{
  "group": "checkpoint",
  "protocol": 1,
  "description": "Checkpoint {v,type,log,size,root,t,prev} signed by K_checkpoint over JCS(body without sigs); hash = SHA-256(JCS(body)). Ed25519 verification requires canonical encodings, S < L, A and R not of small order and BOTH equations (cofactored and cofactorless). keyset_key_* cases: a key in a keyset must be a canonical point of the prime-order subgroup.",
  "keys": {
    "receipt": {
      "seed_label": "notarius/test-key/receipt",
      "seed": "8d60c8dd3c89ce70d4dee3a84aa344c1aba41dba5aee2acea8fa655371d9fffd",
      "public_key": "23577b219d870af8ebe541db5e3cbe41841465117f81a06ed187da006bed00b3",
      "key_id": "de481628f9145c3fee15afed8e09c5c9c766eff7cef22d45afba0a0820c73b5b"
    },
    "checkpoint": {
      "seed_label": "notarius/test-key/checkpoint",
      "seed": "cfcbfbaea52447b157fe04edd97dd0122f7631548221d4b61d3e88889b46f632",
      "public_key": "5d3fed6ab8f096e6d7508bf01faf36fd0662840c92ef48a502d10dfdb692d87c",
      "key_id": "febcffca9626e300ef34d4a0bceacf7cdb9f37fcef7fb6af49c413eae8d4d0b4"
    },
    "vector_rekor": {
      "scalar_label": "notarius/test-key/vector-rekor",
      "scalar": "8865a14961de85fd70fac8933e222e3d30dfaa4a50627ef5f8f42c073b7ca272",
      "public_key_pem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEN9C7c4or5bSU2xD+MgqajMqA/IXL\n3Kj/QoHxwCQO8cMwHEgRd9h3BnX0fI764rZnHUVzNu+ou3j2MiQjJBa9uw==\n-----END PUBLIC KEY-----\n"
    }
  },
  "cases": [
    {
      "name": "signed_checkpoint",
      "key": {
        "seed_label": "notarius/test-key/checkpoint",
        "seed": "cfcbfbaea52447b157fe04edd97dd0122f7631548221d4b61d3e88889b46f632",
        "public_key": "5d3fed6ab8f096e6d7508bf01faf36fd0662840c92ef48a502d10dfdb692d87c",
        "key_id": "febcffca9626e300ef34d4a0bceacf7cdb9f37fcef7fb6af49c413eae8d4d0b4"
      },
      "checkpoint": {
        "v": 1,
        "type": "checkpoint",
        "log": "draw/vec-stream-1",
        "size": 7,
        "root": "463590a662dd181d5bf442c81c938f0893b6f7df9d79bcc2ee3bd511e472acad",
        "t": "2026-10-16T11:59:00.000Z",
        "prev": "71077a9edddabf7e8522ff37044381a3e8f40370b697e5fb68c5e3132711179b",
        "sigs": [
          {
            "alg": "ed25519",
            "key_id": "febcffca9626e300ef34d4a0bceacf7cdb9f37fcef7fb6af49c413eae8d4d0b4",
            "sig": "85dda2a5a1e253ff40c97de28dee0a9842fab6f447261fc8ec37b61e82da0ceb4b53cedd670c3e0bbdbfbffb605bcbb142d5132120ce723df95dc145af07bf05"
          }
        ]
      },
      "expected_signing_bytes_utf8": "{\"log\":\"draw/vec-stream-1\",\"prev\":\"71077a9edddabf7e8522ff37044381a3e8f40370b697e5fb68c5e3132711179b\",\"root\":\"463590a662dd181d5bf442c81c938f0893b6f7df9d79bcc2ee3bd511e472acad\",\"size\":7,\"t\":\"2026-10-16T11:59:00.000Z\",\"type\":\"checkpoint\",\"v\":1}",
      "expected_checkpoint_hash": "079b505877cc3e49e7d51884d18189925a7cbd2b1863757b431afed7e52a426f",
      "expected_valid": true
    },
    {
      "name": "prev_links_checkpoints",
      "first": {
        "v": 1,
        "type": "checkpoint",
        "log": "draw/vec-stream-1",
        "size": 0,
        "root": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
        "t": "2026-10-16T11:50:00.000Z",
        "prev": null,
        "sigs": [
          {
            "alg": "ed25519",
            "key_id": "febcffca9626e300ef34d4a0bceacf7cdb9f37fcef7fb6af49c413eae8d4d0b4",
            "sig": "d9785c250481ed184b3d055aeb2827051a93d0827e6844129ea055adc188726c0895a0797f9eb2a2c5312ac5fabc30351b698cd02437ec6732350b00f7951c0d"
          }
        ]
      },
      "second": {
        "v": 1,
        "type": "checkpoint",
