9b5854aa4c
Each family whose corpus lacked them gets the three signatures a verifier that checks only the equation accepts and WAI's rule refuses (wai_sig::forgeries): the identity as the key with (R, S) = (B, 1), the identity spelled y = p + 1, and R of small order under the base point. Every case is new; no existing vector's expectation changes. - jwp: group_signer_key_identity_forged, group_signer_key_identity_y_not_reduced (step 1, bad_signer_key), group_signature_r_small_order (step 2). - signer: anchor_root_identity_forged, anchor_root_identity_y_not_reduced, anchor_root_signature_r_small_order (not anchored, key_log_signature_invalid). - pack: mutations receipt-key-identity, receipt-key-identity-y-not-reduced, receipt-r-small-order (receipt-signature); receipts/ v1-key-identity, v1-key-identity-y-not-reduced, v1-r-small-order, marked "signature": "refused", which wai-pack and pack_verify.py now read. - quantum-ops: cal_q3_ and job_bell_ key_identity, key_identity_y_not_reduced and r_small_order, "verifies": false, which wai_quantum_ops_vectors checks are refused and hash as pinned. claim (signer_key_identity, signer_key_identity_y_not_reduced, signature_r_small_order and others) and http (sig-key-identity, -long, sig-r-small-order) had them already. OER/2 keeps its own rule. PackageReceipt::signing_payload (v1) and the calibration and job receipts' signing_payload are public, so a corpus generator can sign over them; wai-quantum re-exports wai_sig beside ed25519_dalek. Co-Authored-By: Claude Opus 5.5 <[email protected]>
30 lines
1.2 KiB
JSON
30 lines
1.2 KiB
JSON
{
|
|
"cases": [
|
|
{
|
|
"file": "v1-legacy.json",
|
|
"receipt_hash": "71a9da59a3202abb2c3fd22ee692b1485a9c674bb8c311f4c82455e6be29ae2b"
|
|
},
|
|
{
|
|
"file": "v1-unmetered.json",
|
|
"receipt_hash": "2e9a0a221436ae3b7161b67c0d3215d8bed8f4c2f1a0b27ad786762120f71f31"
|
|
},
|
|
{
|
|
"file": "v1-key-identity.json",
|
|
"receipt_hash": "60731f7c63ea66eb14850f2578714ed83548914f5722ce1f1400416d03523106",
|
|
"signature": "refused",
|
|
"about": "the identity point as the key, with (R, S) = (B, 1): the equation holds for every message, and the key is of small order"
|
|
},
|
|
{
|
|
"file": "v1-key-identity-y-not-reduced.json",
|
|
"receipt_hash": "9a0167d70cb2bb27b05431c05f4fa907ca47beff5fd21df80533f49b368922f3",
|
|
"signature": "refused",
|
|
"about": "the identity spelled y = p + 1, with (R, S) = (B, 1): a decoder that reduces y reads the identity, and the encoding is not canonical"
|
|
},
|
|
{
|
|
"file": "v1-r-small-order.json",
|
|
"receipt_hash": "4b9ebabaf3d1cd22bf5ed0335840913c3162adc6d9315a587523c2654e0d6cdf",
|
|
"signature": "refused",
|
|
"about": "the base point as the key (its discrete logarithm is 1), R the identity and S = k: the equation holds, and R is of small order"
|
|
}
|
|
]
|
|
}
|