AID-1 Provider-Independent Conformance Requirements and Test-Vector Model

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 5 March 2027.¶

Copyright Notice

Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

1. Introduction

AID-1 is intentionally independent of software-only, TPM, TEE, HSM, enclave, cloud, or other implementation providers. Conformance therefore depends on observable verification behavior rather than implementation mechanism.¶

This document defines the semantic contract for the AID-1-TEST machine-readable corpus and its reference vector runner.¶

2. Conformance Requirements

An implementation claiming conformance to AID-1 MUST execute the complete required vector corpus and MUST produce the expected outcome for every required vector.¶

The provider under test MUST NOT receive privileged knowledge of the expected result beyond the ordinary input data supplied to an AID-1 verifier.¶

The same vector corpus MUST be usable without semantic modification against SoftwareProvider, MockTPMProvider, MockTEEProvider, and future provider implementations.¶

3. Machine-Readable Corpus

The AID-1-TEST v1 corpus contains 69 deterministic vectors. Each vector SHOULD contain, directly or by stable reference, a base fixture, mutation or transformation, expected verification outcome, expected failure codes where applicable, and any downstream boundary expectations.¶

aid-1-test-vectors/
  manifest.json
  schema/
    vector.schema.json
    manifest.schema.json
  fixtures/
    identities/
    keys/
    delegations/
    authorizations/
    attestations/
    provenance/
  vectors/
    schema/
    canonicalization/
    crypto/
    identity/
    delegation/
    authorization/
    temporal/
    revocation/
    replay/
    attestation/
    provenance/
    integration/
  replay/
    R1.json
    R2.json
    R3.json
    R4.json
    R5.json
    R6.json

The machine-readable corpus is the executable test artifact. This document specifies the semantics required for interpreting that corpus.¶

4. Vector Execution Model

A reference runner SHOULD evaluate each vector using the following conceptual process:¶

base fixture
     +
specified mutation
     |
     v
deterministic candidate object
     |
     v
AID-1 verifier
     |
     v
actual decision
     |
     v
expected decision
     |
     v
PASS / FAIL

A mutation MUST be deterministic. A runner MUST NOT modify fields that are outside the mutation specified by the vector.¶

5. Expected Outcomes

A vector MAY expect ALLOW, DENY, or INDETERMINATE. A vector MAY also expect one or more standardized failure codes.¶

INDETERMINATE MUST NOT be treated as equivalent to ALLOW for conformance purposes.¶

6. Required Coverage

The corpus MUST include vectors covering at least:¶

• JCS canonicalization and rejection of unsupported values;¶
• Ed25519 positive and negative signature verification;¶
• tampered-envelope rejection;¶
• key-substitution rejection;¶
• identity binding independent from a self-supplied key;¶
• capability, resource, state, time, and delegation enforcement;¶
• revoked and unavailable revocation states;¶
• duplicate nonce and action replay;¶
• forged or untrusted external attestation;¶
• key rotation, overlap, supersession, and historical validity;¶
• audit-chain deletion, reordering, and mutation detection; and¶
• confused-deputy, audience-confusion, cross-repository replay, delegation-escalation, and stale-credential cases.¶

7. Replay and Architectural Boundary Cases

Six replay cases, R1 through R6, are reserved as architecture-level conformance cases. These cases are intended to detect accidental collapse of trust domains across implementations.¶

AID-1 verification: VALID
D6 scientific-admissibility decision: REJECT

8. Provider Independence

A provider implementation MAY use software keys, TPM-backed keys, TEE-backed keys, HSMs, secure enclaves, or future mechanisms. The provider MUST expose behavior compatible with the AID-1 verifier and MUST preserve the same externally observable decision semantics.¶

Provider-specific implementation details MUST NOT alter the expected outcome of any provider-independent vector.¶

9. Reference Vector Runner

The reference runner SHOULD load the corpus manifest, validate each vector against its schema, construct the candidate object, execute the AID-1 verifier, compare actual and expected outcomes, and emit a deterministic report.¶

The reference runner SHOULD report at least the vector identifier, actual decision, expected decision, observed failure codes, expected failure codes, and PASS or FAIL status.¶

10. Release Gates

An implementation MUST NOT claim completion of the AID-1 v1 security conformance profile until the required gates pass. These gates include:¶

1. JCS conformance and rejection tests;¶
2. Ed25519 positive, negative, tampered-envelope, and key-substitution vectors;¶
3. identity-binding separation from self-supplied key material;¶
4. independent authorization checks for capability, resource, state, time, and delegation;¶
5. revocation and unavailable-registry handling;¶
6. replay resistance;¶
7. external attestation verification;¶
8. rotation and historical-verification behavior;¶
9. audit-integrity checks; and¶
10. adversarial trust-boundary vectors.¶

11. Security Considerations

A conformance suite is security-sensitive because a weak oracle can certify incorrect behavior. The corpus, manifest, schemas, and runner SHOULD therefore be content-addressed or otherwise integrity protected.¶

Test providers MUST NOT be permitted to alter vector expectations during execution. CI systems SHOULD pin the corpus revision used for a conformance claim.¶

12. Privacy Considerations

Conformance fixtures SHOULD use synthetic identities, synthetic credentials, and non-production attestation material unless a test explicitly requires otherwise. Real personal credentials, production secrets, and live private keys MUST NOT be distributed in the public corpus.¶

13. IANA Considerations

This document requests no IANA actions.¶

14. Publication and Versioning

The 69-vector corpus SHOULD be versioned independently but SHOULD declare the AID-1 specification revision against which it is evaluated. Published conformance reports SHOULD identify both the corpus revision and the implementation revision.¶

Author's Address