Internet-Draft Signed Evaluation Receipts October 2026
Gruszka Expires 13 April 2027 [Page]
Workgroup:
Network Working Group
Internet-Draft:
draft-gruszka-signed-evaluation-receipts-00
Published:
Intended Status:
Informational
Expires:
Author:
K. Gruszka
b7n0de

Signed Evaluation Receipts

Abstract

This document defines a Signed Evaluation Receipt: one JSON object that records one evaluation result, whether a stated threshold held for a stated metric of a stated test suite, and signs it with Ed25519 over a domain-separated encoding of its canonical bytes. A receipt shows who signed the recorded bytes. It does not show that the recorded result is true. A receipt does not prove registration with a Transparency Service. In SCITT, transparency additionally requires registering a Signed Statement carrying the receipt or its digest with a Transparency Service and verifying the resulting SCITT Receipt. Registration and verification of the resulting SCITT Receipt are outside this document.

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on 13 April 2027.

▲

Table of Contents

1. Introduction

Evaluation results for software and models are often reported as numbers in documents, dashboards or logs. A reader who receives such a number later has no means to tell whether the bytes they see are the bytes the reporting party produced. This document defines a small, fixed format that gives that means and nothing more.

A Signed Evaluation Receipt (receipt) holds exactly one assertion: for a named test suite and metric, whether the score met a threshold under a stated comparator. The model and the dataset are named only through salted commitments. The assertion is serialized with the JSON Canonicalization Scheme [RFC8785], and the resulting bytes are signed with Ed25519 [RFC8032] over a pre-authentication encoding that binds a fixed type.

A receipt establishes integrity and origin: the holder of the signing key signed exactly these bytes. It does not establish truth. Section 6 lists what a receipt does not prove, and that list is part of the definition. A receipt carries no inclusion proof and names no log. A receipt does not prove registration with a Transparency Service. In SCITT [RFC9943], transparency additionally requires registering a Signed Statement carrying the receipt or its digest with a Transparency Service and verifying the resulting SCITT Receipt. Registration and verification of the resulting SCITT Receipt are outside this document.

The receipt is the smallest unit in a line of work: one document asks how a signed statement is named unambiguously, this document fixes the bytes of a receipt, and a companion document describes how existing envelopes cite such a receipt by digest. This document defines no envelope mapping and no transport.

2. Conventions and Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.

Issuer:

The party that creates and signs a receipt.

Receiver:

The party that verifies a receipt. The Receiver fixes the verification key before verification, by means outside this document.

Payload:

The JSON object that holds the assertion (Section 3.2).

B:

The RFC 8785 byte string of the Payload. B is what is signed (through PAE).

PAE:

The pre-authentication encoding of Section 4.1.

Commitment:

A string that binds an identifier without revealing it (Section 3.3).

3. Receipt Format

3.1. The Receipt Object

A receipt is one JSON text [RFC8259] that is an I-JSON message [RFC7493]: UTF-8 without a byte order mark, no string (member names included) that contains a surrogate or noncharacter code point ([RFC7493] Section 2.1), no duplicate member names at any level, and nothing before or after the JSON text other than insignificant whitespace ([RFC8259] Section 2). Member names are compared after unescaping ([RFC8259] Section 8.3), and so are string values: the receipt object is not canonicalized, so \/ and / are the same character. Its top-level value is an object with exactly these members:

schema:

The type of Section 4.2, as a string.

payload_b64:

The base64 encoding of B ([RFC4648] Section 4, with padding). It MUST be the canonical encoding: re-encoding the decoded bytes yields the same string ([RFC4648] Section 3.5).

signature:

An object with exactly the members alg and sig, or exactly alg, sig and key. alg is the string ed25519; sig is the canonical base64 encoding, as for payload_b64, of the 64-byte Ed25519 signature; key, when present, is the canonical base64 encoding, as for payload_b64, of a 32-byte Ed25519 public key and is only a hint (Section 5).

The receipt object has no number member. The number rules of I-JSON are not checked when the receipt is parsed: a number where a string belongs fails the step that checks that member.

The receipt names no trust instance: it carries no certificate, no address from which a key could be fetched, and no list of trusted parties.

3.2. The Payload

The Payload is a JSON object with exactly the members of Table 1. criteria_digest is the only optional member: a Payload either has it or not, and has no member that Table 1 does not list. The Type column states every constraint a member has except two: the pattern sha256: followed by 64 lowercase hexadecimal digits that the commitments of Section 3.3 and criteria_digest (Section 3.5) share, and the agreement of passed with the comparison. A member that violates its row fails step 6 of Section 5, a commitment or a criteria_digest without that pattern fails step 7, and a passed that disagrees fails step 8.

Table 1
Member Type Meaning
schema string, exactly the payload schema identifier below version of the payload format
suite non-empty string name of the test suite
suite_version non-empty string version of the test suite
metric non-empty string name of the metric
comparator string, one of >=, >, <=, < how the score is compared with the threshold
threshold decimal string the threshold the score is compared with
score decimal string the score the Issuer reports
passed true or false whether score comparator threshold holds
n integer from 1 to 2^53 - 1 number of samples the Issuer reports; not checked against anything
model_id_commit string commitment (Section 3.3) to the model identifier
dataset_id_commit string commitment (Section 3.3) to the dataset identifier
commit_alg string, exactly sha256-salted-v1 the commitment construction
timestamp string, a timestamp as defined below when the Issuer states the evaluation ran
criteria_digest string; OPTIONAL digest (Section 3.5) of the criteria set the Issuer states this result belongs to

The payload schema identifier is

https://signed-evidence.org/eval-receipt/v1

In this document a digit is one of the ASCII digits 0 to 9 (0x30 to 0x39); no other Unicode digit counts. A lowercase hexadecimal digit is a digit or one of the ASCII letters a to f (0x61 to 0x66). A non-empty string has at least one character. A decimal string is an optional minus sign, then either the digit 0 or a digit from 1 to 9 followed by any digits, then optionally a full stop followed by one or more digits; it has no exponent and no plus sign. A timestamp is a UTC date-time of [RFC3339] in exactly this form, with an uppercase T and Z:

YYYY-MM-DDTHH:MM:SSZ

The date exists in the proleptic Gregorian calendar: the day of the month is at most the maximum that [RFC3339] Section 5.7 gives for its month and year, under the leap-year rule of [RFC3339] Appendix C, so the year 0000 exists and is a leap year; the hour is 00 to 23, the minute 00 to 59 and the second 00 to 59. A timestamp has no fractional seconds and no offset other than Z, and this format does not represent a leap second. passed MUST equal the result of comparing score with threshold under comparator as exact decimal numbers. The Payload thus carries one assertion, and a Receiver can check that its parts agree with each other; it cannot check that they agree with any evaluation.

The version of the format lives in the schema identifier. A later version uses a different identifier under

https://signed-evidence.org/eval-receipt/

3.3. Salted Commitments

sha256-salted-v1 is defined as follows. The Issuer takes a salt of exactly 16 bytes from a cryptographically secure random source and keeps it. The commitment is the string sha256: followed by the 64 lowercase hexadecimal digits of SHA-256 over the salt bytes immediately followed by the UTF-8 bytes of the identifier. There is no separator and no length prefix. SHA-256 is the hash function specified in [RFC6234]. A Receiver checks only the pattern sha256: followed by 64 lowercase hexadecimal digits; it can check the binding only when the Issuer discloses salt and identifier. Reusing the same salt and identifier produces the same commitment across receipts. Fresh salts avoid this equality link but do not make receipts unlinkable, because verification keys and other shared values may still link them (Section 9).

3.4. The Bytes B

B is the serialization of the Payload under [RFC8785]. For a valid Payload that means: members sorted by name, no insignificant whitespace, the integer n as its decimal digits, and strings with the escaping of [RFC8785] Section 3.2.2.2. A Receiver MUST reject payload bytes that are not their own RFC 8785 serialization, so that exactly one B exists for each Payload. The check (step 5 of Section 5) runs before the member checks of step 6, so it applies RFC 8785 in full, including the number serialization of its Section 3.2.2.3: a B that carries 1.0, 1e0 or 9007199254740993 is not its own serialization.

3.5. The Criteria Digest

criteria_digest is OPTIONAL. When present, it is the string sha256: followed by the 64 lowercase hexadecimal digits of SHA-256 over the bytes of a criteria set, exactly as the publisher of that criteria set fixed them. A criteria set is any document that states how an evaluation is to be judged, for example its metric, comparator and threshold; this document defines no format and no canonical form for it. A Receiver checks only the pattern (step 7 of Section 5). It can check the binding only when it holds the bytes of the criteria set, by computing SHA-256 over them. What the member does not show is part of Section 6.

As an informative example, the profile of [I-D.ozturk-scitt-prml-profile] carries in its hash mode the 32 octets of SHA-256 over the canonical bytes of a criteria set written in [PRML] as the payload of a Signed Statement. When the bytes of the criteria set are those canonical bytes, the 64 hexadecimal digits of criteria_digest are those 32 octets written in lowercase hexadecimal.

4. Signature

4.1. Pre-Authentication Encoding 

PAE(type, body) = "DSSEv1" SP LEN(type) SP type SP LEN(body) SP body

SP is the byte 0x20. LEN(x) is the number of bytes of x as ASCII decimal digits without leading zeros. type is the UTF-8 string of Section 4.2, body is B. "DSSEv1" is the six ASCII bytes of that literal. This is the pre-authentication encoding of DSSE [DSSE]; it is defined here so that this document can be implemented without it.

4.2. The Type

The type is the fixed string

application/vnd.signed-evidence.eval-receipt+json

It enters every signature. It MUST NOT change for this format, because a change would invalidate every signature made under it; a new format uses a new type. The string is a media type name in the vendor tree ([RFC6838] Section 3.2) with the +json structured syntax suffix ([RFC6839] Section 3.1). It is the same string that a DSSE envelope would carry as payloadType.

4.3. Signing

The signature is Ed25519 as defined in [RFC8032] Section 5.1, in its pure form, without context and without prehashing (not Ed25519ctx, not Ed25519ph):

sig = Ed25519-Sign(secret key, PAE(type, B))

4.4. Verification Profile

Ed25519 implementations differ on inputs that RFC 8032 leaves to choice [TAMING]. A Receiver MUST use this profile. In it, x*P is the scalar multiplication of the point P by the integer x, B' is the base point, and L is the order of B' ([RFC8032] Section 5.1).

  1. The public key A and the signature's first half R MUST be canonical encodings: decoding as in [RFC8032] Section 5.1.3 succeeds. That decoding rejects a y-coordinate that is not below p and the encoding of x = 0 with the sign bit set.

  2. A and R MUST have order L: L*A and L*R are the neutral element, and A and R are not the neutral element.

  3. The scalar S, the second half of the signature read as a little-endian integer, MUST be below L ([RFC8032] Section 5.1.7).

  4. With k = SHA-512(R || A || PAE(type, B)) read as a little-endian integer reduced modulo L, the equation S*B' = R + k*A MUST hold (the cofactorless equation). In the hash input, R and A are the 32-byte encodings exactly as received: the first 32 bytes of the 64-byte signature and the verification key.

A signature that fails any rule is invalid. The rules are checked in the order given, and within rules 1 and 2 the key before R. Because A and R have order L, the cofactorless equation of rule 4 and the cofactored equation 8*S*B' = 8*R + 8*k*A of [RFC8032] Section 5.1.7 accept exactly the same signatures. This specification defines individual verification only. A randomized batch result MUST NOT substitute for checking all four rules for each signature. A Receiver MUST NOT leave out any of the four rules.

5. Verification Procedure

Input: the receipt bytes and the verification key that the Receiver fixed. The verification-key input is exactly 32 octets containing the compressed Edwards-point encoding of A defined by [RFC8032] Section 5.1.2. Any textual or file representation used to supply those octets is outside this specification. The steps are evaluated in order; the result is PASS only when every step succeeds, and the first step that fails gives FAIL. String values are compared after unescaping. A Receiver that stops because it reached a resource limit (Section 8) reports a resource-limit error; that is neither PASS nor the FAIL of one of the steps below.

  1. Parse the receipt as one I-JSON text (Section 3.1). A byte order mark, bytes that are not UTF-8, a surrogate or noncharacter code point, duplicate member names at any level, anything before or after the JSON text other than insignificant whitespace ([RFC8259] Section 2), a top-level value that is not an object with exactly the members schema, payload_b64 and signature, or a signature that is not an object with exactly alg and sig or exactly alg, sig and key: FAIL.

  2. schema is not the type of Section 4.2: FAIL.

  3. payload_b64 is not a string of the base64 alphabet with padding, or not the canonical encoding of the bytes it decodes to: FAIL. Otherwise those bytes are B.

  4. B is not one I-JSON text whose value is an object, under the rules of step 1 (byte order mark, UTF-8, surrogates and noncharacters, duplicate names as in [RFC7493] Section 2.3, which [RFC8785] Section 3.1 requires of its input, trailing data): FAIL. Numbers are not judged here: each is read as an IEEE 754 double, rounded to nearest with ties to even and overflowing to infinity, and a number that so has no finite double, such as 1e400, fails step 5.

  5. B is not the RFC 8785 serialization of the value parsed in step 4 (Section 3.4): FAIL. This step alone would also reject every B that step 4 rejects for a byte order mark, duplicate names or trailing data; step 4 is kept so that every Receiver reports the same failing step.

  6. The Payload's member set differs from Section 3.2 (every member of Table 1, with criteria_digest optional), or a member violates its row of Table 1 (its type, the schema and commit_alg values, a non-empty string, the comparator set, the decimal grammar, the range of n, the timestamp form): FAIL.

  7. A commitment, or criteria_digest when present, is not sha256: followed by 64 lowercase hexadecimal digits: FAIL.

  8. passed differs from the comparison of score with threshold: FAIL.

  9. signature.alg is not the string ed25519, or signature.sig is not a string that is the canonical base64 encoding of exactly 64 bytes: FAIL.

  10. signature.key is present and is not a string that is the canonical base64 encoding of the verification key: FAIL. A key in the receipt is only a hint.

  11. The signature is invalid under the profile of Section 4.4 for the verification key and PAE(type, B) with the fixed type: FAIL. A signature made over PAE with another type fails here.

Table 2 lists every vector of Appendix A with the step at which it fails first; each of the eleven steps is the first failing step of at least one vector. A vector shows the first failing step under in-order evaluation; it does not show that a later step would also reject it. Of the profile, the vectors cover rule 1 for the key (N18) and for R (N17), rule 2 for the key (N12, and N61 for a key of mixed order) and for R (N16, and N59 for an R of mixed order), rule 3 (N6) and rule 4 (N7). No vector isolates rule 1 from rule 2. Rule 1 rejects 40 encodings that a decoder reducing y modulo p would try (y from p to p + 18 with either sign bit, and x = 0 with the sign bit set); read by such a decoder, 14 of them give no point, 6 give points of small order and 20 give points of mixed order. None of these 26 points has order L, so a Receiver without rule 1 would still reject each of them under rule 2; N17 and N18 use y = p + 1, which such a decoder reads as the neutral element. P6 has no key hint, so step 10 has nothing to compare. N61 uses the mixed-order test key, the issuer's public point plus a point of order 8, with a signature that satisfies the cofactorless equation; only rule 2 rejects it. Its expected result is FAIL at step 11, rule 2 for the verification key. N59 uses the issuer test key and an R of mixed order, the point r*B' plus the same point of order 8, with S = r + k*a mod L; the cofactored equation holds and the cofactorless one does not, and rule 2 rejects R before rule 4 is reached. P9 and N51 to N55 pin rules that no other vector reaches: the year 0000 (P9), ASCII digits (N51), a number without a finite double (N52), the key before R in rules 1 and 2 (N53, N54), and no number rule at step 1 (N55). N56 writes n as 1800.0, which a Receiver that skipped the number serialization of RFC 8785 would accept. P10 carries the optional criteria_digest; N57 gives it uppercase hexadecimal digits and N58 the value null. The receipts without the member are the other positive vectors. P12 is the receipt of P1 followed by a line feed, insignificant whitespace that step 1 admits. N60 is B of P1 followed by a line feed, signed anew: step 4 admits the line feed under the rules of step 1, and step 5 rejects B, because its RFC 8785 serialization has no insignificant whitespace. P13 is a line feed followed by the receipt of P1, insignificant whitespace before the JSON text that step 1 admits.

