[media-types] [IANA #1446680] application/vnd.vertifil e.pvf registration request

Hi Darrel,

Sending a reminder for this request from March 19th.

thanks,
Amanda

On Thu Mar 19 01:53:48 2026, amanda.baber wrote:
> Hi Darrel,
> 
> Would you be able to review this new request for us by April 2nd?
> 
> thanks,
> Amanda
> 
> =====
> 
> Name: zur halfon
> 
> Email: [email protected]
> 
> Media type name: application
> 
> Media subtype name: vnd.vertifile.pvf
> 
> Required parameters: N/A.
> 
> Optional parameters: version - PVF format version identifier (default:
> "1.0")
> 
> Encoding considerations: binary
> 
> PVF files are UTF-8 encoded HTML documents. Lines may exceed 998
> octets due to base64-encoded document payloads embedded within the
> HTML body.
> 
> Security considerations: PVF files are self-contained HTML documents
> that include embedded JavaScript for document integrity verification.
> 
> (1) Active content: PVF files contain JavaScript that performs SHA-256
> hash computation and HMAC-SHA256 signature validation entirely client-
> side. The JavaScript is obfuscated to resist tampering. The embedded
> document payload is base64-encoded and is not independently
> executable. Viewers SHOULD render PVF files in a sandboxed environment
> (e.g., iframe with sandbox attribute or isolated browser context) to
> mitigate risks from malicious content injection.
> 
> (2) Privacy/Integrity: Yes. PVF files are designed specifically to
> provide integrity verification. Each file embeds a SHA-256 hash of the
> original document and an HMAC-SHA256 signature computed with a server-
> held secret. The issuing server operates under a blind processing
> model — it never reads or stores document content, only hashing raw
> bytes.
> 
> (3) Integrity is provided by the embedded cryptographic values (SHA-
> 256 hash and HMAC-SHA256 signature). Optional online verification
> against the issuing server provides additional assurance. Optional
> blockchain anchoring on the Polygon network provides immutable
> timestamping. For transport-level security, PVF files should be
> transmitted over TLS (HTTPS).
> 
> (4) PVF files use the HTML5 format (WHATWG HTML Living Standard) as a
> container. Security considerations from the HTML specification apply,
> particularly regarding script execution and resource loading. PVF
> files do not employ compression. The format does not use ZIP or other
> container formats.
> 
> (5) PVF files MAY contain a reference to the issuing server's
> verification API endpoint for optional online verification. Basic
> integrity verification works entirely offline without referencing any
> external links.
> 
> Interoperability considerations: PVF files are valid HTML5 documents
> and can be rendered by any modern web browser that supports JavaScript
> and the Web Crypto API (Chrome 37+, Firefox 34+, Safari 11+, Edge
> 79+). Browsers or viewers without JavaScript support will display the
> embedded document without interactive verification. The file begins
> with the magic bytes <!--PVF:1.0--> for reliable format identification
> independent of file extension. PVF files are UTF-8 encoded and use
> standard HTML5 markup, ensuring broad compatibility across platforms.
> 
> Published specification: https://github.com/zur2525-
> star/vertifile/blob/main/spec/PVF-FORMAT-SPEC-v1.0.md
> 
> Applications which use this media: PVF Viewer (desktop application for
> macOS and Windows), Vertifile web platform (https://vertifile.com),
> and any HTML5-capable web browser. The format is intended for tamper-
> proof document distribution in education, healthcare, government, and
> financial sectors.
> 
> Fragment identifier considerations: N/A.
> 
> Restrictions on usage: N/A.
> 
> Provisional registration? (standards tree only): No
> 
> Additional information:
> 
> 1. Deprecated alias names for this type: N/A.
> 2. Magic number(s): <!--PVF:1.0-->
> 3. File extension(s): .pvf
> 4. Macintosh file type code: N/A.
> 5. Object Identifiers: N/A.
> 
> General Comments: PVF (Protected Verified File) is a new document
> format for tamper-proof document protection with embedded
> cryptographic verification. A patent application has been filed for
> the underlying technology.
> 
> Person to contact for further information:
> 
> 1. Name: zur halfon
> 2. Email: [email protected]
> 
> Intended usage: COMMON
> 
> Author/Change controller: Zur Halfon

_______________________________________________
media-types mailing list -- [email protected]
To unsubscribe send an email to [email protected]