# CI-TDF User Manual
ClassifyIt Trusted Data Format

CI-TDF is a demonstrator tool for packaging source files into encrypted, self-describing CI-TDF
containers (`.tdf`) and for decrypting them again. Access to a container's source file is protected
by a cryptographic key, which is protected either by a certificate or a password.

This is a **test environment** with a default `Certificates\` folder holding test certificates and a
default `Data\` folder to encrypt and decrypt files. You can add your own certificates and data in
those folders to test the CI-TDF format.

## 1. Install and first run

Run the installer **CI-TDF-Setup-1.0.0.0.exe**. This will copy the required files in a Program
Folder. Then launch **CI-TDF**, which provides the user interface to select a source file, the
encryption options, metadata options, as well as a classification schema for iCLASS classification
markings. The **CI-TDF** application uses the following default folders:

* `Certificates\` — X.509 identities (`.crt` certs, `.key`/`.pem`/`.p12`/`.pfx` keys); sample-filled.
* `Data\` — a convenient default location for source files and generated `.tdf` packages.

The sample certificates follow a `TYPE_KEYLENGTH_PASSWORD@test.org` naming pattern, so the file name
tells you everything needed to use it:

* **TYPE** — `ECC` (elliptic curve) or `RSA`; the CA root cert/key is just prefixed `ca_`.
* **KEYLENGTH** — curve (`P-256`, `P-384`, `P-521`) or RSA size in bits (`2048`, `4096`, `8092`).
* **PASSWORD** — the key's own passphrase, e.g. `ECC_P-256_p2@test.org.key` unlocks with `p2`.

The app has three tabs: **Encrypt**, **Decrypt**, and **Documentation**.

## 2. Encrypt tab — create a CI-TDF container

1. **Source Plaintext**: click *Browse...* and pick the file to protect.
2. **Target CI-TDF Container** (optional): auto-filled as `<source>.tdf`; *Save To...* to change it.
3. **Metadata File** (optional): attach a plaintext sidecar file; *Clear* removes the selection.
4. **Sender Identity** (optional): *Load Identity...* signs the container as sender; *Show/Hide* reveals its password.
5. **Access Method** — grant access via *Recipient certificate* (**Add Recipient...** loads certs from `Certificates\`, **Find** filters, tick who may open the file — a loaded sender identity also counts as a recipient) and/or *Password* (any passphrase; *Show/Hide* toggles visibility).
6. **Security Label**: set *Classification*, *Releasability*, *Originator*, *Data Category* — recorded as assertions.
7. Click **Encrypt and Create CI-TDF**; progress and errors go to the log below. *Clear Log* wipes it.
8. The `.tdf` output is a ZIP archive — `0.manifest.json` (manifest), `0.payload` (encrypted source), `0.metadata` (optional metadata); rename to `.zip` to inspect with any editor.

## 3. Decrypt tab — open a container

1. **Source CI-TDF Package**: *Select...* a `.tdf` file — CI-TDF inspects the manifest, auto-selects a matching local identity if one is found in `Certificates\`, and otherwise pre-selects the detected access method.
2. **Restored Plaintext**: *Save To...* sets the output path (default `<source>.decrypted`).
3. Under **Detected Access Method**, confirm the *private key* (matching bundle or auto-detected candidate) and its password, or enter the *password* directly.
4. Click **Decrypt CI-TDF**. Result and any errors appear in the log.

## 4. Documentation tab

Reference material, available inside the app without needing network access:

* **User Manual** — this document.
* **Manifest Structure** — the profile (`CI-TDF_ManifestSpecification.md`) for `0.manifest.json`'s JSON fields.

## 5. About

Double-click the CI-TDF badge picture (top-right of the Encrypt tab) to see the About screen, with a
link to https://classifyIt.eu.