        "log": "draw/vec-stream-1",
        "size": 1,
        "root": "bc86a5fff8e4e497d316f011453137c42d3dc82d129c82b7ef66bb888287369a",
        "t": "2026-10-16T11:50:05.120Z",
        "prev": "0eaefa2228179798289ed6b381f20cdb96288176df3e618f8211d4ae32bebe8d",
        "sigs": [
          {
            "alg": "ed25519",
            "key_id": "febcffca9626e300ef34d4a0bceacf7cdb9f37fcef7fb6af49c413eae8d4d0b4",
            "sig": "b7fdf622f88b9fdb2454b417b29ba5da82c0aa027af13c16d5b97db25d7c03e492f6b53eca841aa2c4631830eae22537aad11e31a0f04ef7b282fd6a55a1c503"
          }
        ]
      },
      "expected_second_prev": "0eaefa2228179798289ed6b381f20cdb96288176df3e618f8211d4ae32bebe8d"
    },
    {
      "name": "tampered_root",
      "key": {
        "seed_label": "notarius/test-key/checkpoint",
        "seed": "cfcbfbaea52447b157fe04edd97dd0122f7631548221d4b61d3e88889b46f632",
        "public_key": "5d3fed6ab8f096e6d7508bf01faf36fd0662840c92ef48a502d10dfdb692d87c",
        "key_id": "febcffca9626e300ef34d4a0bceacf7cdb9f37fcef7fb6af49c413eae8d4d0b4"
      },
      "checkpoint": {
        "v": 1,
        "type": "checkpoint",
        "log": "draw/vec-stream-1",
        "size": 7,
        "root": "463590a662dd181d5bf442c81c938f0893b6f7df9d79bcc2ee3bd511e472aca0",
        "t": "2026-10-16T11:59:00.000Z",
        "prev": "71077a9edddabf7e8522ff37044381a3e8f40370b697e5fb68c5e3132711179b",
        "sigs": [
          {
            "alg": "ed25519",
            "key_id": "febcffca9626e300ef34d4a0bceacf7cdb9f37fcef7fb6af49c413eae8d4d0b4",
            "sig": "85dda2a5a1e253ff40c97de28dee0a9842fab6f447261fc8ec37b61e82da0ceb4b53cedd670c3e0bbdbfbffb605bcbb142d5132120ce723df95dc145af07bf05"
          }
        ]
      },
      "expected_valid": false
    },
    {
      "name": "tampered_signature_byte",
      "key": {
        "seed_label": "notarius/test-key/checkpoint",
        "seed": "cfcbfbaea52447b157fe04edd97dd0122f7631548221d4b61d3e88889b46f632",
        "public_key": "5d3fed6ab8f096e6d7508bf01faf36fd0662840c92ef48a502d10dfdb692d87c",
        "key_id": "febcffca9626e300ef34d4a0bceacf7cdb9f37fcef7fb6af49c413eae8d4d0b4"
      },
      "checkpoint": {
        "v": 1,
        "type": "checkpoint",
        "log": "draw/vec-stream-1",
        "size": 7,
        "root": "463590a662dd181d5bf442c81c938f0893b6f7df9d79bcc2ee3bd511e472acad",
        "t": "2026-10-16T11:59:00.000Z",
        "prev": "71077a9edddabf7e8522ff37044381a3e8f40370b697e5fb68c5e3132711179b",
        "sigs": [
          {
            "alg": "ed25519",
            "key_id": "febcffca9626e300ef34d4a0bceacf7cdb9f37fcef7fb6af49c413eae8d4d0b4",
            "sig": "85dda2a5a1e253ff40c97de28dee0a9842fab6f447261fc8ec37b61e82da0ceb4b53cedd670c3e0bbdbfbffb605bcbb142d5132120ce723df95dc145af07bf00"
          }
        ]
      },
      "expected_valid": false
    },
    {
      "name": "mixed_order_R_crafted_by_key_owner",
      "key": {
        "seed_label": "notarius/test-key/checkpoint",
        "seed": "cfcbfbaea52447b157fe04edd97dd0122f7631548221d4b61d3e88889b46f632",
        "public_key": "5d3fed6ab8f096e6d7508bf01faf36fd0662840c92ef48a502d10dfdb692d87c",
        "key_id": "febcffca9626e300ef34d4a0bceacf7cdb9f37fcef7fb6af49c413eae8d4d0b4"
      },
      "checkpoint": {
        "v": 1,
        "type": "checkpoint",
        "log": "draw/vec-stream-1",
        "size": 7,
        "root": "463590a662dd181d5bf442c81c938f0893b6f7df9d79bcc2ee3bd511e472acad",
        "t": "2026-10-16T11:59:00.000Z",
        "prev": "71077a9edddabf7e8522ff37044381a3e8f40370b697e5fb68c5e3132711179b",
        "sigs": [
          {
            "alg": "ed25519",
