@imagina-build/ias-cli 0.0.0 → 0.1.1

package/shared/vault/test-vectors/tampered.json

@@ -0,0 +1,610 @@
+{
+  "format": "ias-vault-1",
+  "description": "Well-formed envelopes that were altered: the server accepts their shape (it cannot tell), and opening them with key must fail with error.",
+  "warning": "Test vectors: the keys are public. Never use them for anything else.",
+  "base": "sealed.json, text-for-recovery-and-runner-a",
+  "cases": [
+    {
+      "name": "ciphertext-bit",
+      "description": "One bit of the first byte of data.ct flipped.",
+      "key": "runner-a",
+      "error": "decrypt-failed",
+      "envelope": {
+        "format": "ias-vault-1",
+        "credential": {
+          "id": "0d5e6c9a-4b8f-4c1e-9a3d-2f7b8e1c6a40",
+          "type": "ios-distribution-certificate",
+          "version": 1
+        },
+        "data": {
+          "iv": "Hp-AoxVNmWFNSG35",
+          "ct": "HnbKVI3MnjfMdX1SDz9oNf7pN_Y03jHt_ttDaw42PdbwY_EyN-HXFv7PhsO55OwGFL05nenQXcUYpA"
+        },
+        "recipients": [
+          {
+            "kid": "gY6AuqT5ADs7vK-fmj9UEb5Gf6ZSdOLxT1mBWwD5hA0",
+            "epk": "Elwq15U3Nxrb6iCJg-aWOEcfsd9DFbIIX4EgCt06qVM",
+            "iv": "gVsaOTmFS8aLqGlS",
+            "wk": "b8ao7aW61LvHQn8xzWHDjT_ocDJGHxclZta5Q2QoV-cS3_84ssTw1zizzVeNBcUF"
+          },
+          {
+            "kid": "OHeCFPD25tPd2DRaYj34dS7DLtio-1gUq_-NYsYmqNk",
+            "epk": "D4lqNnuzZL65zNTmyaKekxzeSwIPF9rruhZkDNxmXSw",
+            "iv": "kJchZolDykWp1SpX",
+            "wk": "AJZjHoXSPJnJydcBz-OiWEtyl5YKjyO1tN0G5vCrX7C6XNcQxsdydovX9zp8j9Ud"
+          }
+        ]
+      }
+    },
+    {
+      "name": "tag-bit",
+      "description": "One bit of the tag (the last byte of data.ct) flipped.",
+      "key": "runner-a",
+      "error": "decrypt-failed",
+      "envelope": {
+        "format": "ias-vault-1",
+        "credential": {
+          "id": "0d5e6c9a-4b8f-4c1e-9a3d-2f7b8e1c6a40",
+          "type": "ios-distribution-certificate",
+          "version": 1
+        },
+        "data": {
+          "iv": "Hp-AoxVNmWFNSG35",
+          "ct": "H3bKVI3MnjfMdX1SDz9oNf7pN_Y03jHt_ttDaw42PdbwY_EyN-HXFv7PhsO55OwGFL05nenQXcUYpQ"
+        },
+        "recipients": [
+          {
+            "kid": "gY6AuqT5ADs7vK-fmj9UEb5Gf6ZSdOLxT1mBWwD5hA0",
+            "epk": "Elwq15U3Nxrb6iCJg-aWOEcfsd9DFbIIX4EgCt06qVM",
+            "iv": "gVsaOTmFS8aLqGlS",
+            "wk": "b8ao7aW61LvHQn8xzWHDjT_ocDJGHxclZta5Q2QoV-cS3_84ssTw1zizzVeNBcUF"
+          },
+          {
+            "kid": "OHeCFPD25tPd2DRaYj34dS7DLtio-1gUq_-NYsYmqNk",
+            "epk": "D4lqNnuzZL65zNTmyaKekxzeSwIPF9rruhZkDNxmXSw",
+            "iv": "kJchZolDykWp1SpX",
+            "wk": "AJZjHoXSPJnJydcBz-OiWEtyl5YKjyO1tN0G5vCrX7C6XNcQxsdydovX9zp8j9Ud"
+          }
+        ]
+      }
+    },
+    {
+      "name": "data-iv",
