248 lines
8.8 KiB
JSON
248 lines
8.8 KiB
JSON
{
|
|
"generat": "2026-10-18T06:12:16.195Z",
|
|
"biblioteci": {
|
|
"@sd-jwt/core": "0.23.0",
|
|
"@sd-jwt/crypto-nodejs": "0.19.0",
|
|
"jose": "6.2.12",
|
|
"@owf/identity-common": "0.5.0",
|
|
"node": "v24.14.1"
|
|
},
|
|
"ceas": 1792281600,
|
|
"randuri": [
|
|
{
|
|
"sens": "noi->lor",
|
|
"caz": "EdDSA: prezentare cu age_over_18 + nationalities[RO], 2 momeli, KB(aud, nonce)",
|
|
"asteptat": "VALID/VALID",
|
|
"noi": "VALID",
|
|
"lor": "VALID",
|
|
"ok": true,
|
|
"nota": ""
|
|
},
|
|
{
|
|
"sens": "noi->lor",
|
|
"caz": "ES256: prezentare cu age_over_18 + nationalities[RO], 2 momeli, KB(aud, nonce)",
|
|
"asteptat": "VALID/VALID",
|
|
"noi": "VALID",
|
|
"lor": "VALID",
|
|
"ok": true,
|
|
"nota": ""
|
|
},
|
|
{
|
|
"sens": "noi->lor",
|
|
"caz": "ML-DSA-65: prezentare cu age_over_18 + nationalities[RO], 2 momeli, KB(aud, nonce)",
|
|
"asteptat": "VALID/VALID",
|
|
"noi": "VALID",
|
|
"lor": "VALID",
|
|
"ok": true,
|
|
"nota": ""
|
|
},
|
|
{
|
|
"sens": "noi->lor",
|
|
"caz": "NEGATIV: dezvaluirea given_name cu valoarea schimbata (fara KB)",
|
|
"asteptat": "REFUZ/REFUZ",
|
|
"noi": "REFUZ: a disclosure is not referenced by any digest of the issuer-signed JWT",
|
|
"lor": "REFUZ: Unreferenced disclosure(s) detected in SD-JWT",
|
|
"ok": true,
|
|
"nota": ""
|
|
},
|
|
{
|
|
"sens": "noi->lor",
|
|
"caz": "NEGATIV: KB pentru alt aud (verificatorul cere al lui)",
|
|
"asteptat": "REFUZ/REFUZ",
|
|
"noi": "REFUZ: key binding: made for https://other.example, not https://verifier.example",
|
|
"lor": "REFUZ: Verify Error: Invalid Key Binding audience",
|
|
"ok": true,
|
|
"nota": ""
|
|
},
|
|
{
|
|
"sens": "noi->lor",
|
|
"caz": "DIFERENTA: acelasi KB pentru alt aud, cand verificatorul LOR nu da expectedKeyBindingAudience",
|
|
"asteptat": "REFUZ/VALID",
|
|
"noi": "REFUZ: key binding: made for https://other.example, not https://verifier.example",
|
|
"lor": "VALID",
|
|
"ok": true,
|
|
"nota": "al lor: @sd-jwt/core compara aud-ul KB numai daca i se cere (RFC 9901 s.7.3 pasul 5.f cere legarea de verificator); la noi aud si nonce sunt cerute mereu"
|
|
},
|
|
{
|
|
"sens": "noi->lor",
|
|
"caz": "NEGATIV: alg none",
|
|
"asteptat": "REFUZ/REFUZ",
|
|
"noi": "REFUZ: alg \"none\" is not accepted (accepted: ES256, EdDSA, Ed25519, ML-DSA-65; never none)",
|
|
"lor": "REFUZ: Verify Error: alg \"none\" is not allowed",
|
|
"ok": true,
|
|
"nota": ""
|
|
},
|
|
{
|
|
"sens": "noi->lor",
|
|
"caz": "NEGATIV: acelasi digest de doua ori in _sd",
|
|
"asteptat": "REFUZ/REFUZ",
|
|
"noi": "REFUZ: the digest eq6hf8ZFjgcT.. appears more than once",
|
|
"lor": "REFUZ: Duplicate digest found in SD-JWT payload",
|
|
"ok": true,
|
|
"nota": ""
|
|
},
|
|
{
|
|
"sens": "noi->lor",
|
|
"caz": "NEGATIV: KB semnat de alta cheie decat cnf.jwk",
|
|
"asteptat": "REFUZ/REFUZ",
|
|
"noi": "REFUZ: key binding: the signature does not verify with the key given",
|
|
"lor": "REFUZ: Verify Error: Invalid JWT Signature [jose: signature verification failed]",
|
|
"ok": true,
|
|
"nota": ""
|
|
},
|
|
{
|
|
"sens": "noi->lor",
|
|