Table 2
ID Step Expected What it shows
P1 all PASS pass
P2 all PASS recorded-failure
P4 all PASS escaped-receipt-string
P6 all PASS no-key-hint
P7 all PASS comparator-le
P8 all PASS exact-decimal
P9 all PASS year-0000
P10 all PASS criteria-digest
P12 all PASS receipt-trailing-whitespace
P13 all PASS receipt-leading-whitespace
N1 4 FAIL no-duplicate-names
N2 2 FAIL receipt-schema
N3 4 FAIL no-trailing-data
N4 7 FAIL commitment-pattern
N5 5 FAIL jcs-form
N6 11 (profile 3) FAIL s-less-than-L
N7 11 (profile 4) FAIL pae-type
N9 10 FAIL key-hint
N10 6 FAIL payload-schema
N11 8 FAIL result-consistency
N12 11 (profile 2, key) FAIL small-order-key
N13 3 FAIL canonical-base64
N14 1 FAIL receipt-duplicate-names
N15 9 FAIL signature-alg
N16 11 (profile 2, R) FAIL small-order-R
N17 11 (profile 1, R) FAIL noncanonical-R
N18 11 (profile 1, key) FAIL noncanonical-key
N19 1 FAIL receipt-trailing-data
N20 1 FAIL receipt-member-set
N21 1 FAIL signature-member-set
N22 1 FAIL receipt-duplicate-after-unescaping
N23 1 FAIL receipt-bom
N24 3 FAIL payload-not-base64
N25 9 FAIL signature-length
N26 9 FAIL signature-canonical-base64
N30 6 FAIL commit-alg
N31 6 FAIL payload-member-missing
N32 6 FAIL payload-member-extra
N33 6 FAIL payload-member-type
N34 6 FAIL decimal-grammar
N35 6 FAIL n-at-least-1
N36 6 FAIL timestamp-calendar
N37 6 FAIL timestamp-leap-second
N38 6 FAIL comparator-set
N39 6 FAIL non-empty-string
N40 4 FAIL payload-utf8
N41 4 FAIL payload-lone-surrogate
N42 4 FAIL payload-noncharacter
N43 4 FAIL payload-bom
N44 1 FAIL receipt-utf8
N45 1 FAIL receipt-lone-surrogate
N46 1 FAIL receipt-noncharacter
N48 8 FAIL comparator-gt
N49 8 FAIL comparator-lt
N50 6 FAIL n-below-2-53
N51 6 FAIL ascii-digits
N52 5 FAIL number-without-double
N53 11 (profile 1, key) FAIL key-before-R-rule-1
N54 11 (profile 2, key) FAIL key-before-R-rule-2
N55 2 FAIL receipt-number-at-step-2
N56 5 FAIL number-serialization
N57 7 FAIL criteria-digest-pattern
N58 6 FAIL criteria-digest-type
N59 11 (profile 2, R) FAIL mixed-order-R
N60 5 FAIL payload-trailing-whitespace
N61 11 (profile 2, key) FAIL mixed-order-key

6. What a Receipt Does Not Prove

Verification establishes that the receipt passes the format, consistency and signature checks in Section 5 under the Receiver's selected key. It does not establish that the Issuer's claims are true. In particular:

8. Security Considerations

This section follows the guidance of [RFC3552]. The attacker considered can read, create, modify, replay and reorder receipts, and controls every input except the Receiver's choice of verification key.

Forgery. Without the secret key an attacker cannot produce a receipt that verifies under the Receiver's key, given the security of Ed25519. The Receiver fixes the key out of band; a key carried in the receipt is only compared with it and never used on its own. A Receiver that took the key from the receipt would accept any receipt from anyone.

Domain separation. The signature covers PAE(type, B), not B alone. A signature made by the same key for another purpose over the same bytes, or over the same bytes under another type, does not verify as a receipt, and a receipt signature does not verify as a signature over B in another protocol that also signs with PAE under a different type. The type is fixed (Section 4.2) so that this separation does not depend on a value the attacker controls.

Ambiguous bytes. Duplicate member names (also when they differ only in escapes), trailing data, a byte order mark, surrogate or noncharacter code points, non-canonical base64 and payload bytes that are not their own RFC 8785 form, for example a number written as 1800.0, would let two parsers see different content behind one signature. The procedure of Section 5 rejects each of them, so that one B has one meaning. The receipt object around B is not canonical and not signed (Section 6).

Ed25519 edge cases. Implementations of Ed25519 differ in whether they accept a non-reduced S, non-canonical point encodings, points of small or mixed order, and whether they use the cofactored or the cofactorless equation [TAMING]. A receipt format whose verdict depends on the library would let one Receiver accept what another rejects. The profile of Section 4.4 fixes each choice. Vector N12 shows why rule 2 refuses points of small order: with the neutral element as verification key, R = S*B' satisfies the cofactorless equation for every message. N61 and N59 show why rule 2 requires order L: under a key or with an R of mixed order the cofactored and the cofactorless equation can disagree (N59), and a verifier that does not check the order accepts N61 under either equation. In the measurements of Section 11, the plain Ed25519 verification of a general library accepted the signatures of vectors N12, N16, N18 and N61 and rejected those of N6, N17 and N59; the profile of Section 4.4 rejects all seven. A Receiver that relies on a library verdict alone therefore does not implement this format.

Resource limits. This document defines no universal input-size limit. Oversized inputs, long strings and deeply nested invalid JSON can exhaust memory or processing time before verification completes. Implementations SHOULD apply documented resource limits before and during processing of untrusted input. Reaching a limit MUST NOT produce PASS and is reported as a resource-limit error, not as a completed format or signature verdict under Section 5.

Commitments. A commitment with a short or guessable salt can be tested against candidate identifiers. The salt is therefore 16 bytes from a cryptographically secure source and stays with the Issuer.

Replay. A receipt is a static statement, not an authentication token. Showing a valid receipt proves nothing about the party that shows it.

Key compromise. A compromised key can sign receipts with any content. This document defines no revocation; a Receiver that needs it uses means outside this document.

9. Privacy Considerations

Model and dataset identifiers appear only as salted commitments. Reusing the same salt and identifier produces the same commitment across receipts. Fresh salts avoid this equality link but do not make receipts unlinkable, because verification keys and other shared values may still link them: identical suite, metric and timestamp values link receipts, and so does the same criteria_digest. Disclosing salt and identifier to one Receiver discloses them to everyone that Receiver passes them on to.

10. IANA Considerations

This document has no IANA actions. Registering the media type of Section 10.1 in the vendor tree goes directly to IANA ([RFC6838] Section 3.2) and is not an action of this document.

10.1. Media Type Registration Template

The following template for application/vnd.signed-evidence.eval-receipt+json is given for information.

This media type identifies the canonical payload bytes B defined in Section 3.4. It does not identify the receipt object of Section 3.1, which may be transferred as application/json. The receipt object's schema member remains the fixed format discriminator defined in Section 4.2.

Type name:

application

Subtype name:

vnd.signed-evidence.eval-receipt+json

Required parameters:

N/A

Optional parameters:

N/A

Encoding considerations:

Binary. The representation is B, a UTF-8 JSON text in the canonical form defined in Section 3.4, without a byte order mark.

Security considerations:

See Section 8 of this document. A Receiver verifies a receipt only under a key it fixed before verification and only with the procedure of Section 5.

Interoperability considerations:

When processing completes without a resource-limit error, the procedure of Section 5 and the signature profile of Section 4.4 determine the verdict and first failing step on the vectors of Appendix A. The type string enters every signature (Section 4.2).

Published specification:

This document.

Applications that use this media type:

Issuers and Receivers of evaluation payloads, including DSSE envelopes that carry B and digest references that identify B.

Fragment identifier considerations:

As specified for the +json structured syntax suffix in [RFC6839] Section 3.1. This document defines no fragment identifier of its own.

Additional information:

Deprecated alias names for this type: N/A. Magic number(s): N/A. File extension(s): N/A. Macintosh file type code(s): N/A.

Person and email address to contact for further information:

The author of this document, see the Author's Address section.

Intended usage:

COMMON

Restrictions on usage:

N/A

Author:

The author of this document, see the Author's Address section.

Change controller:

The author of this document, see the Author's Address section.

11. Implementation Status

This section records the status of known implementations at the time of writing, following [RFC7942], and is to be removed before publication.

The vectors of Appendix A were produced by a generator script whose two runs are byte-identical, and verified by two verifiers: one written by the author of the generator, and one written from the text of this document alone, without access to the generator. Both verifiers reach the expected verdict and the expected first failing step on every vector. An implementation of this format in the proofbundle project, behind an explicit option and with these vectors as conformance tests, is under way on a work branch and not released. That implementation refuses a verification key that rule 1 of Section 4.4 rejects or that is a point of small order, as in vectors N12, N18, N53 and N54, already when the Receiver fixes it and before it reads any receipt; the verdict stays FAIL. A key of mixed order, as in N61, it refuses at step 11.

In the measurements behind Appendix A, the plain Ed25519 verification of pyca/cryptography 41.0.7 accepted the signatures of vectors N12 (small-order key), N16 (small-order R), N18 (non-canonical key) and N61 (mixed-order key), and rejected those of N6 (S not below L), N17 (non-canonical R) and N59 (mixed-order R).

12. References

12.1. Normative References

[RFC2119]
Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, , <https://www.rfc-editor.org/info/rfc2119>.
[RFC3339]
Klyne, G. and C. Newman, "Date and Time on the Internet: Timestamps", RFC 3339, , <https://www.rfc-editor.org/info/rfc3339>.
[RFC4648]
Josefsson, S., "The Base16, Base32, and Base64 Data Encodings", RFC 4648, , <https://www.rfc-editor.org/info/rfc4648>.
[RFC6234]
Eastlake 3rd, D. and T. Hansen, "US Secure Hash Algorithms (SHA and SHA-based HMAC and HKDF)", RFC 6234, , <https://www.rfc-editor.org/info/rfc6234>.
[RFC6838]
Freed, N., Klensin, J., and T. Hansen, "Media Type Specifications and Registration Procedures", BCP 13, RFC 6838, , <https://www.rfc-editor.org/info/rfc6838>.
[RFC6839]
Hansen, T. and A. Melnikov, "Additional Media Type Structured Syntax Suffixes", RFC 6839, , <https://www.rfc-editor.org/info/rfc6839>.
[RFC7493]
Bray, T., Ed., "The I-JSON Message Format", RFC 7493, , <https://www.rfc-editor.org/info/rfc7493>.
[RFC8032]
Josefsson, S. and I. Liusvaara, "Edwards-Curve Digital Signature Algorithm (EdDSA)", RFC 8032, , <https://www.rfc-editor.org/info/rfc8032>.
[RFC8174]
Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, , <https://www.rfc-editor.org/info/rfc8174>.
[RFC8259]
Bray, T., Ed., "The JavaScript Object Notation (JSON) Data Interchange Format", STD 90, RFC 8259, , <https://www.rfc-editor.org/info/rfc8259>.
[RFC8785]
Rundgren, A., Jordan, B., and S. Erdtman, "JSON Canonicalization Scheme (JCS)", RFC 8785, , <https://www.rfc-editor.org/info/rfc8785>.

12.2. Informative References

[DSSE]
Secure Systems Lab, "DSSE: Dead Simple Signing Envelope, protocol specification, version 1.0.2", , <https://github.com/secure-systems-lab/dsse/blob/v1.0.2/protocol.md>.
[I-D.abak-ai-evaluation-claim-preservation]
Abak, A. T., "Claim-Preserving Exchange of AI Evaluation Evidence", Work in Progress, Internet-Draft, draft-abak-ai-evaluation-claim-preservation-00, , <https://datatracker.ietf.org/doc/draft-abak-ai-evaluation-claim-preservation/00/>.
[I-D.chueayen-attestation-receipts]
Chueayen, A., "Enforcement Attestation Receipts for AI Inference Decisions", Work in Progress, Internet-Draft, draft-chueayen-attestation-receipts-03, , <https://datatracker.ietf.org/doc/draft-chueayen-attestation-receipts/03/>.
[I-D.farley-acta-signed-receipts]
Farley, T., "Signed Decision Receipts for Machine-to-Machine Access Control", Work in Progress, Internet-Draft, draft-farley-acta-signed-receipts-03, , <https://datatracker.ietf.org/doc/draft-farley-acta-signed-receipts/03/>.
[I-D.marques-asqav-compliance-receipts]
Gomes Marques, J. A., "Compliance Profile of Signed Action Receipts for AI Agents", Work in Progress, Internet-Draft, draft-marques-asqav-compliance-receipts-09, , <https://datatracker.ietf.org/doc/draft-marques-asqav-compliance-receipts/09/>.
[I-D.ozturk-scitt-prml-profile]
Öztürk, C., "A SCITT Profile for Pre-Run Evaluation Criteria (PRML)", Work in Progress, Internet-Draft, draft-ozturk-scitt-prml-profile-00, , <https://datatracker.ietf.org/doc/draft-ozturk-scitt-prml-profile/00/>.
[PRML]
Öztürk, C., Ed., "PRML: Pre-Registered ML Manifest Specification, Version 0.1", , <https://spec.falsify.dev/v0.1>.
[RFC3552]
Rescorla, E. and B. Korver, "Guidelines for Writing RFC Text on Security Considerations", BCP 72, RFC 3552, , <https://www.rfc-editor.org/info/rfc3552>.
[RFC7942]
Sheffer, Y. and A. Farrel, "Improving Awareness of Running Code: The Implementation Status Section", BCP 205, RFC 7942, , <https://www.rfc-editor.org/info/rfc7942>.
[RFC9162]
Laurie, B., Messeri, E., and R. Stradling, "Certificate Transparency Version 2.0", RFC 9162, , <https://www.rfc-editor.org/info/rfc9162>.
[RFC9943]
Birkholz, H., Delignat-Lavaud, A., Fournet, C., Deshpande, Y., and S. Lasker, "An Architecture for Trustworthy and Transparent Digital Supply Chains", RFC 9943, , <https://www.rfc-editor.org/info/rfc9943>.
[TAMING]
Chalkias, K., Garillot, F., and V. Nikolaenko, "Taming the Many EdDSAs", Security Standardisation Research (SSR 2020), LNCS 12529, , <https://eprint.iacr.org/2020/1244>.

Appendix A. Test Vectors

Vector identifiers are labels: a P vector expects PASS, an N vector expects FAIL, and gaps in the numbering carry no meaning.

The vectors below are complete: a verifier needs only the bytes given here and the verification key named for each vector.

A.1. Constants and Test Material

Receipt schema, also the type of Section 4.2:

application/vnd.signed-evidence.eval-receipt+json

Payload schema:

https://signed-evidence.org/eval-receipt/v1

commit_alg:

sha256-salted-v1

PURE TEST KEYS AND SALTS. They MUST NOT be used for any real receipt.

Issuer test key, Ed25519 seed (hex, 32 bytes) and public key (base64, 32 bytes):

2365520410748de8778b544410b15792fcf174e0fba4806a8c1afbdbb0946b07
x7ppA99DtumHO/Au0M/gumSK8IwCzNwPiID92BSFbak=

Second test key, used only as a wrong hint, Ed25519 seed (hex, 32 bytes) and public key (base64, 32 bytes):

1497efc27315bf3c5fbfa514c8761efa81b669f0b354dd22b762be7209da3b6a
tvFn0pKiOvm4eNHsrH3T6OsiYk7X0aMfy60UyuObvMQ=

Mixed-order test key, used only by vector N61: the public point of the issuer test key plus a point of order 8. It has no RFC 8032 seed; the discrete logarithm of its prime-order part is the secret scalar of the issuer test key. The point of order 8, which vector N59 also adds to its R (hex, 32 bytes), and the public key (base64, 32 bytes):

c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a
JBz17qgxoLE067Bf5k3hKZ6Pfmfx/iD8IEaped1NGoM=

The model commitment: salt (hex, 16 bytes), identifier, commitment:

2d1845bc523b3c2635ab90af343f33eb
acme/model-x@2026-09
sha256:904de42562f9a19651e19eb7ab165e4ffe114ce5a2f98e57da5838959684fb0f

The dataset commitment: salt (hex, 16 bytes), identifier, commitment:

6233feb59b670c391abeed0a61973c40
acme/suite-data@v3
sha256:a21ba4d96c803d4263dd3d2161bc039a30f4462bd59470e31ba5a9ab0a9b3b63

The example criteria set of vectors P10 and N57: its bytes (hex), and criteria_digest over them:

7b22636f6d70617261746f72223a223e3d222c226d6574726963223a22616363
7572616379222c227375697465223a2261636d652d7361666574792d73756974
65222c227468726573686f6c64223a22302e383030227d0a
sha256:7ccedb152aba3740dcde20e4f4014e2875b863ed4a4062879558bf78df9ce41a

A.2. Vector Set

A.2.1. P1 (pass; expected PASS, step all)

A well-formed receipt: the signature over PAE(TYPE, B) verifies under the verification key, the commitments have the fixed pattern, and passed = true agrees with score >= threshold.

