| Internet-Draft | TrackOne VTL | March 2026 |
| El Khatabi | Expires 3 September 2026 | [Page] |
This document specifies a verifiable telemetry ledger profile for resource-constrained sensing environments. The profile defines how a gateway accepts framed telemetry, applies anti-replay policy, projects accepted frames into canonical facts, builds deterministic daily Merkle commitments, and anchors daily artifacts with external timestamp proofs. OpenTimestamps (OTS) is the default anchoring mechanism; optional parallel attestation methods (RFC 3161 timestamp protocol and peer signatures) are also described.¶
The goal is interoperability and independent auditability, not new cryptographic primitives.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 3 September 2026.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document.¶
Long-lived telemetry deployments such as environmental monitoring, heritage conservation, and infrastructure health need evidence that measurements were not silently altered after a collection. A coastal sensor array that reports temperature every six hours over a five-year deployment produces tens of thousands of records; stakeholders such as regulators, researchers, and insurers may need to verify, years later, that the data they rely on is the same data the sensors produced.¶
Existing standards provide important building blocks:¶
However, none of these building blocks defines a complete operational profile for the constrained case: devices with intermittent uplinks, limited compute budgets, and no persistent Internet connectivity at the collection point. SCITT assumes a transparency service is reachable for receipt-oriented workflows. COSE Merkle proofs define proof encodings, but not batching policy or anchoring lifecycle. RATS addresses device identity attestation, but not telemetry commitment.¶
The discussion below compares this profile directly with [SCITT] and [COSE-MERKLE] because those documents define adjacent, but not identical, transparency and proof disclosure models.¶
This document fills that gap. It specifies a practical profile that combines these building blocks for low-power telemetry systems:¶
The profile is informed by TrackOne pre-production validation, including constrained uplink simulations, hardware-in-loop testing, and daily batching and verification workflows.¶
This document is complementary to, not a replacement for, the following work:¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
Terms:¶
day/YYYY-MM-DD.cbor.¶
proofs/YYYY-MM-DD.ots.meta.json, linking an artifact digest to an OTS proof path.¶
(dev_id, fc), where fc is a frame counter for device dev_id.¶
YYYY-MM-DD in UTC.¶
A frame is transported as NDJSON with fields:¶
{
"hdr": { "dev_id": 101, "msg_type": 1, "fc": 42, "flags": 0 },
"nonce": "base64-24B",
"ct": "base64-ciphertext",
"tag": "base64-16B"
}
Gateways MUST validate header field presence, header ranges, and AEAD authentication before fact emission.¶
hdr.dev_id MUST be an unsigned integer in the range 0..65535.¶
hdr.msg_type MUST be an unsigned integer in the range 0..255.¶
hdr.fc MUST be an unsigned integer in the range 0..(2^32-1).¶
hdr.flags MUST be an unsigned integer in the range 0..255.¶
nonce MUST be base64 text that decodes to exactly 24 bytes.¶
tag MUST be base64 text that decodes to exactly 16 bytes.¶
Frames that fail parse, range, or AEAD validation MUST be rejected before fact commitment and MUST NOT produce committed facts.¶
The replay unit is (dev_id, fc).¶
(dev_id, fc) into the ledger.¶
fc more than window_size behind the highest accepted counter for a device MUST be rejected.¶
fc more than window_size ahead of the highest accepted counter for a device MUST also be rejected, because an excessive forward jump is treated as out of window by the current gateway profile.¶
Structured Rejection Evidence¶
Gateways SHOULD produce structured rejection evidence for rejected frames. A rejection record SHOULD include at minimum:¶
Rejection evidence is an audit artifact and MUST NOT be hashed into ledger commitments.¶
Replay State Persistence¶
Gateways SHOULD persist replay state across restart. If replay state is lost, gateways SHOULD record a continuity break event and SHOULD NOT silently re-accept counters that could already have been committed.¶
Scope Limitation¶
This profile provides tamper-evidence for committed facts. It does not prove the absence of selective pre-commitment drops by a malicious gateway.¶
The frame-to-fact projection transforms a validated, decrypted frame into a canonical fact suitable for commitment. The committed fact is a structured record derived from the decrypted payload, not a copy of transport bytes.¶
msg_type.¶
A committed fact MUST contain at minimum:¶
Ciphertext, raw transport bytes, and the authentication tag MUST NOT be part of the committed fact object. The exact payload schema is deployment-specific; the deterministic projection contract is the normative requirement.¶
This section does not define a new general-purpose CBOR variant. It
records the narrow deterministic CBOR encoding used for commitment
bytes in the current TrackOne gateway and ledger implementation.
