Overview
ISO/IEC 14496-22:2019/Amd 2:2023 is an amendment to Part 22 of the ISO/IEC 14496 series - the Open Font Format (OFF) - that extends colour font functionality and updates security and file-format details. The amendment formalizes new data types (e.g., Offset24), enhances the DSIG (digital signature) table for font authentication, and expands the COLR table to support richer multi‑colored glyphs, gradients, transformations and variable-font features.
Key topics and technical requirements
- DSIG (Digital Signature) table
- Defines a DSIG header (uint32 version = 1, uint16 numSignatures, uint16 flags = 0x0001) and an array of signature records.
- Signature blocks use industry formats (PKCS#7 / PKCS#9) and common public/private key architectures.
- Permission bit (bit 0) can prohibit counter-signatures if set by the signer.
- Signing workflow: remove existing DSIG, update table directory and checksums, hash the revised font data (secure one‑way hash such as MD5 is cited as an example), create the PKCS#7 signature, add DSIG and recalculate checksumAdjustment.
- Validation reproduces the signing steps on an in‑memory copy; checksumAdjustment changes do not invalidate verification.
- Special handling for font collections (TTC): DSIG for a TTC must be the last table and signs the entire collection; individual font signatures inside a TTC are discouraged.
- New and updated data types
- Offset24 introduced: a 24‑bit offset (uint24 equivalent), NULL offset = 0x000000.
- COLR (Color) table - two versions
- COLR version 0: layer-based color glyphs made from glyph outlines (glyf, CFF, CFF2) + solid color fills from CPAL; layering with alpha blending.
- COLR version 1: advanced graphic constructs (gradients, affine transforms, blending/compositing, Paint tables) organized as directed acyclic graphs; supports variable-font attributes (e.g., variable gradient stops, variable alpha).
- CPAL dependency: all colors are referenced by palette index into the CPAL table; if COLR exists without CPAL it is ignored.
Practical applications and target users
- Font developers and foundries - implement color glyphs, gradients, variable color fonts, and embed signing metadata.
- Application and OS developers (renderers, browsers, text engines) - add support for COLR v0/v1 rendering, CPAL palette selection, DSIG verification and policy enforcement.
- Digital publishers and enterprises - validate font source/integrity via DSIG and enforce embedding permissions.
- Security teams and system administrators - define policies to allow or block unsigned fonts or manage trust anchors.
Keywords: Open Font Format, ISO/IEC 14496-22, COLR, CPAL, DSIG, color font, PKCS#7, variable fonts, font signature, Offset24.
Related standards
- Other parts of the ISO/IEC 14496 series (see ISO/IEC websites).
- Industry signature formats and web security recommendations referenced by W3C and major platform vendors (used by DSIG and PKCS#7-based signing).