  • verification key: the issuer test key

  • payload bytes B: 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 871 bytes, SHA-256 02036d1f57509858330383755ec16c532bdc58b0f2d949464488d57abc9f95e7

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a22434247744e323639464f68505372357865307a6c
4a4753424e427a47696e457a38693031664d36312b4a4e614a50646e5a793148
626f596934656d686d384b5a715055337973546d726d434578537653786f637a
42413d3d227d7d

A.2.2. P2 (recorded-failure; expected PASS, step all)

A recorded failure (score below the threshold, passed = false) verifies exactly like a recorded success.

  • verification key: the issuer test key

  • payload bytes B: 459 bytes, SHA-256 07182e9bff69baa8ab9a5646d69b5118ccf3780b903b9a9d5b4bd0d9c9d70b87

  • receipt bytes: 871 bytes, SHA-256 2405d1783d1803ddea207c027622fba40b3e82161686505ee96988e306e17278

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a66616c73652c22736368656d61
223a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f65
76616c2d726563656970742f7631222c2273636f7265223a22302e373632222c
227375697465223a2261636d652d7361666574792d7375697465222c22737569
74655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a
22302e383030222c2274696d657374616d70223a22323032362d31302d303254
30303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a706d
5957787a5a53776963324e6f5a573168496a6f696148523063484d364c79397a
615764755a5751745a585a705a4756755932557562334a6e4c32563259577774
636d566a5a576c77644339324d534973496e4e6a62334a6c496a6f694d433433
4e6a49694c434a7a64576c305a534936496d466a625755746332466d5a585235
4c584e316158526c496977696333567064475666646d567963326c7662694936
496a45754d69347749697769644768795a584e6f6232786b496a6f694d433434
4d4441694c434a306157316c63335268625841694f6949794d4449324c544577
4c544179564441774f6a41774f6a417757694a39222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a226c4e61433357554f6c4566486b676c646e576266
31756e6b6a655a49677057325856306d6c31416953356e647975312b79525578
4b3070673435304b2b66387058794156477631326a4a427471546677587a4873
44773d3d227d7d

A.2.3. P4 (escaped-receipt-string; expected PASS, step all)

The receipt writes the schema with the JSON escape \/ for each solidus; compared after unescaping it is the receipt media type. The receipt object is not canonicalized.

  • verification key: the issuer test key

  • payload bytes B: 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 872 bytes, SHA-256 c2a7943f0ea3de6e9da88c11925b1e112d32f697a403f07fcfbc3776bca10e72

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e5c2f766e642e7369676e65642d65766964656e6365
2e6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a
7b22616c67223a2265643235353139222c226b6579223a227837707041393944
74756d484f2f4175304d2f67756d534b384977437a4e77506949443932425346
62616b3d222c22736967223a22434247744e323639464f68505372357865307a
6c4a4753424e427a47696e457a38693031664d36312b4a4e614a50646e5a7931
48626f596934656d686d384b5a715055337973546d726d434578537653786f63
7a42413d3d227d7d

A.2.4. P6 (no-key-hint; expected PASS, step all)

The signature object has exactly alg and sig, without a key hint; step 10 has nothing to compare.

  • verification key: the issuer test key

  • payload bytes B: 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 818 bytes, SHA-256 2c8144d50b4cc42a712d84e4d0417e52b0d8cbc484ad8e6d8d4b36a429b94ec1

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c22736967223a22434247744e32363946
4f68505372357865307a6c4a4753424e427a47696e457a38693031664d36312b
4a4e614a50646e5a793148626f596934656d686d384b5a715055337973546d72
6d434578537653786f637a42413d3d227d7d

A.2.5. P7 (comparator-le; expected PASS, step all)

comparator <= with score 0.762 below threshold 0.800 and passed = true; read as >= the comparison would not hold.

  • verification key: the issuer test key

  • payload bytes B: 458 bytes, SHA-256 9ed224ee6c53d1a6d66a7d5336f4079cead25b306e00f2b10fd1bc71ddc42742

  • receipt bytes: 871 bytes, SHA-256 a42bc3303128f7e18a5c05fabcb57904e054d9d4f1f5ba19186dad5c2e00130a

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223c3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e373632222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69493850534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a6332
4d694973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a22465a6a41565073694b6a76475877424848372b70
7a59454e6369566a387936674953427a58543333346f43646357362f47584f51
416d38336a30486153724f61485a7850714b335541706752556f636342485333
44413d3d227d7d

A.2.6. P8 (exact-decimal; expected PASS, step all)

comparator > with score 0.30000000000000001 and threshold 0.3: as exact decimals the score is greater; as binary floating-point numbers the two are equal.

  • verification key: the issuer test key

  • payload bytes B: 469 bytes, SHA-256 cb8d8913846e3ebdf7dae561682f122a09738c430a28137b083beb7722eaab48

  • receipt bytes: 887 bytes, SHA-256 9f24aa20ea7740cc4735d2fda04d50f19352b2c4769c5995e9bb2747e04110fb

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e222c22646174617365745f69645f636f
6d6d6974223a227368613235363a613231626134643936633830336434323633
6464336432313631626330333961333066343436326264353934373065333162
6135613961623061396233623633222c226d6574726963223a22616363757261
6379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a3930
3464653432353632663961313936353165313965623761623136356534666665
313134636535613266393865353764613538333839353936383466623066222c
226e223a313830302c22706173736564223a747275652c22736368656d61223a
2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f657661
6c2d726563656970742f7631222c2273636f7265223a22302e33303030303030
30303030303030303031222c227375697465223a2261636d652d736166657479
2d7375697465222c2273756974655f76657273696f6e223a22312e322e30222c
227468726573686f6c64223a22302e33222c2274696d657374616d70223a2232
3032362d31302d30325430303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b496977695a47463059584e6c64463970
5a46396a62323174615851694f694a7a614745794e54593659544978596d4530
5a446b32597a67774d3251304d6a597a5a47517a5a4449784e6a4669597a417a
4f57457a4d4759304e445979596d51314f5451334d47557a4d574a684e574535
5957497759546c694d3249324d794973496d316c64484a7059794936496d466a
5933567959574e35496977696257396b5a577866615752665932397462576c30
496a6f69633268684d6a55324f6a6b774e47526c4e4449314e6a4a6d4f574578
4f5459314d5755784f5756694e3246694d5459315a54526d5a6d55784d54526a
5a5456684d6d59354f4755314e3252684e54677a4f446b314f5459344e475a69
4d4759694c434a75496a6f784f4441774c434a7759584e7a5a5751694f6e5279
64575573496e4e6a6147567459534936496d68306448427a4f69387663326c6e
626d566b4c5756326157526c626d4e6c4c6d39795a79396c646d46734c584a6c
5932567063485176646a45694c434a7a593239795a534936496a41754d7a4177
4d4441774d4441774d4441774d4441774d4445694c434a7a64576c305a534936
496d466a625755746332466d5a5852354c584e316158526c4969776963335670
64475666646d567963326c7662694936496a45754d6934774969776964476879
5a584e6f6232786b496a6f694d43347a4969776964476c745a584e3059573177
496a6f694d6a41794e6930784d4330774d6c51774d446f774d446f774d466f69
66513d3d222c22736368656d61223a226170706c69636174696f6e2f766e642e
7369676e65642d65766964656e63652e6576616c2d726563656970742b6a736f
6e222c227369676e6174757265223a7b22616c67223a2265643235353139222c
226b6579223a22783770704139394474756d484f2f4175304d2f67756d534b38
4977437a4e7750694944393242534662616b3d222c22736967223a226e4a6870
53686f412f346a77676c52576b4d52702b64566e74764267496835394c344448
614759356453702f704e4e4f674d5a376c55316c34745937434a61564e30314b
64482b4974365049757630753762797042673d3d227d7d

A.2.7. P9 (year-0000; expected PASS, step all)

The timestamp is 0000-02-29T00:00:00Z: under the leap-year rule of RFC 3339 Appendix C the year 0000 exists and is a leap year.

  • verification key: the issuer test key

  • payload bytes B: 458 bytes, SHA-256 05e1786bef7020811b1643058645b8d77821b036d3e44c656120cc35f8c96ba3

  • receipt bytes: 871 bytes, SHA-256 c2358560b53847832e31dffbad8b1c52a93a7a10960cea5aee1e646ec137defa

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22303030302d30322d32395430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a41774d4441744d444974
4d6a6c554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a22304d7a63354571426e2b51504b427a554a4d4167
3339596651774b684242765047564c644a2f7372384354304769503555514f2f
522f5046315a6f746f5a32422f4d5977694a393972317775615a586751625a59
44773d3d227d7d

A.2.8. P10 (criteria-digest; expected PASS, step all)

The Payload carries the optional member criteria_digest: sha256: followed by the 64 lowercase hexadecimal digits of SHA-256 over the bytes of the example criteria set. A Receiver checks only its pattern.

  • verification key: the issuer test key

  • payload bytes B: 550 bytes, SHA-256 2241d1bcc2da953c9d7d7725398ef852363f3b4fa80c372754b1de539a26d846

  • receipt bytes: 995 bytes, SHA-256 75d4029e2470131e8e88d8ec129efd7b9d15092b668bf0ecb7b32eea3361b7ed

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c2263726974657269615f646967
657374223a227368613235363a37636365646231353261626133373430646364
6532306534663430313465323837356238363365643461343036323837393535
38626637386466396365343161222c22646174617365745f69645f636f6d6d69
74223a227368613235363a613231626134643936633830336434323633646433
6432313631626330333961333066343436326264353934373065333162613561
3961623061396233623633222c226d6574726963223a22616363757261637922
2c226d6f64656c5f69645f636f6d6d6974223a227368613235363a3930346465
3432353632663961313936353165313965623761623136356534666665313134
636535613266393865353764613538333839353936383466623066222c226e22
3a313830302c22706173736564223a747275652c22736368656d61223a226874
7470733a2f2f7369676e65642d65766964656e63652e6f72672f6576616c2d72
6563656970742f7631222c2273636f7265223a22302e383334222c2273756974
65223a2261636d652d7361666574792d7375697465222c2273756974655f7665
7273696f6e223a22312e322e30222c227468726573686f6c64223a22302e3830
30222c2274696d657374616d70223a22323032362d31302d30325430303a3030
3a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d4e796158526c636d6c68
583252705a32567a64434936496e4e6f595449314e6a6f3359324e6c5a474978
4e544a68596d457a4e7a51775a474e6b5a5449775a54526d4e4441784e475579
4f446331596a67324d32566b4e4745304d4459794f4463354e545534596d5933
4f47526d4f574e6c4e444668496977695a47463059584e6c644639705a46396a
62323174615851694f694a7a614745794e54593659544978596d45305a446b32
597a67774d3251304d6a597a5a47517a5a4449784e6a4669597a417a4f57457a
4d4759304e445979596d51314f5451334d47557a4d574a684e57453559574977
59546c694d3249324d794973496d316c64484a7059794936496d466a59335679
59574e35496977696257396b5a577866615752665932397462576c30496a6f69
633268684d6a55324f6a6b774e47526c4e4449314e6a4a6d4f5745784f545931
4d5755784f5756694e3246694d5459315a54526d5a6d55784d54526a5a545668
4d6d59354f4755314e3252684e54677a4f446b314f5459344e475a694d475969
4c434a75496a6f784f4441774c434a7759584e7a5a5751694f6e527964575573
496e4e6a6147567459534936496d68306448427a4f69387663326c6e626d566b
4c5756326157526c626d4e6c4c6d39795a79396c646d46734c584a6c59325670
63485176646a45694c434a7a593239795a534936496a41754f444d3049697769
63335670644755694f694a685932316c4c584e685a6d56306553317a64576c30
5a534973496e4e316158526c58335a6c636e4e70623234694f6949784c6a4975
4d434973496e526f636d567a614739735a434936496a41754f44417749697769
64476c745a584e3059573177496a6f694d6a41794e6930784d4330774d6c5177
4d446f774d446f774d466f6966513d3d222c22736368656d61223a226170706c
69636174696f6e2f766e642e7369676e65642d65766964656e63652e6576616c
2d726563656970742b6a736f6e222c227369676e6174757265223a7b22616c67
223a2265643235353139222c226b6579223a22783770704139394474756d484f
2f4175304d2f67756d534b384977437a4e7750694944393242534662616b3d22
2c22736967223a222f6d595374316c393171374d6f4f6e2b776769742f537170
4a57423246336758707973744c467637677632626f326c554f56435043713555
696d516463354d4575647176424f394b644d5a374a4a50673733573842413d3d
227d7d

A.2.9. P12 (receipt-trailing-whitespace; expected PASS, step all)

The receipt bytes of P1 followed by one line feed (0a), insignificant whitespace after the end of the JSON text (RFC 8259 Section 2), which step 1 admits.

  • verification key: the issuer test key

  • payload bytes B: 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 872 bytes, SHA-256 67f5854e04d24536d9003212924351acc85fa5f1d6965b701c7b313a426a2f7a

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a22434247744e323639464f68505372357865307a6c
4a4753424e427a47696e457a38693031664d36312b4a4e614a50646e5a793148
626f596934656d686d384b5a715055337973546d726d434578537653786f637a
42413d3d227d7d0a

A.2.10. P13 (receipt-leading-whitespace; expected PASS, step all)

One line feed (0a) followed by the receipt bytes of P1, insignificant whitespace before the JSON text (RFC 8259 Section 2), which step 1 admits.

  • verification key: the issuer test key

  • payload bytes B: 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 872 bytes, SHA-256 c3106fc577e88ccfac3633b62837424040eee972e1f353eab02077b2c2bf5980

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

0a7b227061796c6f61645f623634223a2265794a6a6232317461585266595778
6e496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e
7662584268636d4630623349694f69492b50534973496d52686447467a5a5852
66615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a
684e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d
774d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a4669595456
684f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a
6859324e31636d466a65534973496d31765a47567358326c6b58324e76625731
7064434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c
684d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d5445
305932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f4452
6d596a426d49697769626949364d5467774d4377696347467a6332566b496a70
30636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e
705a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a68624331
795a574e6c615842304c3359784969776963324e76636d55694f6949774c6a67
7a4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b
7463335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f
694d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a67
774d434973496e52706257567a6447467463434936496a49774d6a59744d5441
744d444a554d4441364d4441364d444261496e303d222c22736368656d61223a
226170706c69636174696f6e2f766e642e7369676e65642d65766964656e6365
2e6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a
7b22616c67223a2265643235353139222c226b6579223a227837707041393944
74756d484f2f4175304d2f67756d534b384977437a4e77506949443932425346
62616b3d222c22736967223a22434247744e323639464f68505372357865307a
6c4a4753424e427a47696e457a38693031664d36312b4a4e614a50646e5a7931
48626f596934656d686d384b5a715055337973546d726d434578537653786f63
7a42413d3d227d7d

A.2.11. N1 (no-duplicate-names; expected FAIL, step 4)

The payload repeats the member name "passed" (RFC 7493 Section 2.3, RFC 8785 Section 3.1).

Note: the signature over these bytes is valid.

