usually calls a signature at the third or fourth level "LTV enabled".

Which level a signing tool produces is a setting. It has nothing to do with the legal level of the signature. A qualified electronic signature can be produced at the first level, with nothing else embedded. It has the legal effect of a handwritten signature under Article 25(2) from the day it is made, yet it may be hard to validate a decade later.

Long-term validation keeps a signature verifiable for as long as the newest time stamp in the file can be trusted, and no longer. A time stamp is itself a signed statement. It rests on the time-stamp provider's certificate, which has an end date, and on algorithms that will age like any others. Embedding the evidence buys time.

The answer is renewal. Before the latest time stamp's certificate expires or its algorithm is withdrawn, a new time stamp is placed over the whole file, including the earlier stamps and the data needed to check them. The new stamp uses current algorithms and a fresh certificate. The step can be repeated, and each round extends the period over which the original signature can be shown to be sound.

Renewal does not happen by itself. A PDF resting in a document management system will not add its own time stamp. Somebody has to own the task: the signing platform, the archive system or a preservation service. If a renewal is missed and the last time stamp ages out, the chain of proof has a gap that cannot be repaired afterwards. The document is not void. The firm is back to proving the signature by other means, such as correspondence or payment records.

The period to plan for is the retention period of the document. That comes from national law, from sector rules or from the contract itself. Find the period for each kind of document the firm keeps, then compare it with the lifetime of the time stamps in its signed files.

eIDAS deals with long-term validation through the qualified preservation service. Under Article 34(1), such a service may only be provided by a qualified trust service provider that uses procedures and technologies capable of extending the trustworthiness of the qualified electronic signature beyond the technological validity period. That phrase names the point at which certificates and algorithms no longer carry the proof.

The regulation does not prescribe the technique. Article 34(2) gave the Commission until 21 May 2025 to list reference standards for qualified preservation services in implementing acts. Under Article 34(1a), a service that complies with those standards is presumed to meet the requirement. Article 40 applies the same rules to qualified electronic seals. Under Article 24a(5), a qualified preservation service provided in one member state is recognised as one in all the others.

Time stamps do the work underneath. A qualified electronic time stamp carries a presumption that its date and time are accurate and that the data it covers is intact (Article 41(2)). It must rest on a time source linked to Coordinated Universal Time and be signed or sealed by the qualified provider, or protected by an equivalent method (Article 42(1)). When the time stamps inside a signed file are qualified, each layer of evidence starts from that presumption.

Nothing in eIDAS obliges a signer or a firm to use long-term validation or a preservation service. Providers that hold qualified status for preservation are shown in the EU Trusted List browser, beside the providers of certificates and time stamps.

Long-term validation protects the proof of a signature. Electronic archiving protects the document. The 2024 amendment to eIDAS added archiving as a trust service of its own. Article 3(48) defines it as a service ensuring the receipt, storage, retrieval and deletion of electronic data and electronic documents, in order to ensure their durability and legibility and to preserve their integrity, confidentiality and proof of origin throughout the preservation period.

The difference shows in three places. Archiving covers any document, signed or not. It is also concerned with whether the file can still be opened and read. Article 45j(1) requires a qualified archive to keep documents durable and legible beyond the technological validity period, at least for the legal or contractual preservation period, and to safeguard them against loss and alteration, except for changes to their medium or electronic format. A signature embedded in a file does not survive that kind of conversion, because it is tied to the exact content of the original. The third difference is the legal effect. Under Article 45i(2), data and documents preserved in a qualified electronic archiving service enjoy a presumption of their integrity and of their origin for the duration of the preservation period.

A firm that keeps signed originals in an ordinary document store relies on the evidence embedded in each file. A firm that uses a qualified archive has the archive's presumption for the document. As an authorised relying party it can receive a report bearing the provider's qualified electronic signature or seal, confirming that a retrieved document is covered by it.

A firm should check three things: what its own signing tool embeds, what arrives from other parties, and who renews the evidence.

For documents the firm sends out for signature, ask the provider which baseline level its signatures reach and whether its time stamps are qualified. The answer can be tested. Run a signed file through a validator such as the European Commission signature validator and read the report, which names the signature format and lists the time stamps and revocation data it found.

For documents the firm receives, validate on receipt. A file may arrive with a bare signature and nothing embedded. On that day the certificate's status is still easy to obtain. That is the moment to add the missing evidence, where the firm's software can do so, or at least to save the validation report with the file. A report dated on the day of receipt is far better evidence than an inconclusive check made years later.

For documents that must be kept for many years, decide who renews the time stamps and write it down. Then keep the original electronic file. A printout or a scan of a signed PDF shows a picture of the signature and holds none of the cryptographic evidence, so nothing on it can be validated.