SCITT Working Group C. Somaratne Internet-Draft Sovereign Stack Global Intended status: Informational 28 August 2026 Expires: 1 March 2027 Sovereign Tensor Container (STC) and Provenance (STP) Specifications draft-somaratne-scitt-stc-stp-00 Abstract This document defines the Sovereign Tensor Container (STC-1.0) and Sovereign Tensor Provenance (STP-1.0) specifications. STC-1.0 establishes a strict 64-byte physical memory alignment standard for binary machine learning tensor payloads to enable zero-copy Direct Memory Access (DMA). STP-1.0 defines an embedded cryptographic provenance framework utilizing C2PA profiles, X.509 signature chains, and SCITT-compatible attestations to secure supply-chain integrity for distributed AI models. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 1 March 2027. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. Somaratne Expires 1 March 2027 [Page 1] Internet-Draft STC and STP for SCITT August 2026 This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. STC-1.0: Memory Alignment Architecture . . . . . . . . . . . 2 3. STP-1.0: Cryptographic Provenance (TRUST Block) . . . . . . . 3 3.1. C2PA and X.509 Integration . . . . . . . . . . . . . . . 3 3.2. SCITT Attestation . . . . . . . . . . . . . . . . . . . . 3 4. Security Considerations . . . . . . . . . . . . . . . . . . . 3 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 3 6. References . . . . . . . . . . . . . . . . . . . . . . . . . 3 6.1. Normative References . . . . . . . . . . . . . . . . . . 3 6.2. Informative References . . . . . . . . . . . . . . . . . 4 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 4 1. Introduction The proliferation of large neural networks has exposed severe fragmentation in model distribution and supply-chain security. Existing container formats rely on out-of-band metadata files and arbitrary-length headers, which force unaligned memory access during host-to-device transfers and break cryptographic provenance chains upon redistribution. This document proposes an architectural framework to secure the AI supply chain by embedding Supply Chain Integrity, Transparency, and Trust (SCITT) principles directly into the tensor payload container. The foundational architecture is published under Zenodo [STC-ZENODO]. 2. STC-1.0: Memory Alignment Architecture To achieve true zero-copy Unified DMA, STC-1.0 dictates a hermetic binary container utilizing strict 64-byte physical cache-line alignment. All metadata preceding the tensor payload MUST be dynamically padded. Runtimes MUST apply the following mathematical constraint to calculate the padding length (in bytes) before the payload initiates: padding = (64 - (length (mod 64))) (mod 64) Somaratne Expires 1 March 2027 [Page 2] Internet-Draft STC and STP for SCITT August 2026 This alignment ensures execution runtimes can mmap the artifact and dispatch it directly to the GPU without CPU byte-shifting. 3. STP-1.0: Cryptographic Provenance (TRUST Block) The STP-1.0 specification defines a mandatory TRUST block within the STC header structure. This block acts as a cryptographic execution gate for inference engines. 3.1. C2PA and X.509 Integration The TRUST block MUST contain: 1. An AI-specific C2PA manifest [C2PA] detailing training data lineage and synthetic token ratios. 2. An X.509 certificate chain [RFC5280] binding the artifact to a verified developer identity. 3. An absolute SHA-256 payload hash of the aligned tensor bytes. 3.2. SCITT Attestation By embedding these cryptographic claims natively, the STC artifact functions as a self-contained Statement for a SCITT Transparency Service. Inference runtimes SHOULD verify the X.509 signatures and payload hash against a trusted SCITT ledger before allocating VRAM. 4. Security Considerations Traditional ML checksums are easily spoofed during man-in-the-middle redistribution, leading to weight poisoning. STP-1.0 mitigates this by mandating cryptographic signature verification at the engine level. A compromised private key could allow an attacker to sign a poisoned model; therefore, short-lived certificates and Time-Stamp Protocol (TSP) [RFC3161] integration are strongly recommended. 5. IANA Considerations This document requests the registration of a new media type, application/vnd.stc, to identify Sovereign Tensor Container artifacts. 6. References 6.1. Normative References Somaratne Expires 1 March 2027 [Page 3] Internet-Draft STC and STP for SCITT August 2026 [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., and W. Polk, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008, . [RFC3161] Adams, C., Cain, P., Pinkas, D., and R. Zuccherato, "Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)", RFC 3161, DOI 10.17487/RFC3161, August 2001, . [C2PA] "C2PA Technical Specification", n.d., . 6.2. Informative References [STC-ZENODO] "Sovereign Tensor Architecture: A Unified Open Standard", n.d., . Author's Address Chamara Somaratne Sovereign Stack Global Email: chamara@anthosa.com Somaratne Expires 1 March 2027 [Page 4]