{
  "description": "MUST-reject vectors. Each case starts from a valid construction (the seeds of payload-aead.json, key-wrap.json, and ed25519.json) and applies exactly one mutation; a conformant implementation MUST reject it. 'op' is the operation: 'payload-decrypt' (AES-256-GCM with the AVP AAD) and 'key-unwrap' (X25519-HKDF-SHA256-AESGCM-v1) MUST fail authentication; 'ed25519-verify' MUST return false. Wire base64 strictness is implementation-specific and intentionally not tested here. Generated by vectors/generate.ts from the same seeds as the positive vectors.",
  "cases": [
    {
      "name": "payload/flipped-tag",
      "op": "payload-decrypt",
      "mutation": "flip the last byte of the ciphertext (inside the GCM tag)",
      "expect": "reject",
      "keyB64": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=",
      "ivB64": "CgsMDQ4PAAECAwQF",
      "repoId": "repo-aead-1",
      "payloadVersion": 7,
      "keyEpoch": 2,
      "ciphertextB64": "1FyqKaTft8CoC/t3T5pbS4qy5UjvxYcTc31QKQRdgVyfadaPbG0QT6IQ3KgVsQ=="
    },
    {
      "name": "payload/bit-flipped-body",
      "op": "payload-decrypt",
      "mutation": "flip a bit in the first ciphertext byte",
      "expect": "reject",
      "keyB64": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=",
      "ivB64": "CgsMDQ4PAAECAwQF",
      "repoId": "repo-aead-1",
      "payloadVersion": 7,
      "keyEpoch": 2,
      "ciphertextB64": "1VyqKaTft8CoC/t3T5pbS4qy5UjvxYcTc31QKQRdgVyfadaPbG0QT6IQ3KgVsA=="
    },
    {
      "name": "payload/truncated-1-byte",
      "op": "payload-decrypt",
      "mutation": "drop the last ciphertext byte",
      "expect": "reject",
      "keyB64": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=",
      "ivB64": "CgsMDQ4PAAECAwQF",
      "repoId": "repo-aead-1",
      "payloadVersion": 7,
      "keyEpoch": 2,
      "ciphertextB64": "1FyqKaTft8CoC/t3T5pbS4qy5UjvxYcTc31QKQRdgVyfadaPbG0QT6IQ3KgV"
    },
    {
      "name": "payload/missing-tag",
      "op": "payload-decrypt",
      "mutation": "drop the whole 16-byte tag, leaving only the ciphertext body",
      "expect": "reject",
      "keyB64": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=",
      "ivB64": "CgsMDQ4PAAECAwQF",
      "repoId": "repo-aead-1",
      "payloadVersion": 7,
      "keyEpoch": 2,
      "ciphertextB64": "1FyqKaTft8CoC/t3T5pbS4qy5UjvxYcTc31QKQRd"
    },
    {
      "name": "payload/wrong-aad-repoId",
      "op": "payload-decrypt",
      "mutation": "decrypt the valid ciphertext under an AAD with a different repoId",
      "expect": "reject",
      "keyB64": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=",
      "ivB64": "CgsMDQ4PAAECAwQF",
      "repoId": "repo-aead-2",
      "payloadVersion": 7,
      "keyEpoch": 2,
      "ciphertextB64": "1FyqKaTft8CoC/t3T5pbS4qy5UjvxYcTc31QKQRdgVyfadaPbG0QT6IQ3KgVsA=="
    },
    {
      "name": "payload/wrong-aad-version",
      "op": "payload-decrypt",
      "mutation": "decrypt the valid ciphertext under an AAD with a different payloadVersion",
      "expect": "reject",
      "keyB64": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=",
      "ivB64": "CgsMDQ4PAAECAwQF",
      "repoId": "repo-aead-1",
      "payloadVersion": 8,
      "keyEpoch": 2,
      "ciphertextB64": "1FyqKaTft8CoC/t3T5pbS4qy5UjvxYcTc31QKQRdgVyfadaPbG0QT6IQ3KgVsA=="
    },
    {
      "name": "payload/wrong-aad-epoch",
      "op": "payload-decrypt",
      "mutation": "decrypt the valid ciphertext under an AAD with a different keyEpoch (rollback)",
      "expect": "reject",
      "keyB64": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=",
      "ivB64": "CgsMDQ4PAAECAwQF",
      "repoId": "repo-aead-1",
      "payloadVersion": 7,
      "keyEpoch": 3,
      "ciphertextB64": "1FyqKaTft8CoC/t3T5pbS4qy5UjvxYcTc31QKQRdgVyfadaPbG0QT6IQ3KgVsA=="
    },
    {
      "name": "payload/wrong-key",
      "op": "payload-decrypt",
      "mutation": "decrypt the valid ciphertext under a different data key",