The identifier trackone-cbor-map-v1 names this commitment
recipe so verifiers can tell which byte-level rules were used.¶
The authoritative commitment artifacts, namely CBOR fact artifacts and the canonical day artifact, use a constrained subset of deterministic encoding under Section 4.2.1 of [RFC8949]. For TrackOne commitment bytes, the following concrete choices apply:¶
Implementations MUST NOT accept generic CBOR serializers as authoritative commitment encoders. An encoder is acceptable only if it yields the same bytes as these rules.¶
JSON projections of fact artifacts and day artifacts are optional and non-authoritative. They MUST NOT be used as commitment inputs. When produced, such projections SHOULD follow [RFC8785].¶
Device-side or embedded components MAY use other internal encodings,
including different deterministic CBOR layouts optimized for local
constraints. Those encodings are not the authoritative commitment
encoding described here unless they are explicitly identified by a
distinct commitment_profile_id and verified under their own
rules.¶
For a given day D, the current commitment profile computes a
daily root from the canonical fact commitment bytes produced under
Section 4.4. The following steps describe that
calculation.¶
Leaf Digests¶
SHA-256, yielding a 32-byte leaf digest.¶
Digest Ordering¶
Pairwise Reduction¶
SHA-256(left_child_bytes || right_child_bytes), where both operands are raw 32-byte digests.¶
Empty Day¶
SHA-256 digest of zero bytes: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855.¶
The resulting daily root is deterministic for the set of committed facts. Because the leaf digests are sorted before reduction, the result depends on the committed fact set rather than on ingestion order.¶
Any future change to this calculation that alters commitment bytes
(for example, adding domain separation) MUST use a new
commitment_profile_id.¶
The authoritative day artifact is a CBOR-encoded day record produced under Section 4.4. The day record contains the following fields:¶
version (uint): day-record schema version, currently 1.¶
site_id (tstr): site identifier.¶
date (tstr): UTC day label in YYYY-MM-DD form.¶
prev_day_root (tstr): previous day root as 64 lowercase hexadecimal characters.¶
batches (array): array of batch objects.¶
day_root (tstr): deterministic day root as 64 lowercase hexadecimal characters.¶
Each batch object contains:¶
version (uint): batch-record schema version, currently 1.¶
site_id (tstr): site identifier.¶
day (tstr): UTC day label in YYYY-MM-DD form.¶
batch_id (tstr): batch identifier.¶
merkle_root (tstr): batch Merkle root as 64 lowercase hexadecimal characters.¶
count (uint): number of committed facts in the batch.¶
leaf_hashes (array of tstr): sorted leaf hashes as lowercase hexadecimal strings.¶
day/YYYY-MM-DD.cbor is authoritative. The corresponding
day/YYYY-MM-DD.json file is a projection only.¶
This document uses normative field tables rather than CDDL. A future revision may add a formal CDDL appendix if broader independent implementations require it.¶
Day records include prev_day_root.¶
prev_day_root to 64 ASCII zero characters, representing 32 zero bytes.¶
prev_day_root to the previous committed day's day_root.¶
Because day labels are UTC-based, chaining semantics are also defined on UTC day boundaries.¶
Illustrative artifact layout:¶
facts/<fact-id>.cbor — authoritative canonical facts¶
facts/<fact-id>.json — optional projections¶
day/YYYY-MM-DD.cbor — authoritative canonical day artifact¶
day/YYYY-MM-DD.json — optional projection¶
blocks/YYYY-MM-DD-00.block.json — block and batch metadata¶
day/YYYY-MM-DD.cbor.sha256 — convenience digest¶
day/YYYY-MM-DD.cbor.ots — OTS proof¶
proofs/YYYY-MM-DD.ots.meta.json — OTS binding metadata¶
Deployments MAY store artifacts differently and MAY export them as bundles. The path shapes above are illustrative.¶
At minimum, an OTS sidecar MUST bind:¶
Verifiers MUST recompute the day artifact digest and compare it with the sidecar before accepting any proof validation result.¶
The generic anchoring contract is simple: a gateway computes the SHA-256 digest of the authoritative day artifact and submits that digest to one or more external timestamping channels. Verifiers MUST first recompute the day artifact digest locally; proof validation occurs only after digest binding validation succeeds.¶
A deployment conforming to this profile MUST use at least one anchoring channel. OTS is the default channel described by this document; RFC 3161 and peer signatures are optional parallel channels.¶
When [OTS] is used, the gateway stamps
SHA-256(day/YYYY-MM-DD.cbor) and stores an OTS proof plus an
OTS sidecar.¶
