Skip to content

Commit ab6560b

Browse files
yaronfcursoragent
yaronf
and
cursoragent
committed
test: refresh WIMSE conformance to upstream v2 vectors
Replace sign-basic with sign-eddsa and sign-es256, add response signing coverage, and extend the profile overlay for created, wimse-sign-response, and wimse-req-nonce checks. Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent af4f0ac commit ab6560b

3 files changed

Lines changed: 721 additions & 136 deletions

File tree

testdata/wimse/sign-basic.json renamed to testdata/wimse/sign-eddsa.json

Lines changed: 110 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,22 @@
11
{
2-
"format": "wimse-conformance/v1",
2+
"format": "wimse-conformance/v2",
33
"suite": "httpsig",
4-
"id": "sign-basic",
4+
"id": "sign-eddsa",
55
"spec": "draft-ietf-wimse-http-signature-06",
6-
"description": "WIMSE HTTP Message Signature (RFC 9421, ed25519) carrying a WIT, plus the inputs a verifier must reject",
7-
"pop_signing_key_seed_b64u": "CQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQk",
8-
"issuer_verifying_key_b64u": "iojj3XQJ8ZX9UtstPLpdcspnCb8dlBIb83SIAbQPb1w",
6+
"description": "WIMSE HTTP Message Signature (RFC 9421, EdDSA) carrying a WIT, plus the inputs a verifier must reject",
7+
"pop_signing_key": {
8+
"alg": "EdDSA",
9+
"kty": "OKP",
10+
"crv": "Ed25519",
11+
"x": "_RckOFqgx1tk-3jNYC-h2ZH96_drE8WO1wLqyDXp9hg",
12+
"d": "CQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQk"
13+
},
14+
"issuer_verifying_key": {
15+
"alg": "EdDSA",
16+
"kty": "OKP",
17+
"crv": "Ed25519",
18+
"x": "iojj3XQJ8ZX9UtstPLpdcspnCb8dlBIb83SIAbQPb1w"
19+
},
920
"verify_now": 1700000100,
1021
"label": "wimse",
1122
"components": [
@@ -20,7 +31,8 @@
2031
"expires": 1700000300,
2132
"nonce": "abcd1111",
2233
"tag": "wimse-workload-to-workload",
23-
"wimse_aud": "https://service.example/transfer"
34+
"wimse_aud": "https://service.example/transfer",
35+
"wimse_sign_response": true
2436
},
2537
"request": {
2638
"method": "POST",
@@ -44,50 +56,57 @@
4456
},
4557
"body": "{\"amount\":100}",
4658
"wit": "eyJ0eXAiOiJ3aXQrand0IiwiYWxnIjoiRWREU0EiLCJraWQiOiJpc3N1ZXIta2V5LTEifQ.eyJpc3MiOiJodHRwczovL2lzc3Vlci5leGFtcGxlIiwic3ViIjoic3BpZmZlOi8vZXhhbXBsZS5vcmcvd29ya2xvYWQvYXBpIiwiaWF0IjoxNzAwMDAwMDAwLCJleHAiOjE3MDAwMDM2MDAsImp0aSI6ImExYjJjMyIsImNuZiI6eyJqd2siOnsiYWxnIjoiRWREU0EiLCJrdHkiOiJPS1AiLCJjcnYiOiJFZDI1NTE5IiwieCI6Il9SY2tPRnFneDF0ay0zak5ZQy1oMlpIOTZfZHJFOFdPMXdMcXlEWHA5aGcifX19.gEOIwRVXNwJTSXRGBDPV4CQLRUFeKYx-oK_nwSxaxegepaEEcKbn1TIPacMI0rWR2M8kRikyzB4jkcudkUtXCA",
47-
"signature_input": "wimse=(\"@method\" \"@request-target\" \"content-type\" \"content-digest\" \"workload-identity-token\");created=1700000000;expires=1700000300;nonce=\"abcd1111\";tag=\"wimse-workload-to-workload\";wimse-aud=\"https://service.example/transfer\"",
48-
"signature": "wimse=:7wug7wUAtTZkqCo8X2mMySacneAidDDsIldEAL7NLVYv+4c/wnQqClXBxEiuGZQgF6Q4qTnjHw46oEvq3/XYDw==:",
59+
"signature_input": "wimse=(\"@method\" \"@request-target\" \"content-type\" \"content-digest\" \"workload-identity-token\");created=1700000000;expires=1700000300;nonce=\"abcd1111\";tag=\"wimse-workload-to-workload\";wimse-aud=\"https://service.example/transfer\";wimse-sign-response",
