W3C

2004 Route des Lucioles Sophia Antipolis 06902 France chris@w3.org

Internet Media Types This memo serves to register and document the font Top Level Type, under which the Internet Media subtypes for representation formats for fonts may be registered. This document also serves as a registration application for a set of intended subtypes, which are representative of some existing subtypes already in use, and currently registered under the "application" tree by their separate registrations.

[Note to the RFC Editor: Please remove this section upon publication.] This section is non-normative. The source for this specification is maintained on GitHub. The issues list is also on GitHub. Discussion should be on the mailing list justfont@ietf.org.

The process of setting type in computer systems and other forms of text presentation systems uses fonts in order to provide visual representations of the glyphs. Just as with images, for example, there are a number of ways to represent the visual information of the glyphs. Early font formats often used bitmaps, as these could have been carefully tuned for maximum readability at a given size on low-resolution displays. More recently, scalable vector outline fonts have come into widespread use: in these fonts, the outlines of the glyphs are described, and the presentation system renders the outline in the desired position and size. Over time, a number of standard formats for recording font descriptions have evolved. This document defines a new top-level Internet Media Type "font" according to Section 4.2.7 of . This top-level type indicates that the content specifies font data. Under this top-level type, different representation formats of fonts may be registered. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 .

Historically there has not been a registration of formats for fonts. More recently, there have been several representation formats registered as media subtypes under the "application" top-level type (for example, application/font-woff). However, with the rapid adoption of web fonts (based on the data from HTTP Archive showing a huge increase in web font usage from 1% in the end of 2010 to 50% across all sites in the beginning of 2015) custom fonts on the web have become a core web resource. As the in-depth analysis shows, the lack of the intuitive top-level font type is causing significant confusion among developers - while currently defined font subtypes are severely under-utilized there are many more sites that already use non-existent (but highly intuitive) media types such as "font/woff", "font/ttf" and "font/truetype". At the same time, the majority of sites resort to using generic types such as "application/octet-stream", "text/plain" and "text/html"; or use unregistrable types such as "application/x-font-ttf". Contrary to the expectations of the W3C WebFonts Working Group which developed WOFF, the officially defined media types such as "application/font-woff" and "application/font-sfnt" see a very limited use - their adoption rates trail far behind as the actual use of web fonts continues to increase. The members of the W3C WebFonts WG concluded that the use of "application" top-level type is not ideal. First, the "application" sub-tree is treated (correctly) with great caution with respect to viruses and other active code. Secondly, the lack of a top-level type means that there is no opportunity to have a common set of optional parameters, such as are specified here. Third, fonts have a unique set of licensing and usage restrictions, which makes it worthwhile to identify this general category with a unique top-level type. The W3C WebFonts WG decided that the situation can be significantly improved if a set of font media types is registered using "font" as a dedicated top-level type. Based on the data analysis presented above, we conclude that it is the presence of simple and highly intuitive media types for images that caused their widespread adoption, where the correct usage of existing media types reaches over 97% for all subtypes in the "image" tree. The WG considers that, considering a rapid adoption of fonts on the web, the registration of the top-level media type for fonts along with the intuitive set of subtypes that reflect popular and widely used data formats would further stimulate the adoption of web fonts, significantly simplify web server configuration process and facilitate the proper use of media types for fonts.