+      "description": "Another data IV.",
+      "key": "runner-a",
+      "error": "decrypt-failed",
+      "envelope": {
+        "format": "ias-vault-1",
+        "credential": {
+          "id": "0d5e6c9a-4b8f-4c1e-9a3d-2f7b8e1c6a40",
+          "type": "ios-distribution-certificate",
+          "version": 1
+        },
+        "data": {
+          "iv": "i1qEg94O5qWUyrEK",
+          "ct": "H3bKVI3MnjfMdX1SDz9oNf7pN_Y03jHt_ttDaw42PdbwY_EyN-HXFv7PhsO55OwGFL05nenQXcUYpA"
+        },
+        "recipients": [
+          {
+            "kid": "gY6AuqT5ADs7vK-fmj9UEb5Gf6ZSdOLxT1mBWwD5hA0",
+            "epk": "Elwq15U3Nxrb6iCJg-aWOEcfsd9DFbIIX4EgCt06qVM",
+            "iv": "gVsaOTmFS8aLqGlS",
+            "wk": "b8ao7aW61LvHQn8xzWHDjT_ocDJGHxclZta5Q2QoV-cS3_84ssTw1zizzVeNBcUF"
+          },
+          {
+            "kid": "OHeCFPD25tPd2DRaYj34dS7DLtio-1gUq_-NYsYmqNk",
+            "epk": "D4lqNnuzZL65zNTmyaKekxzeSwIPF9rruhZkDNxmXSw",
+            "iv": "kJchZolDykWp1SpX",
+            "wk": "AJZjHoXSPJnJydcBz-OiWEtyl5YKjyO1tN0G5vCrX7C6XNcQxsdydovX9zp8j9Ud"
+          }
+        ]
+      }
+    },
+    {
+      "name": "ciphertext-of-other-envelope",
+      "description": "The data of the other envelope of the same credential, under the wraps of this one.",
+      "key": "runner-a",
+      "error": "decrypt-failed",
+      "envelope": {
+        "format": "ias-vault-1",
+        "credential": {
+          "id": "0d5e6c9a-4b8f-4c1e-9a3d-2f7b8e1c6a40",
+          "type": "ios-distribution-certificate",
+          "version": 1
+        },
+        "data": {
+          "iv": "51Ew6h4vp1cqM3Qd",
+          "ct": "NBW1kV5khGN67RONaqkSUPdE5tK7kaoBxE6tuq6DkoruZIxNBHTciwxxDl54Cd7KmPPPGDDCCySwHQ"
+        },
+        "recipients": [
+          {
+            "kid": "gY6AuqT5ADs7vK-fmj9UEb5Gf6ZSdOLxT1mBWwD5hA0",
+            "epk": "Elwq15U3Nxrb6iCJg-aWOEcfsd9DFbIIX4EgCt06qVM",
+            "iv": "gVsaOTmFS8aLqGlS",
+            "wk": "b8ao7aW61LvHQn8xzWHDjT_ocDJGHxclZta5Q2QoV-cS3_84ssTw1zizzVeNBcUF"
+          },
+          {
+            "kid": "OHeCFPD25tPd2DRaYj34dS7DLtio-1gUq_-NYsYmqNk",
+            "epk": "D4lqNnuzZL65zNTmyaKekxzeSwIPF9rruhZkDNxmXSw",
+            "iv": "kJchZolDykWp1SpX",
+            "wk": "AJZjHoXSPJnJydcBz-OiWEtyl5YKjyO1tN0G5vCrX7C6XNcQxsdydovX9zp8j9Ud"
+          }
+        ]
+      }
+    },
+    {
+      "name": "credential-version",
+      "description": "The version raised from 1 to 2: every wrap was made for version 1.",
+      "key": "runner-a",
+      "error": "unwrap-failed",
+      "envelope": {
+        "format": "ias-vault-1",
+        "credential": {
+          "id": "0d5e6c9a-4b8f-4c1e-9a3d-2f7b8e1c6a40",
+          "type": "ios-distribution-certificate",
+          "version": 2
+        },
+        "data": {
+          "iv": "Hp-AoxVNmWFNSG35",
+          "ct": "H3bKVI3MnjfMdX1SDz9oNf7pN_Y03jHt_ttDaw42PdbwY_EyN-HXFv7PhsO55OwGFL05nenQXcUYpA"
