QES vs AES vs SES: European eIDAS E-Signature Standards (2026)

import * as crypto from "crypto";
import * as fs from "fs";

interface AuditCertificatePayload {
  documentId: string;
  expectedSha256Hash: string;
  senderEmail: string;
  recipientEmail: string;
  signedTimestampUtc: string;
  signingMethod: "SES" | "AES" | "QES";
}

/**
 * Validates the cryptographic integrity of a signed document against its audit certificate.
 * @param pdfFilePath - Absolute or relative path to the signed PDF artifact
 * @param certificate - The recorded audit trail manifest metadata
 */
export function verifyDocumentCertificate(
  pdfFilePath: string,
  certificate: AuditCertificatePayload
): { isValid: boolean; computedHash: string; message: string } {
  if (!fs.existsSync(pdfFilePath)) {
    throw new Error(`Contract file not found at path: ${pdfFilePath}`);
  }

  // 1. Read the exact binary buffer of the signed document
  const fileBuffer = fs.readFileSync(pdfFilePath);

  // 2. Compute the cryptographic SHA-256 digest
  const hashSum = crypto.createHash("sha256");
  hashSum.update(fileBuffer);
  const computedHash = hashSum.digest("hex");

  // 3. Perform constant-time string comparison to prevent timing attacks
  const expectedHashBuffer = Buffer.from(certificate.expectedSha256Hash, "hex");
  const computedHashBuffer = Buffer.from(computedHash, "hex");

  const isMatch =
    expectedHashBuffer.length === computedHashBuffer.length &&
    crypto.timingSafeEqual(expectedHashBuffer, computedHashBuffer);

  if (isMatch) {
    return {
      isValid: true,
      computedHash,
      message: `[PASS] Document ${certificate.documentId} verified under tier ${certificate.signingMethod}. Zero tampering detected.`,
    };
  } else {
    return {
      isValid: false,
      computedHash,
      message: `[FAIL] Hash mismatch! Expected ${certificate.expectedSha256Hash}, computed ${computedHash}. Document altered!`,
    };
  }
}

// Example Execution
const sampleAuditRecord: AuditCertificatePayload = {
  documentId: "doc_eu_98432a10",
  expectedSha256Hash: "a7f3b9c2e4d1059f88c346123491bce987019234857102934857109238475019",
  senderEmail: "legal@enterprise.de",
  recipientEmail: "cto@vendor.eu",
  signedTimestampUtc: "2026-08-19T14:32:00Z",
  signingMethod: "SES",
};

// const result = verifyDocumentCertificate("./signed_contract.pdf", sampleAuditRecord);
// console.log(result.message);

import hashlib
import hmac
import os
from typing import Dict, Any, Tuple

def verify_contract_sha256(
    file_path: str,
    expected_hash: str,
    audit_metadata: Dict[str, Any]
) -> Tuple[bool, str, Dict[str, Any]]:
    """
    Verifies the cryptographic SHA-256 certificate hash of an eIDAS-compliant PDF.
    
    :param file_path: Path to the signed PDF artifact.
    :param expected_hash: The hex SHA-256 hash recorded in the audit certificate.
    :param audit_metadata: Dictionary containing signer identifiers and timestamps.
    :return: (is_valid, computed_hex_hash, audit_report)
    """
    if not os.path.exists(file_path):
        raise FileNotFoundError(f"Target PDF file does not exist: {file_path}")

    sha256_hasher = hashlib.sha256()
    
    # Read in 64KB chunks to optimize memory for large enterprise contracts
    with open(file_path, "rb") as pdf_file:
        while chunk := pdf_file.read(65536):
            sha256_hasher.update(chunk)

    computed_hash = sha256_hasher.hexdigest().lower()
    expected_normalized = expected_hash.strip().lower()

    # Constant-time comparison to prevent side-channel timing analysis
    is_tamper_free = hmac.compare_digest(computed_hash, expected_normalized)

    report = {
        "document_id": audit_metadata.get("document_id"),
        "tier": audit_metadata.get("tier", "SES"),
        "signers": audit_metadata.get("signers", []),
        "timestamp_utc": audit_metadata.get("timestamp_utc"),
        "status": "VALID_TAMPER_FREE" if is_tamper_free else "INTEGRITY_VIOLATION"
    }

    return is_tamper_free, computed_hash, report

if __name__ == "__main__":
    audit_manifest = {
        "document_id": "doc_991823-eu",
        "tier": "AES",
        "signers": ["alice@signbee.com", "bob@corporation.com"],
        "timestamp_utc": "2026-08-19T17:00:00Z"
    }
    
    # Demonstration check
    print("Python cryptographic audit verifier initialized.")