{
 "generat": "2026-10-18T06:12:16.195Z",
 "biblioteci": {
  "@sd-jwt/core": "0.23.0",
  "@sd-jwt/crypto-nodejs": "0.19.0",
  "jose": "6.2.12",
  "@owf/identity-common": "0.5.0",
  "node": "v24.14.1"
 },
 "ceas": 1792281600,
 "randuri": [
  {
   "sens": "noi->lor",
   "caz": "EdDSA: prezentare cu age_over_18 + nationalities[RO], 2 momeli, KB(aud, nonce)",
   "asteptat": "VALID/VALID",
   "noi": "VALID",
   "lor": "VALID",
   "ok": true,
   "nota": ""
  },
  {
   "sens": "noi->lor",
   "caz": "ES256: prezentare cu age_over_18 + nationalities[RO], 2 momeli, KB(aud, nonce)",
   "asteptat": "VALID/VALID",
   "noi": "VALID",
   "lor": "VALID",
   "ok": true,
   "nota": ""
  },
  {
   "sens": "noi->lor",
   "caz": "ML-DSA-65: prezentare cu age_over_18 + nationalities[RO], 2 momeli, KB(aud, nonce)",
   "asteptat": "VALID/VALID",
   "noi": "VALID",
   "lor": "VALID",
   "ok": true,
   "nota": ""
  },
  {
   "sens": "noi->lor",
   "caz": "NEGATIV: dezvaluirea given_name cu valoarea schimbata (fara KB)",
   "asteptat": "REFUZ/REFUZ",
   "noi": "REFUZ: a disclosure is not referenced by any digest of the issuer-signed JWT",
   "lor": "REFUZ: Unreferenced disclosure(s) detected in SD-JWT",
   "ok": true,
   "nota": ""
  },
  {
   "sens": "noi->lor",
   "caz": "NEGATIV: KB pentru alt aud (verificatorul cere al lui)",
   "asteptat": "REFUZ/REFUZ",
   "noi": "REFUZ: key binding: made for https://other.example, not https://verifier.example",
   "lor": "REFUZ: Verify Error: Invalid Key Binding audience",
   "ok": true,
   "nota": ""
  },
  {
   "sens": "noi->lor",
   "caz": "DIFERENTA: acelasi KB pentru alt aud, cand verificatorul LOR nu da expectedKeyBindingAudience",
   "asteptat": "REFUZ/VALID",
   "noi": "REFUZ: key binding: made for https://other.example, not https://verifier.example",
   "lor": "VALID",
   "ok": true,
   "nota": "al lor: @sd-jwt/core compara aud-ul KB numai daca i se cere (RFC 9901 s.7.3 pasul 5.f cere legarea de verificator); la noi aud si nonce sunt cerute mereu"
  },
  {
   "sens": "noi->lor",
   "caz": "NEGATIV: alg none",
   "asteptat": "REFUZ/REFUZ",
   "noi": "REFUZ: alg \"none\" is not accepted (accepted: ES256, EdDSA, Ed25519, ML-DSA-65; never none)",
   "lor": "REFUZ: Verify Error: alg \"none\" is not allowed",
   "ok": true,
   "nota": ""
  },
  {
   "sens": "noi->lor",
   "caz": "NEGATIV: acelasi digest de doua ori in _sd",
   "asteptat": "REFUZ/REFUZ",
   "noi": "REFUZ: the digest eq6hf8ZFjgcT.. appears more than once",
   "lor": "REFUZ: Duplicate digest found in SD-JWT payload",
   "ok": true,
   "nota": ""
  },
  {
   "sens": "noi->lor",
   "caz": "NEGATIV: KB semnat de alta cheie decat cnf.jwk",
   "asteptat": "REFUZ/REFUZ",
   "noi": "REFUZ: key binding: the signature does not verify with the key given",
   "lor": "REFUZ: Verify Error: Invalid JWT Signature [jose: signature verification failed]",
   "ok": true,
   "nota": ""
  },
  {
   "sens": "noi->lor",
   "caz": "NEGATIV: _sd_alg imbricat (RFC 9901 s.4.1.1 MUST NOT)",
