Message Encryption Test Vector Execution Guide

Normative test vectors · Common execution rules

Coverage

File: message-encryption-v1.json. Sections: envelope_signature, payload, and timeline.

Fixed Inputs and References

envelope_signature retains separately supplied signing input and signature results. Restore its two external inputs according to the following table:

payload.aad provides the original AAD. payload.encryption provides fixed inputs and results for X25519/HKDF/AES-GCM. timeline is an independent, complete request case containing key boxes for both sender and recipient.

Execution Steps and Assertions

Envelope Signing and Recipient Decryption

Reconstruct the signing input from the restored unsigned envelope, compare it with the supplied input and signature, and verify the signature. Unwrap the recipient key box and decrypt the body, comparing the AAD, key derivation, and encryption/decryption results individually.

AAD Authentication Rejection

payload.aad_rejection_cases uses the fixed content key, nonce, and ciphertext from payload.encryption. First reconstruct the message AAD object from that envelope and network_context, then replace the input fields specified by each case's aad_overrides, regenerate the Canonical JSON bytes, and directly perform AES-GCM authenticated decryption. expected_authenticated: false requires authentication failure without delivering plaintext.

These cases cover context mismatches caused by separate changes to the message ID, creation time, sender account, sender device, target account, network number, and Registry address. Envelope signature failure alone MUST NOT substitute for this authenticated decryption check.

Sender and Recipient Key Boxes

The KDF/AAD inputs, shared secrets, wrapping keys, and decryption results of the key boxes in timeline are exact protocol bytes. The implementation MUST also confirm that the original envelope's device signature is valid and that the sender key box can decrypt the same payload.