            "key_id": "febcffca9626e300ef34d4a0bceacf7cdb9f37fcef7fb6af49c413eae8d4d0b4",
            "sig": "40a4cf5c611d737a2f1c6fcca84d9cabfed80987f186a5a6c57e629bff1af27fad0a964c5f446c0c84a2ea31ac2dd46bf28219fd9ebe9f981dfef34527f4470b"
          }
        ]
      },
      "expected_valid": false,
      "cofactored_equation_alone_would_accept": true
    },
    {
      "name": "R_identity_crafted_by_key_owner",
      "key": {
        "seed_label": "notarius/test-key/checkpoint",
        "seed": "cfcbfbaea52447b157fe04edd97dd0122f7631548221d4b61d3e88889b46f632",
        "public_key": "5d3fed6ab8f096e6d7508bf01faf36fd0662840c92ef48a502d10dfdb692d87c",
        "key_id": "febcffca9626e300ef34d4a0bceacf7cdb9f37fcef7fb6af49c413eae8d4d0b4"
      },
      "checkpoint": {
        "v": 1,
        "type": "checkpoint",
        "log": "draw/vec-stream-1",
        "size": 7,
        "root": "463590a662dd181d5bf442c81c938f0893b6f7df9d79bcc2ee3bd511e472acad",
        "t": "2026-10-16T11:59:00.000Z",
        "prev": "71077a9edddabf7e8522ff37044381a3e8f40370b697e5fb68c5e3132711179b",
        "sigs": [
          {
            "alg": "ed25519",
            "key_id": "febcffca9626e300ef34d4a0bceacf7cdb9f37fcef7fb6af49c413eae8d4d0b4",
            "sig": "010000000000000000000000000000000000000000000000000000000000000099d91d170166b1c60f1e42ab246692caf61de06efa7adabe31400953ad4b8708"
          }
        ]
      },
      "expected_valid": false,
      "note": "R = identity, S = k*a: both equations hold, rejected because R is of small order"
    },
    {
      "name": "S_plus_L",
      "key": {
        "seed_label": "notarius/test-key/checkpoint",
        "seed": "cfcbfbaea52447b157fe04edd97dd0122f7631548221d4b61d3e88889b46f632",
        "public_key": "5d3fed6ab8f096e6d7508bf01faf36fd0662840c92ef48a502d10dfdb692d87c",
        "key_id": "febcffca9626e300ef34d4a0bceacf7cdb9f37fcef7fb6af49c413eae8d4d0b4"
      },
      "checkpoint": {
        "v": 1,
        "type": "checkpoint",
        "log": "draw/vec-stream-1",
        "size": 7,
        "root": "463590a662dd181d5bf442c81c938f0893b6f7df9d79bcc2ee3bd511e472acad",
        "t": "2026-10-16T11:59:00.000Z",
        "prev": "71077a9edddabf7e8522ff37044381a3e8f40370b697e5fb68c5e3132711179b",
        "sigs": [
          {
            "alg": "ed25519",
            "key_id": "febcffca9626e300ef34d4a0bceacf7cdb9f37fcef7fb6af49c413eae8d4d0b4",
            "sig": "85dda2a5a1e253ff40c97de28dee0a9842fab6f447261fc8ec37b61e82da0ceb3827c43a826f5063935cb79e3f55aac642d5132120ce723df95dc145af07bf15"
          }
        ]
      },
      "expected_valid": false,
      "note": "S >= L is not canonical"
    },
    {
      "name": "R_not_canonical_y_ge_p",
      "key": {
        "seed_label": "notarius/test-key/checkpoint",
        "seed": "cfcbfbaea52447b157fe04edd97dd0122f7631548221d4b61d3e88889b46f632",
        "public_key": "5d3fed6ab8f096e6d7508bf01faf36fd0662840c92ef48a502d10dfdb692d87c",
        "key_id": "febcffca9626e300ef34d4a0bceacf7cdb9f37fcef7fb6af49c413eae8d4d0b4"
      },
      "checkpoint": {
        "v": 1,
        "type": "checkpoint",
        "log": "draw/vec-stream-1",
        "size": 7,
        "root": "463590a662dd181d5bf442c81c938f0893b6f7df9d79bcc2ee3bd511e472acad",
        "t": "2026-10-16T11:59:00.000Z",
        "prev": "71077a9edddabf7e8522ff37044381a3e8f40370b697e5fb68c5e3132711179b",
        "sigs": [
          {
            "alg": "ed25519",
            "key_id": "febcffca9626e300ef34d4a0bceacf7cdb9f37fcef7fb6af49c413eae8d4d0b4",
            "sig": "eeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f99d91d170166b1c60f1e42ab246692caf61de06efa7adabe31400953ad4b8708"