+        },
+        "recipients": [
+          {
+            "kid": "gY6AuqT5ADs7vK-fmj9UEb5Gf6ZSdOLxT1mBWwD5hA0",
+            "epk": "Elwq15U3Nxrb6iCJg-aWOEcfsd9DFbIIX4EgCt06qVM",
+            "iv": "gVsaOTmFS8aLqGlS",
+            "wk": "b8ao7aW61LvHQn8xzWHDjT_ocDJGHxclZta5Q2QoV-cS3_84ssTw1zizzVeNBcUF"
+          },
+          {
+            "kid": "OHeCFPD25tPd2DRaYj34dS7DLtio-1gUq_-NYsYmqNk",
+            "epk": "D4lqNnuzZL65zNTmyaKekxzeSwIPF9rruhZkDNxmXSw",
+            "iv": "kJchZolDykWp1SpX",
+            "wk": "AJZjHoXSPJnJydcBz-OiWEtyl5YKjyO1tN0G5vCrX7C6XNcQxsdydovX9zp8j9Ud"
+          }
+        ]
+      }
+    },
+    {
+      "name": "credential-id",
+      "description": "Another credential id.",
+      "key": "runner-a",
+      "error": "unwrap-failed",
+      "envelope": {
+        "format": "ias-vault-1",
+        "credential": {
+          "id": "ffffffff-4b8f-4c1e-9a3d-2f7b8e1c6a40",
+          "type": "ios-distribution-certificate",
+          "version": 1
+        },
+        "data": {
+          "iv": "Hp-AoxVNmWFNSG35",
+          "ct": "H3bKVI3MnjfMdX1SDz9oNf7pN_Y03jHt_ttDaw42PdbwY_EyN-HXFv7PhsO55OwGFL05nenQXcUYpA"
+        },
+        "recipients": [
+          {
+            "kid": "gY6AuqT5ADs7vK-fmj9UEb5Gf6ZSdOLxT1mBWwD5hA0",
+            "epk": "Elwq15U3Nxrb6iCJg-aWOEcfsd9DFbIIX4EgCt06qVM",
+            "iv": "gVsaOTmFS8aLqGlS",
+            "wk": "b8ao7aW61LvHQn8xzWHDjT_ocDJGHxclZta5Q2QoV-cS3_84ssTw1zizzVeNBcUF"
+          },
+          {
+            "kid": "OHeCFPD25tPd2DRaYj34dS7DLtio-1gUq_-NYsYmqNk",
+            "epk": "D4lqNnuzZL65zNTmyaKekxzeSwIPF9rruhZkDNxmXSw",
+            "iv": "kJchZolDykWp1SpX",
+            "wk": "AJZjHoXSPJnJydcBz-OiWEtyl5YKjyO1tN0G5vCrX7C6XNcQxsdydovX9zp8j9Ud"
+          }
+        ]
+      }
+    },
+    {
+      "name": "credential-type",
+      "description": "Another credential type.",
+      "key": "runner-a",
+      "error": "unwrap-failed",
+      "envelope": {
+        "format": "ias-vault-1",
+        "credential": {
+          "id": "0d5e6c9a-4b8f-4c1e-9a3d-2f7b8e1c6a40",
+          "type": "ios-provisioning-profile",
+          "version": 1
+        },
+        "data": {
+          "iv": "Hp-AoxVNmWFNSG35",
+          "ct": "H3bKVI3MnjfMdX1SDz9oNf7pN_Y03jHt_ttDaw42PdbwY_EyN-HXFv7PhsO55OwGFL05nenQXcUYpA"
+        },
+        "recipients": [
+          {
+            "kid": "gY6AuqT5ADs7vK-fmj9UEb5Gf6ZSdOLxT1mBWwD5hA0",
+            "epk": "Elwq15U3Nxrb6iCJg-aWOEcfsd9DFbIIX4EgCt06qVM",
+            "iv": "gVsaOTmFS8aLqGlS",
+            "wk": "b8ao7aW61LvHQn8xzWHDjT_ocDJGHxclZta5Q2QoV-cS3_84ssTw1zizzVeNBcUF"
+          },
+          {
+            "kid": "OHeCFPD25tPd2DRaYj34dS7DLtio-1gUq_-NYsYmqNk",
+            "epk": "D4lqNnuzZL65zNTmyaKekxzeSwIPF9rruhZkDNxmXSw",
+            "iv": "kJchZolDykWp1SpX",
