Topic
Zero Trust Data Format
What the Zero Trust Data Format specifies, how it relates to TDF and OpenTDF, and how policy is evaluated at decrypt time.
13 posts
ZTDF is the Zero Trust Data Format, an object format that wraps a payload in encryption and binds an access policy and integrity metadata to it. Each object carries its own policy, so the decision to release a decryption key happens at open time, wherever the object has traveled. That is cryptographic enforcement: no key release, no plaintext.
The naming causes most of the confusion. TDF is the Trusted Data Format, which originated in the US Intelligence Community; OpenTDF is the open source implementation; ZTDF is the zero trust profile of that format. A second mistake treats ZTDF as equivalent to a sensitivity label, but a label is a marking a cooperating application chooses to honor, while a ZTDF policy is enforced through key release.
Posts under this hub cover what the specification defines, how policy evaluation works at decrypt time, how ZTDF diverges from Microsoft Purview sensitivity labels, and what ACP 240 specifies for coalition use. Lattix Technologies implements ZTDF objects and their policy decision path in the Lattix Security Fabric.
Frequently asked questions
What is ZTDF?
ZTDF stands for Zero Trust Data Format, a container that holds an encrypted payload alongside an access policy and integrity metadata bound to that payload. Opening the object requires a key, and the key service evaluates the attached policy before releasing one. Policy therefore travels with the data and is evaluated on every open, including copies outside the originating environment.
What is the difference between TDF, OpenTDF, and ZTDF?
Trusted Data Format is the original specification, developed in the US Intelligence Community for binding policy and integrity metadata to a payload. OpenTDF is the open source implementation of that specification, providing libraries and services. Zero Trust Data Format is the zero trust profile of the same family, and the three terms describe a lineage rather than three competing formats.
How is ZTDF different from a sensitivity label?
A sensitivity label is metadata that instructs cooperating applications how to treat a file, and an application that ignores the label still reads the content. A ZTDF object is encrypted, so the label equivalent is enforced by a key decision rather than by application courtesy. Where a label stops carrying policy, the two approaches diverge completely in what they guarantee.
Can you revoke access to a ZTDF file after someone downloads it?
Yes, because the recipient holds ciphertext and must request a key each time they open the object. Withdrawing the policy grant or changing an attribute causes the next key request to be refused, and the local copy becomes unreadable. Revocation does not reach plaintext the recipient already extracted and saved elsewhere, which is a limit worth stating plainly.
