diff --git a/js/security/Witness.js b/js/security/Witness.js
index 1a8c5e0..2378595 100644
--- a/js/security/Witness.js
+++ b/js/security/Witness.js
@@ -116,11 +116,10 @@
 		} else if (witness[i] == 0x04) {
 			if ((witness[i + 1] & 0x80) != 0) {
 				len = witness[i+1] & 0x7F;
-			} else {
-				len = witness[i+1];
 			}
 			if (step == 4) {
 				// Start to decode digest hex string
+				len = witness[i+1];  // XXX: digest hex should always be 32 bytes
 				str = DataUtils.toHex(witness.subarray(i + 2, i + 2 + len));
 				this.path.digestList.push(str);  // digest hex string
 				//console.log(str);
diff --git a/js/testing/test-get-async.html b/js/testing/test-get-async.html
index 4b6a37a..d3fbdd6 100644
--- a/js/testing/test-get-async.html
+++ b/js/testing/test-get-async.html
@@ -41,7 +41,12 @@
 				//console.log(content);
 				document.getElementById('content').innerHTML += contentObjectToHtml(content);
 			} else if (kind == Closure.UPCALL_CONTENT_BAD) {
+				var content = upcallInfo.contentObject;
 				console.log("Closure.upcall: content signature verification fail.");
+				if (content.signature.signature)
+					console.log("Signature: " + DataUtils.toHex(content.signature.signature).toLowerCase());
+				if (content.signature.Witness)
+					console.log("Witness: " + DataUtils.toHex(content.signature.Witness).toLowerCase());
 			} else if (kind == Closure.UPCALL_INTEREST_TIMED_OUT) {
 				console.log("Closure.upcall called with interest time out.");
 			}
diff --git a/js/tools/build/ndn-js-uncomp.js b/js/tools/build/ndn-js-uncomp.js
index e4117eb..8469498 100644
--- a/js/tools/build/ndn-js-uncomp.js
+++ b/js/tools/build/ndn-js-uncomp.js
@@ -4709,11 +4709,10 @@
 		} else if (witness[i] == 0x04) {
 			if ((witness[i + 1] & 0x80) != 0) {
 				len = witness[i+1] & 0x7F;
-			} else {
-				len = witness[i+1];
 			}
 			if (step == 4) {
 				// Start to decode digest hex string
+				len = witness[i+1];  // XXX: digest hex should always be 32 bytes
 				str = DataUtils.toHex(witness.subarray(i + 2, i + 2 + len));
 				this.path.digestList.push(str);  // digest hex string
 				//console.log(str);
diff --git a/js/tools/build/ndn-js.js b/js/tools/build/ndn-js.js
index 5b29d9b..4c17018 100644
--- a/js/tools/build/ndn-js.js
+++ b/js/tools/build/ndn-js.js
@@ -150,9 +150,9 @@
