[media-types] [IANA #1425698] application/vnd.g3pix. g3fc registration request

Hi Alexey,

Would you be able to review this new media type request by August 11th?

Thank you!

Best regards,

David Dong
IANA Services Sr. Specialist

On Mon Jul 28 02:42:23 2025, [email protected] wrote:
> 
> Name: Lucas Guimarães
> 
> Email: [email protected]
> 
> Media type name: application
> 
> Media subtype name: vnd.g3pix.g3fc
> 
> Required parameters: N/A
> 
> Optional parameters: N/A
> 
> Encoding considerations: binary
> 
> 
> 
> Security considerations: This media type does not contain any active
> or executable content. The G3FC format is a container for passive data
> files and metadata only.
> 
> The G3FC format provides optional, built-in services for
> confidentiality and integrity through robust, password-based
> encryption. When enabled, the file index and all data blocks are
> encrypted using AES-256-GCM. The GCM mode is significant as it
> provides both confidentiality (encryption) and authentication
> (integrity checking via an authentication tag), protecting against
> unauthorized access and modification of the archive's content. Keys
> are derived from user-supplied passwords using PBKDF2 with HMAC-
> SHA256, which mitigates dictionary and brute-force attacks. If the
> native encryption is not used, these security services must be
> provided by external means, such as by transporting the file over a
> secure channel like TLS.
> 
> Compression
> The media type employs Zstandard compression. As with any format that
> uses compression, G3FC files are susceptible to "compression bomb"
> denial-of-service attacks, where a small file decompresses to an
> extremely large size, potentially exhausting system memory or disk
> space. Implementations that parse this format SHOULD mitigate this
> risk by first checking the uncompressed_size field in the file's
> metadata index and enforcing reasonable limits on resource allocation
> before attempting decompression.
> 
> Container Format
> As a container format, G3FC stores internal file and directory paths.
> A maliciously crafted archive could contain paths intended to
> overwrite sensitive system files (e.g., a path traversal attack using
> ../../..). Implementations MUST rigorously validate and sanitize all
> path information from the file index before writing any data to the
> local filesystem. File paths MUST be treated as relative to the
> designated extraction directory, and any attempts to write outside of
> this directory must be prevented.
> 
> Password-Based Encryption Considerations
> Password Strength: The security of an encrypted archive is entirely
> dependent on the strength of the user's password. Implementations
> SHOULD encourage or enforce strong password policies.
> 
> KDF Iterations: The number of PBKDF2 iterations (kdf_iterations) is
> critical for resisting brute-force attacks. The recommended value of
> 100,000 is a baseline and SHOULD be increased over time as computing
> power grows.
> 
> Salt: The use of a unique, randomly generated salt for each archive is
> crucial to prevent rainbow table attacks. The read_salt MUST be
> cryptographically random.
> 
> Interoperability considerations: This document specifies format
> version 1.0.  All fields use little-endian byte order.
> 
> Published specification:
> https://g3pix.com.br/g3fc/g3fc_file_format_specification.txt
> https://g3pix.com.br/g3fc/g3fc_file_format_specification.html
> https://g3pix.com.br/g3fc/g3fc_file_format_specification.xml
> https://github.com/guimaraeslucas/g3fc
> 
> Applications which use this media: G3FC Archiver Tool and other
> compatible archiving utilities.
> 
> Fragment identifier considerations: N/A
> 
> Restrictions on usage: None
> 
> Provisional registration? (standards tree only): No
> 
> Additional information:
> 
> 1. Deprecated alias names for this type: N/A
> 2. Magic number(s): The first 4 bytes are 0x47 0x33 0x46 0x43 (ASCII
> "G3FC")
> 3. File extension(s): .g3fc, .g3fc<n>
> 4. Macintosh file type code: N/A
> 5. Object Identifiers: N/A
> 
> General Comments:
> 
> Person to contact for further information:
> 
> 1. Name: Lucas Guimarães
> 2. Email: [email protected]
> 
> Intended usage: COMMON
> 
> 
> 
> Author/Change controller: G3Pix

_______________________________________________
media-types mailing list -- [email protected]
To unsubscribe send an email to [email protected]