  • verification key: the issuer test key

  • payload bytes B: 117 bytes, SHA-256 a27339f6948cb3acb0c0c529ad33452708c7c7a5c90c8cc1c9f818cc85060f08

  • receipt bytes: 415 bytes, SHA-256 37e6ef34cffc4f9ded8c3bfab5060680233fe0f27742d5aad4a802191e0fdbbb

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22706173736564223a747275652c22706173736564223a66616c73652c2273
6368656d61223a2268747470733a2f2f7369676e65642d65766964656e63652e
6f72672f6576616c2d726563656970742f7631227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496e4268
63334e6c5a43493664484a315a5377696347467a6332566b496a706d5957787a
5a53776963324e6f5a573168496a6f696148523063484d364c79397a61576475
5a5751745a585a705a4756755932557562334a6e4c32563259577774636d566a
5a576c77644339324d534a39222c22736368656d61223a226170706c69636174
696f6e2f766e642e7369676e65642d65766964656e63652e6576616c2d726563
656970742b6a736f6e222c227369676e6174757265223a7b22616c67223a2265
643235353139222c226b6579223a22783770704139394474756d484f2f417530
4d2f67756d534b384977437a4e7750694944393242534662616b3d222c227369
67223a22306d524847364e67414f554e376e494a77736545723059334c767662
7044686349724a35794647693039716838734870706d387732416f566b784f2b
666a6836333050454d756b4c59384631506d79305754745444773d3d227d7d

A.2.12. N2 (receipt-schema; expected FAIL, step 2)

The receipt schema is not the receipt media type.

  • verification key: the issuer test key

  • payload bytes carried (not B: the procedure stops at step 2 before it obtains B): 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 856 bytes, SHA-256 cab21721441b3e3aa23fcb2ce714809248d937b3c6842354769928ec49765c2f

Payload bytes carried (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e6578616d706c652e6f746865722b6a73
6f6e222c227369676e6174757265223a7b22616c67223a226564323535313922
2c226b6579223a22783770704139394474756d484f2f4175304d2f67756d534b
384977437a4e7750694944393242534662616b3d222c22736967223a22434247
744e323639464f68505372357865307a6c4a4753424e427a47696e457a386930
31664d36312b4a4e614a50646e5a793148626f596934656d686d384b5a715055
337973546d726d434578537653786f637a42413d3d227d7d

A.2.13. N3 (no-trailing-data; expected FAIL, step 4)

The payload bytes carry data after the end of the JSON text (RFC 8259 Section 2).

Note: the signature over these bytes is valid.

  • verification key: the issuer test key

  • payload bytes B: 469 bytes, SHA-256 a43f0ec906e97e50202458a0dc6c7ec44bcc00b3779e9e882c9ef3f95eb786f6

  • receipt bytes: 887 bytes, SHA-256 e11f4c7d69052c6a9356429d54176f6bce585aca5981ba5880939e4dc34e7419

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d0a2320747261696c696e67

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e304b49794230636d467062476c75
5a773d3d222c22736368656d61223a226170706c69636174696f6e2f766e642e
7369676e65642d65766964656e63652e6576616c2d726563656970742b6a736f
6e222c227369676e6174757265223a7b22616c67223a2265643235353139222c
226b6579223a22783770704139394474756d484f2f4175304d2f67756d534b38
4977437a4e7750694944393242534662616b3d222c22736967223a2254456c58
2f37643538634f2b54755a55557071476d6267456e702b59314477364c4a4650
746735555756317a6a2b727833586363634e4d547165483064672f5852746b6b
744854386771686c634133492b67666442773d3d227d7d

A.2.14. N4 (commitment-pattern; expected FAIL, step 7)

model_id_commit is the cleartext identifier, not "sha256:" followed by 64 lowercase hexadecimal digits.

  • verification key: the issuer test key

  • payload bytes B: 407 bytes, SHA-256 1f62f990a568b94e4956c093a6db5fea45fa3f8ab1702ba773e5684a3f2ae522

  • receipt bytes: 803 bytes, SHA-256 dbd2ddefa3a5dab6cc06bbde2f6704eaf738ee116f3476bf6f763c398d03f293

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a2261636d652f6d6f64
656c2d7840323032362d3039222c226e223a313830302c22706173736564223a
747275652c22736368656d61223a2268747470733a2f2f7369676e65642d6576
6964656e63652e6f72672f6576616c2d726563656970742f7631222c2273636f
7265223a22302e383334222c227375697465223a2261636d652d736166657479
2d7375697465222c2273756974655f76657273696f6e223a22312e322e30222c
227468726573686f6c64223a22302e383030222c2274696d657374616d70223a
22323032362d31302d30325430303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496d466a625755766257396b5a577774654541794d4449324c544135
49697769626949364d5467774d4377696347467a6332566b496a7030636e566c
4c434a7a5932686c625745694f694a6f64485277637a6f764c334e705a32356c
5a43316c646d6c6b5a57356a5a533576636d63765a585a68624331795a574e6c
615842304c3359784969776963324e76636d55694f6949774c6a677a4e434973
496e4e316158526c496a6f6959574e745a53317a59575a6c64486b7463335670
644755694c434a7a64576c305a5639325a584a7a61573975496a6f694d533479
4c6a41694c434a3061484a6c63326876624751694f6949774c6a67774d434973
496e52706257567a6447467463434936496a49774d6a59744d5441744d444a55
4d4441364d4441364d444261496e303d222c22736368656d61223a226170706c
69636174696f6e2f766e642e7369676e65642d65766964656e63652e6576616c
2d726563656970742b6a736f6e222c227369676e6174757265223a7b22616c67
223a2265643235353139222c226b6579223a22783770704139394474756d484f
2f4175304d2f67756d534b384977437a4e7750694944393242534662616b3d22
2c22736967223a22376a41417963523375626763334366754946524248752b36
4578456f7a583749467834316e41494c704e72506832444c4f4f45302f2f3063
4936593953365076495639683769464137734c30796275304c396c7943773d3d
227d7d

A.2.15. N5 (jcs-form; expected FAIL, step 5)

The payload bytes are a valid JSON text of the same object but not its own RFC 8785 form (insignificant whitespace, member order).

Note: the signature over these bytes is valid; re-serializing the parsed payload gives other bytes.

  • verification key: the issuer test key

  • payload bytes B: 498 bytes, SHA-256 fa97d7e9e6e2560d3025761ebfbae46635427dd2856b8c9b965679456cef2318

  • receipt bytes: 923 bytes, SHA-256 f4573f3c66570e347f4fa305b61cd189211824d9c02c603942766ff082c391c4

B (hex):

7b0a2022736368656d61223a202268747470733a2f2f7369676e65642d657669
64656e63652e6f72672f6576616c2d726563656970742f7631222c0a20227375
697465223a202261636d652d7361666574792d7375697465222c0a2022737569
74655f76657273696f6e223a2022312e322e30222c0a20226d6574726963223a
20226163637572616379222c0a2022636f6d70617261746f72223a20223e3d22
2c0a20227468726573686f6c64223a2022302e383030222c0a202273636f7265
223a2022302e383334222c0a2022706173736564223a20747275652c0a20226e
223a20313830302c0a20226d6f64656c5f69645f636f6d6d6974223a20227368
613235363a393034646534323536326639613139363531653139656237616231
3635653466666531313463653561326639386535376461353833383935393638
3466623066222c0a2022646174617365745f69645f636f6d6d6974223a202273
68613235363a6132316261346439366338303364343236336464336432313631
6263303339613330663434363262643539343730653331626135613961623061
396233623633222c0a2022636f6d6d69745f616c67223a20227368613235362d
73616c7465642d7631222c0a202274696d657374616d70223a2022323032362d
31302d30325430303a30303a30305a220a7d

Receipt (hex):

7b227061796c6f61645f623634223a2265776f67496e4e6a6147567459534936
49434a6f64485277637a6f764c334e705a32356c5a43316c646d6c6b5a57356a
5a533576636d63765a585a68624331795a574e6c615842304c3359784969774b
49434a7a64576c305a53493649434a685932316c4c584e685a6d56306553317a
64576c305a534973436941696333567064475666646d567963326c7662694936
494349784c6a49754d4349734369416962575630636d6c6a496a6f67496d466a
5933567959574e354969774b49434a6a6232317759584a6864473979496a6f67
496a34394969774b49434a3061484a6c63326876624751694f6941694d433434
4d4441694c416f67496e4e6a62334a6c496a6f67496a41754f444d304969774b
49434a7759584e7a5a5751694f694230636e566c4c416f67496d34694f694178
4f4441774c416f67496d31765a47567358326c6b58324e766257317064434936
49434a7a614745794e5459364f5441305a4755304d6a55324d6d593559544535
4e6a55785a5445355a574933595749784e6a566c4e475a6d5a5445784e474e6c
4e5745795a6a6b345a5455335a4745314f444d344f5455354e6a67305a6d4977
5a694973436941695a47463059584e6c644639705a46396a6232317461585169
4f694169633268684d6a55324f6d45794d574a684e4751354e6d4d344d444e6b
4e4449324d32526b4d3251794d545978596d4d774d7a6c684d7a426d4e445132
4d6d4a6b4e546b304e7a426c4d7a4669595456684f5746694d474535596a4e69
4e6a4d694c416f67496d4e766257317064463968624763694f69416963326868
4d6a55324c584e686248526c5a4331324d5349734369416964476c745a584e30
59573177496a6f67496a49774d6a59744d5441744d444a554d4441364d444136
4d44426149677039222c22736368656d61223a226170706c69636174696f6e2f
766e642e7369676e65642d65766964656e63652e6576616c2d72656365697074
2b6a736f6e222c227369676e6174757265223a7b22616c67223a226564323535
3139222c226b6579223a22783770704139394474756d484f2f4175304d2f6775
6d534b384977437a4e7750694944393242534662616b3d222c22736967223a22
745a4e2f5145764a714d50596169426d6f4663346d34683572374e4d77474138
4f55556e70526531462f6153424d4e6766754d556c31456f6746655151315878
4379304f4855714159436d733372672b6d59597142413d3d227d7d

A.2.16. N6 (s-less-than-L; expected FAIL, step 11 (profile 3))

The signature scalar S is not reduced (S >= L, RFC 8032 Section 5.1.7); S was replaced by S + L, which a verifier without the range check accepts.

  • verification key: the issuer test key

  • payload bytes B: 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 871 bytes, SHA-256 a13f20454e9ac6514d26d80275ec0e1055b62bb56884192960848438e33d26e0

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a22434247744e323639464f68505372357865307a6c
4a4753424e427a47696e457a38693031664d36312b4a4e482b4f7a45675a425a
786c792f324979416c614775715055337973546d726d434578537653786f637a
46413d3d227d7d

A.2.17. N7 (pae-type; expected FAIL, step 11 (profile 4))

The signature was made over PAE with a different type string; under the fixed type it does not verify.

  • verification key: the issuer test key

  • payload bytes B: 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 871 bytes, SHA-256 18b1b6dc631cf0f00d8b0d2c237b28a67b12c2d7088ae0313a2fb27760f96bdd

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a224e66464c314f4b356b3374784951424459695956
6d71746d50303668533269434777736e573142637376727953646d2f49703463
5542546e61384a30646a6f57664658346659494c51686231654e6a6b7339436c
42513d3d227d7d

A.2.18. N9 (key-hint; expected FAIL, step 10)

The key hint in the receipt is not the verification key the receiver fixed.

  • verification key: the issuer test key

  • payload bytes B: 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 871 bytes, SHA-256 b6fe0a0217007d55ca484b286053edbfc54248d4770e4df0022754804bdbaaf2

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a227476466e30704b694f
766d34654e487372483354364f7369596b375830614d667936305579754f6276
4d513d222c22736967223a22434247744e323639464f68505372357865307a6c
4a4753424e427a47696e457a38693031664d36312b4a4e614a50646e5a793148
626f596934656d686d384b5a715055337973546d726d434578537653786f637a
42413d3d227d7d

A.2.19. N10 (payload-schema; expected FAIL, step 6)

The payload schema is not the payload schema URI.

  • verification key: the issuer test key

  • payload bytes B: 458 bytes, SHA-256 f5a680f3c35ef0dd8777820d61f6e477edbef9bbdf2a65463ba8a8f3b88043e2

  • receipt bytes: 871 bytes, SHA-256 842b9f1716b014d91079020701247ed21a371dfdf365c361631f19dbbb19862d

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7630222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359774969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a2279595344626766395172496e676e4d4e68357133
7a494936764b5a6a346a4943374e434b516c3245574d495a484437505979575a
7641344f5752326876416b366334653850587976312b5a694c685a73312f4277
42673d3d227d7d

A.2.20. N11 (result-consistency; expected FAIL, step 8)

passed = true, but the score 0.762 does not satisfy >= 0.800.

  • verification key: the issuer test key

  • payload bytes B: 458 bytes, SHA-256 b25d0733d5881a332a1f531670f6ab900cf1a1184af7b584dbb769aaa765944f

  • receipt bytes: 871 bytes, SHA-256 e3f46618657620e9e5d28470df04a83da3f4275a9fcba3774455af7f65ef57f1

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e373632222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a6332
4d694973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a222f43614d514f2f70496d3132396f735563414e32
33323747694a744a7a69345475476f6d69472b6a7a554150436478756d2f4c36
4334384f422b564e79304144416e52724b62644d34767178306951325a563046
44413d3d227d7d

A.2.21. N12 (small-order-key; expected FAIL, step 11 (profile 2, key))

The verification key is the neutral element (a point of small order). The signature R || S with R = S*B' satisfies the cofactorless equation for any message under that key; the profile rejects small-order keys.

Note: the receiver fixed this key; the vector shows why the profile refuses it.

  • verification key: the neutral element, canonical encoding (01 followed by 31 zero bytes)

  • payload bytes B: 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 871 bytes, SHA-256 19d798c4199635a8bc637e09466633a270f1502ce5f802e57908a063443b3e60

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22415141414141414141
4141414141414141414141414141414141414141414141414141414141414141
41413d222c22736967223a22466233322f334579647a382b78377242636e2f42
777657366d4b64574f58492f614f566b327331572f2f3248596f68534d567536
61663049746d4f7052654d627a377473396c5645356f55587a3338786c537079
43773d3d227d7d

A.2.22. N13 (canonical-base64; expected FAIL, step 3)

payload_b64 decodes to the same B but is not its canonical base64 encoding (non-zero padding bits, RFC 4648 Section 3.5).

  • verification key: the issuer test key

  • payload bytes carried (not B: the procedure stops at step 3 before it obtains B): 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 871 bytes, SHA-256 31a34194edd90bade6568a3cb00dbb983dabab9efccfd7a8b38650bd3e8d5201

Payload bytes carried (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e313d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a22434247744e323639464f68505372357865307a6c
4a4753424e427a47696e457a38693031664d36312b4a4e614a50646e5a793148
626f596934656d686d384b5a715055337973546d726d434578537653786f637a
42413d3d227d7d

A.2.23. N14 (receipt-duplicate-names; expected FAIL, step 1)

The signature object repeats the member name "sig"; a parser that keeps the last value and one that keeps the first disagree.

  • verification key: the issuer test key

  • payload bytes carried (not B: the procedure stops at step 1 before it obtains B): 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 968 bytes, SHA-256 8966f27c5f2566d986b0ab7821060ea0c901504fe984d450dfc7f8ca7d1c27e1

Payload bytes carried (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a224141414141414141414141414141414141414141
4141414141414141414141414141414141414141414141414141414141414141
4141414141414141414141414141414141414141414141414141414141414141
41413d3d222c22736967223a22434247744e323639464f68505372357865307a
6c4a4753424e427a47696e457a38693031664d36312b4a4e614a50646e5a7931
48626f596934656d686d384b5a715055337973546d726d434578537653786f63
7a42413d3d227d7d

A.2.24. N15 (signature-alg; expected FAIL, step 9)

signature.alg is not "ed25519"; the signature itself is a valid Ed25519 signature.

