> For the complete documentation index, see [llms.txt](https://docs.emudhradigital.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.emudhradigital.com/documentation/key-concepts-and-terminology.md).

# Key Concepts and Terminology

## Actors

| Term                                   | Definition                                                                                                                                                       |
| -------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Subscriber / eSign user**            | The individual who signs. Their identity is established through eKYC.                                                                                            |
| **ASP — Application Service Provider** | The organisation whose application requests the signature (a bank, insurer, portal, SaaS platform). The ASP is onboarded with an ESP under an ASP–ESP agreement. |
| **ESP — eSign Service Provider**       | A CCA-empanelled trusted third party that authenticates the user, generates keys, obtains the DSC from the CA and creates the signature. eMudhra is an ESP.      |
| **CA — Certifying Authority**          | A CA licensed by CCA that issues the DSC. eMudhra is a licensed CA.                                                                                              |
| **eKYC provider**                      | The source of verified identity — UIDAI for online Aadhaar eKYC, or the CA's own eKYC account system.                                                            |
| **CCA**                                | Controller of Certifying Authorities, Ministry of Electronics and IT — the regulator and Root CA of India (RCAI).                                                |
| **UIDAI**                              | Unique Identification Authority of India, operator of Aadhaar authentication and eKYC.                                                                           |

## Identity and authentication

| Term                             | Definition                                                                                                                 |
| -------------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| **eKYC**                         | Electronic Know-Your-Customer — verified demographic data (name, address, photo, etc.) returned after authentication.      |
| **Online Aadhaar eKYC**          | Real-time authentication against UIDAI. Used by eSign v2.                                                                  |
| **Offline Aadhaar eKYC**         | A UIDAI-signed Aadhaar XML downloaded by the resident and submitted to the CA to create an eKYC account. Used by eSign v3. |
| **AuthMode**                     | eSign v2 attribute that selects the Aadhaar authentication factor: 1 OTP, 2 fingerprint, 3 iris, 4 face.                   |
| **RD Service**                   | UIDAI *Registered Device* service — the certified driver/app that captures and encrypts biometrics on the device.          |
| **Single-factor / Multi-factor** | Assurance class of the eKYC authentication. OTP is single factor; fingerprint and iris are multi-factor.                   |
| **PIN / AuthPIN**                | Knowledge factor set by the subscriber for an eKYC account (v3) or for a remotely stored key (Remote Key Storage).         |
| **MAT**                          | Mobile Access Token — a device-bound second factor for eSign v3.                                                           |

## Cryptography and documents

| Term                          | Definition                                                                                                                      |
| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| **DSC**                       | Digital Signature Certificate (X.509) binding a public key to an identity.                                                      |
| **eKYC class certificate**    | The certificate class used for eSign. One-time eSign certificates are valid for ≤ 30 minutes.                                   |
| **HSM**                       | Hardware Security Module — tamper-resistant hardware in which keys are generated and used. ESP HSMs must be FIPS 140-3 Level 3. |
| **Document hash / InputHash** | SHA-256 digest of the document (hex encoded) that is sent for signing instead of the document.                                  |
| **responseSigType**           | Format of the returned signature: raw, PKCS7, PKCS7pdf, PKCS7complete.                                                          |
| **CMS / PKCS#7**              | Cryptographic Message Syntax — the container used to embed signatures in PDF and other formats.                                 |
| **PAdES / XAdES / CAdES**     | ETSI advanced signature formats for PDF, XML and CMS respectively.                                                              |
| **LTV**                       | Long-Term Validation — embedding chain, revocation data and timestamp so a signature can be verified years later.               |
| **Timestamp (TSA)**           | RFC 3161 token proving the signature existed at a point in time.                                                                |

## Transaction identifiers

| Term        | Definition                                                                                                                      |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------- |
| **txn**     | ASP-generated transaction ID, unique per ASP per day, echoed in all responses.                                                  |
| **resCode** | ESP-generated response code for the transaction. Store it in your audit trail; it is also carried in the DSC's pseudonym field. |
| **aspId**   | Identifier issued by eMudhra to the ASP at onboarding.                                                                          |