+            "wk": "AJZjHoXSPJnJydcBz-OiWEtyl5YKjyO1tN0G5vCrX7C6XNcQxsdydovX9zp8j9Ud"
+          }
+        ]
+      }
+    },
+    {
+      "name": "kids-swapped",
+      "description": "The kids of the recovery and runner-a wraps exchanged: runner-a finds the recovery wrap under its kid.",
+      "key": "runner-a",
+      "error": "unwrap-failed",
+      "envelope": {
+        "format": "ias-vault-1",
+        "credential": {
+          "id": "0d5e6c9a-4b8f-4c1e-9a3d-2f7b8e1c6a40",
+          "type": "ios-distribution-certificate",
+          "version": 1
+        },
+        "data": {
+          "iv": "Hp-AoxVNmWFNSG35",
+          "ct": "H3bKVI3MnjfMdX1SDz9oNf7pN_Y03jHt_ttDaw42PdbwY_EyN-HXFv7PhsO55OwGFL05nenQXcUYpA"
+        },
+        "recipients": [
+          {
+            "kid": "OHeCFPD25tPd2DRaYj34dS7DLtio-1gUq_-NYsYmqNk",
+            "epk": "Elwq15U3Nxrb6iCJg-aWOEcfsd9DFbIIX4EgCt06qVM",
+            "iv": "gVsaOTmFS8aLqGlS",
+            "wk": "b8ao7aW61LvHQn8xzWHDjT_ocDJGHxclZta5Q2QoV-cS3_84ssTw1zizzVeNBcUF"
+          },
+          {
+            "kid": "gY6AuqT5ADs7vK-fmj9UEb5Gf6ZSdOLxT1mBWwD5hA0",
+            "epk": "D4lqNnuzZL65zNTmyaKekxzeSwIPF9rruhZkDNxmXSw",
+            "iv": "kJchZolDykWp1SpX",
+            "wk": "AJZjHoXSPJnJydcBz-OiWEtyl5YKjyO1tN0G5vCrX7C6XNcQxsdydovX9zp8j9Ud"
+          }
+        ]
+      }
+    },
+    {
+      "name": "wrap-of-other-recipient",
+      "description": "The recovery wrap copied under the kid of runner-a, in place of its own.",
+      "key": "runner-a",
+      "error": "unwrap-failed",
+      "envelope": {
+        "format": "ias-vault-1",
+        "credential": {
+          "id": "0d5e6c9a-4b8f-4c1e-9a3d-2f7b8e1c6a40",
+          "type": "ios-distribution-certificate",
+          "version": 1
+        },
+        "data": {
+          "iv": "Hp-AoxVNmWFNSG35",
+          "ct": "H3bKVI3MnjfMdX1SDz9oNf7pN_Y03jHt_ttDaw42PdbwY_EyN-HXFv7PhsO55OwGFL05nenQXcUYpA"
+        },
+        "recipients": [
+          {
+            "kid": "gY6AuqT5ADs7vK-fmj9UEb5Gf6ZSdOLxT1mBWwD5hA0",
+            "epk": "Elwq15U3Nxrb6iCJg-aWOEcfsd9DFbIIX4EgCt06qVM",
+            "iv": "gVsaOTmFS8aLqGlS",
+            "wk": "b8ao7aW61LvHQn8xzWHDjT_ocDJGHxclZta5Q2QoV-cS3_84ssTw1zizzVeNBcUF"
+          },
+          {
+            "kid": "OHeCFPD25tPd2DRaYj34dS7DLtio-1gUq_-NYsYmqNk",
+            "epk": "Elwq15U3Nxrb6iCJg-aWOEcfsd9DFbIIX4EgCt06qVM",
+            "iv": "gVsaOTmFS8aLqGlS",
+            "wk": "b8ao7aW61LvHQn8xzWHDjT_ocDJGHxclZta5Q2QoV-cS3_84ssTw1zizzVeNBcUF"
+          }
+        ]
+      }
+    },
+    {
+      "name": "wrap-of-other-credential",
+      "description": "A recovery wrap of another credential, put under runner-a.",
+      "key": "runner-a",
+      "error": "unwrap-failed",
+      "envelope": {
+        "format": "ias-vault-1",
+        "credential": {