  • verification key: the issuer test key

  • payload bytes B: 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 869 bytes, SHA-256 ff3503a055376f62bb6c49372480a7725481b0f23cc873745bb2dc267e8c100f

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a226564343438222c226b6579223a22783770704139394474756d
484f2f4175304d2f67756d534b384977437a4e7750694944393242534662616b
3d222c22736967223a22434247744e323639464f68505372357865307a6c4a47
53424e427a47696e457a38693031664d36312b4a4e614a50646e5a793148626f
596934656d686d384b5a715055337973546d726d434578537653786f637a4241
3d3d227d7d

A.2.25. N16 (small-order-R; expected FAIL, step 11 (profile 2, R))

R is the neutral element (01 followed by 31 zero bytes) and S = k*a mod L with the issuer's secret scalar a. The cofactorless equation holds, R is canonical and S is below L; only the small-order rule for R rejects it.

  • verification key: the issuer test key

  • payload bytes B: 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 871 bytes, SHA-256 bbd077e845409291f230145a0fe306d8230c1a1838fb51dc6463569785a66700

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a224151414141414141414141414141414141414141
414141414141414141414141414141414141414141414339476133596c6d4d44
6174366b374d61644e38797237563258372b666d79465a446676695077623131
41413d3d227d7d

A.2.26. N17 (noncanonical-R; expected FAIL, step 11 (profile 1, R))

R is the non-canonical encoding y = p + 1 of the neutral element and S = k*a mod L over these R bytes. A decoder that reduces y modulo p accepts the signature; RFC 8032 Section 5.1.3 decoding rejects R (the small-order rule would reject it too).

  • verification key: the issuer test key

  • payload bytes B: 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 871 bytes, SHA-256 395817f738a5e3c36b8d3ee201d3a64ce401dc5a8059c03f06216b0cca84cb69

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a2237762f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f
2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f33394d396764345159422b
35717a79336a6a3042502b6a32465845734f3839377643493049776254314855
41413d3d227d7d

A.2.27. N18 (noncanonical-key; expected FAIL, step 11 (profile 1, key))

The verification key is the non-canonical encoding y = p + 1 of the neutral element. With R = r*B' and S = r the cofactorless equation holds for any message under a decoder that reduces y modulo p; RFC 8032 Section 5.1.3 decoding rejects the key.

Note: the receiver fixed this key; the vector shows why the profile refuses it.

  • verification key: the neutral element, non-canonical encoding y = p + 1 (EE, 30 bytes FF, 7F)

  • payload bytes B: 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 871 bytes, SHA-256 dd8e1071f833f6c5c47d499cd7224cf65f34ff12977d6551d2fcdcfbebf8e42f

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a2237762f2f2f2f2f2f2f
2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f
33383d222c22736967223a224957536862313147326f61714a6668494d706358
77395135474b6443627947375a335730673750767653626a3271637257597745
4e7a3971774f4b633632457062467374306a4c7030525333785848736d514c49
43773d3d227d7d

A.2.28. N19 (receipt-trailing-data; expected FAIL, step 1)

Data follows the end of the receipt's JSON text (RFC 8259 Section 2).

  • verification key: the issuer test key

  • payload bytes carried (not B: the procedure stops at step 1 before it obtains B): 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 873 bytes, SHA-256 95d6f847e43fed6d31c38b5fe3d16edf91c8f16d2c56ed141a8ce5bfcaedb60b

Payload bytes carried (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a22434247744e323639464f68505372357865307a6c
4a4753424e427a47696e457a38693031664d36312b4a4e614a50646e5a793148
626f596934656d686d384b5a715055337973546d726d434578537653786f637a
42413d3d227d7d2078

A.2.29. N20 (receipt-member-set; expected FAIL, step 1)

The receipt object has a member other than schema, payload_b64 and signature.

  • verification key: the issuer test key

  • payload bytes carried (not B: the procedure stops at step 1 before it obtains B): 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 885 bytes, SHA-256 ba9c9f6dcab7753cd73f462c2a18bff8a7ea40cea7fe75f8dd16583593f0d413

Payload bytes carried (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b22636f6d6d656e74223a2278222c227061796c6f61645f623634223a226579
4a6a62323174615852665957786e496a6f69633268684d6a55324c584e686248
526c5a4331324d534973496d4e7662584268636d4630623349694f69492b5053
4973496d52686447467a5a585266615752665932397462576c30496a6f696332
68684d6a55324f6d45794d574a684e4751354e6d4d344d444e6b4e4449324d32
526b4d3251794d545978596d4d774d7a6c684d7a426d4e4451324d6d4a6b4e54
6b304e7a426c4d7a4669595456684f5746694d474535596a4e694e6a4d694c43
4a745a58527961574d694f694a6859324e31636d466a65534973496d31765a47
567358326c6b58324e766257317064434936496e4e6f595449314e6a6f354d44
526b5a5451794e5459795a6a6c684d546b324e54466c4d546c6c596a6468596a
45324e5755305a6d5a6c4d5445305932553159544a6d4f54686c4e54646b5954
55344d7a67354e546b324f44526d596a426d49697769626949364d5467774d43
77696347467a6332566b496a7030636e566c4c434a7a5932686c625745694f69
4a6f64485277637a6f764c334e705a32356c5a43316c646d6c6b5a57356a5a53
3576636d63765a585a68624331795a574e6c615842304c335978496977696332
4e76636d55694f6949774c6a677a4e434973496e4e316158526c496a6f695957
4e745a53317a59575a6c64486b7463335670644755694c434a7a64576c305a56
39325a584a7a61573975496a6f694d5334794c6a41694c434a3061484a6c6332
6876624751694f6949774c6a67774d434973496e52706257567a644746746343
4936496a49774d6a59744d5441744d444a554d4441364d4441364d444261496e
303d222c22736368656d61223a226170706c69636174696f6e2f766e642e7369
676e65642d65766964656e63652e6576616c2d726563656970742b6a736f6e22
2c227369676e6174757265223a7b22616c67223a2265643235353139222c226b
6579223a22783770704139394474756d484f2f4175304d2f67756d534b384977
437a4e7750694944393242534662616b3d222c22736967223a22434247744e32
3639464f68505372357865307a6c4a4753424e427a47696e457a38693031664d
36312b4a4e614a50646e5a793148626f596934656d686d384b5a715055337973
546d726d434578537653786f637a42413d3d227d7d

A.2.30. N21 (signature-member-set; expected FAIL, step 1)

The signature object has a member other than alg, sig and the optional key.

  • verification key: the issuer test key

  • payload bytes carried (not B: the procedure stops at step 1 before it obtains B): 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 881 bytes, SHA-256 e3350ef79e20fa84c543adfb5853a453fd9729456f9a6ef4d77bb1dfe821a3da

Payload bytes carried (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c226b6964223a2278222c22736967223a22434247744e323639464f
68505372357865307a6c4a4753424e427a47696e457a38693031664d36312b4a
4e614a50646e5a793148626f596934656d686d384b5a715055337973546d726d
434578537653786f637a42413d3d227d7d

A.2.31. N22 (receipt-duplicate-after-unescaping; expected FAIL, step 1)

The signature object has the member names "s\u0069g" and "sig", which are the same name after unescaping.

  • verification key: the issuer test key

  • payload bytes carried (not B: the procedure stops at step 1 before it obtains B): 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 973 bytes, SHA-256 fbd6938aa6cfb748f3e9e78a8267e5e67b0f84b72f23dda64bf791ae908f9850

Payload bytes carried (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22735c753030363967223a22414141414141414141414141414141
4141414141414141414141414141414141414141414141414141414141414141
4141414141414141414141414141414141414141414141414141414141414141
414141414141413d3d222c22736967223a22434247744e323639464f68505372
357865307a6c4a4753424e427a47696e457a38693031664d36312b4a4e614a50
646e5a793148626f596934656d686d384b5a715055337973546d726d43457853
7653786f637a42413d3d227d7d

A.2.32. N23 (receipt-bom; expected FAIL, step 1)

The receipt bytes begin with a UTF-8 byte order mark, which is not part of a JSON text.

  • verification key: the issuer test key

  • payload bytes carried (not B: the procedure stops at step 1 before it obtains B): 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 874 bytes, SHA-256 ee0f033e3e6e519bf5185f2cf74eedeacfe05abfe39ab81ed67c6c53b58c1d6a

Payload bytes carried (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

efbbbf7b227061796c6f61645f623634223a2265794a6a623231746158526659
57786e496a6f69633268684d6a55324c584e686248526c5a4331324d53497349
6d4e7662584268636d4630623349694f69492b50534973496d52686447467a5a
585266615752665932397462576c30496a6f69633268684d6a55324f6d45794d
574a684e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d54597859
6d4d774d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959
5456684f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f
694a6859324e31636d466a65534973496d31765a47567358326c6b58324e7662
57317064434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a
6a6c684d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d
5445305932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f
44526d596a426d49697769626949364d5467774d4377696347467a6332566b49
6a7030636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c
334e705a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862
4331795a574e6c615842304c3359784969776963324e76636d55694f6949774c
6a677a4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64
486b7463335670644755694c434a7a64576c305a5639325a584a7a6157397549
6a6f694d5334794c6a41694c434a3061484a6c63326876624751694f6949774c
6a67774d434973496e52706257567a6447467463434936496a49774d6a59744d
5441744d444a554d4441364d4441364d444261496e303d222c22736368656d61
223a226170706c69636174696f6e2f766e642e7369676e65642d65766964656e
63652e6576616c2d726563656970742b6a736f6e222c227369676e6174757265
223a7b22616c67223a2265643235353139222c226b6579223a22783770704139
394474756d484f2f4175304d2f67756d534b384977437a4e7750694944393242
534662616b3d222c22736967223a22434247744e323639464f68505372357865
307a6c4a4753424e427a47696e457a38693031664d36312b4a4e614a50646e5a
793148626f596934656d686d384b5a715055337973546d726d43457853765378
6f637a42413d3d227d7d

A.2.33. N24 (payload-not-base64; expected FAIL, step 3)

payload_b64 contains a character outside the base64 alphabet.

  • verification key: the issuer test key

  • payload bytes B: none, payload_b64 does not decode

  • receipt bytes: 871 bytes, SHA-256 fd53aaeb3d9821341a48db1f73fd7f9d0d97d9fdbe552a08f8c2e4a11214677a

Receipt (hex):

7b227061796c6f61645f623634223a2221794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a22434247744e323639464f68505372357865307a6c
4a4753424e427a47696e457a38693031664d36312b4a4e614a50646e5a793148
626f596934656d686d384b5a715055337973546d726d434578537653786f637a
42413d3d227d7d

A.2.34. N25 (signature-length; expected FAIL, step 9)

signature.sig decodes to 63 bytes, not 64.

  • verification key: the issuer test key

  • payload bytes B: 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 867 bytes, SHA-256 259e88eba23d8e72940a69211a642f03985e3125bbdaec8344bb2416285401bd

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a22434247744e323639464f68505372357865307a6c
4a4753424e427a47696e457a38693031664d36312b4a4e614a50646e5a793148
626f596934656d686d384b5a715055337973546d726d434578537653786f637a
227d7d

A.2.35. N26 (signature-canonical-base64; expected FAIL, step 9)

signature.sig decodes to the valid signature but is not its canonical base64 encoding (non-zero padding bits).

  • verification key: the issuer test key

  • payload bytes B: 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 871 bytes, SHA-256 4dabedcdda99544090dd57178c1775e0d44ca6f5604d35be90abefbe99157476

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a22434247744e323639464f68505372357865307a6c
4a4753424e427a47696e457a38693031664d36312b4a4e614a50646e5a793148
626f596934656d686d384b5a715055337973546d726d434578537653786f637a
42423d3d227d7d

A.2.36. N30 (commit-alg; expected FAIL, step 6)

commit_alg is not sha256-salted-v1.

  • verification key: the issuer test key

  • payload bytes B: 458 bytes, SHA-256 08a3e32e0637c384a5a3546ca30c6dcf7d63cd4c2aed79ee33e1f6539dd47f13

  • receipt bytes: 871 bytes, SHA-256 bb505266c5ef9bcaf1d5f259aac1bf7e044ae317c629caf4d8ceadf7cd5a730e

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763222
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d694973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a224c314d694767486e4e70594c5a49735569714369
4e646477722b69772f717950637934634978724c6e3448506638466a6d684e62
4b316f683943364843457742727434534d37353267567354474166484d303568
41673d3d227d7d

A.2.37. N31 (payload-member-missing; expected FAIL, step 6)

The payload lacks the member n.

  • verification key: the issuer test key

  • payload bytes B: 449 bytes, SHA-256 b39e1ed00f019e16a4806b340e0ea4772b1b012a4725a66194519415cd8aea43

  • receipt bytes: 859 bytes, SHA-256 8987d84e184fa1df5af4fdda796aa36c8dd254327e0987270a3870e863e76c42

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c22706173736564223a747275652c22736368656d61223a2268747470733a2f
2f7369676e65642d65766964656e63652e6f72672f6576616c2d726563656970
742f7631222c2273636f7265223a22302e383334222c227375697465223a2261
636d652d7361666574792d7375697465222c2273756974655f76657273696f6e
223a22312e322e30222c227468726573686f6c64223a22302e383030222c2274
696d657374616d70223a22323032362d31302d30325430303a30303a30305a22
7d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d496977696347467a6332566b496a7030636e566c4c434a7a5932686c
625745694f694a6f64485277637a6f764c334e705a32356c5a43316c646d6c6b
5a57356a5a533576636d63765a585a68624331795a574e6c615842304c335978
4969776963324e76636d55694f6949774c6a677a4e434973496e4e316158526c
496a6f6959574e745a53317a59575a6c64486b7463335670644755694c434a7a
64576c305a5639325a584a7a61573975496a6f694d5334794c6a41694c434a30
61484a6c63326876624751694f6949774c6a67774d434973496e52706257567a
6447467463434936496a49774d6a59744d5441744d444a554d4441364d444136
4d444261496e303d222c22736368656d61223a226170706c69636174696f6e2f
766e642e7369676e65642d65766964656e63652e6576616c2d72656365697074
2b6a736f6e222c227369676e6174757265223a7b22616c67223a226564323535
3139222c226b6579223a22783770704139394474756d484f2f4175304d2f6775
6d534b384977437a4e7750694944393242534662616b3d222c22736967223a22
724f5331335a387743654f72566a2f783736654754644f762f6d4e5353527234
375672552b6c584f6d6d3559526c57495a666665577078446944686f5379396b
6e2b657576344e37525275316c574b785067723642513d3d227d7d

A.2.38. N32 (payload-member-extra; expected FAIL, step 6)

The payload has a member not in Table 1.

  • verification key: the issuer test key

  • payload bytes B: 470 bytes, SHA-256 160ead10fac9f38e9b36136ae69c3d530e8179acb4d1347333436561f02f6488

  • receipt bytes: 887 bytes, SHA-256 a141fae9d60c2a00890f4bf79a66dd33e7994f53b834b5b9b671421779aedd52

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226578747261223a2278222c226d65
74726963223a226163637572616379222c226d6f64656c5f69645f636f6d6d69
74223a227368613235363a393034646534323536326639613139363531653139
6562376162313635653466666531313463653561326639386535376461353833
3839353936383466623066222c226e223a313830302c22706173736564223a74
7275652c22736368656d61223a2268747470733a2f2f7369676e65642d657669
64656e63652e6f72672f6576616c2d726563656970742f7631222c2273636f72
65223a22302e383334222c227375697465223a2261636d652d7361666574792d
7375697465222c2273756974655f76657273696f6e223a22312e322e30222c22
7468726573686f6c64223a22302e383030222c2274696d657374616d70223a22
323032362d31302d30325430303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a6c6548527959534936496e6769
4c434a745a58527961574d694f694a6859324e31636d466a65534973496d3176
5a47567358326c6b58324e766257317064434936496e4e6f595449314e6a6f35
4d44526b5a5451794e5459795a6a6c684d546b324e54466c4d546c6c596a6468
596a45324e5755305a6d5a6c4d5445305932553159544a6d4f54686c4e54646b
595455344d7a67354e546b324f44526d596a426d49697769626949364d546777
4d4377696347467a6332566b496a7030636e566c4c434a7a5932686c62574569
4f694a6f64485277637a6f764c334e705a32356c5a43316c646d6c6b5a57356a
5a533576636d63765a585a68624331795a574e6c615842304c33597849697769
63324e76636d55694f6949774c6a677a4e434973496e4e316158526c496a6f69
59574e745a53317a59575a6c64486b7463335670644755694c434a7a64576c30
5a5639325a584a7a61573975496a6f694d5334794c6a41694c434a3061484a6c
63326876624751694f6949774c6a67774d434973496e52706257567a64474674
63434936496a49774d6a59744d5441744d444a554d4441364d4441364d444261
496e303d222c22736368656d61223a226170706c69636174696f6e2f766e642e
7369676e65642d65766964656e63652e6576616c2d726563656970742b6a736f
6e222c227369676e6174757265223a7b22616c67223a2265643235353139222c
226b6579223a22783770704139394474756d484f2f4175304d2f67756d534b38
4977437a4e7750694944393242534662616b3d222c22736967223a226e314b78
727a79333846644e65616744376738366b674d55585a6c47694a5642392f7569
6b446d41343145574e54696c494a6c4a475941744561706938582b6c4d486777
68534d396d6e355230435a596833684244673d3d227d7d

A.2.39. N33 (payload-member-type; expected FAIL, step 6)

n is a string, not an integer.

