Conformance and test vectors
What “valid” means is defined by public test vectors – not by a description. Every implementation can measure itself against them.
In short
Public test vectors with real signatures define what is valid. Every implementation can measure itself against them, free of charge.
The test vectors
39 vectors with real signatures (ES256, EdDSA) and real RFC 3161 timestamps (RSA and ECDSA) from purpose-built test certificate authorities. Plus 11 Verifiable Intent vectors generated with the official Mastercard reference and carrying its verdict, and 12 Web Bot Auth vectors based on the test vectors published by Cloudflare. Every vector states input, options and the expected result. Private keys were never stored. License: Apache 2.0.
Download vectors.json, download vi-vectors.json, download wba-vectors.json
What the vectors cover
- Complete evidence packs at A3 and A4
- Tampered disclosures, signatures, chains and manifests
- Expired, not yet valid, revoked and suspended mandates
- Actions outside scope and amount limit, correctly denied actions
- Delegation chains, intact and impermissibly widened
- Timestamps over wrong content, with a foreign anchor and without a target
- Unknown, recognized and unsigned inputs
How to check your implementation
- Feed every vector with its input and options into your verification, with the verification time from
now. - Compare verdict, level and the checks named in the vector.
- For issuer implementations: produce your own evidence and verify it here or with the command line against the engine.
Getting a format added
Formats are added when there is a public specification and at least one test vector with a real signature. There is no fee and no preference for individual vendors. Requests to info@innopulse.io.
Known implementations
| Implementation | Role | Status |
|---|---|---|
| @knowyouragent/verify-core | Verification | Normative source of this specification |
| Mandact | Issuance and decision | Commercial reference implementation, same operator |
Further implementations are listed here as soon as they pass the vectors.
What conformance does not mean
Conformance means an implementation produces the same results as the engine. It is not a certification, not a security audit and not a statement about how an implementation is operated.