Fonts are interpreted data structures that represent collections of different tables containing data that represent different types of information, including glyph outlines in various formats, hinting instructions, metrics and layout information for multiple languages and writing systems, rules for glyph substitution and positioning, etc. In particular, the hinting instructions for TrueType glyphs represent executable code which has the potential to be maliciously constructed (for example, intended to hang the interpreter). There are many existing, already standardized font table tags and formats that allow an unspecified number of entries containing predefined data fields for storage of variable length binary data. Many existing font formats (TrueType , OpenType and OFF , SIL Graphite, WOFF, etc.) are based on the table-based SFNT (scalable font) format which is extremely flexible, highly extensible and offers an opportunity to introduce additional table structures when needed, in an upward-compatible way that would not affect existing font rendering engines and text layout implementations. However, this very extensibility may present specific security concerns – the flexibility and ease of adding new data structures makes it easy for any arbitrary data to be hidden inside a font file. There is a significant risk that the flexibility of font data structures may be exploited to hide malicious binary content disguised as a font data component. Fonts may contain 'hints', which are programmatic instructions that are executed by the font engine for the alignment of graphical elements of glyph outlines with the target display pixel grid. Depending on the font technology utilized in the creation of a font these hints may represent active code interpreted and executed by the font rasterizer. Even though hints operate within the confines of the glyph outline conversion system and have no access outside the font rendering engine, hint instructions can be, however, quite complex, and a maliciously designed complex font could cause undue resource consumption (e.g. memory or CPU cycles) on a machine interpreting it. Indeed, fonts are sufficiently complex that most (if not all) interpreters cannot be completely protected from malicious fonts without undue performance penalties. Widespread use of fonts as necessary components of visual content presentation warrants that careful attention should be given to security considerations whenever a font is either embedded into an electronic document or transmitted alongside media content as a linked resource. While many existing font formats provide certain levels of protection of data integrity (such mechanisms include e.g. checksums and digital signatures), font data formats provide neither privacy nor confidentiality protection internally; if needed, such protection should be provided externally.

This specification registers a new top-level type, "font", in the standards tree; adds it as an alternative value of "Type Name" in the media types registration form ; and registers several subtypes for it.

The "font" as the primary media content type indicates that the content identified by it requires certain graphic subsystem such as font rendering engine (and, in some cases, text layout and shaping engine) to process it as font data, which in turn may require certain level of hardware capabilities such as certain levels of CPU performance and available memory. The "font" media type does not provide any specific information about the underlying data format and how the font information should be interpreted - the subtypes defined within a "font" tree name the specific font formats. Unrecognized sub-types of "font" should be treated as "application/octet-stream". Implementations may pass unrecognized subtypes to a common font-handling system, if such a system is available.

New font formats should be registered using the online form . RFC 6838 should be consulted on registration procedures. In particular the font specification should preferably be freely available. If the font format can contain multiple fonts, a fragment identifier syntax should also be defined. Note that new parameter sub-values may be defined in the future. If an implementation does not recognize a sub-value in the comma-separated list, it should ignore the sub-value and continue processing the other sub-values in the list.

In this section the initial entries under the top-level 'font' media type are specified. They also serve as examples for future registrations. For each subtype, an @font-face format identifer is listed. This is for use with the @font-face src descriptor, defined by the CSS3 Fonts specification . That specification is normative; the identifiers here are informative.

font sfnt None. Values: a comma-separated subset of: TTF, CFF, SVG This parameter can be used to specify the type of outlines provided by the font. Value "TTF" shall be used when a font resource contains glyph outlines in TrueType format, value "CFF" shall be used to identify fonts containing PostScript/CFF outlines , and value SVG shall be used to identify fonts that include SVG outlines. TTF, CFF or SVG outlines can be present in various combinations in the same font file, therefore, this optional parameter is a list containing one or more items, separated by commas. Order in the list is not significant. Values: a comma-separated subset of: OTL, AAT, SIL This parameter identifies the type of implemented support for advanced text layout features. The predefined values "OTL", "AAT" and "SIL" respectively indicate support for OpenType text layout, Apple Advanced Typography or Graphite SIL. More than one shaping and layout mechanism may be provided by the same font file, therefore, this optional parameter is a list containing one or more items, separated by commas. Order in the list is not significant. Binary. As it was noted in the first paragraph of the "Security considerations" section, a single font file can contain encoding of the same glyphs using several different representations, e.g., both TrueType and PostScript (CFF) outlines. Existing font rendering engines may not be able to process some of the particular outline formats, and downloading a font resource that contains only unsupported glyph data format would be futile. Therefore, it is useful to clearly identify the format of the glyph outline data within a font using an optional parameter, and allow applications to make decisions about downloading a particular font resource sooner. Similarly, another optional parameter identifies the type of text shaping and layout mechanism that is provided by a font. ISO/IEC 14496-22 "Open Font Format" (OFF) specification being developed by ISO/IEC SC29/WG11. All applications that are able to create, edit or display textual media content. The TrueType fonts and OFF / OpenType fonts containing TrueType outlines should use 0x00010000 as the 'sfnt' version number. The OFF / OpenType fonts containing CFF data should use the tag 'OTTO' as 'sfnt' version number. Font file extensions used for OFF / OpenType fonts: .ttf, .otf Typically, .ttf extension is only used for fonts containing TrueType outlines, while .otf extension can be used for any OpenType/OFF font, either with TrueType or CFF outlines. (no code specified) public.font none. none. The existing registration application/font-sfnt is deprecated in favor of font/sfnt. Vladimir Levantovsky (vladimir.levantovsky@monotype.com). COMMON None The ISO/IEC 14496-22 "Open Font Format" specification is a product of the ISO/IEC JTC1 SC29/WG11. The ISO/IEC has change control over this specification.

