TDF, ZTDF and OpenTDF name three different kinds of thing. Trusted Data Format (TDF) is a specification for an encrypted data object that carries its own access policy. Zero Trust Data Format (ZTDF) is a profile of that format for allied and coalition use, adding cryptographic assertions the format leaves optional. OpenTDF is the open-source project that publishes the current JSON specification and reference implementations of it. One is a format, one is a constrained variant of the format, one is code and the specification text that describes it. Procurement documents that use the terms as synonyms produce requirements that cannot be tested.
The three terms at a glance
| Term | What it names | Who maintains it | What it produces |
|---|---|---|---|
| TDF (Trusted Data Format) | A format for an encrypted object carrying a bound access policy | Originated in the United States intelligence community; the JSON encoding is specified by the OpenTDF project | A .tdf object with an encrypted payload and a manifest.json |
| IC-TDF | The intelligence community lineage of TDF, originally XML based, version 3.0 dated 6 September 2013 | Office of the Director of National Intelligence | XML trusted data objects with assertion structures |
| ZTDF (Zero Trust Data Format) | A profile of the OpenTDF specification that mandates specific cryptographic assertions for allied contexts | Sponsored through the Combined Communications-Electronics Board process, referenced by ACP 240 | TDF objects that carry the assertions coalition partners require |
| OpenTDF | An open-source project: specification text, schemas, SDKs, key access server and platform services | The OpenTDF community project | Running software and the schema documents implementations conform to |
What TDF names
TDF names a file format and the protocol for opening it. A TDF object is a container, by default a ZIP archive, holding an encrypted payload and a JSON manifest. The manifest records the encryption method, integrity information, one or more key access objects, and a policy bound to the data encryption key by a keyed hash.
TDF as a term says nothing about which key access server is used, which attributes appear in policy, or which identity provider authenticates the caller. Those are deployment decisions. A requirement that says only "must support TDF" is satisfied by any conforming reader and writer, which is usually not what the requirement intended.
The mechanics of the format are covered in What Is Trusted Data Format: A Technical Reference.
What ZTDF names
ZTDF names a constrained use of the format. The OpenTDF specification describes ZTDF as building directly on OpenTDF and extending it by mandating specific cryptographic assertions required in Five Eyes contexts. The base format treats assertions as optional; the profile makes named assertions mandatory so that a partner nation's reader can rely on their presence.
ZTDF appears in two places that matter for public sector buyers. Allied Communications Publication 240, sponsored by the Combined Communications-Electronics Board rather than NATO, is where ZTDF is specified, with the technical content in Supplements 3 and 4. NSA zero trust implementation guidance names ZTDF alongside IC-TDF as data rights management schemas components should standardize on to achieve interoperability.
A ZTDF object is a TDF object. A TDF object is not necessarily a ZTDF object. Specifying ZTDF is therefore the stricter and more testable requirement where coalition exchange is in scope. NATO ACP 240 and Zero Trust Data Format covers what the publication does and does not settle.
What OpenTDF names
OpenTDF names a project, not a format. It publishes the schema documents that define manifest.json and its constituent objects, protocol documentation covering the interaction between clients, key access servers and identity providers, and concepts documentation covering access control and security properties. It also publishes SDKs and platform services including a key access server and an authorization service.
The distinction matters in two directions. An organization can conform to the TDF specification without running any OpenTDF code, by implementing the schemas independently. An organization can also run OpenTDF code and still fail an interoperability requirement, if its attribute model, key access server topology or assertion set does not match a partner's.
Which term to use in a requirements document
Requirements that name a term without naming a conformance point are not testable. The following pairings hold.
- Use TDF where the requirement is that protected objects be readable by any conforming implementation, and name the schema version.
- Use ZTDF where the requirement is coalition or allied exchange, and name the assertions and the attribute authority.
- Use OpenTDF where the requirement is about the software supply chain, licensing, or a reference implementation, not about the wire format.
- Use IC-TDF where the requirement concerns intelligence community systems built on the older XML lineage.
