ClassifyIt video · 2 minutes 31 seconds
CI-TDF explained
See how a protected container combines encrypted content, a JSON manifest, integrity checks and iCLASS assertions, then follow recipient decryption and the planned Key Access Server.
2 minutes 31 seconds · English captions · Published 2026-10-20
This page loads a YouTube player in privacy-enhanced mode. Privacy information · Watch on YouTube ↗
Video transcript
CI-TDF, the ClassifyIt Trusted Data Format, is based on Open TDF and establishes data protection by bringing encrypted content and its protection information together.
Here is a readable document and an empty container. As the document enters, its content is encrypted and becomes unreadable. A JSON manifest is added alongside it, describing the file and the mechanisms needed to use it securely.
Let us look inside the manifest. The version field identifies the format as CI-TDF, version one point zero. The payload section describes the original file and the stored payload.
Root signature protects the whole manifest, including its assertions and key access information. Together with the payload hash and authenticated encryption, this allows changes to be detected. Verification uses a digital signature or a keyed integrity check, depending on the mode.
The key access section describes how a recipient recovers the content encryption key. Here, certificate access carries a wrapped key, which requires the recipient’s matching private key. The plaintext content key is never exposed in the manifest.
Further down, the iCLASS assertion describes the information’s classification. Here, BEL identifies Belgium as the originator. R means Restricted. The release list names Germany and the United States, subject to the originating organisation’s policy and required agreements. The assertion is protected by the manifest’s root integrity check.
The recipient uses their matching private key to recover the content key. After successful integrity verification, the document is decrypted and readable again. The private key stays with the recipient.
A Key Access Server is planned alongside local access. It will verify identity and evaluate policy before releasing the protected key to an authorised recipient.
Protection travels with the data, a building block for Data Centric Security and Zero Trust. Explore the CI-TDF specification under Documentation at classify it dot E U.