font ttf None. Values: a comma-separated subset of: OTL, AAT, SIL This parameter identifies the type of support mechanism for advanced text layout features. The predefined values "OTL", "AAT" and "SIL" respectively indicate support for OpenType text layout, Apple Advanced Typography or Graphite SIL. More than one shaping and layout mechanism may be provided by the same font file, therefore, this optional parameter is a list containing one or more items, separated by commas. Order in the list is not significant. Binary. As it was noted in the first paragraph of the "Security considerations" section, a single font file can contain encoding of the same glyphs using several different representations, e.g., both TrueType and PostScript (CFF) outlines. Existing font rendering engines may not be able to process some of the particular outline formats, and downloading a font resource that contains only unsupported glyph data format would be futile. Therefore, it is useful to clearly identify the format of the glyph outline data within a font using an optional parameter, and allow applications to make decisions about downloading a particular font resource sooner. Similarly, another optional parameter identifies the type of text shaping and layout mechanism that is provided by a font. ISO/IEC 14496-22 "Open Font Format" (OFF) specification being developed by ISO/IEC SC29/WG11. All applications that are able to create, edit or display textual media content. The TrueType fonts and OFF / OpenType fonts containing TrueType outlines should use 0x00010000 as the 'sfnt' version number. Font file extensions used for TrueType / OFF / OpenType fonts: .ttf, .otf Typically, .ttf extension is only used for fonts containing TrueType outlines, while .otf extension may be used for any OpenType/OFF font, either with TrueType or CFF outlines. (no code specified) public.truetype-font truetype none. Vladimir Levantovsky (vladimir.levantovsky@monotype.com). COMMON None The ISO/IEC 14496-22 "Open Font Format" specification is a product of the ISO/IEC JTC1 SC29/WG11. The ISO/IEC has change control over this specification.

font otf None. Values: a comma-separated subset of: TTF, CFF, SVG This parameter can be used to specify the type of outlines provided by the font. Value "TTF" shall be used when a font resource contains glyph outlines in TrueType format, value "CFF" shall be used to identify fonts containing PostScript/CFF outlines, and value SVG shall be used to identify fonts that include SVG outlines. TTF, CFF or SVG outlines can be present in various combinations in the same font file, therefore, this optional parameter is a list containing one or more items, separated by commas. Order in the list is not significant. Binary. As it was noted in the first paragraph of the "Security considerations" section, a single font file can contain encoding of the same glyphs using several different representations, e.g., both TrueType and PostScript (CFF) outlines. Existing font rendering engines may not be able to process some of the particular outline formats, and downloading a font resource that contains only unsupported glyph data format would be futile. Therefore, it is useful to clearly identify the format of the glyph outline data within a font using an optional parameter, and allow applications to make decisions about downloading a particular font resource sooner. Similarly, another optional parameter identifies the type of text shaping and layout mechanism that is provided by a font. ISO/IEC 14496-22 "Open Font Format" (OFF) specification being developed by ISO/IEC SC29/WG11. All applications that are able to create, edit or display textual media content. The TrueType fonts and OFF / OpenType fonts containing TrueType outlines should use 0x00010000 as the 'sfnt' version number. The OFF / OpenType fonts containing CFF outlines should use the tag 'OTTO' as 'sfnt' version number. There is no magic number for SVG outlines; these are always accompanied by either TrueType or CFF outlines and thus use the corresponding magic number. Font file extensions used for OFF / OpenType fonts: .ttf, .otf Typically, .ttf extension is only used for fonts containing TrueType outlines, while .otf extension can be used for any OpenType/OFF font, either with TrueType, CFF or SVG outlines. (no code specified) public.opentype-font opentype none. Vladimir Levantovsky (vladimir.levantovsky@monotype.com). COMMON None The ISO/IEC 14496-22 "Open Font Format" specification is a product of the ISO/IEC JTC1 SC29/WG11. The ISO/IEC has change control over this specification.

