VECTORS v1.3.3 · 6 VALID · 6 MUST-REJECT · 2 TRANSLATION

Test Vectors

The preimage ships with the verdict

Fourteen complete artifacts — six that must verify, six that must be rejected (tampered, expired, premature, revoked, wrong CA, self-signed), and two cross-format translations. Each carries its canonical bytes, so verification is reproduction.

14
VECTORS
6
VALID
6
MUST-REJECT
2
TRANSLATIONS
3
CA KEYS
1
REGENERATOR
Open the indexFile convention← Suite root
node ../score-runner.mjs·node generate-accept-vectors.mjs
uta / conformance vectors /
Test vectors · RFC 8785 JCS

The 14 vectors

Each vector is a complete trust-card (or key) artifact with a known expected verdict. Canonicalization is JCS (RFC 8785); the canonical bytes are published as hex, base64 and UTF-8 alongside the SHA-256, so an external verifier reproduces signature verification without guessing the preimage.

VectorKindExpectedWhy
valid-atcvalidverify ✓—
valid-atc-2validverify ✓—
valid-unknown-fieldvalidverify ✓—
invalid-signatureinvalidreject ✗tampered signature
expired-atcinvalidreject ✗expired
premature-atcinvalidreject ✗premature — issued_at is in the future (2030-01-01); the lower bound of the validity window fails
revoked-atcinvalidreject ✗revoked
valid-ztavalidverify ✓—
valid-a2avalidverify ✓—
valid-mcpvalidverify ✓—
atc-to-utstranslationverify ✓—
uts-to-ztatranslationverify ✓—
wrong-cainvalidreject ✗signed-by-wrong-ca-key
self-signed-atcinvalidreject ✗self-signed-untrusted-key
File convention

What ships with each vector

For a vector X:

  • X.json — the card as issued (what a verifier receives)
  • X.canonical.txt — the JCS-canonicalized bytes: the exact preimage that was signed
  • X.bytes.hex / X.bytes.base64 — the same canonical bytes, raw
  • X.sha256 — digest of the canonical bytes

CA material: _test-ca-keys.json, ca-test-1/2 (SPKI + raw32), wrong CA ca-wrong-1, self-signing key ca-self-1. generate-accept-vectors.mjs regenerates the set deterministically.