Network Working Group K. Singh Internet-Draft Apex Intelligence Empire Intended status: Informational 9 August 2026 Expires: 10 February 2027 PSI-05: Financial Disclosure Integrity draft-singh-apex-psi-05-02 Abstract PSI-05 defines a cryptographic attestation framework for financial disclosures, enabling third parties to recompute and verify company filings against their published figures. It establishes a public ledger of sealed financial statements, a verification protocol using RFC 8785 canonicalization with Ed25519 (classical) and ML-DSA-65 (post-quantum) signatures, and an API for querying reconciliation results. The framework supports ASX, NYSE, NSE, LSE, and Euronext filings. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 10 February 2027. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. Singh Expires 10 February 2027 [Page 1] Internet-Draft PSI-05 Financial Disclosure Integrity August 2026 This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3 3. Cryptographic Framework . . . . . . . . . . . . . . . . . . . 3 3.1. Canonicalization . . . . . . . . . . . . . . . . . . . . 3 3.2. Hashing . . . . . . . . . . . . . . . . . . . . . . . . . 3 3.3. Signing . . . . . . . . . . . . . . . . . . . . . . . . . 3 3.4. Ledger Recording . . . . . . . . . . . . . . . . . . . . 4 4. Verification Protocol . . . . . . . . . . . . . . . . . . . . 4 4.1. Recomputation Request . . . . . . . . . . . . . . . . . . 4 4.2. Independent Recomputation . . . . . . . . . . . . . . . . 4 4.3. Variance Detection . . . . . . . . . . . . . . . . . . . 4 4.4. Public Verification Endpoint . . . . . . . . . . . . . . 4 5. Ledger Structure . . . . . . . . . . . . . . . . . . . . . . 5 6. API Endpoints . . . . . . . . . . . . . . . . . . . . . . . . 5 7. Commercial Reuse . . . . . . . . . . . . . . . . . . . . . . 5 8. Security Considerations . . . . . . . . . . . . . . . . . . . 6 9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 6 10. References . . . . . . . . . . . . . . . . . . . . . . . . . 6 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 7 1. Introduction Public companies publish financial disclosures (10-K, 10-Q, 20-F, annual reports) that are legally binding but rarely independently verified. PSI-05 establishes a cryptographic framework where: * Every financial disclosure is sealed with SHA-256. * The seal is signed with Ed25519 (classical) and ML-DSA-65 (post- quantum) in a hybrid dual-signature scheme. * The dual signature is recorded in a public PSI-04 ledger. * Third parties can recompute the disclosed figures and verify against the sealed source. * Variance between published and recomputed figures is flagged. Singh Expires 10 February 2027 [Page 2] Internet-Draft PSI-05 Financial Disclosure Integrity August 2026 This creates a trust layer for financial data that is independent of the filing entity and quantum-resistant by design. 2. Terminology Sealed Disclosure: A financial document hashed with SHA-256 and signed with Ed25519 + ML-DSA-65 hybrid scheme, recorded in the PSI public ledger. Recomputation: Independent calculation of disclosed figures from source data using the PSI reconciliation engine. Variance: Difference between published and recomputed figures, expressed as a percentage. Ledger Entry: A PSI-04 attestation recording the dual seal hash, timestamp, and source citation. Hybrid Signature: A cryptographic envelope containing both an Ed25519 signature (classical) and an ML-DSA-65 signature (post- quantum) over the same canonicalized document. 3. Cryptographic Framework 3.1. Canonicalization All financial disclosures MUST be canonicalized using [RFC8785] (JSON Canonicalization Scheme) before hashing. 3.2. Hashing The canonicalized document MUST be hashed with SHA-256. 3.3. Signing The hash MUST be signed using a hybrid dual-signature scheme: a. Classical signature: Ed25519 [RFC8032] b. Post-quantum signature: ML-DSA-65 (NIST FIPS 204) Both signatures MUST be included in the attestation bundle. Verifiers MUST validate at least one signature. Verifiers SHOULD validate both for maximum assurance. Singh Expires 10 February 2027 [Page 3] Internet-Draft PSI-05 Financial Disclosure Integrity August 2026 The classical Ed25519 signature provides backwards compatibility with existing tooling. The ML-DSA-65 signature provides quantum resistance. The hybrid scheme ensures security against both classical and quantum adversaries. Implementations SHOULD transition to ML-DSA-65 as the primary signature by 1 January 2028. Ed25519 alone is NOT quantum- resistant and SHOULD NOT be used without a post-quantum counterpart. 