Buyers writing this language into solicitations will find further detail in what TDF and ZTDF mean for procurement officers.
Implementations of TDF available today
Several implementations exist, and describing them accurately matters more than ranking them.
OpenTDF is the open-source project. It provides the specification, SDKs in multiple languages, a key access server, and platform services for attributes and authorization. It is the common starting point for an organization building its own deployment.
Virtru is the primary commercial vendor associated with TDF. TDF was invented by a Virtru co-founder during earlier work at the National Security Agency, and Virtru maintains a commercial data security platform built on the format, including email and file protection products and support for allied ACP 240 adoption.
Lattix implements TDF objects with a policy decision point evaluating attribute-based access control (ABAC), a policy enforcement point acting at decrypt time, fail-closed defaults, and Merkle-tree lineage records for decision history.
Government implementations exist inside intelligence community and defence systems on the IC-TDF lineage and are not publicly documented in detail.
Choosing between them is a question about attribute governance, key custody and deployment topology rather than about the format, since all conforming implementations produce readable objects.
Where the terminology is genuinely unsettled
Three ambiguities are real and are worth naming rather than papering over.
ZTDF versus TDF in vendor material. Some vendor and press material uses ZTDF as a synonym for TDF generally. The OpenTDF specification treats ZTDF as a profile that adds mandatory assertions. Readers encountering ZTDF in marketing text should confirm which sense is meant.
Ratification claims. Public sources describe ZTDF as ratified through the Combined Communications-Electronics Board process and referenced by ACP 240. At least one public technical source states that NATO itself has not adopted ZTDF and is not working towards doing so, and that NATO's own data-centric security work rests on the STANAG 4774, 4778 and 5663 family. Both statements can be true, because the CCEB and NATO are separate bodies, and treating them as one produces incorrect procurement language.
Version naming. TDF3 and NanoTDF appear in implementation documentation as distinct encodings of the same ideas, the first ZIP based and the second a compact binary form. Requirements should name the encoding, not just the family.
Frequently asked questions
What is OpenTDF?
OpenTDF is an open-source project that publishes the current specification for Trusted Data Format and reference implementations of it. It provides JSON schemas for the TDF manifest and its constituent objects, protocol documentation describing how clients, key access servers and identity providers interact, SDKs, and platform services including a key access server and an authorization service.
What is Zero Trust Data Format?
Zero Trust Data Format (ZTDF) is a profile of the OpenTDF specification for allied and coalition use. It extends the base format by mandating specific cryptographic assertions that the base specification leaves optional, so partner systems can rely on their presence. ZTDF is referenced by Allied Communications Publication 240 and named in NSA zero trust implementation guidance alongside IC-TDF.
What is the difference between TDF and OpenTDF?
TDF is the format: an encrypted payload plus a manifest carrying a bound access policy. OpenTDF is the project that publishes the specification for that format and open-source software implementing it. An organization can implement TDF from the schemas without using OpenTDF code, and can run OpenTDF code without meeting a specific partner's interoperability requirements.
What are the best implementations of TDF?
The main publicly available options are the OpenTDF open-source project, the commercial Virtru data security platform, and Lattix. Selection turns on attribute governance, key custody, deployment topology and support model rather than on the format, because every conforming implementation produces objects that other conforming implementations can read. Coalition use adds ZTDF assertion conformance as a further criterion.
Is ZTDF a NATO standard?
ZTDF is referenced by Allied Communications Publication 240, sponsored through the Combined Communications-Electronics Board, whose members are Australia, Canada, New Zealand, the United Kingdom and the United States. NATO is a separate body with its own data-centric security standards in the STANAG 4774, 4778 and 5663 family. Public sources disagree on how far NATO itself has adopted ZTDF.
Do TDF and ZTDF objects interoperate?
A ZTDF object is a valid TDF object, so a conforming TDF reader can process one provided it can reach the key access server named in the manifest and satisfy the policy. The reverse is not guaranteed. A plain TDF object may omit assertions that a ZTDF consumer requires, in which case the consuming system rejects it on profile grounds rather than on cryptographic ones.