   "asteptat": "REFUZ/REFUZ",
   "noi": "REFUZ: _sd_alg below the top level of the payload (RFC 9901 s.4.1.1)",
   "lor": "REFUZ: Nested _sd_alg is not allowed",
   "ok": true,
   "nota": "reparat la noi pe 2026-10-18: pana atunci _sd_alg imbricat era pastrat ca afirmatie"
  },
  {
   "sens": "noi->lor",
   "caz": "DIFERENTA: prezentarea cu KB, verificatorul LOR fara keyBindingNonce (si fara cerinta de KB)",
   "asteptat": "REFUZ/VALID",
   "noi": "REFUZ: the verifier must give its audience and nonce to judge a key binding (RFC 9901 s.7.3)",
   "lor": "VALID",
   "ok": true,
   "nota": "al lor: fara keyBindingNonce @sd-jwt/core nu judeca KB-ul prezent si nu il cere; la noi fara aud+nonce o prezentare cu KB e refuzata (RFC 9901 s.7.3)"
  },
  {
   "sens": "noi->lor",
   "caz": "DIFERENTA: jetonul emitentului cu typ JWT (ne-explicit)",
   "asteptat": "REFUZ/VALID",
   "noi": "REFUZ: typ \"JWT\" is not the type expected (an explicit ...+sd-jwt)",
   "lor": "VALID",
   "ok": true,
   "nota": "al lor: @sd-jwt/core nu verifica typ-ul jetonului emitentului; RFC 9901 s.9.11 RECOMANDA ca verificatorii sa il verifice; la noi expectedTyp:null il lasa"
  },
  {
   "sens": "lor->noi",
   "caz": "EdDSA: dezvaluiri imbricate (address.locality), element de lista (nationalities[0]), 2 momeli, KB(aud, nonce); verificat cu expectedTyp:null",
   "asteptat": "VALID/VALID",
   "noi": "VALID",
   "lor": "VALID",
   "ok": true,
   "nota": ""
  },
  {
   "sens": "lor->noi",
   "caz": "ES256: dezvaluiri imbricate (address.locality), element de lista (nationalities[0]), 2 momeli, KB(aud, nonce); verificat cu expectedTyp:null",
   "asteptat": "VALID/VALID",
   "noi": "VALID",
   "lor": "VALID",
   "ok": true,
   "nota": ""
  },
  {
   "sens": "lor->noi",
   "caz": "ML-DSA-65: dezvaluiri imbricate (address.locality), element de lista (nationalities[0]), 2 momeli, KB(aud, nonce); verificat cu expectedTyp:null",
   "asteptat": "VALID/VALID",
   "noi": "VALID",
   "lor": "VALID",
   "ok": true,
   "nota": ""
  },
  {
   "sens": "lor->noi",
   "caz": "DIFERENTA: acelasi jeton LOR, verificat cu tipul implicit cerut de noi (orice ...+sd-jwt)",
   "asteptat": "REFUZ/VALID",
   "noi": "REFUZ: typ undefined is not the type expected (an explicit ...+sd-jwt)",
   "lor": "VALID",
   "ok": true,
   "nota": "al lor: SDJwtInstance nu pune typ implicit (SDJwtVcInstance pune dc+sd-jwt); RFC 9901 s.9.11: tipul explicit e RECOMMENDED; la noi se primeste cu expectedTyp:null sau cu typ dat la emitere"
  },
  {
   "sens": "lor->noi",
   "caz": "EdDSA: jetonul LOR emis cu header typ example+sd-jwt, verificat cu tipul implicit al nostru",
   "asteptat": "VALID/VALID",
   "noi": "VALID",
   "lor": "VALID",
   "ok": true,
   "nota": ""
  },
  {
   "sens": "lor->noi",
   "caz": "DIFERENTA: jetonul LOR cu _sd_alg sha-384",
   "asteptat": "REFUZ/VALID",
   "noi": "REFUZ: _sd_alg \"sha-384\" is not understood (only sha-256)",
   "lor": "VALID",
   "ok": true,