      "expect": "reject",
      "keyB64": "//////////////////////////////////////////8=",
      "ivB64": "CgsMDQ4PAAECAwQF",
      "repoId": "repo-aead-1",
      "payloadVersion": 7,
      "keyEpoch": 2,
      "ciphertextB64": "1FyqKaTft8CoC/t3T5pbS4qy5UjvxYcTc31QKQRdgVyfadaPbG0QT6IQ3KgVsA=="
    },
    {
      "name": "key-wrap/flipped-tag",
      "op": "key-unwrap",
      "mutation": "flip the last byte of the wrap ciphertext (inside the GCM tag)",
      "expect": "reject",
      "recipientPrivateKeyB64": "dwdtCnMYpX08FsFyUbJmRd9ML4frwJkqsXf7pR25LCo=",
      "ephemeralPublicKeyB64": "3p7bfXt9wbTTW2HC7OQ1Nz+DQ8hbeGdNrfx+FG+IK08=",
      "ivB64": "qrvM3e7/ABEiM0RV",
      "ciphertextB64": "PM93je2VfKwFXs8G6RCrrcRGjIr6C/+a4cz16NxRnZbTMbXNxyvWDPXbU4Xj+dH6"
    },
    {
      "name": "key-wrap/tampered-body",
      "op": "key-unwrap",
      "mutation": "flip a bit in the first wrap-ciphertext byte",
      "expect": "reject",
      "recipientPrivateKeyB64": "dwdtCnMYpX08FsFyUbJmRd9ML4frwJkqsXf7pR25LCo=",
      "ephemeralPublicKeyB64": "3p7bfXt9wbTTW2HC7OQ1Nz+DQ8hbeGdNrfx+FG+IK08=",
      "ivB64": "qrvM3e7/ABEiM0RV",
      "ciphertextB64": "Pc93je2VfKwFXs8G6RCrrcRGjIr6C/+a4cz16NxRnZbTMbXNxyvWDPXbU4Xj+dH7"
    },
    {
      "name": "key-wrap/truncated-1-byte",
      "op": "key-unwrap",
      "mutation": "drop the last wrap-ciphertext byte",
      "expect": "reject",
      "recipientPrivateKeyB64": "dwdtCnMYpX08FsFyUbJmRd9ML4frwJkqsXf7pR25LCo=",
      "ephemeralPublicKeyB64": "3p7bfXt9wbTTW2HC7OQ1Nz+DQ8hbeGdNrfx+FG+IK08=",
      "ivB64": "qrvM3e7/ABEiM0RV",
      "ciphertextB64": "PM93je2VfKwFXs8G6RCrrcRGjIr6C/+a4cz16NxRnZbTMbXNxyvWDPXbU4Xj+dE="
    },
    {
      "name": "key-wrap/wrong-recipient-key",
      "op": "key-unwrap",
      "mutation": "unwrap with a different recipient private key (wrong KEK)",
      "expect": "reject",
      "recipientPrivateKeyB64": "XasIfmJKikt54X+Lg4AO5m87sSkmGLb9HC+LJ/+I4Os=",
      "ephemeralPublicKeyB64": "3p7bfXt9wbTTW2HC7OQ1Nz+DQ8hbeGdNrfx+FG+IK08=",
      "ivB64": "qrvM3e7/ABEiM0RV",
      "ciphertextB64": "PM93je2VfKwFXs8G6RCrrcRGjIr6C/+a4cz16NxRnZbTMbXNxyvWDPXbU4Xj+dH7"
    },
    {
      "name": "key-wrap/wrong-ephemeral-key",
      "op": "key-unwrap",
      "mutation": "unwrap against a different ephemeral public key (wrong shared secret)",
      "expect": "reject",
      "recipientPrivateKeyB64": "dwdtCnMYpX08FsFyUbJmRd9ML4frwJkqsXf7pR25LCo=",
      "ephemeralPublicKeyB64": "hSDwCYkwp1R0i33ctD73Wg2/Og0mOBr066SpjqqbTmo=",
      "ivB64": "qrvM3e7/ABEiM0RV",
      "ciphertextB64": "PM93je2VfKwFXs8G6RCrrcRGjIr6C/+a4cz16NxRnZbTMbXNxyvWDPXbU4Xj+dH7"
    },
    {
      "name": "ed25519/flipped-signature",
      "op": "ed25519-verify",
      "mutation": "flip the first signature byte",
      "expect": "reject",
      "publicKeyHex": "3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c",
      "messageHex": "72",
      "signatureHex": "93a009a9f0d4cab8720e820b5f642540a2b27b5416503f8fb3762223ebdb69da085ac1e43e15996e458f3613d0f11d8c387b2eaeb4302aeeb00d291612bb0c00"
    },
    {
      "name": "ed25519/wrong-message",
      "op": "ed25519-verify",
      "mutation": "verify the valid signature against a different message",
      "expect": "reject",
      "publicKeyHex": "3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c",
      "messageHex": "ff",
      "signatureHex": "92a009a9f0d4cab8720e820b5f642540a2b27b5416503f8fb3762223ebdb69da085ac1e43e15996e458f3613d0f11d8c387b2eaeb4302aeeb00d291612bb0c00"
    },
    {
      "name": "ed25519/wrong-public-key",
      "op": "ed25519-verify",
      "mutation": "verify the valid signature under a different public key",
      "expect": "reject",
      "publicKeyHex": "fc51cd8e6218a1a38da47ed00230f0580816ed13ba3303ac5deb911548908025",
      "messageHex": "72",
      "signatureHex": "92a009a9f0d4cab8720e820b5f642540a2b27b5416503f8fb3762223ebdb69da085ac1e43e15996e458f3613d0f11d8c387b2eaeb4302aeeb00d291612bb0c00"
    }
  ]
}