60+
"signature": "wimse=:katKyeq7rWthUkDpgal/Zta7ktMJ9jqUqGFBWjZw9rLeb7UqHwCuaJybtyt0kDdNMtzy1jaBmb2OhdOiKBqUCg==:",
4961
"negative": [
5062
{
5163
"id": "forbidden-alg-parameter",
5264
"description": "the signature carries the `alg` parameter, which the profile forbids",
5365
"expect": "forbidden_parameter",
54-
"signature_input": "wimse=(\"@method\" \"@request-target\" \"content-type\" \"content-digest\" \"workload-identity-token\");created=1700000000;expires=1700000300;alg=\"ed25519\";nonce=\"abcd1111\";tag=\"wimse-workload-to-workload\";wimse-aud=\"https://service.example/transfer\"",
55-
"signature": "wimse=:7/gmpqDCKZYNgSsQtcVZp2nclqlx9OQk9u9/TQv7brNfF/HCR3iUGSByw+gG76DElEPrBPEMnFT/By8AzUwABg==:"
66+
"signature_input": "wimse=(\"@method\" \"@request-target\" \"content-type\" \"content-digest\" \"workload-identity-token\");created=1700000000;expires=1700000300;alg=\"ed25519\";nonce=\"abcd1111\";tag=\"wimse-workload-to-workload\";wimse-aud=\"https://service.example/transfer\";wimse-sign-response",
67+
"signature": "wimse=:pIj6LjAUqTES17qdQiJYzcX4uu3LJJD6CFFMjHoYxE90A+1M1OPh5LZwUfDAStSf1mc8cm6wB3RGk7GvX2+6DQ==:"
5668
},
5769
{
5870
"id": "forbidden-keyid-parameter",
5971
"description": "the signature carries the `keyid` parameter, which the profile forbids",
6072
"expect": "forbidden_parameter",
61-
"signature_input": "wimse=(\"@method\" \"@request-target\" \"content-type\" \"content-digest\" \"workload-identity-token\");created=1700000000;expires=1700000300;keyid=\"issuer-key-1\";nonce=\"abcd1111\";tag=\"wimse-workload-to-workload\";wimse-aud=\"https://service.example/transfer\"",
62-
"signature": "wimse=:Ue9Zw5RggvORbc4mcDtk6aBG20ddmCcp2fR7DbqF73AQHaMezs2nuMQCyj0ilIY0kiDrXoa/VO3xq2V7DKtTDQ==:"
73+
"signature_input": "wimse=(\"@method\" \"@request-target\" \"content-type\" \"content-digest\" \"workload-identity-token\");created=1700000000;expires=1700000300;keyid=\"issuer-key-1\";nonce=\"abcd1111\";tag=\"wimse-workload-to-workload\";wimse-aud=\"https://service.example/transfer\";wimse-sign-response",
74+
"signature": "wimse=:BbpQ5T+YDz6OqYpl+WqG4HlMGI1oL/vgvE9STDO95C+CkXYkSpCHUbRowRY8RzXvdkI2HL+/GahrgBt3ScpaAg==:"
6375
},
6476
{
6577
"id": "missing-nonce",
6678
"description": "the signature omits the mandatory `nonce` parameter",
6779
"expect": "missing_parameter",
68-
"signature_input": "wimse=(\"@method\" \"@request-target\" \"content-type\" \"content-digest\" \"workload-identity-token\");created=1700000000;expires=1700000300;tag=\"wimse-workload-to-workload\";wimse-aud=\"https://service.example/transfer\"",
69-
"signature": "wimse=:iq2jrPDHBRAtdh17iq3fYxOOHUwlp5Gz6eJSNRH2vkbt2WZJZRvxjTgeSkRXPZg3Ily1XoFVIKp9CB61HlzfCg==:"
80+
"signature_input": "wimse=(\"@method\" \"@request-target\" \"content-type\" \"content-digest\" \"workload-identity-token\");created=1700000000;expires=1700000300;tag=\"wimse-workload-to-workload\";wimse-aud=\"https://service.example/transfer\";wimse-sign-response",
81+
"signature": "wimse=:6E/+3yBeTOOQ4fMt9V7bf5cKnAYXBOQBhcrAcA78PXl2u2T33vgCgMEomgoj0O6XBaso36YXyfNWqoSPw/3zAg==:"
82+
},
83+
