Hi Songbo, Thank you very much, both for rerunning the verifier against the AAT-02 corpus and for the C6 cases. I checked the bundle against d813114 and got the same 13/13 and identical anchor-results.json. The paired negative control (issuer and key in different anchor records) is exactly the case the existing vectors cannot reach, since all their anchors have distinct keys.
Yes, they would be useful. Could you open them as a pull request from a fork of github.com/azatdavliatshin/aat? That way the authorship and the Apache-2.0 contribution stay in the history, and I can review and merge there. One correction to the context: the draft authors are not aware of C6 yet. I have not filed it with them so far; I plan to open an issue on tenuo-ai/tenuo today and will post the link to this thread. Until they answer, the tests document this implementation's interpretation, as your README already says. If you agree, I would also like to acknowledge your rerun and the C6 tests in the next revision of the report. Best, Azat вт, 3 нояб. 2026 г. в 05:39, Songbo Bu <[email protected]>: > > Hi Azat, > > I reran your verifier at d813114 against the bundled AAT-02 corpus. All 229 > vectors agree in the existing presentation/array checks, including the > denial-step and tracked replay-state checks. This uses the bundled oracle, > not a separate implementation. > > For C6, I added seven small issuer/key-pair regressions. They cover a shared > key under two issuer names in both orders, wrong-issuer and wrong-key > controls, and a key-rotation ordering. The paired negative control places the > correct issuer and the verifying key in different anchor records; it denies > at 3k rather than combining them. > > All seven pass without changing the verifier. The small attached bundle > contains the test, patch, results and reproduction instructions. > > Would these be useful as regression coverage for your stated interpretation > while the draft authors clarify C6? > > Best, > Songbo _______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