+          "id": "0d5e6c9a-4b8f-4c1e-9a3d-2f7b8e1c6a40",
+          "type": "ios-distribution-certificate",
+          "version": 1
+        },
+        "data": {
+          "iv": "Hp-AoxVNmWFNSG35",
+          "ct": "H3bKVI3MnjfMdX1SDz9oNf7pN_Y03jHt_ttDaw42PdbwY_EyN-HXFv7PhsO55OwGFL05nenQXcUYpA"
+        },
+        "recipients": [
+          {
+            "kid": "gY6AuqT5ADs7vK-fmj9UEb5Gf6ZSdOLxT1mBWwD5hA0",
+            "epk": "Elwq15U3Nxrb6iCJg-aWOEcfsd9DFbIIX4EgCt06qVM",
+            "iv": "gVsaOTmFS8aLqGlS",
+            "wk": "b8ao7aW61LvHQn8xzWHDjT_ocDJGHxclZta5Q2QoV-cS3_84ssTw1zizzVeNBcUF"
+          },
+          {
+            "kid": "OHeCFPD25tPd2DRaYj34dS7DLtio-1gUq_-NYsYmqNk",
+            "epk": "Guk6Vno302kiqafqOq6SctusJnksnDV4LADm5GsB2Q0",
+            "iv": "jvlIoUtIaO-2cGmj",
+            "wk": "4Xe6PEwBVTezuZkoGwiyZ26nISplZhv_P8di23OqgRTfjAYtJGWofMLdVUehIN0N"
+          }
+        ]
+      }
+    },
+    {
+      "name": "wrap-of-other-envelope",
+      "description": "The runner-a wrap of another envelope of the same credential in place of its own: it opens, but its data key does not open this data.",
+      "key": "runner-a",
+      "error": "decrypt-failed",
+      "envelope": {
+        "format": "ias-vault-1",
+        "credential": {
+          "id": "0d5e6c9a-4b8f-4c1e-9a3d-2f7b8e1c6a40",
+          "type": "ios-distribution-certificate",
+          "version": 1
+        },
+        "data": {
+          "iv": "Hp-AoxVNmWFNSG35",
+          "ct": "H3bKVI3MnjfMdX1SDz9oNf7pN_Y03jHt_ttDaw42PdbwY_EyN-HXFv7PhsO55OwGFL05nenQXcUYpA"
+        },
+        "recipients": [
+          {
+            "kid": "gY6AuqT5ADs7vK-fmj9UEb5Gf6ZSdOLxT1mBWwD5hA0",
+            "epk": "Elwq15U3Nxrb6iCJg-aWOEcfsd9DFbIIX4EgCt06qVM",
+            "iv": "gVsaOTmFS8aLqGlS",
+            "wk": "b8ao7aW61LvHQn8xzWHDjT_ocDJGHxclZta5Q2QoV-cS3_84ssTw1zizzVeNBcUF"
+          },
+          {
+            "kid": "OHeCFPD25tPd2DRaYj34dS7DLtio-1gUq_-NYsYmqNk",
+            "epk": "zWtoy2Y9WhXuVvKH1lQmW6jL230r7wMkBgLKv78BhzA",
+            "iv": "ZkMDyCGR4fn4U327",
+            "wk": "QHIp0aCx4kc38VMSebyXGB8yBZ5dxiA7Hgf9jh_FoZKzRJ0z26N8NBcUCcbvQoI-"
+          }
+        ]
+      }
+    },
+    {
+      "name": "wrapped-key-bit",
+      "description": "One bit of the runner-a wrapped key flipped.",
+      "key": "runner-a",
+      "error": "unwrap-failed",
+      "envelope": {
+        "format": "ias-vault-1",
+        "credential": {
+          "id": "0d5e6c9a-4b8f-4c1e-9a3d-2f7b8e1c6a40",
+          "type": "ios-distribution-certificate",
+          "version": 1
+        },
+        "data": {
+          "iv": "Hp-AoxVNmWFNSG35",
+          "ct": "H3bKVI3MnjfMdX1SDz9oNf7pN_Y03jHt_ttDaw42PdbwY_EyN-HXFv7PhsO55OwGFL05nenQXcUYpA"
+        },
+        "recipients": [
+          {
+            "kid": "gY6AuqT5ADs7vK-fmj9UEb5Gf6ZSdOLxT1mBWwD5hA0",
