> For the complete documentation index, see [llms.txt](https://docs.emudhradigital.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.emudhradigital.com/documentation/esign-v2-online-aadhaar-ekyc/signing-flow.md).

# Signing Flow

This page describes the end-to-end eSign v2 transaction as defined in CCA eSign API 2.1.

## Sequence

| #  | Actor           | Step                                                                                                                                         |
| -- | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| 1  | ASP             | Signer chooses to sign a document in the ASP application.                                                                                    |
| 2  | ASP             | ASP shows the document and obtains the signer's consent.                                                                                     |
| 3  | ASP             | ASP computes the SHA-256 hash of the document (hex). For PDFs, the hash is computed over the byte range of a prepared signature placeholder. |
| 4  | ASP             | ASP builds the `<Esign>` request XML and signs it with its ASP certificate (W3C XML-DSig).                                                   |
| 5  | ASP → eMudhra   | The request is submitted (browser POST, app hand-off or SDK).                                                                                |
| 6  | eMudhra         | Validates `aspId`, XML signature, timestamp (±30 min) and uniqueness of `txn`; logs the transaction.                                         |
| 7  | eMudhra         | Displays `docInfo` and consent; captures Aadhaar number and OTP/biometric/face.                                                              |
| 8  | eMudhra ↔ UIDAI | Performs Aadhaar authentication and obtains eKYC. If `ekycId` (UID token) was supplied, it must match.                                       |
| 9  | eMudhra         | Generates a one-time key pair in the HSM and a CSR containing the eKYC name.                                                                 |
| 10 | eMudhra CA      | Issues an eKYC class DSC (validity ≤ 30 min); pseudonym carries the response code.                                                           |
| 11 | eMudhra         | Signs the document hash; destroys the private key.                                                                                           |
| 12 | eMudhra → ASP   | Returns the signed `<EsignResp>` to `responseUrl`.                                                                                           |
| 13 | ASP             | Verifies the ESP signature, extracts the signature and certificate, embeds them in the document, stores `txn` and `resCode`.                 |

## Signing a PDF (PKCS7pdf)

1. Prepare the PDF with an empty signature field and a reserved `/Contents` placeholder (e.g., 16–32 KB).
2. Compute SHA-256 over the `/ByteRange` (everything except the placeholder).
3. Request `responseSigType="PKCS7pdf"`.
4. Insert the returned CMS (which includes the chain up to the root, OCSP/CRL and a CA timestamp) into `/Contents`.

The resulting signature is LTV-enabled and validates in Adobe Acrobat via the AATL.

## Timeouts

* Request timestamp tolerance: **±30 minutes** from eMudhra server time (IST).
* eMudhra authentication pages expire after a period of inactivity (`ESP-946`).
* The one-time DSC is valid for at most **30 minutes**, so the signature must be embedded promptly; timestamps in PKCS7pdf preserve validity afterwards.