  • verification key: the issuer test key

  • payload bytes B: 460 bytes, SHA-256 cd159a2d03631e22669eab61f4da0370571d9b43d4f4343cfcf6141dea4fe1ca

  • receipt bytes: 875 bytes, SHA-256 de6c58c37bc31b89ca4eec4c4f289a74daa20819b2fe172bd2f8fafb3bbb8486

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a2231383030222c22706173736564223a747275652c22736368656d
61223a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f
6576616c2d726563656970742f7631222c2273636f7265223a22302e38333422
2c227375697465223a2261636d652d7361666574792d7375697465222c227375
6974655f76657273696f6e223a22312e322e30222c227468726573686f6c6422
3a22302e383030222c2274696d657374616d70223a22323032362d31302d3032
5430303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d4969776962694936496a45344d4441694c434a7759584e7a5a575169
4f6e527964575573496e4e6a6147567459534936496d68306448427a4f693876
63326c6e626d566b4c5756326157526c626d4e6c4c6d39795a79396c646d4673
4c584a6c5932567063485176646a45694c434a7a593239795a534936496a4175
4f444d304969776963335670644755694f694a685932316c4c584e685a6d5630
6553317a64576c305a534973496e4e316158526c58335a6c636e4e7062323469
4f6949784c6a49754d434973496e526f636d567a614739735a434936496a4175
4f4441774969776964476c745a584e3059573177496a6f694d6a41794e693078
4d4330774d6c51774d446f774d446f774d466f6966513d3d222c22736368656d
61223a226170706c69636174696f6e2f766e642e7369676e65642d6576696465
6e63652e6576616c2d726563656970742b6a736f6e222c227369676e61747572
65223a7b22616c67223a2265643235353139222c226b6579223a227837707041
39394474756d484f2f4175304d2f67756d534b384977437a4e77506949443932
42534662616b3d222c22736967223a224d376259502f35694531347452675230
4953786b54574e39446848486137624f6237706e694e68704a31416a412b5648
65436f6732666f477838486b336c496e6d666b4c693643354f2b56794a375941
4a6b4f4241773d3d227d7d

A.2.40. N34 (decimal-grammar; expected FAIL, step 6)

score is .834, which is not a decimal string (no leading digit).

  • verification key: the issuer test key

  • payload bytes B: 457 bytes, SHA-256 b8ff1f5b884a29dbec6335ff3683643b830a82e4be6822863134374503586024

  • receipt bytes: 871 bytes, SHA-256 931807cdfcf32e7e930c89eb2a57f1abd1a08148b17383fd73e5264074e65cae

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a222e383334222c2273
75697465223a2261636d652d7361666574792d7375697465222c227375697465
5f76657273696f6e223a22312e322e30222c227468726573686f6c64223a2230
2e383030222c2274696d657374616d70223a22323032362d31302d3032543030
3a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949754f444d30
4969776963335670644755694f694a685932316c4c584e685a6d56306553317a
64576c305a534973496e4e316158526c58335a6c636e4e70623234694f694978
4c6a49754d434973496e526f636d567a614739735a434936496a41754f444177
4969776964476c745a584e3059573177496a6f694d6a41794e6930784d433077
4d6c51774d446f774d446f774d466f6966513d3d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a224e706f7170694956514a427933322f75626e3046
536d506f69353057594a3948556964423470344463482f583131416843677349
3853482f536c5a732b586d64663231444d35595a48643231444c6c7868646548
44413d3d227d7d

A.2.41. N35 (n-at-least-1; expected FAIL, step 6)

n is 0.

  • verification key: the issuer test key

  • payload bytes B: 455 bytes, SHA-256 4ff8e0e87bb64f4447e6f46e8473f96cc3c60ded53c7524ad29a918e5398fa87

  • receipt bytes: 867 bytes, SHA-256 f6f8149a5735884041bb4384ad1a7a31e9de2ffa88772b781109b8b0335399fc

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a302c22706173736564223a747275652c22736368656d61223a2268
747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576616c2d
726563656970742f7631222c2273636f7265223a22302e383334222c22737569
7465223a2261636d652d7361666574792d7375697465222c2273756974655f76
657273696f6e223a22312e322e30222c227468726573686f6c64223a22302e38
3030222c2274696d657374616d70223a22323032362d31302d30325430303a30
303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d4377696347467a6332566b496a7030636e566c
4c434a7a5932686c625745694f694a6f64485277637a6f764c334e705a32356c
5a43316c646d6c6b5a57356a5a533576636d63765a585a68624331795a574e6c
615842304c3359784969776963324e76636d55694f6949774c6a677a4e434973
496e4e316158526c496a6f6959574e745a53317a59575a6c64486b7463335670
644755694c434a7a64576c305a5639325a584a7a61573975496a6f694d533479
4c6a41694c434a3061484a6c63326876624751694f6949774c6a67774d434973
496e52706257567a6447467463434936496a49774d6a59744d5441744d444a55
4d4441364d4441364d444261496e303d222c22736368656d61223a226170706c
69636174696f6e2f766e642e7369676e65642d65766964656e63652e6576616c
2d726563656970742b6a736f6e222c227369676e6174757265223a7b22616c67
223a2265643235353139222c226b6579223a22783770704139394474756d484f
2f4175304d2f67756d534b384977437a4e7750694944393242534662616b3d22
2c22736967223a226975437359454257506e59486e422b4578414a3339656972
536d5956437051774d2f527434366869344a6c652f4357663470617a554a344f
626346777a5a336b4467454f7661596b63636e574e57534c72714a6943413d3d
227d7d

A.2.42. N36 (timestamp-calendar; expected FAIL, step 6)

timestamp names 30 February.

  • verification key: the issuer test key

  • payload bytes B: 458 bytes, SHA-256 04eac528e06a72681465808a06b3c23dc54dfc8e453dc682abfda8f6abc4105a

  • receipt bytes: 871 bytes, SHA-256 f3f3a0a5f588491d10acbccc1ca8d1f94d5a69b0d0f314399feceb463fbb4b15

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d30322d33305430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d444974
4d7a42554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a225831762b4b4c67394175626c45412b6446305836
3732484b487762336d6e5a66557961626c6e6368333546657a752f643162314e
78416d55374c624a6c6f51693777436c4e44344a6e5771323139687a52504e55
42413d3d227d7d

A.2.43. N37 (timestamp-leap-second; expected FAIL, step 6)

timestamp has second 60, which this format does not admit.

  • verification key: the issuer test key

  • payload bytes B: 458 bytes, SHA-256 88f6d07eadb5242e05dce0b246a1415a041b29f0d540e79cfa896b36109d1c6e

  • receipt bytes: 871 bytes, SHA-256 f7c1e19280ea53079b35e4a098194442b5e6603b8e59b8bcb1c5a856e31952e7

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31322d33315432
333a35393a36305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544974
4d7a46554d6a4d364e546b364e6a4261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a22337742434c4d3534646b736a3255715a6c79354e
53306d514852336e53792f4f2f4e7363305157526657364c6a5156344e6a6e41
4f6d41736d2f6259494373376a7058524956476b4e756431527957677a63564c
43673d3d227d7d

A.2.44. N38 (comparator-set; expected FAIL, step 6)

comparator is => , not one of >=, >, <=, <.

  • verification key: the issuer test key

  • payload bytes B: 458 bytes, SHA-256 5f4c2a5be9958a57fd737ad4dce987c64cadce01300f173b077408e987ce96c7

  • receipt bytes: 871 bytes, SHA-256 4a97220459e3d69d8e7e1ac159d7ab1a1628257545f110eb00260cb072aeee84

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223d3e222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69493950694973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a226b62356759586f664e4f57334a336e4b4146364b
6570534e3872386645595946303471357852626764327546474d332b6a594376
466f4c5139515251624d4e6861416e42764c2b7272506a344a75626c6a6f594d
41773d3d227d7d

A.2.45. N39 (non-empty-string; expected FAIL, step 6)

suite is the empty string.

  • verification key: the issuer test key

  • payload bytes B: 441 bytes, SHA-256 2025cdbb96bf3f8bc44238262f7b4430e97b4a1c3b82f821cb23120fbb68aced

  • receipt bytes: 847 bytes, SHA-256 560ecebc2e4b40ee30a99fe8a411a03125ee142033705d81472bac8c3f9ccdf5

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a22222c2273756974655f76657273696f6e223a22312e322e30
222c227468726573686f6c64223a22302e383030222c2274696d657374616d70
223a22323032362d31302d30325430303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f69496977696333567064475666646d5679
63326c7662694936496a45754d69347749697769644768795a584e6f6232786b
496a6f694d4334344d4441694c434a306157316c63335268625841694f694979
4d4449324c5445774c544179564441774f6a41774f6a417757694a39222c2273
6368656d61223a226170706c69636174696f6e2f766e642e7369676e65642d65
766964656e63652e6576616c2d726563656970742b6a736f6e222c227369676e
6174757265223a7b22616c67223a2265643235353139222c226b6579223a2278
3770704139394474756d484f2f4175304d2f67756d534b384977437a4e775069
4944393242534662616b3d222c22736967223a222f7a4a464f4a6c795045565a
3154354e6834324652444a54703943554948504f667a6a7a4737457766664d4b
5462526348396d746f6b6a396d38304e552f4c397747656c4667736d6836674f
417562494f64303741673d3d227d7d

A.2.46. N40 (payload-utf8; expected FAIL, step 4)

B contains the byte 0xFF, which is not UTF-8.

Note: the signature over these bytes is valid.

  • verification key: the issuer test key

  • payload bytes B: 453 bytes, SHA-256 e4070c3aa058423ce8a5cea36b845bbb9a9ce776850efba925ae59f9f37d8c3d

  • receipt bytes: 863 bytes, SHA-256 5dbcb20f1d321f8bcdfc6f4fa94d696bdc4795f561b10922a175b584d81b583f

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652dff2d7375697465222c2273756974655f766572
73696f6e223a22312e322e30222c227468726573686f6c64223a22302e383030
222c2274696d657374616d70223a22323032362d31302d30325430303a30303a
30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53332f4c584e316158526c
496977696333567064475666646d567963326c7662694936496a45754d693477
49697769644768795a584e6f6232786b496a6f694d4334344d4441694c434a30
6157316c63335268625841694f6949794d4449324c5445774c54417956444177
4f6a41774f6a417757694a39222c22736368656d61223a226170706c69636174
696f6e2f766e642e7369676e65642d65766964656e63652e6576616c2d726563
656970742b6a736f6e222c227369676e6174757265223a7b22616c67223a2265
643235353139222c226b6579223a22783770704139394474756d484f2f417530
4d2f67756d534b384977437a4e7750694944393242534662616b3d222c227369
67223a22446e4d6347624c7076554d584c7667394c596b38616564774a637333
424d515053302b4a626e5742764a787179784e43546d77672f56393245496571
63666979346e456b65382f4b754656576c6b56513149696b42673d3d227d7d

A.2.47. N41 (payload-lone-surrogate; expected FAIL, step 4)

B contains the escape \ud800, a lone surrogate, which I-JSON forbids (RFC 7493 Section 2.1).

Note: the signature over these bytes is valid.

  • verification key: the issuer test key

  • payload bytes B: 458 bytes, SHA-256 8e45016c1374521334320ea15b5f7cd35a2f46b4e0361103fe8bd25b9a05e603

  • receipt bytes: 871 bytes, SHA-256 ed4e4b86a1615e8e5b4e4f89e5bcdc5f7a46953825a2b18776e3760cfa089456

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d5c75643830302d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a533163645751344d444174
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a227670786f30414941354d5a4733696f496275356c
42695a582f5632392b656832616c6f2f43494c555270676d44797349564e6f63
3363616832785277784a4d736c4f41396d7542725a5359503845782f71337a58
42513d3d227d7d

A.2.48. N42 (payload-noncharacter; expected FAIL, step 4)

B contains U+FFFF, a noncharacter, which I-JSON forbids (RFC 7493 Section 2.1).

Note: the signature over these bytes is valid.

  • verification key: the issuer test key

  • payload bytes B: 455 bytes, SHA-256 ebb05d1b6da24bbcf7a6c19198fd0a5ad08322b342793705e83faa9a8e5123e6

  • receipt bytes: 867 bytes, SHA-256 3afb20dd37565406fbd82b5671b48725b05361a94631498c3f1b57fd47d65585

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652defbfbf2d7375697465222c2273756974655f76
657273696f6e223a22312e322e30222c227468726573686f6c64223a22302e38
3030222c2274696d657374616d70223a22323032362d31302d30325430303a30
303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a5333767637387463335670
644755694c434a7a64576c305a5639325a584a7a61573975496a6f694d533479
4c6a41694c434a3061484a6c63326876624751694f6949774c6a67774d434973
496e52706257567a6447467463434936496a49774d6a59744d5441744d444a55
4d4441364d4441364d444261496e303d222c22736368656d61223a226170706c
69636174696f6e2f766e642e7369676e65642d65766964656e63652e6576616c
2d726563656970742b6a736f6e222c227369676e6174757265223a7b22616c67
223a2265643235353139222c226b6579223a22783770704139394474756d484f
2f4175304d2f67756d534b384977437a4e7750694944393242534662616b3d22
2c22736967223a2243356e7265586a646f4b334875566253555176532f2b2f73
7432583339774b667277737a736b65336452657652736e3946792f63746d394a
522b376130306b4c74792f6536504d7557653272743750546e6c2f6c41673d3d
227d7d

A.2.49. N43 (payload-bom; expected FAIL, step 4)

B begins with a UTF-8 byte order mark.

Note: the signature over these bytes is valid.

  • verification key: the issuer test key

  • payload bytes B: 461 bytes, SHA-256 3c6e404df7ae90d9e6ade9327a7e60852b3f8c09af36bd38cc78d58377c8f5c2

  • receipt bytes: 875 bytes, SHA-256 30e4f5e6d7e36059f1f93e2142b601b4c51ec0e183b5ee19e5289779645e7e36

B (hex):

efbbbf7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d
7631222c22636f6d70617261746f72223a223e3d222c22646174617365745f69
645f636f6d6d6974223a227368613235363a6132316261346439366338303364
3432363364643364323136316263303339613330663434363262643539343730
653331626135613961623061396233623633222c226d6574726963223a226163
637572616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235
363a393034646534323536326639613139363531653139656237616231363565
3466666531313463653561326639386535376461353833383935393638346662
3066222c226e223a313830302c22706173736564223a747275652c2273636865
6d61223a2268747470733a2f2f7369676e65642d65766964656e63652e6f7267
2f6576616c2d726563656970742f7631222c2273636f7265223a22302e383334
222c227375697465223a2261636d652d7361666574792d7375697465222c2273
756974655f76657273696f6e223a22312e322e30222c227468726573686f6c64
223a22302e383030222c2274696d657374616d70223a22323032362d31302d30
325430303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a223737752f65794a6a6232317461585266
5957786e496a6f69633268684d6a55324c584e686248526c5a4331324d534973
496d4e7662584268636d4630623349694f69492b50534973496d52686447467a
5a585266615752665932397462576c30496a6f69633268684d6a55324f6d4579
4d574a684e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978
596d4d774d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a4669
595456684f5746694d474535596a4e694e6a4d694c434a745a58527961574d69
4f694a6859324e31636d466a65534973496d31765a47567358326c6b58324e76
6257317064434936496e4e6f595449314e6a6f354d44526b5a5451794e545979
5a6a6c684d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c
4d5445305932553159544a6d4f54686c4e54646b595455344d7a67354e546b32
4f44526d596a426d49697769626949364d5467774d4377696347467a6332566b
496a7030636e566c4c434a7a5932686c625745694f694a6f64485277637a6f76
4c334e705a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a68
624331795a574e6c615842304c3359784969776963324e76636d55694f694977
4c6a677a4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c
64486b7463335670644755694c434a7a64576c305a5639325a584a7a61573975
496a6f694d5334794c6a41694c434a3061484a6c63326876624751694f694977
4c6a67774d434973496e52706257567a6447467463434936496a49774d6a5974
4d5441744d444a554d4441364d4441364d444261496e303d222c22736368656d
61223a226170706c69636174696f6e2f766e642e7369676e65642d6576696465
6e63652e6576616c2d726563656970742b6a736f6e222c227369676e61747572
65223a7b22616c67223a2265643235353139222c226b6579223a227837707041
39394474756d484f2f4175304d2f67756d534b384977437a4e77506949443932
42534662616b3d222c22736967223a22624a694b34654c4d514b673063536358
69494d342f75666e5032434561625159506731324f54676e49684c70776e5962
6a455958447757697859412f2b38346263416457564f782b65742b5646446e44
4245306c44673d3d227d7d

A.2.50. N44 (receipt-utf8; expected FAIL, step 1)

The receipt contains the byte 0xFF, which is not UTF-8.