+            "epk": "Elwq15U3Nxrb6iCJg-aWOEcfsd9DFbIIX4EgCt06qVM",
+            "iv": "gVsaOTmFS8aLqGlS",
+            "wk": "b8ao7aW61LvHQn8xzWHDjT_ocDJGHxclZta5Q2QoV-cS3_84ssTw1zizzVeNBcUF"
+          },
+          {
+            "kid": "OHeCFPD25tPd2DRaYj34dS7DLtio-1gUq_-NYsYmqNk",
+            "epk": "D4lqNnuzZL65zNTmyaKekxzeSwIPF9rruhZkDNxmXSw",
+            "iv": "kJchZolDykWp1SpX",
+            "wk": "AJZjHoXSPJnJydcBz-OiWEtyl5YKjyO1tN0G5vCrX7C6XNcQxsdydovX9zp8j9Uc"
+          }
+        ]
+      }
+    },
+    {
+      "name": "wrap-iv",
+      "description": "Another IV in the runner-a wrap.",
+      "key": "runner-a",
+      "error": "unwrap-failed",
+      "envelope": {
+        "format": "ias-vault-1",
+        "credential": {
+          "id": "0d5e6c9a-4b8f-4c1e-9a3d-2f7b8e1c6a40",
+          "type": "ios-distribution-certificate",
+          "version": 1
+        },
+        "data": {
+          "iv": "Hp-AoxVNmWFNSG35",
+          "ct": "H3bKVI3MnjfMdX1SDz9oNf7pN_Y03jHt_ttDaw42PdbwY_EyN-HXFv7PhsO55OwGFL05nenQXcUYpA"
+        },
+        "recipients": [
+          {
+            "kid": "gY6AuqT5ADs7vK-fmj9UEb5Gf6ZSdOLxT1mBWwD5hA0",
+            "epk": "Elwq15U3Nxrb6iCJg-aWOEcfsd9DFbIIX4EgCt06qVM",
+            "iv": "gVsaOTmFS8aLqGlS",
+            "wk": "b8ao7aW61LvHQn8xzWHDjT_ocDJGHxclZta5Q2QoV-cS3_84ssTw1zizzVeNBcUF"
+          },
+          {
+            "kid": "OHeCFPD25tPd2DRaYj34dS7DLtio-1gUq_-NYsYmqNk",
+            "epk": "D4lqNnuzZL65zNTmyaKekxzeSwIPF9rruhZkDNxmXSw",
+            "iv": "CG1JGosEr-Gu9LuV",
+            "wk": "AJZjHoXSPJnJydcBz-OiWEtyl5YKjyO1tN0G5vCrX7C6XNcQxsdydovX9zp8j9Ud"
+          }
+        ]
+      }
+    },
+    {
+      "name": "ephemeral-key",
+      "description": "Another (valid) ephemeral public key in the runner-a wrap.",
+      "key": "runner-a",
+      "error": "unwrap-failed",
+      "envelope": {
+        "format": "ias-vault-1",
+        "credential": {
+          "id": "0d5e6c9a-4b8f-4c1e-9a3d-2f7b8e1c6a40",
+          "type": "ios-distribution-certificate",
+          "version": 1
+        },
+        "data": {
+          "iv": "Hp-AoxVNmWFNSG35",
+          "ct": "H3bKVI3MnjfMdX1SDz9oNf7pN_Y03jHt_ttDaw42PdbwY_EyN-HXFv7PhsO55OwGFL05nenQXcUYpA"
+        },
+        "recipients": [
+          {
+            "kid": "gY6AuqT5ADs7vK-fmj9UEb5Gf6ZSdOLxT1mBWwD5hA0",
+            "epk": "Elwq15U3Nxrb6iCJg-aWOEcfsd9DFbIIX4EgCt06qVM",
+            "iv": "gVsaOTmFS8aLqGlS",
+            "wk": "b8ao7aW61LvHQn8xzWHDjT_ocDJGHxclZta5Q2QoV-cS3_84ssTw1zizzVeNBcUF"
+          },
+          {
+            "kid": "OHeCFPD25tPd2DRaYj34dS7DLtio-1gUq_-NYsYmqNk",
+            "epk": "6L8x6hVnLNSV2ApoexpOCCc2CxTRdBR23DF26x0JpBc",
+            "iv": "kJchZolDykWp1SpX",
+            "wk": "AJZjHoXSPJnJydcBz-OiWEtyl5YKjyO1tN0G5vCrX7C6XNcQxsdydovX9zp8j9Ud"
+          }
+        ]
+      }
+    },
+    {
