35bb8c9910
smart-byte-core
- `wire`: canonical CBOR for any serde type. `from_slice` refuses bytes that
are not the decoded object's own encoding. Serde otherwise accepts an array
of integers for a byte string, a byte string for text, and an array for a
struct, each a second encoding the SAID does not cover.
- Controller AIDs. Controller signatures are checked against the key states
replayed logs establish. One strict Ed25519 rule.
- The envelope: attested provenance, ownership chain and joule cost. Cargo
carries a registered type tag.
smart-byte-keri-witness
- Events are §2 SAIDs over canonical CBOR.
- The default verifier is spec v1. It replays one event at a time and says
which event it refused. It refuses `dip`, which skipped the pre-rotation
check entirely, plus zero thresholds, duplicate keys, rotations after an
empty `n`, and extension members.
- Extension mode, fixed:
- Witness receipts carried their own key, so anyone could receipt in any
witness's name. Witnesses are now named by their keys, and receipts sign
everything they claim.
- Duplicity evidence was gathered from unverified receipts.
- Recovery accepted any keys; it now needs its witnesses' receipts.
- OOBIs were signed by an embedded key; they are now controller signatures.
- Configuration traits were never enforced, so they are gone.
VC, BBS+, CRDT, mDL, lockstep, libp2p and the CLI move to the new envelope.
smart-byte-conformance
- kel_vectors.json: 25 vectors.
- envelope_vectors.json: 18 vectors, checked against the logs' key states.
- The SAID and signature vectors are rebuilt on the real objects, so all the
files describe one set of parties.
- Planted defects in every file are caught on their own vectors.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
72 lines
8 KiB
JSON
72 lines
8 KiB
JSON
[
|
|
{
|
|
"name": "sig-001-issuer-attestation",
|
|
"description": "What the issuer signs to issue env-001: the canonical encoding of {cargo, issuer, nonce, recipient} (envelope wire format §3). The key is RFC 8032's first test key, and Ed25519 is deterministic, so this is the one signature that key makes over this message — the 64 bytes after the algorithm identifier in env-001's provenance signature.",
|
|
"message_hex": "a465636172676fa26474797065016562797465734da1666d6963726f731a05f5e100656e6f6e636550dcc74ebbcedebda361fb18a7abec95d96669737375657278354269343733616278673233626d666e32617564337136786f743761706d3364366f6361357a6a6161646c6c6969726863366976637169726563697069656e747835427a7870656366786d3370646c666536786d36707334356b7668647869656c6f35356b74736a356e646b6e7968676e7237326f7161",
|
|
"signing_key_seed": "9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60",
|
|
"verifying_key": "d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a",
|
|
"signature": "88d2bbf7bf3ea95bb33866235bae150ac65c7371bc2776f17eb0944884cc8a4e7d402947d334d07e871acd0c305e6791d6e9b5747a683b6c58fc81f21dbcdd09",
|
|
"expected_verify": true,
|
|
"error": null
|
|
},
|
|
{
|
|
"name": "sig-002-key-event",
|
|
"description": "Alice's inception event (kel-002, event 0), signed by the key it reveals: RFC 8032's second test key. The message is the event's canonical encoding (identity spec §3.5).",
|
|
"message_hex": "ab61618061647835457a7870656366786d3370646c666536786d36707334356b7668647869656c6f35356b74736a356e646b6e7968676e7237326f716161697835427a7870656366786d3370646c666536786d36707334356b7668647869656c6f35356b74736a356e646b6e7968676e7237326f7161616b815821013d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c616e81783545716d7361776967366f7a6e6834623563626f7671756b767a78613575356a62696b6c6b726c776874646f3672627273796a666e7161706061730061746369637061766b534259544531304a534f4e626b7401626e7401",
|
|
"signing_key_seed": "4ccd089b28ff96da9db6c346ec114e0f5b8a319f35aba624da8cf6ed4fb8a6fb",
|
|
"verifying_key": "3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c",
|
|
"signature": "c0999c04eee90f056e29a2753f1a90665636394e819578d4cc2a2a40afb841b9a89a759b881adc095be848ba4ce9be9f64da3f4efcb5f935c0c20723ab68da07",
|
|
"expected_verify": true,
|
|
"error": null
|
|
},
|
|
{
|
|
"name": "sig-003-message-swapped",
|
|
"description": "sig-002's signature presented with sig-001's message: an adversary swaps the message and forwards the original signature. The signature is well-formed but binds another message, so verification MUST fail.",
|
|
"message_hex": "a465636172676fa26474797065016562797465734da1666d6963726f731a05f5e100656e6f6e636550dcc74ebbcedebda361fb18a7abec95d96669737375657278354269343733616278673233626d666e32617564337136786f743761706d3364366f6361357a6a6161646c6c6969726863366976637169726563697069656e747835427a7870656366786d3370646c666536786d36707334356b7668647869656c6f35356b74736a356e646b6e7968676e7237326f7161",
|
|
"signing_key_seed": "4ccd089b28ff96da9db6c346ec114e0f5b8a319f35aba624da8cf6ed4fb8a6fb",
|
|
"verifying_key": "3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c",
|
|
