PSI-05: Financial Disclosure Integrity

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 10 February 2027.¶

Copyright Notice

Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

1. Introduction

Public companies publish financial disclosures (10-K, 10-Q, 20-F, annual reports) that are legally binding but rarely independently verified. PSI-05 establishes a cryptographic framework where:¶

• Every financial disclosure is sealed with SHA-256.¶
• The seal is signed with Ed25519 (classical) and ML-DSA-65 (post-quantum) in a hybrid dual-signature scheme.¶
• The dual signature is recorded in a public PSI-04 ledger.¶
• Third parties can recompute the disclosed figures and verify against the sealed source.¶
• Variance between published and recomputed figures is flagged.¶

This creates a trust layer for financial data that is independent of the filing entity and quantum-resistant by design.¶

2. Terminology

Sealed Disclosure:

A financial document hashed with SHA-256 and signed with Ed25519 + ML-DSA-65 hybrid scheme, recorded in the PSI public ledger.¶

Recomputation:

Independent calculation of disclosed figures from source data using the PSI reconciliation engine.¶

Variance:

Difference between published and recomputed figures, expressed as a percentage.¶

Ledger Entry:

A PSI-04 attestation recording the dual seal hash, timestamp, and source citation.¶

Hybrid Signature:

A cryptographic envelope containing both an Ed25519 signature (classical) and an ML-DSA-65 signature (post-quantum) over the same canonicalized document.¶

3. Cryptographic Framework

4. Verification Protocol

GET /api/v1/companies/{ticker}/filings/{year}/{type}

GET /api/v1/verify/{hash}

5. Ledger Structure

The PSI ledger maintains a registry of sealed disclosures:¶

{
  "company_id": "UBER",
  "filing_type": "10-K",
  "fiscal_year": 2025,
  "sealed_at": "2026-03-15T10:30:00Z",
  "hash": "a3f2e8...",
  "source": "https://sec.gov/Archives/edgar/data/...",
  "signatures": {
    "ed25519": "base64-encoded-ed25519-signature",
    "ml_dsa_65": "base64-encoded-ml-dsa-65-signature"
  },
  "recomputed_at": "2026-08-09T20:40:00Z",
  "variance": 0.0003,
  "status": "verified"
}

6. API Endpoints

Five REST API endpoints are defined for the PSI ledger:¶

GET  /api/v1/companies                 List all companies with sealed disclosures
GET  /api/v1/companies/{ticker}/filings  Get all sealed filings for a company
GET  /api/v1/verify/{hash}               Verify a sealed disclosure hash
GET  /api/v1/ledger/stats                Total seals, companies, daily activity
POST /api/v1/seal                        Submit a new financial disclosure for sealing

The POST /api/v1/seal endpoint accepts a JSON body with company_id, filing_type, fiscal_year, document, and source_url. It returns the seal hash and both signatures (Ed25519 and ML-DSA-65).¶

7. Commercial Reuse

The PSI ledger is free to read and cite. Commercial reuse above 1,000 rows per year requires a royalty agreement with Rockyfilms888 Pty Ltd (ABN 71672237795). Royalty tiers:¶

Exemptions: Personal research, academic citation, journalism, public-interest reporting, and regulatory compliance audits.¶

8. Security Considerations

• Sealed disclosures are immutable once recorded in the ledger.¶
• Ed25519 signatures prevent classical tampering.¶
• ML-DSA-65 signatures prevent quantum tampering.¶
• The hybrid dual-signature scheme ensures security against both classical and quantum adversaries.¶
• Public ledger ensures transparency and verifiability.¶
• Recomputation is deterministic and verifiable by any party.¶
• Private keys MUST be stored in hardware security modules (HSM) or equivalent secure enclaves.¶
• Signatures MUST be timestamped with a trusted time source.¶

9. IANA Considerations

This document has no IANA actions.¶

Author's Address