font collection None. Values: a comma-separated subset of: TTF, CFF, SVG This parameter can be used to specify the type of outlines provided by the font. Value "TTF" shall be used when a font resource contains glyph outlines in TrueType format, value "CFF" shall be used to identify fonts containing PostScript/CFF outlines, and value SVG shall be used to identify fonts that include SVG outlines. TTF, CFF or SVG outlines can be present in various combinations in the same font file, therefore, this optional parameter is a list containing one or more items, separated by commas. Order in the list is not significant. Binary. As it was noted in the first paragraph of the "Security considerations" section, a single font file can contain encoding of the same glyphs using several different representations, e.g., both TrueType and PostScript (CFF) outlines. Existing font rendering engines may not be able to process some of the particular outline formats, and downloading a font resource that contains only unsupported glyph data format would be futile. Therefore, it is useful to clearly identify the format of the glyph outline data within a font using an optional parameter, and allow applications to make decisions about downloading a particular font resource sooner. Similarly, another optional parameter identifies the type of text shaping and layout mechanism that is provided by a font. ISO/IEC 14496-22 "Open Font Format" (OFF) specification being developed by ISO/IEC SC29/WG11. All applications that are able to create, edit or display textual media content. The TrueType fonts and OFF / OpenType fonts containing TrueType outlines should use 0x00010000 as the 'sfnt' version number. The OFF / OpenType fonts containing CFF outlines should use the tag 'OTTO' as 'sfnt' version number. There is no magic number for SVG outlines; these are always accompanied by either TrueType or CFF outlines and thus use the corresponding magic number. Font file extensions used for OFF / TrueType and OpenType fonts: .ttc (no code specified) public.truetype-collection-​font collection A string, no longer than 63 characters and restricted to the printable ASCII subset, codes 33 – 126, except for the 10 characters '[', ']', '(', ')', '{', '}', '<', '>', '/', '%'. If this string matches one of the PostScript names (name ID=6) in the name table, that font is selected. For example, #Foo-Bold refers to the font with PostScript name Foo-Bold. If the name does not match, or if a fragment is not specified, the first font in the collection is matched. Note that the order of fonts in collections may change as the font is revised, so relying on a particular font in a collection always being first is unwise. Vladimir Levantovsky (vladimir.levantovsky@monotype.com). COMMON None The ISO/IEC 14496-22 "Open Font Format" specification is a product of the ISO/IEC JTC1 SC29/WG11. The ISO/IEC has change control over this specification.

font woff None. None. Binary. None. This media type registration updates the WOFF specification at W3C. WOFF is used by Web browsers, often in conjunction with HTML and CSS. The signature field in the WOFF header MUST contain the "magic number" 0x774F4646 ('wOFF') woff (no code specified) org.w3.woff woff none. The existing registration application/font-woff is deprecated in favor of font/woff. Chris Lilley (www-font@w3.org). COMMON None The WOFF specification is a work product of the World Wide Web Consortium's WebFonts Working Group. The W3C has change control over this specification.