+      "name": "ephemeral-key-zero",
+      "description": "An all-zero ephemeral key in the runner-a wrap: a low-order point whose X25519 secret is zero.",
+      "key": "runner-a",
+      "error": "unwrap-failed",
+      "envelope": {
+        "format": "ias-vault-1",
+        "credential": {
+          "id": "0d5e6c9a-4b8f-4c1e-9a3d-2f7b8e1c6a40",
+          "type": "ios-distribution-certificate",
+          "version": 1
+        },
+        "data": {
+          "iv": "Hp-AoxVNmWFNSG35",
+          "ct": "H3bKVI3MnjfMdX1SDz9oNf7pN_Y03jHt_ttDaw42PdbwY_EyN-HXFv7PhsO55OwGFL05nenQXcUYpA"
+        },
+        "recipients": [
+          {
+            "kid": "gY6AuqT5ADs7vK-fmj9UEb5Gf6ZSdOLxT1mBWwD5hA0",
+            "epk": "Elwq15U3Nxrb6iCJg-aWOEcfsd9DFbIIX4EgCt06qVM",
+            "iv": "gVsaOTmFS8aLqGlS",
+            "wk": "b8ao7aW61LvHQn8xzWHDjT_ocDJGHxclZta5Q2QoV-cS3_84ssTw1zizzVeNBcUF"
+          },
+          {
+            "kid": "OHeCFPD25tPd2DRaYj34dS7DLtio-1gUq_-NYsYmqNk",
+            "epk": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+            "iv": "kJchZolDykWp1SpX",
+            "wk": "AJZjHoXSPJnJydcBz-OiWEtyl5YKjyO1tN0G5vCrX7C6XNcQxsdydovX9zp8j9Ud"
+          }
+        ]
+      }
+    },
+    {
+      "name": "runner-a-removed",
+      "description": "The runner-a wrap removed.",
+      "key": "runner-a",
+      "error": "not-a-recipient",
+      "envelope": {
+        "format": "ias-vault-1",
+        "credential": {
+          "id": "0d5e6c9a-4b8f-4c1e-9a3d-2f7b8e1c6a40",
+          "type": "ios-distribution-certificate",
+          "version": 1
+        },
+        "data": {
+          "iv": "Hp-AoxVNmWFNSG35",
+          "ct": "H3bKVI3MnjfMdX1SDz9oNf7pN_Y03jHt_ttDaw42PdbwY_EyN-HXFv7PhsO55OwGFL05nenQXcUYpA"
+        },
+        "recipients": [
+          {
+            "kid": "gY6AuqT5ADs7vK-fmj9UEb5Gf6ZSdOLxT1mBWwD5hA0",
+            "epk": "Elwq15U3Nxrb6iCJg-aWOEcfsd9DFbIIX4EgCt06qVM",
+            "iv": "gVsaOTmFS8aLqGlS",
+            "wk": "b8ao7aW61LvHQn8xzWHDjT_ocDJGHxclZta5Q2QoV-cS3_84ssTw1zizzVeNBcUF"
+          }
+        ]
+      }
+    },
+    {
+      "name": "outsider",
+      "description": "A valid envelope opened with a key that is not a recipient.",
+      "key": "outsider",
+      "error": "not-a-recipient",
+      "envelope": {
+        "format": "ias-vault-1",
+        "credential": {
+          "id": "0d5e6c9a-4b8f-4c1e-9a3d-2f7b8e1c6a40",
+          "type": "ios-distribution-certificate",
+          "version": 1
+        },
+        "data": {
+          "iv": "Hp-AoxVNmWFNSG35",
+          "ct": "H3bKVI3MnjfMdX1SDz9oNf7pN_Y03jHt_ttDaw42PdbwY_EyN-HXFv7PhsO55OwGFL05nenQXcUYpA"
+        },
+        "recipients": [
+          {
+            "kid": "gY6AuqT5ADs7vK-fmj9UEb5Gf6ZSdOLxT1mBWwD5hA0",
+            "epk": "Elwq15U3Nxrb6iCJg-aWOEcfsd9DFbIIX4EgCt06qVM",
