[media-types] Re: [IANA #1446680] application/vnd.ve rtifile.pvf registration request

This registration looks good to register.

Darrel

________________________________
From: Sabrina Tanamal via RT <[email protected]>
Sent: Wednesday, April 08, 2026 17:56
Cc: [email protected] <[email protected]>; Darrel Miller <[email protected]>
Subject: [IANA #1446680] application/vnd.vertifile.pvf registration request

Hi Darrel,

The requester has provided additional information below.

Thanks,
Sabrina

====

While the request is with the reviewer, I wanted to provide a significant technical update regarding the PVF (Protected Vertifile Format) specification that may be of interest to the IESG-designated experts.

We have recently enhanced the PVF security model by adding Asymmetric Cryptographic Signing (Ed25519) alongside the existing HMAC-SHA256 validation.

This update allows for:

Independent Verification: Third parties can now verify document integrity using the issuer's public key (published via JWKS) without requiring access to server-side secrets or API calls.

Trust-Minimized Architecture: Further aligning with best practices for tamper-proof document distribution.

I have updated the published specification on GitHub to reflect these changes: https://github.com/zur2525-star/vertifile/blob/main/spec/PVF-FORMAT-SPEC-v1.0.md.

On Wed Apr 08 01:33:13 2026, amanda.baber wrote:
> Hi Darrel,
>
> Sending a reminder for this request from March 19th.
>
> thanks,
> Amanda
>
> On Thu Mar 19 01:53:48 2026, amanda.baber wrote:
> > Hi Darrel,
> >
> > Would you be able to review this new request for us by April 2nd?
> >
> > thanks,
> > Amanda
> >
> > =====
> >
> > Name: zur halfon
> >
> > Email: [email protected]
> >
> > Media type name: application
> >
> > Media subtype name: vnd.vertifile.pvf
> >
> > Required parameters: N/A.
> >
> > Optional parameters: version - PVF format version identifier (default:
> > "1.0")
> >
> > Encoding considerations: binary
> >
> > PVF files are UTF-8 encoded HTML documents. Lines may exceed 998
> > octets due to base64-encoded document payloads embedded within the
> > HTML body.
> >
> > Security considerations: PVF files are self-contained HTML documents
> > that include embedded JavaScript for document integrity verification.
> >
> > (1) Active content: PVF files contain JavaScript that performs SHA-256
> > hash computation and HMAC-SHA256 signature validation entirely client-
> > side. The JavaScript is obfuscated to resist tampering. The embedded
> > document payload is base64-encoded and is not independently
> > executable. Viewers SHOULD render PVF files in a sandboxed environment
> > (e.g., iframe with sandbox attribute or isolated browser context) to
> > mitigate risks from malicious content injection.
> >
> > (2) Privacy/Integrity: Yes. PVF files are designed specifically to
> > provide integrity verification. Each file embeds a SHA-256 hash of the
> > original document and an HMAC-SHA256 signature computed with a server-
> > held secret. The issuing server operates under a blind processing
> > model — it never reads or stores document content, only hashing raw
> > bytes.
> >
> > (3) Integrity is provided by the embedded cryptographic values (SHA-
> > 256 hash and HMAC-SHA256 signature). Optional online verification
> > against the issuing server provides additional assurance. Optional
> > blockchain anchoring on the Polygon network provides immutable
> > timestamping. For transport-level security, PVF files should be
> > transmitted over TLS (HTTPS).
> >
> > (4) PVF files use the HTML5 format (WHATWG HTML Living Standard) as a
> > container. Security considerations from the HTML specification apply,
> > particularly regarding script execution and resource loading. PVF
> > files do not employ compression. The format does not use ZIP or other
> > container formats.
> >
> > (5) PVF files MAY contain a reference to the issuing server's
> > verification API endpoint for optional online verification. Basic
> > integrity verification works entirely offline without referencing any
> > external links.
> >
> > Interoperability considerations: PVF files are valid HTML5 documents
> > and can be rendered by any modern web browser that supports JavaScript
> > and the Web Crypto API (Chrome 37+, Firefox 34+, Safari 11+, Edge
> > 79+). Browsers or viewers without JavaScript support will display the
> > embedded document without interactive verification. The file begins
> > with the magic bytes <!--PVF:1.0--> for reliable format identification
> > independent of file extension. PVF files are UTF-8 encoded and use
> > standard HTML5 markup, ensuring broad compatibility across platforms.
> >
> > Published specification: https://github.com/zur2525-
> > star/vertifile/blob/main/spec/PVF-FORMAT-SPEC-v1.0.md
> >
> > Applications which use this media: PVF Viewer (desktop application for
> > macOS and Windows), Vertifile web platform (https://vertifile.com),
> > and any HTML5-capable web browser. The format is intended for tamper-
> > proof document distribution in education, healthcare, government, and
> > financial sectors.
> >
> > Fragment identifier considerations: N/A.
> >
> > Restrictions on usage: N/A.
> >
> > Provisional registration? (standards tree only): No
> >
> > Additional information:
> >
> > 1. Deprecated alias names for this type: N/A.
> > 2. Magic number(s): <!--PVF:1.0-->
> > 3. File extension(s): .pvf
> > 4. Macintosh file type code: N/A.
> > 5. Object Identifiers: N/A.
> >
> > General Comments: PVF (Protected Verified File) is a new document
> > format for tamper-proof document protection with embedded
> > cryptographic verification. A patent application has been filed for
> > the underlying technology.
> >
> > Person to contact for further information:
> >
> > 1. Name: zur halfon
> > 2. Email: [email protected]
> >
> > Intended usage: COMMON
> >
> > Author/Change controller: Zur Halfon

_______________________________________________
media-types mailing list -- [email protected]
To unsubscribe send an email to [email protected]