"signature": "c0999c04eee90f056e29a2753f1a90665636394e819578d4cc2a2a40afb841b9a89a759b881adc095be848ba4ce9be9f64da3f4efcb5f935c0c20723ab68da07",
|
|
"expected_verify": false,
|
|
"error": "signature_invalid"
|
|
},
|
|
{
|
|
"name": "sig-004-wrong-key",
|
|
"description": "sig-002's message and signature, presented with another key — the one the all-zero seed derives. The signature is valid for the key that made it, which is not this one, so verification MUST fail.",
|
|
"message_hex": "ab61618061647835457a7870656366786d3370646c666536786d36707334356b7668647869656c6f35356b74736a356e646b6e7968676e7237326f716161697835427a7870656366786d3370646c666536786d36707334356b7668647869656c6f35356b74736a356e646b6e7968676e7237326f7161616b815821013d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c616e81783545716d7361776967366f7a6e6834623563626f7671756b767a78613575356a62696b6c6b726c776874646f3672627273796a666e7161706061730061746369637061766b534259544531304a534f4e626b7401626e7401",
|
|
"signing_key_seed": "0000000000000000000000000000000000000000000000000000000000000000",
|
|
"verifying_key": "3b6a27bcceb6a42d62a3a8d02a6f0d73653215771de243a63ac048a18b59da29",
|
|
"signature": "c0999c04eee90f056e29a2753f1a90665636394e819578d4cc2a2a40afb841b9a89a759b881adc095be848ba4ce9be9f64da3f4efcb5f935c0c20723ab68da07",
|
|
"expected_verify": false,
|
|
"error": "signature_invalid"
|
|
},
|
|
{
|
|
"name": "sig-005-malformed-signature",
|
|
"description": "sig-002's signature cut to 63 bytes. It is refused as malformed before any cryptography runs, and an implementation MUST NOT panic on it.",
|
|
"message_hex": "ab61618061647835457a7870656366786d3370646c666536786d36707334356b7668647869656c6f35356b74736a356e646b6e7968676e7237326f716161697835427a7870656366786d3370646c666536786d36707334356b7668647869656c6f35356b74736a356e646b6e7968676e7237326f7161616b815821013d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c616e81783545716d7361776967366f7a6e6834623563626f7671756b767a78613575356a62696b6c6b726c776874646f3672627273796a666e7161706061730061746369637061766b534259544531304a534f4e626b7401626e7401",
|
|
"signing_key_seed": "4ccd089b28ff96da9db6c346ec114e0f5b8a319f35aba624da8cf6ed4fb8a6fb",
|
|
"verifying_key": "3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c",
|
|
"signature": "c0999c04eee90f056e29a2753f1a90665636394e819578d4cc2a2a40afb841b9a89a759b881adc095be848ba4ce9be9f64da3f4efcb5f935c0c20723ab68da",
|
|
"expected_verify": false,
|
|
"error": "malformed_signature"
|
|
},
|
|
{
|
|
"name": "sig-006-non-canonical-s-rejected",
|
|
"description": "sig-002's signature with its scalar S replaced by S + L: the same scalar, written outside [0, L). RFC 8032 §5.1.7 requires refusing it; accepting it would make signatures malleable, giving a second valid-looking signature for one message and key.",
|
|
"message_hex": "ab61618061647835457a7870656366786d3370646c666536786d36707334356b7668647869656c6f35356b74736a356e646b6e7968676e7237326f716161697835427a7870656366786d3370646c666536786d36707334356b7668647869656c6f35356b74736a356e646b6e7968676e7237326f7161616b815821013d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c616e81783545716d7361776967366f7a6e6834623563626f7671756b767a78613575356a62696b6c6b726c776874646f3672627273796a666e7161706061730061746369637061766b534259544531304a534f4e626b7401626e7401",
|
|
"signing_key_seed": "4ccd089b28ff96da9db6c346ec114e0f5b8a319f35aba624da8cf6ed4fb8a6fb",
|
|
"verifying_key": "3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c",
|
|
"signature": "c0999c04eee90f056e29a2753f1a90665636394e819578d4cc2a2a40afb841b9956e6bf8a27dee613185405d2be39db464da3f4efcb5f935c0c20723ab68da17",
|
|
"expected_verify": false,
|
|
"error": "signature_invalid"
|
|
},
|
|
{
|
|
"name": "sig-007-non-canonical-key-rejected",
|
|
"description": "A verifying key spelled with y = p + 3: an out-of-range encoding of the valid, large-order point with y = 3. RFC 8032 §5.1.3 requires decoding to fail when y is not below p, so the key is refused as malformed before any verification runs — one key has one spelling. There is no seed: no key pair has this spelling.",
|
|
"message_hex": "ab61618061647835457a7870656366786d3370646c666536786d36707334356b7668647869656c6f35356b74736a356e646b6e7968676e7237326f716161697835427a7870656366786d3370646c666536786d36707334356b7668647869656c6f35356b74736a356e646b6e7968676e7237326f7161616b815821013d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c616e81783545716d7361776967366f7a6e6834623563626f7671756b767a78613575356a62696b6c6b726c776874646f3672627273796a666e7161706061730061746369637061766b534259544531304a534f4e626b7401626e7401",
|
|
"signing_key_seed": null,
|
|
"verifying_key": "f0ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f",
|
|
"signature": "c0999c04eee90f056e29a2753f1a90665636394e819578d4cc2a2a40afb841b9a89a759b881adc095be848ba4ce9be9f64da3f4efcb5f935c0c20723ab68da07",
|
|
"expected_verify": false,
|
|
"error": "malformed_verifying_key"
|
|
}
|
|
]
|