Gateways SHOULD submit to multiple independent calendars to reduce single-calendar unavailability risk.¶
Deployments MAY also produce:¶
(site_id, day, day_root, context).¶
When multiple channels are present, verifiers SHOULD validate all available channels independently and report per-channel results.¶
If a verifier is configured in strict mode for optional channels, failure of those channels MUST cause overall verification failure.¶
Verifiers SHOULD apply checks in the following fail-fast order:¶
day_root.¶
SHA-256(day/YYYY-MM-DD.cbor) and compare it to the sidecar artifact_sha256.¶
Verifier implementations SHOULD expose machine-usable failure categories:¶
Verification claims depend on what artifacts are disclosed. This profile defines three disclosure classes.¶
A Class A bundle MUST include:¶
A Class A bundle SHOULD also include a machine-readable verification
manifest and SHOULD record the commitment_profile_id.¶
A Class B bundle MUST include:¶
Class B outputs MUST NOT be represented as publicly recomputable.¶
A Class C disclosure MUST be labeled as existence and timestamp evidence only and MUST NOT claim fact-level reproducibility.¶
A Class C bundle MUST include:¶
If a verification manifest is present, it SHOULD include:¶
This profile has several independent version surfaces:¶
-00, -01) is editorial and is not part of commitment output.¶
version fields in day and batch records.¶
commitment_profile_id identifies the canonical CBOR, hash, and Merkle rules that define commitment outputs.¶
The commitment profile defined in this document is
trackone-cbor-map-v1. If a verifier encounters an unsupported
commitment_profile_id, it MUST reject the verification claim
rather than silently using a fallback interpretation.¶
Determinism claims in this profile are testable. Implementations that
claim conformance to trackone-cbor-map-v1 MUST be able to
reproduce the published conformance vectors for that profile.¶
Published vector sets SHOULD include coverage for:¶
Cross-implementation checks MUST verify byte-for-byte parity across independent implementations. Any mismatch in canonical bytes or roots is a conformance failure.¶
Published vector bundles MUST include the
commitment_profile_id.¶
This profile does not introduce new cryptographic primitives. Security depends on correct composition of existing primitives and on operational discipline.¶
Replay and Duplicate Suppression¶
The (dev_id, fc) replay unit enforces single-consumption: at
most one committed fact per unique replay unit.¶
Tamper Evidence¶
Once a day artifact is anchored, mutation of that artifact changes its digest and invalidates the proof. Day chaining extends this property across days.¶
Proof Substitution¶
Sidecar metadata binds an artifact digest to a proof path. Verifiers MUST recompute the artifact digest independently.¶
Calendar Trust and Withholding¶
A compromised or unavailable calendar can delay or withhold proofs. Multi-calendar submission reduces single-calendar dependency but does not eliminate coordinated compromise risk.¶
Operational Misuse¶
Test or placeholder proofs MUST NOT be treated as production attestations.¶
Confidentiality Boundary¶
This profile addresses integrity and timing provenance only. Payload confidentiality remains the responsibility of the deployment's AEAD and key-management layers.¶
Pre-Commitment Censorship¶
This profile proves inclusion and timestamping of committed facts. It does not prove completeness of all observed or emitted frames.¶
Telemetry payloads may include sensitive operational data. Operators SHOULD:¶
Privacy-preserving disclosures remain valid, but they MUST NOT be described as publicly recomputable unless Class A conditions are met.¶
This document has no IANA actions.¶
In particular, this revision does not request:¶
The current profile is identified by in-band version and profile fields, not by IANA allocation.¶
Note to RFC Editor: Please remove this section before publication.¶
This section records implementation status at the time of posting, per [RFC7942].¶
This draft reflects the TrackOne pre-production implementation
snapshot at release 0.1.0-alpha.6.¶
A pre-production reference implementation exists and is aligned with
the current 0.1.0-alpha.6 release. It is suitable for
interoperability review and validation, but it is not a production
deployment.¶
This appendix shows a non-authoritative JSON projection of a day artifact. The authoritative artifact is the corresponding CBOR file.¶
{
"version": 1,
"site_id": "an-001",
"date": "2025-10-07",
"prev_day_root": "<genesis root hex>",
"batches": [
{
"version": 1,
"site_id": "an-001",
"day": "2025-10-07",
"batch_id": "an-001-2025-10-07-00",
"merkle_root": "9d1f...c2",
"count": 10,
"leaf_hashes": [
"01ab...",
"7fe2..."