3.4. Ledger Recording The dual signature, hash, timestamp, and source URL MUST be recorded in the PSI public ledger as a PSI-04 attestation [PSI04]. 4. Verification Protocol 4.1. Recomputation Request A verifier requests a company's financial disclosure via the PSI API: GET /api/v1/companies/{ticker}/filings/{year}/{type} Response includes the sealed document hash, dual signatures, and source citation. 4.2. Independent Recomputation The verifier recomputes the disclosed figures from the source data and compares against the published figures. 4.3. Variance Detection If variance exceeds a threshold (default: 0.1%), the verifier flags the discrepancy in the PSI ledger. 4.4. Public Verification Endpoint Any party may verify a sealed disclosure via: GET /api/v1/verify/{hash} Response includes: * match: true/false * sealed_at: ISO 8601 timestamp * source: URL of original filing Singh Expires 10 February 2027 [Page 4] Internet-Draft PSI-05 Financial Disclosure Integrity August 2026 * recomputed_figures: JSON object * signatures: { ed25519: valid/invalid, ml_dsa_65: valid/invalid } 5. Ledger Structure The PSI ledger maintains a registry of sealed disclosures: { "company_id": "UBER", "filing_type": "10-K", "fiscal_year": 2025, "sealed_at": "2026-03-15T10:30:00Z", "hash": "a3f2e8...", "source": "https://sec.gov/Archives/edgar/data/...", "signatures": { "ed25519": "base64-encoded-ed25519-signature", "ml_dsa_65": "base64-encoded-ml-dsa-65-signature" }, "recomputed_at": "2026-08-09T20:40:00Z", "variance": 0.0003, "status": "verified" } 6. API Endpoints Five REST API endpoints are defined for the PSI ledger: GET /api/v1/companies List all companies with sealed disclosures GET /api/v1/companies/{ticker}/filings Get all sealed filings for a company GET /api/v1/verify/{hash} Verify a sealed disclosure hash GET /api/v1/ledger/stats Total seals, companies, daily activity POST /api/v1/seal Submit a new financial disclosure for sealing The POST /api/v1/seal endpoint accepts a JSON body with company_id, filing_type, fiscal_year, document, and source_url. It returns the seal hash and both signatures (Ed25519 and ML-DSA-65). 7. Commercial Reuse The PSI ledger is free to read and cite. Commercial reuse above 1,000 rows per year requires a royalty agreement with Rockyfilms888 Pty Ltd (ABN 71672237795). Royalty tiers: Singh Expires 10 February 2027 [Page 5] Internet-Draft PSI-05 Financial Disclosure Integrity August 2026 +======+======================+======================+ | Tier | Annual Row Threshold | Per-Row Fee (AUD) | +======+======================+======================+ | A | <= 1,000 | Free | +------+----------------------+----------------------+ | B | 1,001 - 100,000 | $0.001 | +------+----------------------+----------------------+ | C | > 100,000 | $0.0001 (negotiable) | +------+----------------------+----------------------+ Table 1 Exemptions: Personal research, academic citation, journalism, public- interest reporting, and regulatory compliance audits. 8. Security Considerations * Sealed disclosures are immutable once recorded in the ledger. * Ed25519 signatures prevent classical tampering. * ML-DSA-65 signatures prevent quantum tampering. * The hybrid dual-signature scheme ensures security against both classical and quantum adversaries. * Public ledger ensures transparency and verifiability. * Recomputation is deterministic and verifiable by any party. * Private keys MUST be stored in hardware security modules (HSM) or equivalent secure enclaves. * Signatures MUST be timestamped with a trusted time source. 9. IANA Considerations This document has no IANA actions. 10. References [FIPS204] NIST, "Module-Lattice-Based Digital Signature Standard", August 2024, . [PSI04] Singh, K., "PSI-04: Evidentiary Document Integrity", July 2026, . Singh Expires 10 February 2027 [Page 6] Internet-Draft PSI-05 Financial Disclosure Integrity August 2026 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . [RFC8032] Josefsson, S. and I. Liusvaara, "Edwards-Curve Digital Signature Algorithm (EdDSA)", RFC 8032, DOI 10.17487/RFC8032, January 2017, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, . [RFC8554] McGrew, D., Curcio, M., and S. Fluhrer, "Leighton-Micali Hash-Based Signatures", RFC 8554, DOI 10.17487/RFC8554, April 2019, . [RFC8785] Rundgren, A., Jordan, B., and S. Erdtman, "JSON Canonicalization Scheme (JCS)", RFC 8785, DOI 10.17487/RFC8785, June 2020, . Author's Address Kawaljeet Singh Apex Intelligence Empire Balaclava, Victoria Australia Email: kawaljeet.singh3008@gmail.com URI: https://apex-infrastructure.com Singh Expires 10 February 2027 [Page 7]