  • verification key: the issuer test key

  • payload bytes carried (not B: the procedure stops at step 1 before it obtains B): 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 872 bytes, SHA-256 cdf4844bfa2b06b975fef8cb76bfac9da0d20fe0981a5559fa0c05ef28e7a5ec

Payload bytes carried (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139ff222c226b6579223a227837707041393944
74756d484f2f4175304d2f67756d534b384977437a4e77506949443932425346
62616b3d222c22736967223a22434247744e323639464f68505372357865307a
6c4a4753424e427a47696e457a38693031664d36312b4a4e614a50646e5a7931
48626f596934656d686d384b5a715055337973546d726d434578537653786f63
7a42413d3d227d7d

A.2.51. N45 (receipt-lone-surrogate; expected FAIL, step 1)

A string of the receipt contains the escape \ud800, a lone surrogate, which I-JSON forbids.

  • verification key: the issuer test key

  • payload bytes carried (not B: the procedure stops at step 1 before it obtains B): 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 877 bytes, SHA-256 b18339f4e11f57576a6386bc0a6660ff8d9f92acad2d58b441deb34190b3d90f

Payload bytes carried (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a22656432353531395c7564383030222c226b6579223a22783770
704139394474756d484f2f4175304d2f67756d534b384977437a4e7750694944
393242534662616b3d222c22736967223a22434247744e323639464f68505372
357865307a6c4a4753424e427a47696e457a38693031664d36312b4a4e614a50
646e5a793148626f596934656d686d384b5a715055337973546d726d43457853
7653786f637a42413d3d227d7d

A.2.52. N46 (receipt-noncharacter; expected FAIL, step 1)

A string of the receipt contains U+FFFF, a noncharacter, which I-JSON forbids.

  • verification key: the issuer test key

  • payload bytes carried (not B: the procedure stops at step 1 before it obtains B): 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 874 bytes, SHA-256 5613dd7435a723ff593f1730f786cefe185e1dec31ea297a1c96c06911eddaab

Payload bytes carried (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139efbfbf222c226b6579223a22783770704139
394474756d484f2f4175304d2f67756d534b384977437a4e7750694944393242
534662616b3d222c22736967223a22434247744e323639464f68505372357865
307a6c4a4753424e427a47696e457a38693031664d36312b4a4e614a50646e5a
793148626f596934656d686d384b5a715055337973546d726d43457853765378
6f637a42413d3d227d7d

A.2.53. N48 (comparator-gt; expected FAIL, step 8)

comparator > with score equal to threshold (0.800) and passed = true; read as >= the comparison would hold.

  • verification key: the issuer test key

  • payload bytes B: 457 bytes, SHA-256 1b905efaa6a5f9e62e1830196642fb84252ab649f002598b8c6ff899d313ac21

  • receipt bytes: 871 bytes, SHA-256 0d58d49c4039231de5fcb49ffd0595a3c17ff903fa67dec71bbe3964f6c318b1

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e222c22646174617365745f69645f636f
6d6d6974223a227368613235363a613231626134643936633830336434323633
6464336432313631626330333961333066343436326264353934373065333162
6135613961623061396233623633222c226d6574726963223a22616363757261
6379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a3930
3464653432353632663961313936353165313965623761623136356534666665
313134636535613266393865353764613538333839353936383466623066222c
226e223a313830302c22706173736564223a747275652c22736368656d61223a
2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f657661
6c2d726563656970742f7631222c2273636f7265223a22302e383030222c2273
75697465223a2261636d652d7361666574792d7375697465222c227375697465
5f76657273696f6e223a22312e322e30222c227468726573686f6c64223a2230
2e383030222c2274696d657374616d70223a22323032362d31302d3032543030
3a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b496977695a47463059584e6c64463970
5a46396a62323174615851694f694a7a614745794e54593659544978596d4530
5a446b32597a67774d3251304d6a597a5a47517a5a4449784e6a4669597a417a
4f57457a4d4759304e445979596d51314f5451334d47557a4d574a684e574535
5957497759546c694d3249324d794973496d316c64484a7059794936496d466a
5933567959574e35496977696257396b5a577866615752665932397462576c30
496a6f69633268684d6a55324f6a6b774e47526c4e4449314e6a4a6d4f574578
4f5459314d5755784f5756694e3246694d5459315a54526d5a6d55784d54526a
5a5456684d6d59354f4755314e3252684e54677a4f446b314f5459344e475a69
4d4759694c434a75496a6f784f4441774c434a7759584e7a5a5751694f6e5279
64575573496e4e6a6147567459534936496d68306448427a4f69387663326c6e
626d566b4c5756326157526c626d4e6c4c6d39795a79396c646d46734c584a6c
5932567063485176646a45694c434a7a593239795a534936496a41754f444177
4969776963335670644755694f694a685932316c4c584e685a6d56306553317a
64576c305a534973496e4e316158526c58335a6c636e4e70623234694f694978
4c6a49754d434973496e526f636d567a614739735a434936496a41754f444177
4969776964476c745a584e3059573177496a6f694d6a41794e6930784d433077
4d6c51774d446f774d446f774d466f6966513d3d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a226d5952704b526c466e4b7942464463467a59784c
304f4d4f2b4e36796d44685574364f30357979755746597956534c4e47477935
747742735868586e475a3035795454685a47517a4f6430736d34494954634359
41413d3d227d7d

A.2.54. N49 (comparator-lt; expected FAIL, step 8)

comparator < with score 0.834 below threshold 0.900 and passed = false; the comparison holds, so passed must be true.

  • verification key: the issuer test key

  • payload bytes B: 458 bytes, SHA-256 1fe4e0d27fadbe6960b1ddea0566f287994da625dea26bb255c66467c203da80

  • receipt bytes: 871 bytes, SHA-256 28d17a28c5c1eaad5956069955ef50ae53fbac351fd4d916a176c9fbdfe800eb

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223c222c22646174617365745f69645f636f
6d6d6974223a227368613235363a613231626134643936633830336434323633
6464336432313631626330333961333066343436326264353934373065333162
6135613961623061396233623633222c226d6574726963223a22616363757261
6379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a3930
3464653432353632663961313936353165313965623761623136356534666665
313134636535613266393865353764613538333839353936383466623066222c
226e223a313830302c22706173736564223a66616c73652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e393030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f694938496977695a47463059584e6c64463970
5a46396a62323174615851694f694a7a614745794e54593659544978596d4530
5a446b32597a67774d3251304d6a597a5a47517a5a4449784e6a4669597a417a
4f57457a4d4759304e445979596d51314f5451334d47557a4d574a684e574535
5957497759546c694d3249324d794973496d316c64484a7059794936496d466a
5933567959574e35496977696257396b5a577866615752665932397462576c30
496a6f69633268684d6a55324f6a6b774e47526c4e4449314e6a4a6d4f574578
4f5459314d5755784f5756694e3246694d5459315a54526d5a6d55784d54526a
5a5456684d6d59354f4755314e3252684e54677a4f446b314f5459344e475a69
4d4759694c434a75496a6f784f4441774c434a7759584e7a5a5751694f6d5a68
62484e6c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6b77
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a227a556d79616d6e51686f6d766758514d432f4c4c
36726c4d78374d56547468746d7a703346787566504b65504233357a6a597953
386f2f6f594e72777975644d6a6338374939303136774d6e61646b3064557262
43773d3d227d7d

A.2.55. N50 (n-below-2-53; expected FAIL, step 6)

n = 9007199254740992 (2^53). B is its own RFC 8785 form, since 2^53 is a double, but n is not below 2^53.

  • verification key: the issuer test key

  • payload bytes B: 470 bytes, SHA-256 868cb0eaa38f69fcad1698b358a57cdbbe85711addaeeb8822f35fd449e53b2c

  • receipt bytes: 887 bytes, SHA-256 a10a3baab62d60007f77aae358fecd132e8319e3600baebfa1730a6248af905d

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a393030373139393235343734303939322c22706173736564223a74
7275652c22736368656d61223a2268747470733a2f2f7369676e65642d657669
64656e63652e6f72672f6576616c2d726563656970742f7631222c2273636f72
65223a22302e383334222c227375697465223a2261636d652d7361666574792d
7375697465222c2273756974655f76657273696f6e223a22312e322e30222c22
7468726573686f6c64223a22302e383030222c2274696d657374616d70223a22
323032362d31302d30325430303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364f5441774e7a45354f5449314e4463304d446b35
4d6977696347467a6332566b496a7030636e566c4c434a7a5932686c62574569
4f694a6f64485277637a6f764c334e705a32356c5a43316c646d6c6b5a57356a
5a533576636d63765a585a68624331795a574e6c615842304c33597849697769
63324e76636d55694f6949774c6a677a4e434973496e4e316158526c496a6f69
59574e745a53317a59575a6c64486b7463335670644755694c434a7a64576c30
5a5639325a584a7a61573975496a6f694d5334794c6a41694c434a3061484a6c
63326876624751694f6949774c6a67774d434973496e52706257567a64474674
63434936496a49774d6a59744d5441744d444a554d4441364d4441364d444261
496e303d222c22736368656d61223a226170706c69636174696f6e2f766e642e
7369676e65642d65766964656e63652e6576616c2d726563656970742b6a736f
6e222c227369676e6174757265223a7b22616c67223a2265643235353139222c
226b6579223a22783770704139394474756d484f2f4175304d2f67756d534b38
4977437a4e7750694944393242534662616b3d222c22736967223a22647a4238
4f70327571736231644c476a32416a4830666c4b69562b79634145363850317a
6b4d32476c6c4972626a4643632f6451754b455a475271634947612f6d583973
4c475972624e7662473349395335424842773d3d227d7d

A.2.56. N51 (ascii-digits; expected FAIL, step 6)

The score is 0. followed by the Arabic-Indic digits U+0668 U+0663 U+0664; a digit is an ASCII digit, so the score is not a decimal string.

  • verification key: the issuer test key

  • payload bytes B: 461 bytes, SHA-256 5697ad5e12e2d5786be9f1cf42eb3384398943221a39cc688b0525ab61e2e715

  • receipt bytes: 875 bytes, SHA-256 53227810012a48fa79dd1fe54fe18e382003150f2f4f4348d9bfdf30beee5579

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302ed9a8d9a3d9a4
222c227375697465223a2261636d652d7361666574792d7375697465222c2273
756974655f76657273696f6e223a22312e322e30222c227468726573686f6c64
223a22302e383030222c2274696d657374616d70223a22323032362d31302d30
325430303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c746d6f
3261505a70434973496e4e316158526c496a6f6959574e745a53317a59575a6c
64486b7463335670644755694c434a7a64576c305a5639325a584a7a61573975
496a6f694d5334794c6a41694c434a3061484a6c63326876624751694f694977
4c6a67774d434973496e52706257567a6447467463434936496a49774d6a5974
4d5441744d444a554d4441364d4441364d444261496e303d222c22736368656d
61223a226170706c69636174696f6e2f766e642e7369676e65642d6576696465
6e63652e6576616c2d726563656970742b6a736f6e222c227369676e61747572
65223a7b22616c67223a2265643235353139222c226b6579223a227837707041
39394474756d484f2f4175304d2f67756d534b384977437a4e77506949443932
42534662616b3d222c22736967223a226458384b3667594749447a5145717737
533245346565364f582b6f4234614852784c4b646e7235536d34585274435552
3943336d776c536878444f682b6a3348303866345778614d733875745351436a
6832623843673d3d227d7d

A.2.57. N52 (number-without-double; expected FAIL, step 5)

B writes n as 1e400, a number with no finite double; it has no RFC 8785 serialization, so B is not its own.

Note: the signature over these bytes is valid.

  • verification key: the issuer test key

  • payload bytes B: 459 bytes, SHA-256 999bd423a90e8671943ddc99e0b6f94b6a5941327923a7e97347094310324fd2

  • receipt bytes: 871 bytes, SHA-256 e6d6782e9d78e133f2c40a065a144dc0d25db254742894e5cd2ba35e050e2af8

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a31653430302c22706173736564223a747275652c22736368656d61
223a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f65
76616c2d726563656970742f7631222c2273636f7265223a22302e383334222c
227375697465223a2261636d652d7361666574792d7375697465222c22737569
74655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a
22302e383030222c2274696d657374616d70223a22323032362d31302d303254
30303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5755304d444173496e426863334e6c5a434936
64484a315a53776963324e6f5a573168496a6f696148523063484d364c79397a
615764755a5751745a585a705a4756755932557562334a6e4c32563259577774
636d566a5a576c77644339324d534973496e4e6a62334a6c496a6f694d433434
4d7a51694c434a7a64576c305a534936496d466a625755746332466d5a585235
4c584e316158526c496977696333567064475666646d567963326c7662694936
496a45754d69347749697769644768795a584e6f6232786b496a6f694d433434
4d4441694c434a306157316c63335268625841694f6949794d4449324c544577
4c544179564441774f6a41774f6a417757694a39222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a2234784265486a2f55364b30767a76556344563253
455836376155524a4f3938356e6b6d4e555047557545495a4d2f42617a4a414f
376f5453535474734344776d38556157656c5a72646942306e416e444d4a686c
43773d3d227d7d

A.2.58. N53 (key-before-R-rule-1; expected FAIL, step 11 (profile 1, key))

The verification key and R are both the non-canonical encoding y = p + 1 and S = 0; rule 1 fails for both and is reported for the key, which is checked first.

Note: the receiver fixed this key; the vector shows the order of the profile's checks.

  • verification key: the neutral element, non-canonical encoding y = p + 1 (EE, 30 bytes FF, 7F)

  • payload bytes B: 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 871 bytes, SHA-256 4b4a4e5fbf62f88aa3557f763a5f7c1ddb45157903d34998a8090c4bc0aa8dec

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a2237762f2f2f2f2f2f2f
2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f
33383d222c22736967223a2237762f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f
2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f3338414141414141414141
4141414141414141414141414141414141414141414141414141414141414141
41413d3d227d7d

A.2.59. N54 (key-before-R-rule-2; expected FAIL, step 11 (profile 2, key))

The verification key and R are both the neutral element and S = 0; rule 2 fails for both and is reported for the key, which is checked first.

Note: the receiver fixed this key; the vector shows the order of the profile's checks.

  • verification key: the neutral element, canonical encoding (01 followed by 31 zero bytes)

  • payload bytes B: 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 871 bytes, SHA-256 162720ee2254eae2ea5d2a1fa65e1d24e238cdcef9bafc7547cef44a1ddbcf33

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22415141414141414141
4141414141414141414141414141414141414141414141414141414141414141
41413d222c22736967223a224151414141414141414141414141414141414141
4141414141414141414141414141414141414141414141414141414141414141
4141414141414141414141414141414141414141414141414141414141414141
41413d3d227d7d

A.2.60. N55 (receipt-number-at-step-2; expected FAIL, step 2)

The receipt writes schema as the number 1e400. Step 1 does not judge numbers, so the receipt fails at step 2, where schema is not the type.