"caz": "NEGATIV: _sd_alg imbricat (RFC 9901 s.4.1.1 MUST NOT)",
|
|
"asteptat": "REFUZ/REFUZ",
|
|
"noi": "REFUZ: _sd_alg below the top level of the payload (RFC 9901 s.4.1.1)",
|
|
"lor": "REFUZ: Nested _sd_alg is not allowed",
|
|
"ok": true,
|
|
"nota": "reparat la noi pe 2026-10-18: pana atunci _sd_alg imbricat era pastrat ca afirmatie"
|
|
},
|
|
{
|
|
"sens": "noi->lor",
|
|
"caz": "DIFERENTA: prezentarea cu KB, verificatorul LOR fara keyBindingNonce (si fara cerinta de KB)",
|
|
"asteptat": "REFUZ/VALID",
|
|
"noi": "REFUZ: the verifier must give its audience and nonce to judge a key binding (RFC 9901 s.7.3)",
|
|
"lor": "VALID",
|
|
"ok": true,
|
|
"nota": "al lor: fara keyBindingNonce @sd-jwt/core nu judeca KB-ul prezent si nu il cere; la noi fara aud+nonce o prezentare cu KB e refuzata (RFC 9901 s.7.3)"
|
|
},
|
|
{
|
|
"sens": "noi->lor",
|
|
"caz": "DIFERENTA: jetonul emitentului cu typ JWT (ne-explicit)",
|
|
"asteptat": "REFUZ/VALID",
|
|
"noi": "REFUZ: typ \"JWT\" is not the type expected (an explicit ...+sd-jwt)",
|
|
"lor": "VALID",
|
|
"ok": true,
|
|
"nota": "al lor: @sd-jwt/core nu verifica typ-ul jetonului emitentului; RFC 9901 s.9.11 RECOMANDA ca verificatorii sa il verifice; la noi expectedTyp:null il lasa"
|
|
},
|
|
{
|
|
"sens": "lor->noi",
|
|
"caz": "EdDSA: dezvaluiri imbricate (address.locality), element de lista (nationalities[0]), 2 momeli, KB(aud, nonce); verificat cu expectedTyp:null",
|
|
"asteptat": "VALID/VALID",
|
|
"noi": "VALID",
|
|
"lor": "VALID",
|
|
"ok": true,
|
|
"nota": ""
|
|
},
|
|
{
|
|
"sens": "lor->noi",
|
|
"caz": "ES256: dezvaluiri imbricate (address.locality), element de lista (nationalities[0]), 2 momeli, KB(aud, nonce); verificat cu expectedTyp:null",
|
|
"asteptat": "VALID/VALID",
|
|
"noi": "VALID",
|
|
"lor": "VALID",
|
|
"ok": true,
|
|
"nota": ""
|
|
},
|
|
{
|
|
"sens": "lor->noi",
|
|
"caz": "ML-DSA-65: dezvaluiri imbricate (address.locality), element de lista (nationalities[0]), 2 momeli, KB(aud, nonce); verificat cu expectedTyp:null",
|
|
"asteptat": "VALID/VALID",
|
|
"noi": "VALID",
|
|
"lor": "VALID",
|
|
"ok": true,
|
|
"nota": ""
|
|
},
|
|
{
|
|
"sens": "lor->noi",
|
|
"caz": "DIFERENTA: acelasi jeton LOR, verificat cu tipul implicit cerut de noi (orice ...+sd-jwt)",
|
|
"asteptat": "REFUZ/VALID",
|
|
"noi": "REFUZ: typ undefined is not the type expected (an explicit ...+sd-jwt)",
|
|
"lor": "VALID",
|
|
"ok": true,
|
|
"nota": "al lor: SDJwtInstance nu pune typ implicit (SDJwtVcInstance pune dc+sd-jwt); RFC 9901 s.9.11: tipul explicit e RECOMMENDED; la noi se primeste cu expectedTyp:null sau cu typ dat la emitere"
|
|
},
|
|
{
|
|
"sens": "lor->noi",
|
|
"caz": "EdDSA: jetonul LOR emis cu header typ example+sd-jwt, verificat cu tipul implicit al nostru",
|
|
"asteptat": "VALID/VALID",
|
|
"noi": "VALID",
|
|
"lor": "VALID",
|
|
"ok": true,
|
|
"nota": ""
|
|
},
|
|
{
|
|
"sens": "lor->noi",
|
|
"caz": "DIFERENTA: jetonul LOR cu _sd_alg sha-384",
|
|
"asteptat": "REFUZ/VALID",
|
|
"noi": "REFUZ: _sd_alg \"sha-384\" is not understood (only sha-256)",
|
|
"lor": "VALID",
|
|
"ok": true,
|
|