          }
        ]
      },
      "expected_valid": false,
      "note": "y of R encoded as y + p"
    },
    {
      "name": "two_entries_same_key_first_broken",
      "key": {
        "seed_label": "notarius/test-key/checkpoint",
        "seed": "cfcbfbaea52447b157fe04edd97dd0122f7631548221d4b61d3e88889b46f632",
        "public_key": "5d3fed6ab8f096e6d7508bf01faf36fd0662840c92ef48a502d10dfdb692d87c",
        "key_id": "febcffca9626e300ef34d4a0bceacf7cdb9f37fcef7fb6af49c413eae8d4d0b4"
      },
      "checkpoint": {
        "v": 1,
        "type": "checkpoint",
        "log": "draw/vec-stream-1",
        "size": 7,
        "root": "463590a662dd181d5bf442c81c938f0893b6f7df9d79bcc2ee3bd511e472acad",
        "t": "2026-10-16T11:59:00.000Z",
        "prev": "71077a9edddabf7e8522ff37044381a3e8f40370b697e5fb68c5e3132711179b",
        "sigs": [
          {
            "alg": "ed25519",
            "key_id": "febcffca9626e300ef34d4a0bceacf7cdb9f37fcef7fb6af49c413eae8d4d0b4",
            "sig": "85dda2a5a1e253ff40c97de28dee0a9842fab6f447261fc8ec37b61e82da0ceb4b53cedd670c3e0bbdbfbffb605bcbb142d5132120ce723df95dc145af07bf00"
          },
          {
            "alg": "ed25519",
            "key_id": "febcffca9626e300ef34d4a0bceacf7cdb9f37fcef7fb6af49c413eae8d4d0b4",
            "sig": "85dda2a5a1e253ff40c97de28dee0a9842fab6f447261fc8ec37b61e82da0ceb4b53cedd670c3e0bbdbfbffb605bcbb142d5132120ce723df95dc145af07bf05"
          }
        ]
      },
      "expected_valid": true,
      "note": "signed by K if ANY ed25519 entry with its key_id verifies"
    },
    {
      "name": "entry_of_other_alg_ignored",
      "key": {
        "seed_label": "notarius/test-key/checkpoint",
        "seed": "cfcbfbaea52447b157fe04edd97dd0122f7631548221d4b61d3e88889b46f632",
        "public_key": "5d3fed6ab8f096e6d7508bf01faf36fd0662840c92ef48a502d10dfdb692d87c",
        "key_id": "febcffca9626e300ef34d4a0bceacf7cdb9f37fcef7fb6af49c413eae8d4d0b4"
      },
      "checkpoint": {
        "v": 1,
        "type": "checkpoint",
        "log": "draw/vec-stream-1",
        "size": 7,
        "root": "463590a662dd181d5bf442c81c938f0893b6f7df9d79bcc2ee3bd511e472acad",
        "t": "2026-10-16T11:59:00.000Z",
        "prev": "71077a9edddabf7e8522ff37044381a3e8f40370b697e5fb68c5e3132711179b",
        "sigs": [
          {
            "alg": "gost-34.10-2018",
            "key_id": "febcffca9626e300ef34d4a0bceacf7cdb9f37fcef7fb6af49c413eae8d4d0b4",
            "sig": "ab"
          },
          {
            "alg": "ed25519",
            "key_id": "febcffca9626e300ef34d4a0bceacf7cdb9f37fcef7fb6af49c413eae8d4d0b4",
            "sig": "85dda2a5a1e253ff40c97de28dee0a9842fab6f447261fc8ec37b61e82da0ceb4b53cedd670c3e0bbdbfbffb605bcbb142d5132120ce723df95dc145af07bf05"
          }
        ]
      },
      "expected_valid": true,
      "note": "entries with another alg are skipped (room for a second signature)"
    },
    {
      "name": "keyset_key_honest",
      "public_key": "5d3fed6ab8f096e6d7508bf01faf36fd0662840c92ef48a502d10dfdb692d87c",
      "expected_usable": true
    },
    {
      "name": "keyset_key_small_order",
      "public_key": "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a",
      "expected_usable": false
    },
    {
      "name": "keyset_key_mixed_order",
      "public_key": "1c354c4c7a6de4bcb4fd275f391333dd9bf17d38b41332753f60cf56d5ef4fcc",
      "expected_usable": false,
      "note": "[L]A != O: refused in a keyset"
    },
    {
      "name": "keyset_key_not_canonical",
      "public_key": "eeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f",
      "expected_usable": false
    }
  ]
}