  • verification key: the issuer test key

  • payload bytes carried (not B: the procedure stops at step 2 before it obtains B): 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 825 bytes, SHA-256 70e8bdb4fe5f12d428cf26e5c87b24eb0dfa63de6714f499739253dcbade0f65

Payload bytes carried (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a31
653430302c227369676e6174757265223a7b22616c67223a2265643235353139
222c226b6579223a22783770704139394474756d484f2f4175304d2f67756d53
4b384977437a4e7750694944393242534662616b3d222c22736967223a224342
47744e323639464f68505372357865307a6c4a4753424e427a47696e457a3869
3031664d36312b4a4e614a50646e5a793148626f596934656d686d384b5a7150
55337973546d726d434578537653786f637a42413d3d227d7d

A.2.61. N56 (number-serialization; expected FAIL, step 5)

B writes n as 1800.0. Its RFC 8785 serialization is 1800, so B is not its own serialization, although the value is the n of P1 written another way.

Note: the signature over these bytes is valid.

  • verification key: the issuer test key

  • payload bytes B: 460 bytes, SHA-256 dec848505eae6a9cfd4eae1f31f3f1e992d4e3f75ffb17bb2b0c4a38c9c174d4

  • receipt bytes: 875 bytes, SHA-256 78b71cb911a1ab306d611180f6a23310ee047ddcbfa7a385342bad39e77cea4f

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302e302c22706173736564223a747275652c22736368656d
61223a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f
6576616c2d726563656970742f7631222c2273636f7265223a22302e38333422
2c227375697465223a2261636d652d7361666574792d7375697465222c227375
6974655f76657273696f6e223a22312e322e30222c227468726573686f6c6422
3a22302e383030222c2274696d657374616d70223a22323032362d31302d3032
5430303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4334774c434a7759584e7a5a575169
4f6e527964575573496e4e6a6147567459534936496d68306448427a4f693876
63326c6e626d566b4c5756326157526c626d4e6c4c6d39795a79396c646d4673
4c584a6c5932567063485176646a45694c434a7a593239795a534936496a4175
4f444d304969776963335670644755694f694a685932316c4c584e685a6d5630
6553317a64576c305a534973496e4e316158526c58335a6c636e4e7062323469
4f6949784c6a49754d434973496e526f636d567a614739735a434936496a4175
4f4441774969776964476c745a584e3059573177496a6f694d6a41794e693078
4d4330774d6c51774d446f774d446f774d466f6966513d3d222c22736368656d
61223a226170706c69636174696f6e2f766e642e7369676e65642d6576696465
6e63652e6576616c2d726563656970742b6a736f6e222c227369676e61747572
65223a7b22616c67223a2265643235353139222c226b6579223a227837707041
39394474756d484f2f4175304d2f67756d534b384977437a4e77506949443932
42534662616b3d222c22736967223a226870396c76454f4e5971597068464f49
48586637696269446b494a6a4833777136754a74416e68324c386932585a4b48
757358716a6963364f434f7a4577466b584871736b3334615075473278676f76
505a6b6444673d3d227d7d

A.2.62. N57 (criteria-digest-pattern; expected FAIL, step 7)

criteria_digest has uppercase hexadecimal digits, so it is not sha256: followed by 64 lowercase hexadecimal digits.

  • verification key: the issuer test key

  • payload bytes B: 550 bytes, SHA-256 10843299cd49f4de2ef357352235aae11d35f31a1ccf344fcdc2146c9ba03c31

  • receipt bytes: 995 bytes, SHA-256 d56b2df1da864f8998a45eebaea9795ce872e24b666f02ac20c52b9a8bea15a4

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c2263726974657269615f646967
657374223a227368613235363a37434345444231353241424133373430444344
4532304534463430313445323837354238363345443441343036323837393535
38424637384446394345343141222c22646174617365745f69645f636f6d6d69
74223a227368613235363a613231626134643936633830336434323633646433
6432313631626330333961333066343436326264353934373065333162613561
3961623061396233623633222c226d6574726963223a22616363757261637922
2c226d6f64656c5f69645f636f6d6d6974223a227368613235363a3930346465
3432353632663961313936353165313965623761623136356534666665313134
636535613266393865353764613538333839353936383466623066222c226e22
3a313830302c22706173736564223a747275652c22736368656d61223a226874
7470733a2f2f7369676e65642d65766964656e63652e6f72672f6576616c2d72
6563656970742f7631222c2273636f7265223a22302e383334222c2273756974
65223a2261636d652d7361666574792d7375697465222c2273756974655f7665
7273696f6e223a22312e322e30222c227468726573686f6c64223a22302e3830
30222c2274696d657374616d70223a22323032362d31302d30325430303a3030
3a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d4e796158526c636d6c68
583252705a32567a64434936496e4e6f595449314e6a6f3351304e4652454978
4e544a42516b457a4e7a517752454e4552544977525452474e4441784e455579
4f446331516a67324d3056454e4545304d4459794f4463354e545534516b5933
4f4552474f554e464e444642496977695a47463059584e6c644639705a46396a
62323174615851694f694a7a614745794e54593659544978596d45305a446b32
597a67774d3251304d6a597a5a47517a5a4449784e6a4669597a417a4f57457a
4d4759304e445979596d51314f5451334d47557a4d574a684e57453559574977
59546c694d3249324d794973496d316c64484a7059794936496d466a59335679
59574e35496977696257396b5a577866615752665932397462576c30496a6f69
633268684d6a55324f6a6b774e47526c4e4449314e6a4a6d4f5745784f545931
4d5755784f5756694e3246694d5459315a54526d5a6d55784d54526a5a545668
4d6d59354f4755314e3252684e54677a4f446b314f5459344e475a694d475969
4c434a75496a6f784f4441774c434a7759584e7a5a5751694f6e527964575573
496e4e6a6147567459534936496d68306448427a4f69387663326c6e626d566b
4c5756326157526c626d4e6c4c6d39795a79396c646d46734c584a6c59325670
63485176646a45694c434a7a593239795a534936496a41754f444d3049697769
63335670644755694f694a685932316c4c584e685a6d56306553317a64576c30
5a534973496e4e316158526c58335a6c636e4e70623234694f6949784c6a4975
4d434973496e526f636d567a614739735a434936496a41754f44417749697769
64476c745a584e3059573177496a6f694d6a41794e6930784d4330774d6c5177
4d446f774d446f774d466f6966513d3d222c22736368656d61223a226170706c
69636174696f6e2f766e642e7369676e65642d65766964656e63652e6576616c
2d726563656970742b6a736f6e222c227369676e6174757265223a7b22616c67
223a2265643235353139222c226b6579223a22783770704139394474756d484f
2f4175304d2f67756d534b384977437a4e7750694944393242534662616b3d22
2c22736967223a22546f5669786c427537366a51597a34696154426d48304157
524435734d4e344445315232617743576879674441676e304c6b527950387630
77544f65616e614b59547174586b6e413553567041334e735a51473642773d3d
227d7d

A.2.63. N58 (criteria-digest-type; expected FAIL, step 6)

criteria_digest is null, not a string.

  • verification key: the issuer test key

  • payload bytes B: 481 bytes, SHA-256 4e867ad1f3af62d74ebf50e1d080037886fc3c497d82d680fef7caff5effd37c

  • receipt bytes: 903 bytes, SHA-256 ae586cad042461a7e8f08f530467ed2242a16fd27cb0b2aabc187660b6071af9

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c2263726974657269615f646967
657374223a6e756c6c2c22646174617365745f69645f636f6d6d6974223a2273
68613235363a6132316261346439366338303364343236336464336432313631
6263303339613330663434363262643539343730653331626135613961623061
396233623633222c226d6574726963223a226163637572616379222c226d6f64
656c5f69645f636f6d6d6974223a227368613235363a39303464653432353632
6639613139363531653139656237616231363565346666653131346365356132
66393865353764613538333839353936383466623066222c226e223a31383030
2c22706173736564223a747275652c22736368656d61223a2268747470733a2f
2f7369676e65642d65766964656e63652e6f72672f6576616c2d726563656970
742f7631222c2273636f7265223a22302e383334222c227375697465223a2261
636d652d7361666574792d7375697465222c2273756974655f76657273696f6e
223a22312e322e30222c227468726573686f6c64223a22302e383030222c2274
696d657374616d70223a22323032362d31302d30325430303a30303a30305a22
7d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d4e796158526c636d6c68
583252705a32567a64434936626e5673624377695a47463059584e6c64463970
5a46396a62323174615851694f694a7a614745794e54593659544978596d4530
5a446b32597a67774d3251304d6a597a5a47517a5a4449784e6a4669597a417a
4f57457a4d4759304e445979596d51314f5451334d47557a4d574a684e574535
5957497759546c694d3249324d794973496d316c64484a7059794936496d466a
5933567959574e35496977696257396b5a577866615752665932397462576c30
496a6f69633268684d6a55324f6a6b774e47526c4e4449314e6a4a6d4f574578
4f5459314d5755784f5756694e3246694d5459315a54526d5a6d55784d54526a
5a5456684d6d59354f4755314e3252684e54677a4f446b314f5459344e475a69
4d4759694c434a75496a6f784f4441774c434a7759584e7a5a5751694f6e5279
64575573496e4e6a6147567459534936496d68306448427a4f69387663326c6e
626d566b4c5756326157526c626d4e6c4c6d39795a79396c646d46734c584a6c
5932567063485176646a45694c434a7a593239795a534936496a41754f444d30
4969776963335670644755694f694a685932316c4c584e685a6d56306553317a
64576c305a534973496e4e316158526c58335a6c636e4e70623234694f694978
4c6a49754d434973496e526f636d567a614739735a434936496a41754f444177
4969776964476c745a584e3059573177496a6f694d6a41794e6930784d433077
4d6c51774d446f774d446f774d466f6966513d3d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a22496473455674596d536a6870524b3873462f4a57
47656e7435585a3236416661684459485777536e4a72435057343944772f6f6c
75556b6a6e6f77397a662f76596853694639436d626c78767771794d67493144
42513d3d227d7d

A.2.64. N59 (mixed-order-R; expected FAIL, step 11 (profile 2, R))

R is the point r*B' plus the point of order 8, a canonical encoding of a point of mixed order, and S = r + k*a mod L with the issuer's secret scalar a. The cofactored equation 8*S*B' = 8*R + 8*k*A holds and the cofactorless equation does not; rule 2 rejects R before rule 4 is reached.

  • verification key: the issuer test key

  • payload bytes B: 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 871 bytes, SHA-256 2c913638dc4b977574a2582a60aeb934a87b3492a0da5dc451e1de84d9e4c3cc

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a22474b44624f565966752b682b4b6962376c355859
374a5a3461544975714f53586f46784a715a726c7a4e306576355855764d444f
745a78436849674c7552684d696a76464937786c5830416c667a68425355786e
44513d3d227d7d

A.2.65. N60 (payload-trailing-whitespace; expected FAIL, step 5)

B is that of P1 followed by one line feed (0a), signed anew. Step 4 admits the line feed under the rules of step 1; step 5 rejects B, because its RFC 8785 serialization has no insignificant whitespace.

Note: the signature over these bytes is valid.

  • verification key: the issuer test key

  • payload bytes B: 459 bytes, SHA-256 9b2463824053df70b4ee5378d97ae64a8c0c4abcdbfb92a4ba02cfcfff047e60

  • receipt bytes: 871 bytes, SHA-256 8ae470dfef62873bddb5e7a7c963c0e870f7dd5aec86ab5d79e85472430f4b8f

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d0a

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e304b222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a22783770704139394474
756d484f2f4175304d2f67756d534b384977437a4e7750694944393242534662
616b3d222c22736967223a22462b3737655536387074364b5851724e666b5678
65524d2b796736367155767275374876415844444a6b54304d774a3770307544
516d574f30387652334f594b33694e576f4d4252433839487476553241624f58
41773d3d227d7d

A.2.66. N61 (mixed-order-key; expected FAIL, step 11 (profile 2, key))

The verification key is the mixed-order test key: the issuer's public point plus a point of order 8. It is a canonical encoding and not a point of small order, but it is not of order L, so rule 2 rejects it. The signature satisfies the cofactorless equation under that key; a Receiver without rule 2 would accept it.

Note: the key is a pure test key with no RFC 8032 seed; R is of order L and S is below L.

  • verification key: the mixed-order test key

  • payload bytes B: 458 bytes, SHA-256 8cd849a6dcce08aee334511d7b2f31c54e478885dda1795d3c8f972dd0d4811c

  • receipt bytes: 871 bytes, SHA-256 c60d7faea7a71147c8cf2f0013e2630fa6d3913c02462203b74299ce2dc3f596

B (hex):

7b22636f6d6d69745f616c67223a227368613235362d73616c7465642d763122
2c22636f6d70617261746f72223a223e3d222c22646174617365745f69645f63
6f6d6d6974223a227368613235363a6132316261346439366338303364343236
3364643364323136316263303339613330663434363262643539343730653331
626135613961623061396233623633222c226d6574726963223a226163637572
616379222c226d6f64656c5f69645f636f6d6d6974223a227368613235363a39
3034646534323536326639613139363531653139656237616231363565346666
6531313463653561326639386535376461353833383935393638346662306622
2c226e223a313830302c22706173736564223a747275652c22736368656d6122
3a2268747470733a2f2f7369676e65642d65766964656e63652e6f72672f6576
616c2d726563656970742f7631222c2273636f7265223a22302e383334222c22
7375697465223a2261636d652d7361666574792d7375697465222c2273756974
655f76657273696f6e223a22312e322e30222c227468726573686f6c64223a22
302e383030222c2274696d657374616d70223a22323032362d31302d30325430
303a30303a30305a227d

Receipt (hex):

7b227061796c6f61645f623634223a2265794a6a62323174615852665957786e
496a6f69633268684d6a55324c584e686248526c5a4331324d534973496d4e76
62584268636d4630623349694f69492b50534973496d52686447467a5a585266
615752665932397462576c30496a6f69633268684d6a55324f6d45794d574a68
4e4751354e6d4d344d444e6b4e4449324d32526b4d3251794d545978596d4d77
4d7a6c684d7a426d4e4451324d6d4a6b4e546b304e7a426c4d7a466959545668
4f5746694d474535596a4e694e6a4d694c434a745a58527961574d694f694a68
59324e31636d466a65534973496d31765a47567358326c6b58324e7662573170
64434936496e4e6f595449314e6a6f354d44526b5a5451794e5459795a6a6c68
4d546b324e54466c4d546c6c596a6468596a45324e5755305a6d5a6c4d544530
5932553159544a6d4f54686c4e54646b595455344d7a67354e546b324f44526d
596a426d49697769626949364d5467774d4377696347467a6332566b496a7030
636e566c4c434a7a5932686c625745694f694a6f64485277637a6f764c334e70
5a32356c5a43316c646d6c6b5a57356a5a533576636d63765a585a6862433179
5a574e6c615842304c3359784969776963324e76636d55694f6949774c6a677a
4e434973496e4e316158526c496a6f6959574e745a53317a59575a6c64486b74
63335670644755694c434a7a64576c305a5639325a584a7a61573975496a6f69
4d5334794c6a41694c434a3061484a6c63326876624751694f6949774c6a6777
4d434973496e52706257567a6447467463434936496a49774d6a59744d544174
4d444a554d4441364d4441364d444261496e303d222c22736368656d61223a22
6170706c69636174696f6e2f766e642e7369676e65642d65766964656e63652e
6576616c2d726563656970742b6a736f6e222c227369676e6174757265223a7b
22616c67223a2265643235353139222c226b6579223a224a427a31377167786f
4c453036374266356b33684b5a3650666d66782f694438494561706564314e47
6f4d3d222c22736967223a2246726b48396d4635592f33534d6a394d51704d59
67374c777351725864506d466b6277562f4a4b565234654b636244566e796f33
50466d63612b35435447596f69724359447963484f305252734932796b59664e
44513d3d227d7d

Open Items (to be removed before publication)

Author's Address

Konrad Gruszka
b7n0de