Appearance
Golden packet examples and test vectors
Vectors are produced by
node scripts/generate-test-vectors.mjsusing the reference wire parsers inlib/mesh-wire.mjs, NodecryptoAES-256-CCM, and an independent AES-ECB CCM construction for cross-check. Committed ciphertext/MIC/PDU hex lives intests/fixtures/golden-vectors.json. Tests consume those fixture values; they do not treat a re-encrypt of the same helper as the expected result.
Related: Packet layout, Channels & security, Base profile.
Generator
bash
node scripts/generate-test-vectors.mjsOutputs structured JSON under tests/fixtures/golden-vectors.json.
How to read a vector
| Column | Meaning |
|---|---|
| Prefix fields | verFlags, channelHash, sessionId, optional blocks |
| Nonce | 12-byte srcId || sessionId || messageId || fragmentWord |
| AAD | Base (16/20) + region + fragment; ttlRaw zero-masked at offset 0x04 |
| innerBodyLen | AES-CCM plaintext length (cipherLen) |
| Final PDU | Full Mesh PDU (≤ 255 bytes) |
Default-community PSK in these vectors is SHA256("LowMesh/v2/defaultCommunityPsk32"):
3DAC4E5626960D351DDC986C452CE1C7C62F189FF9732B8C17325D4D8DC50150Vector catalog
| # | Case | Status |
|---|---|---|
| 1 | Minimal CCM-4 frame without dstId | Complete (ciphertext + 4-byte MIC) |
| 2 | CCM-4 frame with dstId | Complete |
| 3 | CCM-8 frame (MIC_MODE=01) | Complete (8-byte MIC) |
| 4 | Region block (HAS_REGION) | Complete |
| 5 | Fragmented PAYLOAD_BODY_V2 (totalCount=3) | Complete; header fragmentIndex aligned |
| 6 | Same messageId, different fragment → different nonce/ciphertext | Asserted |
| 7 | Same messageId, different sessionId → different nonce/ciphertext | Asserted |
| 8 | AAD ttlRaw zero-mask | AAD byte at index 4 = 0x00 |
| 9 | Relay inserts routing block / decrements TTL; inner tail still authenticates; second relay appends | Complete |
| 10 | Wrong key rejection | Negative test |
| 11 | Modified authenticated header rejection | Negative test |
| 12 | Modified ciphertext rejection | Negative test |
| 13 | Modified MIC rejection | Negative test |
| 14 | Reserved MIC_MODE (10/11) | Parser drop |
| 15 | ACK_BASIC full fixed 17-byte body | Complete |
| 16 | DM HKDF + CCM encryption | Complete |
Vector 1 (excerpt)
| Field | Hex |
|---|---|
| Prefix | 0082000004D4C3B2A104030201010001 |
| Nonce | D4C3B2A10403020101000000 |
| AAD | 0082000000D4C3B2A104030201010001 |
| Ciphertext | 4CBA1F27EFB1 |
| MIC | 7AAC71F3 |
| PDU | 0082000004D4C3B2A1040302010100014CBA1F27EFB17AAC71F3 |
Automated tests
bash
npm testtests/mesh-wire.test.mjs covers 16/20-byte base parse/serialize, nonce uniqueness, PAYLOAD_BODY_V2 limits and header alignment, routing-growth budget, first/second relay breadcrumb insert, USB :LLLL framing, DM HKDF, ACK_BASIC SNR Q4, nodeId32 derivation/collision, and decryption of committed golden PDUs.