 "30819F300D06092A864886F70D010101050003818D0030818902818100E17D30A7D828AB1B840B17542DCAF6207AFD221E086B2A60D16CB7F54448BA9F3F08BCD099DB21DD162A779E61AA89EEE554D3A47DE230BC7AC590D524067C3898BBA6F5DC4360B845EDA48CBD9CF126A723445F0E1952D7325A75FAF556144F9A98AF7186B0278685B8E2C08BEA87171B4DEE585C1828295B5395EB4A17779F0203010001";this.privateKey="MIICXQIBAAKBgQDhfTCn2CirG4QLF1QtyvYgev0iHghrKmDRbLf1REi6nz8IvNCZ2yHdFip3nmGqie7lVNOkfeIwvHrFkNUkBnw4mLum9dxDYLhF7aSMvZzxJqcjRF8OGVLXMlp1+vVWFE+amK9xhrAnhoW44sCL6ocXG03uWFwYKClbU5XrShd3nwIDAQABAoGAGkv6T6jC3WmhFZYL6CdCWvlc6gysmKrhjarrLTxgavtFY6R5g2ft5BXAsCCVbUkWxkIFSKqxpVNl0gKZCNGEzPDN6mHJOQI/h0rlxNIHAuGfoAbCzALnqmyZivhJAPGijAyKuU9tczsst5+Kpn+bn7ehzHQuj7iwJonS5WbojqECQQD851K8TpW2GrRizNgG4dx6orZxAaon/Jnl8lS7soXhllQty7qG+oDfzznmdMsiznCqEABzHUUKOVGE9RWPN3aRAkEA5D/w9N55d0ibnChFJlc8cUAoaqH+w+U3oQP2Lb6AZHJpLptN4y4b/uf5d4wYU5/i/gC7SSBH3wFhh9bjRLUDLwJAVOx8vN0Kqt7myfKNbCo19jxjVSlA8TKCn1Oznl/BU1I+rC4oUaEW25DjmX6IpAR8kq7S59ThVSCQPjxqY/A08QJBAIRaF2zGPITQk3r/VumemCvLWiRK/yG0noc9dtibqHOWbCtcXtOm/xDWjq+lis2i3ssOvYrvrv0/HcDY+Dv1An0CQQCLJtMsfSg4kvG/FRY5UMhtMuwo8ovYcMXt4Xv/LWaMhndD67b2UGawQCRqr5ghRTABWdDD/HuuMBjrkPsX0861"};
 KeyManager.prototype.verify=function(a,b){var c=this.certificate,d=new X509;d.readCertPEM(c);return d.subjectPublicKeyRSA.verifyString(a,b)};KeyManager.prototype.sign=function(a){var b=this.privateKey,c=new RSAKey;c.readPrivateKeyFromPEMString(b);return c.signString(a,"sha256")};var globalKeyManager=new KeyManager,MerklePath=function(){this.index=null;this.digestList=[]},Witness=function(){this.oid=null;this.path=new MerklePath};
 function parseOID(a,b,c){for(var d,e=0,f=0;b<c;++b){var g=a[b],e=e<<7|g&127,f=f+7;g&128||(d=void 0==d?parseInt(e/40)+"."+e%40:d+("."+(31<=f?"bigint":e)),e=f=0);d+=String.fromCharCode()}return d}function parseInteger(a,b,c){for(var d=0;b<c;++b)d=d<<8|a[b];return d}
-Witness.prototype.decode=function(a){for(var b=0,c=0;b<a.length;){var d=0;48==a[b]?(0!=(a[b+1]&128)&&(d=a[b+1]&127),c++):6==a[b]?(d=a[b+1],this.oid=parseOID(a,b+2,b+2+d)):2==a[b]?(d=a[b+1],this.path.index=parseInteger(a,b+2,b+2+d)):4==a[b]&&(d=0!=(a[b+1]&128)?a[b+1]&127:a[b+1],4==c&&(str=DataUtils.toHex(a.subarray(b+2,b+2+d)),this.path.digestList.push(str)));b=b+2+d}};var hexcase=0,b64pad="";function hex_sha256_from_bytes(a){return rstr2hex(binb2rstr(binb_sha256(byteArray2binb(a),8*a.length)))}
-function hex_sha256(a){return rstr2hex(rstr_sha256(str2rstr_utf8(a)))}function b64_sha256(a){return rstr2b64(rstr_sha256(str2rstr_utf8(a)))}function any_sha256(a,b){return rstr2any(rstr_sha256(str2rstr_utf8(a)),b)}function hex_hmac_sha256(a,b){return rstr2hex(rstr_hmac_sha256(str2rstr_utf8(a),str2rstr_utf8(b)))}function b64_hmac_sha256(a,b){return rstr2b64(rstr_hmac_sha256(str2rstr_utf8(a),str2rstr_utf8(b)))}
