[media-types] Re: [IANA #1425698] application/vnd.g3 pix.g3fc registration request

Hi David,

Sorry for the delay. This is fine to register.

Best Regards,

Alexey

On 29/07/2025 01:21, David Dong via RT wrote:
> Hi Alexey,
>
> Would you be able to review this new media type request by August 11th?
>
> Thank you!
>
> Best regards,
>
> David Dong
> IANA Services Sr. Specialist
>
> On Mon Jul 28 02:42:23 2025, [email protected] wrote:
>> Name: Lucas Guimarães
>>
>> Email: [email protected]
>>
>> Media type name: application
>>
>> Media subtype name: vnd.g3pix.g3fc
>>
>> Required parameters: N/A
>>
>> Optional parameters: N/A
>>
>> Encoding considerations: binary
>>
>>
>>
>> Security considerations: This media type does not contain any active
>> or executable content. The G3FC format is a container for passive data
>> files and metadata only.
>>
>> The G3FC format provides optional, built-in services for
>> confidentiality and integrity through robust, password-based
>> encryption. When enabled, the file index and all data blocks are
>> encrypted using AES-256-GCM. The GCM mode is significant as it
>> provides both confidentiality (encryption) and authentication
>> (integrity checking via an authentication tag), protecting against
>> unauthorized access and modification of the archive's content. Keys
>> are derived from user-supplied passwords using PBKDF2 with HMAC-
>> SHA256, which mitigates dictionary and brute-force attacks. If the
>> native encryption is not used, these security services must be
>> provided by external means, such as by transporting the file over a
>> secure channel like TLS.
>>
>> Compression
>> The media type employs Zstandard compression. As with any format that
>> uses compression, G3FC files are susceptible to "compression bomb"
>> denial-of-service attacks, where a small file decompresses to an
>> extremely large size, potentially exhausting system memory or disk
>> space. Implementations that parse this format SHOULD mitigate this
>> risk by first checking the uncompressed_size field in the file's
>> metadata index and enforcing reasonable limits on resource allocation
>> before attempting decompression.
>>
>> Container Format
>> As a container format, G3FC stores internal file and directory paths.
>> A maliciously crafted archive could contain paths intended to
>> overwrite sensitive system files (e.g., a path traversal attack using
>> ../../..). Implementations MUST rigorously validate and sanitize all
>> path information from the file index before writing any data to the
>> local filesystem. File paths MUST be treated as relative to the
>> designated extraction directory, and any attempts to write outside of
>> this directory must be prevented.
>>
>> Password-Based Encryption Considerations
>> Password Strength: The security of an encrypted archive is entirely
>> dependent on the strength of the user's password. Implementations
>> SHOULD encourage or enforce strong password policies.
>>
>> KDF Iterations: The number of PBKDF2 iterations (kdf_iterations) is
>> critical for resisting brute-force attacks. The recommended value of
>> 100,000 is a baseline and SHOULD be increased over time as computing
>> power grows.
>>
>> Salt: The use of a unique, randomly generated salt for each archive is
>> crucial to prevent rainbow table attacks. The read_salt MUST be
>> cryptographically random.
>>
>> Interoperability considerations: This document specifies format
>> version 1.0.  All fields use little-endian byte order.
>>
>> Published specification:
>> https://g3pix.com.br/g3fc/g3fc_file_format_specification.txt
>> https://g3pix.com.br/g3fc/g3fc_file_format_specification.html
>> https://g3pix.com.br/g3fc/g3fc_file_format_specification.xml
>> https://github.com/guimaraeslucas/g3fc
>>
>> Applications which use this media: G3FC Archiver Tool and other
>> compatible archiving utilities.
>>
>> Fragment identifier considerations: N/A
>>
>> Restrictions on usage: None
>>
>> Provisional registration? (standards tree only): No
>>
>> Additional information:
>>
>> 1. Deprecated alias names for this type: N/A
>> 2. Magic number(s): The first 4 bytes are 0x47 0x33 0x46 0x43 (ASCII
>> "G3FC")
>> 3. File extension(s): .g3fc, .g3fc<n>
>> 4. Macintosh file type code: N/A
>> 5. Object Identifiers: N/A
>>
>> General Comments:
>>
>> Person to contact for further information:
>>
>> 1. Name: Lucas Guimarães
>> 2. Email: [email protected]
>>
>> Intended usage: COMMON
>>
>>
>>
>> Author/Change controller: G3Pix

_______________________________________________
media-types mailing list -- [email protected]
To unsubscribe send an email to [email protected]