The terms you come across in CEI One and in this guide, in alphabetical order, briefly explained. Where it helps, the Romanian term is shown in parentheses.
A–C
App lock (blocarea aplicației)
An option that asks for Face ID, Touch ID, Optic ID, your passcode or your Mac password when CEI One starts and when you come back to the app. It’s off by default. See App lock and remembered CAN.
Automatic verification (verificare automată)
The verification your iPhone runs on its own for the documents in Local history, offline, using only the data in the document. For a full online verification, choose Verify again.
ByteRange
The part of the PDF file covered by a signature. The app uses it to work out which revision of the document was signed and what was added afterwards.
CAN
The 6-digit number printed on the front of your eID, right under the expiry date. The app uses it to set up a secure connection with the chip, before any PIN. See CAN and PIN codes.
Card reader (cititor de carduri)
The device your Mac uses to read your eID. CEI One needs a contact USB CCID reader recognized by macOS. USB CCID support is included, so you don’t need to install anything. See Card readers on Mac.
Certificate (certificat)
The electronic file on your eID that links your identity to the signing key. A signed PDF contains the signing certificate, including the cardholder’s name.
D–L
Data PIN (PIN-ul pentru date)
The 4-digit code, received separately when you collected your eID, that you use to authorize reading the data on the card. It isn’t printed on the eID and is never saved by the app.
eID (CEI)
The Romanian electronic identity card (cartea electronică de identitate). In the Romanian version of the app, it’s also called “actul” or “cartea de identitate”.
Electronic signature (semnătură electronică)
The cryptographic signature made with the certificate and the private key on your eID, authorized with the signing PIN. The private key stays on the eID.
Fingerprint (amprentă: SHA-256, hash)
A short code calculated from the content of a file or a signature. If a single bit changes, the fingerprint changes. When you sign, the timestamp authority receives only the signature’s fingerprint.
On Mac, in Documents, you can copy a document’s SHA-256 fingerprint.
Handwritten signature (semnătură olografă)
Your signature by hand. It can be the image of the signature stored on your eID, which you can use in the mark, or a signature drawn on a scanned document, in Scan. A drawn signature isn’t an electronic signature.
Identity report (raport de identitate)
The PDF with the data and photo read from your eID, which you create after reading it. It isn’t saved automatically, isn’t synced to iCloud, and says nothing about the authenticity of the data.
Issuer (emitent)
The authority that issued the certificate. In the verification report, the Certificate issuer can be a known qualified issuer (MAI or certSIGN), an issuer recognized by the system, or an issuer that isn’t confirmed.
Keychain
The protected Apple system storage where apps keep sensitive data. CEI One keeps the remembered CAN there, only on that device.
Local history and Documents (Istoric local, Documente)
The app’s document library. On iPhone it’s called Local history, and on Mac Documents. It’s kept on the device and syncs to iCloud only if you turn on sync.
M–P
Mark (marcaj)
The visible part of the signature on the PDF page: the signer’s name or handwritten signature, the date and the text “Digitally signed with CEI” (the on-screen preview says “Digitally signed with eID”). The mark only shows the signature. The actual signature is the cryptographic one.
NFC
The contactless technology your iPhone uses to read the eID chip from a few centimeters away. On Mac, your eID is read with a card reader, not over NFC.
PAdES-LT
The long-term PDF signature format. CEI One includes the validation evidence (certificates and revocation lists) in every signed PDF, so the signature can still be verified later. Without this evidence, the signature isn’t saved.
Passcode (cod de acces)
The code you use to unlock your iPhone. You can use it instead of Face ID or Touch ID for app lock and for the remembered CAN.
Passive authentication (autentificare pasivă)
The check done every time your eID is read: the data, photo and handwritten signature are compared with the fingerprints the issuer signed on the card (EF.SOD). The issuer’s signature is verified on your device, without internet access, using Romania’s CSCA certificates included in the app.
Practice document (document de exercițiu)
An already signed PDF, included in the iPhone app and shown in Local history. You use it to see what a verification report looks like without signing anything.
Private iCloud (iCloud privat)
The optional syncing of your library with the private CloudKit database of your Apple Account. It’s off by default. See iCloud sync.
Proof of address (dovadă de domiciliu)
The PDF created from the data and address read from your eID, in Proof of address. It isn’t saved automatically and is never synced to iCloud.
R–Z
Remembered CAN (CAN memorat)
A card’s CAN that you choose to keep in the Keychain, only on that iPhone or Mac, so you don’t have to type it again. It’s read only after Face ID, Touch ID, Optic ID, your passcode or your Mac password, and it’s deleted automatically if the eID rejects it twice in a row.
Review (atenționare)
The status of a signature that has an unconfirmed check, a change detected after signing, or a missing item. The signature isn’t necessarily wrong, but it’s worth reading the explanation. See Signature verification results.
Revision (revizie)
A saved version of a PDF. Each signature adds a new revision without changing the earlier ones. Revision history shows what was added after a signature.
Revocation (OCSP/CRL) (revocare)
The check that a certificate hasn’t been canceled by its issuer. It’s done with certificate revocation lists (CRLs) or OCSP responses, downloaded from the authorities named in the certificate.
Signing PIN (PIN-ul de semnare)
The 6-digit code you use to authorize each electronic signature. After 5 incorrect attempts, it’s blocked.
Timestamp (marcă temporală)
Proof, issued by a time authority, that the signature existed at a given moment. In the Romanian version of the app it often appears as “Timestamp”. CEI One requests it from DigiCert and, only if DigiCert doesn’t respond, from GlobalSign and then Sectigo.
Trust chain (lanț de încredere)
The sequence of certificates from the signer’s certificate up to a recognized root authority. It’s one of the checks in the verification report.
USB CCID
The standard that lets a USB card reader work on a Mac without a separate driver. CEI One needs a contact reader that supports USB CCID. See Card readers on Mac.
Verdict
The overall result of verifying a PDF: Valid document, Valid with warnings, Invalid document, Inconclusive result or Unsigned document. On Mac, the result appears with equivalent titles. See Signature verification results.
Verification report (raport de verificare)
The result of verifying a signed PDF: the overall verdict, each signature and each check. You can save it as a PDF with Export report.