+            "iv": "gVsaOTmFS8aLqGlS",
+            "wk": "b8ao7aW61LvHQn8xzWHDjT_ocDJGHxclZta5Q2QoV-cS3_84ssTw1zizzVeNBcUF"
+          },
+          {
+            "kid": "OHeCFPD25tPd2DRaYj34dS7DLtio-1gUq_-NYsYmqNk",
+            "epk": "D4lqNnuzZL65zNTmyaKekxzeSwIPF9rruhZkDNxmXSw",
+            "iv": "kJchZolDykWp1SpX",
+            "wk": "AJZjHoXSPJnJydcBz-OiWEtyl5YKjyO1tN0G5vCrX7C6XNcQxsdydovX9zp8j9Ud"
+          }
+        ]
+      }
+    },
+    {
+      "name": "revoked-runner-a",
+      "description": "runner-a after its revocation (sealed.json, revoke-runner-a).",
+      "key": "runner-a",
+      "error": "not-a-recipient",
+      "envelope": {
+        "format": "ias-vault-1",
+        "credential": {
+          "id": "0d5e6c9a-4b8f-4c1e-9a3d-2f7b8e1c6a40",
+          "type": "ios-distribution-certificate",
+          "version": 1
+        },
+        "data": {
+          "iv": "Hp-AoxVNmWFNSG35",
+          "ct": "H3bKVI3MnjfMdX1SDz9oNf7pN_Y03jHt_ttDaw42PdbwY_EyN-HXFv7PhsO55OwGFL05nenQXcUYpA"
+        },
+        "recipients": [
+          {
+            "kid": "gY6AuqT5ADs7vK-fmj9UEb5Gf6ZSdOLxT1mBWwD5hA0",
+            "epk": "Elwq15U3Nxrb6iCJg-aWOEcfsd9DFbIIX4EgCt06qVM",
+            "iv": "gVsaOTmFS8aLqGlS",
+            "wk": "b8ao7aW61LvHQn8xzWHDjT_ocDJGHxclZta5Q2QoV-cS3_84ssTw1zizzVeNBcUF"
+          },
+          {
+            "kid": "3ZL6nCkm1BcKR1Nd5MqK3OMzPTijlc-wKtLHjIB-5hg",
+            "epk": "_WtawL4wS55ePjiLMn6FcPc55kKiIA3Q9ySrlSSL0j0",
+            "iv": "2puuuf3f6vCQyRjq",
+            "wk": "A19EQYJ1bAfCmBH7JAzTuSMtLttMoL1AX3BzfsqkelBq3u1IFovzFSmzcb9Ar1zK"
+          }
+        ]
+      }
+    },
+    {
+      "name": "recovery-after-version-change",
+      "description": "The recovery key also refuses the envelope whose version was raised.",
+      "key": "recovery",
+      "error": "unwrap-failed",
+      "envelope": {
+        "format": "ias-vault-1",
+        "credential": {
+          "id": "0d5e6c9a-4b8f-4c1e-9a3d-2f7b8e1c6a40",
+          "type": "ios-distribution-certificate",
+          "version": 2
+        },
+        "data": {
+          "iv": "Hp-AoxVNmWFNSG35",
+          "ct": "H3bKVI3MnjfMdX1SDz9oNf7pN_Y03jHt_ttDaw42PdbwY_EyN-HXFv7PhsO55OwGFL05nenQXcUYpA"
+        },
+        "recipients": [
+          {
+            "kid": "gY6AuqT5ADs7vK-fmj9UEb5Gf6ZSdOLxT1mBWwD5hA0",
+            "epk": "Elwq15U3Nxrb6iCJg-aWOEcfsd9DFbIIX4EgCt06qVM",
+            "iv": "gVsaOTmFS8aLqGlS",
+            "wk": "b8ao7aW61LvHQn8xzWHDjT_ocDJGHxclZta5Q2QoV-cS3_84ssTw1zizzVeNBcUF"
+          },
+          {
+            "kid": "OHeCFPD25tPd2DRaYj34dS7DLtio-1gUq_-NYsYmqNk",
+            "epk": "D4lqNnuzZL65zNTmyaKekxzeSwIPF9rruhZkDNxmXSw",
+            "iv": "kJchZolDykWp1SpX",
+            "wk": "AJZjHoXSPJnJydcBz-OiWEtyl5YKjyO1tN0G5vCrX7C6XNcQxsdydovX9zp8j9Ud"
+          }
+        ]
+      }
+    }
+  ]
+}