{
84+
"id": "missing-created",
85+
"description": "the signature omits the mandatory `created` parameter",
86+
"expect": "missing_parameter",
87+
"signature_input": "wimse=(\"@method\" \"@request-target\" \"content-type\" \"content-digest\" \"workload-identity-token\");expires=1700000300;nonce=\"abcd1111\";tag=\"wimse-workload-to-workload\";wimse-aud=\"https://service.example/transfer\";wimse-sign-response",
88+
"signature": "wimse=:89/LcsLxkO+KbNL5c3Tljhh0kK+i0hmablqTCyQkY98bhHoMDe1Eh214toX/6RWIIUy81hIzI2X3oR9wXd4JAg==:"
7089
},
7190
{
7291
"id": "missing-expires",
7392
"description": "the signature omits the mandatory `expires` parameter",
7493
"expect": "missing_parameter",
75-
"signature_input": "wimse=(\"@method\" \"@request-target\" \"content-type\" \"content-digest\" \"workload-identity-token\");created=1700000000;nonce=\"abcd1111\";tag=\"wimse-workload-to-workload\";wimse-aud=\"https://service.example/transfer\"",
76-
"signature": "wimse=:aZQ+nRBonH4ANWM+yXqxPkwqsINAZ51jGN7sdgYW/z2pJK3C840b3Mu1HfKFURepNHYLeywVnzMpaEiPWIuVDw==:"
94+
"signature_input": "wimse=(\"@method\" \"@request-target\" \"content-type\" \"content-digest\" \"workload-identity-token\");created=1700000000;nonce=\"abcd1111\";tag=\"wimse-workload-to-workload\";wimse-aud=\"https://service.example/transfer\";wimse-sign-response",
95+
"signature": "wimse=:UZAKuXHbxRHeJMr0/BJpjPHK8aqKW+kxyksxHSLwnq6rVy3GZtDKVPXzOFTGubQ+wQwfbT/O88xkem69rUuKCg==:"
7796
},
7897
{
7998
"id": "missing-wimse-aud",
8099
"description": "the request signature omits the mandatory `wimse-aud` parameter",
81100
"expect": "missing_parameter",
82-
"signature_input": "wimse=(\"@method\" \"@request-target\" \"content-type\" \"content-digest\" \"workload-identity-token\");created=1700000000;expires=1700000300;nonce=\"abcd1111\";tag=\"wimse-workload-to-workload\"",
83-
"signature": "wimse=:yiAx6JLxQmJ8xp2jaS+3/mHCBORLgD4baGsX8GFFSfGW3m1gS241/2p7UvlgKLvLlylp/eQmJcsjPOjXc00QDQ==:"
101+
"signature_input": "wimse=(\"@method\" \"@request-target\" \"content-type\" \"content-digest\" \"workload-identity-token\");created=1700000000;expires=1700000300;nonce=\"abcd1111\";tag=\"wimse-workload-to-workload\";wimse-sign-response",
102+
"signature": "wimse=:Lr4kxK1ZAry1sxooEgPqOhAgFOZbOuLpqM9rICVtb2RiuaE3lMxiuUwAMalr2cogd6dpFg1E7NI8AEqd7meGAA==:"
84103
},
85104
{
86105
"id": "wrong-tag",
87106
"description": "the signature's `tag` is not `wimse-workload-to-workload`",
88107
"expect": "wrong_tag",
89-
"signature_input": "wimse=(\"@method\" \"@request-target\" \"content-type\" \"content-digest\" \"workload-identity-token\");created=1700000000;expires=1700000300;nonce=\"abcd1111\";tag=\"some-other-protocol\";wimse-aud=\"https://service.example/transfer\"",
90-
"signature": "wimse=:1TlIWI/ISc34P9z75NxLcaBNc3jSoCjPeSGSkYPBXsLfZXlyG6cllNxhUftjADUZQZlVYrlUPF9ntOs7QF4hCg==:"
108+
"signature_input": "wimse=(\"@method\" \"@request-target\" \"content-type\" \"content-digest\" \"workload-identity-token\");created=1700000000;expires=1700000300;nonce=\"abcd1111\";tag=\"some-other-protocol\";wimse-aud=\"https://service.example/transfer\";wimse-sign-response",
109+
