| Internet-Draft | STC and STP for SCITT | August 2026 |
| Somaratne | Expires 1 March 2027 | [Page] |
This document defines the Sovereign Tensor Container (STC-1.0) and Sovereign Tensor Provenance (STP-1.0) specifications. STC-1.0 establishes a strict 64-byte physical memory alignment standard for binary machine learning tensor payloads to enable zero-copy Direct Memory Access (DMA). STP-1.0 defines an embedded cryptographic provenance framework utilizing C2PA profiles, X.509 signature chains, and SCITT-compatible attestations to secure supply-chain integrity for distributed AI models.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 1 March 2027.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
The proliferation of large neural networks has exposed severe fragmentation in model distribution and supply-chain security. Existing container formats rely on out-of-band metadata files and arbitrary-length headers, which force unaligned memory access during host-to-device transfers and break cryptographic provenance chains upon redistribution.¶
This document proposes an architectural framework to secure the AI supply chain by embedding Supply Chain Integrity, Transparency, and Trust (SCITT) principles directly into the tensor payload container. The foundational architecture is published under Zenodo [STC-ZENODO].¶
To achieve true zero-copy Unified DMA, STC-1.0 dictates a hermetic binary container utilizing strict 64-byte physical cache-line alignment.¶
All metadata preceding the tensor payload MUST be dynamically padded. Runtimes MUST apply the following mathematical constraint to calculate the padding length (in bytes) before the payload initiates:¶
padding = (64 - (length (mod 64))) (mod 64)¶
This alignment ensures execution runtimes can mmap the artifact and dispatch it directly to the GPU without CPU byte-shifting.¶
The STP-1.0 specification defines a mandatory TRUST block within the STC header structure. This block acts as a cryptographic execution gate for inference engines.¶
The TRUST block MUST contain:¶
By embedding these cryptographic claims natively, the STC artifact functions as a self-contained Statement for a SCITT Transparency Service. Inference runtimes SHOULD verify the X.509 signatures and payload hash against a trusted SCITT ledger before allocating VRAM.¶
Traditional ML checksums are easily spoofed during man-in-the-middle redistribution, leading to weight poisoning. STP-1.0 mitigates this by mandating cryptographic signature verification at the engine level. A compromised private key could allow an attacker to sign a poisoned model; therefore, short-lived certificates and Time-Stamp Protocol (TSP) [RFC3161] integration are strongly recommended.¶
This document requests the registration of a new media type, application/vnd.stc, to identify Sovereign Tensor Container artifacts.¶