"nota": "a noastra, dinadins: verificatorul nostru stie numai sha-256 (RFC 9901 s.4.1.1: sha-256 MUST be supported; alte functii sunt politica); @sd-jwt/core accepta lista IANA fara formele trunchiate"
|
|
},
|
|
{
|
|
"sens": "lor->noi",
|
|
"caz": "DIFERENTA: sarea dezvaluirii: lor 16 caractere (64 biti), noi 22 caractere (128 biti)",
|
|
"asteptat": "VALID/REFUZ",
|
|
"noi": "VALID",
|
|
"lor": "REFUZ: 64 biti sub cei 128 RECOMANDATI (RFC 9901 s.9.3)",
|
|
"ok": true,
|
|
"nota": "al lor: generateSalt(16) din @sd-jwt/crypto-nodejs da 16 caractere hexa = 64 de biti; generatorul de sare e injectabil, deci un emitent poate pune unul de 128 de biti; verificatorii nu judeca lungimea sarii"
|
|
},
|
|
{
|
|
"sens": "lor->noi",
|
|
"caz": "NEGATIV: dezvaluirea age_over_18 cu valoarea schimbata (fara KB)",
|
|
"asteptat": "REFUZ/REFUZ",
|
|
"noi": "REFUZ: a disclosure is not referenced by any digest of the issuer-signed JWT",
|
|
"lor": "REFUZ: Unreferenced disclosure(s) detected in SD-JWT",
|
|
"ok": true,
|
|
"nota": ""
|
|
},
|
|
{
|
|
"sens": "lor->noi",
|
|
"caz": "NEGATIV: KB pentru alt aud",
|
|
"asteptat": "REFUZ/REFUZ",
|
|
"noi": "REFUZ: key binding: made for https://other.example, not https://verifier.example",
|
|
"lor": "REFUZ: Verify Error: Invalid Key Binding audience",
|
|
"ok": true,
|
|
"nota": ""
|
|
},
|
|
{
|
|
"sens": "lor->noi",
|
|
"caz": "NEGATIV: alg none",
|
|
"asteptat": "REFUZ/REFUZ",
|
|
"noi": "REFUZ: alg \"none\" is not accepted (accepted: ES256, EdDSA, Ed25519, ML-DSA-65; never none)",
|
|
"lor": "REFUZ: Verify Error: alg \"none\" is not allowed",
|
|
"ok": true,
|
|
"nota": ""
|
|
},
|
|
{
|
|
"sens": "lor->noi",
|
|
"caz": "NEGATIV: acelasi digest de doua ori in _sd (re-semnat de emitentul LOR)",
|
|
"asteptat": "REFUZ/REFUZ",
|
|
"noi": "REFUZ: the digest CKtNAhaoNS2c.. appears more than once",
|
|
"lor": "REFUZ: Duplicate digest found in SD-JWT payload",
|
|
"ok": true,
|
|
"nota": ""
|
|
},
|
|
{
|
|
"sens": "lor->noi",
|
|
"caz": "NEGATIV: KB semnat de alta cheie decat cnf.jwk",
|
|
"asteptat": "REFUZ/REFUZ",
|
|
"noi": "REFUZ: key binding: the signature does not verify with the key given",
|
|
"lor": "REFUZ: Verify Error: Invalid JWT Signature [jose: signature verification failed]",
|
|
"ok": true,
|
|
"nota": ""
|
|
},
|
|
{
|
|
"sens": "lor->noi",
|
|
"caz": "NEGATIV: o dezvaluire scoasa din prezentare dupa semnarea KB",
|
|
"asteptat": "REFUZ/REFUZ",
|
|
"noi": "REFUZ: key binding: sd_hash is not the hash of what was presented",
|
|
"lor": "REFUZ: Invalid sd_hash in Key Binding JWT",
|
|
"ok": true,
|
|
"nota": ""
|
|
},
|
|
{
|
|
"sens": "lor->noi",
|
|
"caz": "ML-DSA-65: cheia AKP FARA parametrul alg (RFC 9964 s.3 il cere)",
|
|
"asteptat": "REFUZ/REFUZ",
|
|
"noi": "REFUZ: The property 'key.alg' must be one of: 'ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87'. Received undefined",
|
|
"lor": "REFUZ: jose.importJWK: missing \"alg\" (Algorithm) Parameter value",
|
|
"ok": true,
|
|
"nota": "masurat: jose o refuza; node:crypto refuza JWK-ul AKP fara alg: The property 'key.alg' must be one of: 'ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87'. Re"
|
|
}
|
|
]
|
|
}
|