ECDSA-SD-2023: empty mandatory and selective pointers tests

[filip26]

Hi,
please consider testing corner cases when pointers are empty/null. The tests could show real maturity/stability of an implementation.

1. Issuer.sign - empty/null mandatory pointers
   An implementation should return a base proof with no mandatory/always disclosed/ data.

2. Holder.derive - base proof from 1. + empty/null selective pointers
   An implementation should fail, as there is nothing to disclose. @Wind4Greg please can you confirm? Thank you!

3. Holder.derive - base having mandatory pointers + empty/null selective pointers
   An implementation should return a derived proof disclosing only mandatory data.

[Wind4Greg]

@filip26 good cases. I think you found an error in my server side checks. I was rejecting the case with nothing selected but forgot that there could be mandatory reveal information.

I've gotten some requests to update the spec test vectors with something a bit more relevant than fictional windsurfing races. Also the longer test cases from @aljones15 helped me find a bug in my primitives so I'm going to try to come up with something more relevant for the spec and something longer and a bit more realistic for adding here. Ideas are welcome.

[aljones15]

@filip26 I'm not aware of a normative statement for empty mandatoryPointers and selectiveDisclosure in the spec, but this is a good idea.

[PatStLouis]

@filip26 we have added mandatoryPointer tests here and here.

Does this address the issue? @filip26

[filip26]

@PatStLouis you are referring to:

• 'The transformation options MUST contain an array of mandatory ' +
  'JSON pointers (mandatoryPointers) and MAY contain additional ' +
  'options, such as a JSON-LD document loader'
• If the length of signatures does not match the length of ' +
  'nonMandatory, an error MUST be raised and SHOULD convey an ' +
  'error type of PROOF_VERIFICATION_ERROR, indicating that the ' +
  'signature count does not match the non-mandatory message count.'

How do these tests resolve this issue?

[PatStLouis]

The first test sends a request with and without mandatory pointers. (Issuer.sign - empty/null mandatory pointers)

However, its expecting the issuer to inject mandatoryPointers if none were provided, as is indicated by the specification.

For the 2 other points, the "derive" endpoint isn't provided by implementers, we are only testing the verification endpoint.

Happy to leave this open if it doesn't quite address the issue.

[filip26]

Understood, feel free to close it. It was intended as a suggestion for consideration, and I appreciate you taking the time to review and respond to it.