]
}
],
"day_root": "9d1f...c2"
}
The values in this appendix were generated by the Python gateway code
path and cross-checked against trackone_core._native (Rust)
for deterministic CBOR and Merkle parity. This vector bundle reflects
the 0.1.0-alpha.6 implementation snapshot.¶
commitment_profile_id:
trackone-cbor-map-v1
fixture fact_a:
device_id: pod-101
timestamp: 2026-03-01T12:00:00Z
nonce: ""
payload.temp_c: 21.5
fixture fact_b:
device_id: pod-102
timestamp: 2026-03-01T12:10:00Z
nonce: "n1"
payload.temp_c: 22.0
fixture fact_c:
device_id: pod-103
timestamp: 2026-03-01T12:20:00Z
nonce: "n2"
payload.temp_c: 22.5
fixture fact_d:
device_id: pod-104
timestamp: 2026-03-01T12:30:00Z
nonce: "n3"
payload.temp_c: 23.0
empty-day-v1:
artifact_sha256:
c00c984fdd78476f1044fa52eae94606
6f403460e6585044c39b125a13ee3d7e
batch_merkle_root:
e3b0c44298fc1c149afbf4c8996fb924
27ae41e4649b934ca495991b7852b855
day_root:
e3b0c44298fc1c149afbf4c8996fb924
27ae41e4649b934ca495991b7852b855
single-fact-v1:
fact_cbor_hex:
a4656e6f6e636560677061796c6f6164a16674656d705f63f94d606964657669
63655f696467706f642d3130316974696d657374616d7074323032362d30332d
30315431323a30303a30305a
fact_leaf_hash:
bb154e441ccdebec09969f1911b46394
20f7830825b75b02ac52512aa5d32591
odd-leaf-layer-v1:
artifact_sha256:
6f81c6de96dc635ff29f73a60457205b
a0874a97b2ad6f9f88b1f61870592825
day_root:
6c96b4f201e5f6f1badfef6c84d4003a
b12a7034daeb20fa7f59c33f43c5ae18
leaf_hashes_sorted:
26e4affe56412f9e1d4323b27d3ca54c
4add4fa971800bc25568c4b175d55581
bb154e441ccdebec09969f1911b46394
20f7830825b75b02ac52512aa5d32591
e2003581ac4364cb322005c465c8d565
e69f5578af1a614e2762c222a46fd7a5
power-of-two-v1:
artifact_sha256:
81cc87aaf2ecb8b7d9420faa910814aa
47dd5c8b1ead76d2da19bef55afa48a8
day_root:
57bd26f73115f130dcf877a10c434ba2
8686196daf81f5e48388833303600e73
duplicate-leaf-hash-v1:
artifact_sha256:
4fafb987ef0df50e5e382a09d140793a
84180f4a86e67924eab1184e20a11c00
day_root:
9166c21933341729c08b3a1f61710d9d
f5efc5aa00d3af9f596c2e166c65b54e
genesis-chain-v1:
artifact_sha256:
4fb6d4570d4662c63b682e2f2d993e9f
a01669217b61ff64400b981b50b1a8c2
day_root:
bb154e441ccdebec09969f1911b46394
20f7830825b75b02ac52512aa5d32591
non-genesis-chain-v1:
artifact_sha256:
8969bafb62ad9e9aaa6c8460a52320ba
107975d06352d6562107c5070d792f7e
day_root:
e2003581ac4364cb322005c465c8d565
e69f5578af1a614e2762c222a46fd7a5
class-a-bundle-v1:
disclosure_class: A
day_root:
6c96b4f201e5f6f1badfef6c84d4003a
b12a7034daeb20fa7f59c33f43c5ae18
artifact_sha256:
6f81c6de96dc635ff29f73a60457205b
a0874a97b2ad6f9f88b1f61870592825
The full machine-readable vector set is maintained in the TrackOne repository alongside the reference implementation.¶
Early structural drafts of this document were prepared with AI writing assistance. All technical content, design decisions, and normative requirements were reviewed against the TrackOne implementation.¶
The author thanks the OpenTimestamps project for the public calendar infrastructure used during validation.¶