font woff2 None. None. Binary. WOFF 2.0 is an improvement on WOFF 1.0. The two formats have different Internet Media Types, different @font-face formats, and may be used in parallel. This media type registration is extracted from the WOFF 2.0 specification at W3C. WOFF 2.0 is used by Web browsers, often in conjunction with HTML and CSS. The signature field in the WOFF header MUST contain the "magic number" 0x774F4632 ('wOF2') woff2 (no code specified) org.w3.woff2 woff2 ,A string, no longer than 63 characters and restricted to the printable ASCII subset, codes 33 – 126, except for the 10 characters '[', ']', '(', ')', '{', '}', '<', '>', '/', '%'. If this string matches one of the PostScript names (name ID=6) in the name table, that font is selected. For example, #Foo-Bold refers to the font with PostScript name Foo-Bold. If the name does not match, or if a fragment is not specified, the first font in the collection is matched (the only font, if the WOFF does not encode a collection). Note that the order of fonts in collections may change as the font is revised, so relying on a particular font in a collection always being first is unwise. Chris Lilley (www-font@w3.org). COMMON None The WOFF2 specification is a work product of the World Wide Web Consortium's WebFonts Working Group. The W3C has change control over this specification.

In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. This document defines procedures for the specification and registration of media types for use in HTTP, MIME, and other Internet protocols. This memo documents an Internet Best Current Practice. This CSS3 module describes how font properties are specified and how font resources are loaded dynamically. The contents of this specification are a consolidation of content previously divided into CSS3 Fonts and CSS3 Web Fonts modules. The description of font load events was moved into the CSS3 Font Load Events module. International Organization for Standardization ISO/IEC 14496-22:2015 specifies the Open Font Format (OFF) specification, the TrueType™ and Compact Font Format (CFF) outline formats, and the TrueType hinting language. Many references to both TrueType and PostScript exist throughout this document, as Open Font Format fonts combine the two technologies This document specifies the WOFF font packaging format. This format was designed to provide lightweight, easy-to-implement compression of font data, suitable for use with CSS @font-face rules. Any properly licensed TrueType/OpenType/Open Font Format file can be packaged in WOFF format for Web use. User agents decode the WOFF file to restore the font data such that it will display identically to the input font. The WOFF format also allows additional metadata to be attached to the file; this can be used by font designers or vendors to include licensing or other information, beyond that present in the original font. Such metadata does not affect the rendering of the font in any way, but may be displayed to the user on request. The WOFF format is not intended to replace other formats such as TrueType/OpenType/Open Font Format or SVG fonts, but provides an alternative solution for use cases where these formats may be less optimal, or where licensing considerations make their use less acceptable. Based on experience with WOFF 1.0, which is widely deployed, this specification was developed to provide improved compression and thus lower use of network bandwidth, while still allowing fast decompression even on mobile devices. This is achieved by combining a content-aware preprocessing step and improved entropy coding, compared to the Flate compression used in WOFF 1.0. Compact Font Format (also known as CFF font format, Type 2 font format, or CFF/Type 2 font format) is a lossless compaction of the Type 1 format using Type 2 charstrings. The PostScript or Type 1 flavor of OpenType fonts, also called OpenType CFF, contains glyph outlines and hints in a CFF table OpenType is a format for scalable computer fonts. It was built on its predecessor TrueType, retaining TrueType's basic structure and adding many intricate data structures for prescribing typographic behavior. TrueType is an outline font standard developed by Apple and Microsoft in the late 1980s as a competitor to Adobe's Type 1 fonts used in PostScript. Scalable Vector Graphics (SVG) is an XML-based vector image format for two-dimensional graphics with support for interactivity and animation. The SVG specification is an open standard developed by the World Wide Web Consortium (W3C) since 1999. Analysis of the Alexa top 480K websites, from Nov 15 2010 to Feb 15 2015. It shows a steady rise in the number of sites using webfonts, from 1% in 2010 to 50% in 2015. Adoption rate of registered media types for TrueType, OpenType and WOFF fonts (in the application tree) is extremely low, ranging from 1% to 0.07%. In practice, a wide range of unregistered types is observed, including significant use (90.8%, for WOFF) of the non-existent font top-level type. This contrasts with more than 90% adoption rate for PNG, GIF, and JPEG which have intuitive Media Types in the image tree. W3C Following discussion at several phone calls and face to face meetings, the W3C WebFonts Working group decided that the widely used but unregistered font/* top-level type should be standardized, and created this action item to track it. IANA Application form for new Internet Media Types.