"signature": "wimse=:N4dwnp1CpwVqoUWQUgvFWddbVb30Gnu9dEL/xeCEVyCcqq8D984Ff5uEAdKSSHdgGu9S07WG+SwMnmFRpzLwDg==:"
91110
},
92111
{
93112
"id": "audience-mismatch",
@@ -153,5 +172,75 @@
153172
"\"authorization\""
154173
]
155174
}
156-
]
175+
],
176+
"response": {
177+
"status": 200,
178+
"headers": [
179+
[
180+
"Content-Type",
181+
"application/json"
182+
],
183+
[
184+
"Content-Digest",
185+
"sha-256=:C6fANWFJlGvwZC+rTvhblecJD294XQ+4QyPQxELlGQo=:"
186+
],
187+
[
188+
"Workload-Identity-Token",
189+
"eyJ0eXAiOiJ3aXQrand0IiwiYWxnIjoiRWREU0EiLCJraWQiOiJpc3N1ZXIta2V5LTEifQ.eyJpc3MiOiJodHRwczovL2lzc3Vlci5leGFtcGxlIiwic3ViIjoic3BpZmZlOi8vZXhhbXBsZS5vcmcvd29ya2xvYWQvYXBpIiwiaWF0IjoxNzAwMDAwMDAwLCJleHAiOjE3MDAwMDM2MDAsImp0aSI6ImExYjJjMyIsImNuZiI6eyJqd2siOnsiYWxnIjoiRWREU0EiLCJrdHkiOiJPS1AiLCJjcnYiOiJFZDI1NTE5IiwieCI6Il9SY2tPRnFneDF0ay0zak5ZQy1oMlpIOTZfZHJFOFdPMXdMcXlEWHA5aGcifX19.gEOIwRVXNwJTSXRGBDPV4CQLRUFeKYx-oK_nwSxaxegepaEEcKbn1TIPacMI0rWR2M8kRikyzB4jkcudkUtXCA"
190+
]
191+
],
192+
"body": "{\"status\":\"accepted\"}",
193+
"components": [
194+
"\"@status\"",
195+
"\"@method\";req",
196+
"\"@request-target\";req",
197+
"\"content-type\"",
198+
"\"content-digest\"",
199+
"\"workload-identity-token\""
200+
],
201+
"params": {
202+
"created": 1700000000,
203+
"expires": 1700000300,
204+
"nonce": "abcd2222",
205+
"tag": "wimse-workload-to-workload",
206+
"wimse_aud": "",
207+
"wimse_req_nonce": "abcd1111"
208+
},
209+
"signature_input": "wimse=(\"@status\" \"@method\";req \"@request-target\";req \"content-type\" \"content-digest\" \"workload-identity-token\");created=1700000000;expires=1700000300;nonce=\"abcd2222\";tag=\"wimse-workload-to-workload\";wimse-req-nonce=\"abcd1111\"",
210+
"signature": "wimse=:5cStMKi8sJluxZGXL1xLgE+PAId9bgbKaZlF3ibPW9vHmD8lhalIo/7v61ka++0xc5fj0s/dHIqltx3nEmcWAg==:",
211+
"expected_req_nonce": "abcd1111",
212+
"negative": [
213+
{
214+
"id": "lifted-onto-another-request",
215+
"description": "the same signed response, verified against a different request",
216+
"expect": "invalid_signature",
217+
"request": {
218+
"method": "POST",
219+
"authority": "service.example",
220+
"path": "/admin",
221+
"query": null,
222+
"headers": [
223+
[
224+
"Content-Type",
225+
"application/json"
226+
],
227+
[
228+
"Content-Digest",
229+
"sha-256=:TUu+Wcaq0iRCzeGZpqil8DRAX814+1qBwk7ySd4cRfE=:"
230+
],
231+
[
232+
"Workload-Identity-Token",
233+
"eyJ0eXAiOiJ3aXQrand0IiwiYWxnIjoiRWREU0EiLCJraWQiOiJpc3N1ZXIta2V5LTEifQ.eyJpc3MiOiJodHRwczovL2lzc3Vlci5leGFtcGxlIiwic3ViIjoic3BpZmZlOi8vZXhhbXBsZS5vcmcvd29ya2xvYWQvYXBpIiwiaWF0IjoxNzAwMDAwMDAwLCJleHAiOjE3MDAwMDM2MDAsImp0aSI6ImExYjJjMyIsImNuZiI6eyJqd2siOnsiYWxnIjoiRWREU0EiLCJrdHkiOiJPS1AiLCJjcnYiOiJFZDI1NTE5IiwieCI6Il9SY2tPRnFneDF0ay0zak5ZQy1oMlpIOTZfZHJFOFdPMXdMcXlEWHA5aGcifX19.gEOIwRVXNwJTSXRGBDPV4CQLRUFeKYx-oK_nwSxaxegepaEEcKbn1TIPacMI0rWR2M8kRikyzB4jkcudkUtXCA"
234+
]
235+
]
236+
}
237+
},
238+
{
239+
"id": "wrong-req-nonce",
240+
"description": "the client's nonce is not the one the response carries back",
241+
"expect": "request_nonce_mismatch",
242+
"expected_req_nonce": "some-other-nonce"
243+
}
244+
]
245+
}
157246
}

0 commit comments

Comments
 (0)