   "nota": "a noastra, dinadins: verificatorul nostru stie numai sha-256 (RFC 9901 s.4.1.1: sha-256 MUST be supported; alte functii sunt politica); @sd-jwt/core accepta lista IANA fara formele trunchiate"
  },
  {
   "sens": "lor->noi",
   "caz": "DIFERENTA: sarea dezvaluirii: lor 16 caractere (64 biti), noi 22 caractere (128 biti)",
   "asteptat": "VALID/REFUZ",
   "noi": "VALID",
   "lor": "REFUZ: 64 biti sub cei 128 RECOMANDATI (RFC 9901 s.9.3)",
   "ok": true,
   "nota": "al lor: generateSalt(16) din @sd-jwt/crypto-nodejs da 16 caractere hexa = 64 de biti; generatorul de sare e injectabil, deci un emitent poate pune unul de 128 de biti; verificatorii nu judeca lungimea sarii"
  },
  {
   "sens": "lor->noi",
   "caz": "NEGATIV: dezvaluirea age_over_18 cu valoarea schimbata (fara KB)",
   "asteptat": "REFUZ/REFUZ",
   "noi": "REFUZ: a disclosure is not referenced by any digest of the issuer-signed JWT",
   "lor": "REFUZ: Unreferenced disclosure(s) detected in SD-JWT",
   "ok": true,
   "nota": ""
  },
  {
   "sens": "lor->noi",
   "caz": "NEGATIV: KB pentru alt aud",
   "asteptat": "REFUZ/REFUZ",
   "noi": "REFUZ: key binding: made for https://other.example, not https://verifier.example",
   "lor": "REFUZ: Verify Error: Invalid Key Binding audience",
   "ok": true,
   "nota": ""
  },
  {
   "sens": "lor->noi",
   "caz": "NEGATIV: alg none",
   "asteptat": "REFUZ/REFUZ",
   "noi": "REFUZ: alg \"none\" is not accepted (accepted: ES256, EdDSA, Ed25519, ML-DSA-65; never none)",
   "lor": "REFUZ: Verify Error: alg \"none\" is not allowed",
   "ok": true,
   "nota": ""
  },
  {
   "sens": "lor->noi",
   "caz": "NEGATIV: acelasi digest de doua ori in _sd (re-semnat de emitentul LOR)",
   "asteptat": "REFUZ/REFUZ",
   "noi": "REFUZ: the digest CKtNAhaoNS2c.. appears more than once",
   "lor": "REFUZ: Duplicate digest found in SD-JWT payload",
   "ok": true,
   "nota": ""
  },
  {
   "sens": "lor->noi",
   "caz": "NEGATIV: KB semnat de alta cheie decat cnf.jwk",
   "asteptat": "REFUZ/REFUZ",
   "noi": "REFUZ: key binding: the signature does not verify with the key given",
   "lor": "REFUZ: Verify Error: Invalid JWT Signature [jose: signature verification failed]",
   "ok": true,
   "nota": ""
  },
  {
   "sens": "lor->noi",
   "caz": "NEGATIV: o dezvaluire scoasa din prezentare dupa semnarea KB",
   "asteptat": "REFUZ/REFUZ",
   "noi": "REFUZ: key binding: sd_hash is not the hash of what was presented",
   "lor": "REFUZ: Invalid sd_hash in Key Binding JWT",
   "ok": true,
   "nota": ""
  },
  {
   "sens": "lor->noi",
   "caz": "ML-DSA-65: cheia AKP FARA parametrul alg (RFC 9964 s.3 il cere)",
   "asteptat": "REFUZ/REFUZ",
   "noi": "REFUZ: The property 'key.alg' must be one of: 'ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87'. Received undefined",
   "lor": "REFUZ: jose.importJWK: missing \"alg\" (Algorithm) Parameter value",
   "ok": true,
   "nota": "masurat: jose o refuza; node:crypto refuza JWK-ul AKP fara alg: The property 'key.alg' must be one of: 'ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87'. Re"
  }
 ]
}