-function any_hmac_sha256(a,b,c){return rstr2any(rstr_hmac_sha256(str2rstr_utf8(a),str2rstr_utf8(b)),c)}function sha256_vm_test(){return"ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"==hex_sha256("abc").toLowerCase()}function rstr_sha256(a){return binb2rstr(binb_sha256(rstr2binb(a),8*a.length))}
+Witness.prototype.decode=function(a){for(var b=0,c=0;b<a.length;){var d=0;48==a[b]?(0!=(a[b+1]&128)&&(d=a[b+1]&127),c++):6==a[b]?(d=a[b+1],this.oid=parseOID(a,b+2,b+2+d)):2==a[b]?(d=a[b+1],this.path.index=parseInteger(a,b+2,b+2+d)):4==a[b]&&(0!=(a[b+1]&128)&&(d=a[b+1]&127),4==c&&(d=a[b+1],str=DataUtils.toHex(a.subarray(b+2,b+2+d)),this.path.digestList.push(str)));b=b+2+d}};var hexcase=0,b64pad="";
+function hex_sha256_from_bytes(a){return rstr2hex(binb2rstr(binb_sha256(byteArray2binb(a),8*a.length)))}function hex_sha256(a){return rstr2hex(rstr_sha256(str2rstr_utf8(a)))}function b64_sha256(a){return rstr2b64(rstr_sha256(str2rstr_utf8(a)))}function any_sha256(a,b){return rstr2any(rstr_sha256(str2rstr_utf8(a)),b)}function hex_hmac_sha256(a,b){return rstr2hex(rstr_hmac_sha256(str2rstr_utf8(a),str2rstr_utf8(b)))}
+function b64_hmac_sha256(a,b){return rstr2b64(rstr_hmac_sha256(str2rstr_utf8(a),str2rstr_utf8(b)))}function any_hmac_sha256(a,b,c){return rstr2any(rstr_hmac_sha256(str2rstr_utf8(a),str2rstr_utf8(b)),c)}function sha256_vm_test(){return"ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"==hex_sha256("abc").toLowerCase()}function rstr_sha256(a){return binb2rstr(binb_sha256(rstr2binb(a),8*a.length))}
 function rstr_hmac_sha256(a,b){var c=rstr2binb(a);16<c.length&&(c=binb_sha256(c,8*a.length));for(var d=Array(16),e=Array(16),f=0;16>f;f++)d[f]=c[f]^909522486,e[f]=c[f]^1549556828;c=binb_sha256(d.concat(rstr2binb(b)),512+8*b.length);return binb2rstr(binb_sha256(e.concat(c),768))}function rstr2hex(a){try{hexcase}catch(b){hexcase=0}for(var c=hexcase?"0123456789ABCDEF":"0123456789abcdef",d="",e,f=0;f<a.length;f++)e=a.charCodeAt(f),d+=c.charAt(e>>>4&15)+c.charAt(e&15);return d}
 function rstr2b64(a){try{b64pad}catch(b){b64pad=""}for(var c="",d=a.length,e=0;e<d;e+=3)for(var f=a.charCodeAt(e)<<16|(e+1<d?a.charCodeAt(e+1)<<8:0)|(e+2<d?a.charCodeAt(e+2):0),g=0;4>g;g++)c=8*e+6*g>8*a.length?c+b64pad:c+"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(f>>>6*(3-g)&63);return c}
 function rstr2any(a,b){var c=b.length,d=[],e,f,g,j,k=Array(Math.ceil(a.length/2));for(e=0;e<k.length;e++)k[e]=a.charCodeAt(2*e)<<8|a.charCodeAt(2*e+1);for(;0<k.length;){j=[];for(e=g=0;e<k.length;e++)if(g=(g<<16)+k[e],f=Math.floor(g/c),g-=f*c,0<j.length||0<f)j[j.length]=f;d[d.length]=g;k=j}c="";for(e=d.length-1;0<=e;e--)c+=b.charAt(d[e]);d=Math.ceil(8*a.length/(Math.log(b.length)/Math.log(2)));for(e=c.length;e<d;e++)c=b[0]+c;return c}