@awacloud/pdf 0.0.0-stage → 1.0.0

package/src/sig/oids.js

@@ -0,0 +1,157 @@
+// Copyright (c) 2026 AwaCloud SAS
+// Author: Matthieu Bouilloux
+// SPDX-License-Identifier: AGPL-3.0-only
+// Dual-licensed; see the NOTICE file for licensing and any additional terms.
+
+/**
+ * @fileoverview Shared OID dispatch tables for the `pdf/sig/*` family.
+ *
+ * Thin adapter over `@awacloud/fw/crypto/utils/asn1-oid.js` — the canonical
+ * OID database (~150 entries covering PKCS, X.509, CMS, JOSE, PAdES,
+ * ECC, AES). This module **does not** duplicate the data ; it filters
+ * and normalises a subset for the dispatch semantics expected by the
+ * PDF signature code path :
+ *
+ *   - `DIGEST_OIDS`           — OID → fw hash module name
+ *                               (`'sha256'`, `'sha384'`, `'sha512'`, `'sha1'`).
+ *   - `SIG_DISPATCH_OIDS`     — OID → fw verifier name
+ *                               (`'rsa'`, `'rsa-pss'`, `'ecc'`, `'ed25519'`).
+ *   - `KEY_ALG_OIDS`          — SPKI algorithm OID → short algorithm name
+ *                               (`'rsa'`, `'ecc'`, `'ed25519'`, `'ed448'`).
+ *   - `SIG_ALG_OIDS_VERBOSE`  — cert `sigAlgorithm` verbose name
+ *                               (e.g. `'sha256WithRSAEncryption'`,
+ *                               `'ecdsa-with-SHA256'`, `'rsassa-pss'`).
+ *   - `OID_TST_INFO`/`OID_AA_TIMESTAMP` — RFC 3161 constants.
+ *   - `shortOid()`            — DN attribute OID → `'CN'`/`'O'`/… short form,
+ *                               delegated to `asn1Oid.lookup(oid).shortName`.
+ *
+ * Adding/renaming an OID happens in fw's `asn1Oid` database ; this
+ * module just decides how to surface the entry to PDF callers.
+ *
+ * Factory-only strict — no top-level binding besides this descriptor.
+ *
+ * @module pdf/sig/oids
+ */
+
+import { asn1Oid } from '@awacloud/fw/crypto/utils/asn1-oid.js';
+
+export const pdfSigOids = {
+    name: 'pdfSigOids',
+    dependencies: ['asn1Oid'],
+    deps: [asn1Oid],
+    factory(asn1Oid) {
+        // ── Dispatch tables built from fw's database ─────────────────
+        //
+        // We rebuild static `Object.freeze`-d tables for two reasons :
+        //   1. Existing consumers (signature.js, timestamp.js,
+        //      certChain.js, sign.js) destructure the tables and look
+        //      up by OID directly — keeping the table shape avoids
+        //      cascading refactors.
+        //   2. The dispatch semantics (e.g. mapping multiple
+        //      `*WithRSAEncryption` OIDs to a single `'rsa'` verifier
+        //      name) are PDF-domain decisions that don't belong in fw.
+
+        // DIGEST_OIDS — fw hash module names. fw stores `hashAlg` as
+        // `'sha-256'` (RFC 5280 form) and digest-category entries as
+        // `name: 'sha256'`. We surface the fw module name (no dash).
+        const DIGEST_OID_LIST = [
+            '2.16.840.1.101.3.4.2.1', // sha256
+            '2.16.840.1.101.3.4.2.2', // sha384
+            '2.16.840.1.101.3.4.2.3', // sha512
+            '1.3.14.3.2.26'           // sha1
+        ];
+        const _digest = {};
+        for (const oid of DIGEST_OID_LIST) {
+            const e = asn1Oid.lookup(oid);
+            if (e) _digest[oid] = e.name; // 'sha256', 'sha384', 'sha512', 'sha1'
+        }
+        const DIGEST_OIDS = Object.freeze(_digest);
+
+        // SIG_DISPATCH_OIDS — verifier name. PDF maps:
+        //   PKCS#1 v1.5 family       → 'rsa'
+        //   RSASSA-PSS                → 'rsa-pss'
+        //   id-ecPublicKey + ECDSA-W  → 'ecc'
+        //   id-Ed25519                → 'ed25519'
+        const SIG_DISPATCH_OID_LIST = [
+            ['1.2.840.113549.1.1.1',  'rsa'],     // rsaEncryption (PKCS#1 v1.5)
+            ['1.2.840.113549.1.1.11', 'rsa'],     // sha256WithRSAEncryption
+            ['1.2.840.113549.1.1.12', 'rsa'],     // sha384WithRSAEncryption
+            ['1.2.840.113549.1.1.13', 'rsa'],     // sha512WithRSAEncryption
+            ['1.2.840.113549.1.1.10', 'rsa-pss'], // id-RSASSA-PSS
+            ['1.2.840.10045.2.1',     'ecc'],     // id-ecPublicKey
+            ['1.2.840.10045.4.3.2',   'ecc'],     // ecdsa-with-SHA256
+            ['1.2.840.10045.4.3.3',   'ecc'],     // ecdsa-with-SHA384
+            ['1.2.840.10045.4.3.4',   'ecc'],     // ecdsa-with-SHA512
+            ['1.3.101.112',           'ed25519']  // id-Ed25519
+        ];
+        const _sig = {};
+        for (const [oid, dispatch] of SIG_DISPATCH_OID_LIST) {
+            if (asn1Oid.lookup(oid)) _sig[oid] = dispatch;
+        }
+        const SIG_DISPATCH_OIDS = Object.freeze(_sig);
+
+        // KEY_ALG_OIDS — SPKI base algo (no hash suffix).
+        const KEY_ALG_OID_LIST = [
+            ['1.2.840.113549.1.1.1', 'rsa'],
+            ['1.2.840.10045.2.1',    'ecc'],
+            ['1.3.101.112',          'ed25519'],
+            ['1.3.101.113',          'ed448']
+        ];
+        const _key = {};
+        for (const [oid, alg] of KEY_ALG_OID_LIST) {
+            if (asn1Oid.lookup(oid)) _key[oid] = alg;
+        }
+        const KEY_ALG_OIDS = Object.freeze(_key);
+
+        // SIG_ALG_OIDS_VERBOSE — cert sigAlgorithm verbose name. PDF
+        // uses RFC-canonical wire-format names that differ slightly
+        // from fw's `name` field.
+        const _verbose = {
+            '1.2.840.113549.1.1.5':  'sha1WithRSAEncryption',
+            '1.2.840.113549.1.1.11': 'sha256WithRSAEncryption',
+            '1.2.840.113549.1.1.12': 'sha384WithRSAEncryption',
+            '1.2.840.113549.1.1.13': 'sha512WithRSAEncryption',
+            '1.2.840.113549.1.1.10': 'rsassa-pss',
+            '1.2.840.10045.4.3.2':   'ecdsa-with-SHA256',
+            '1.2.840.10045.4.3.3':   'ecdsa-with-SHA384',
+            '1.2.840.10045.4.3.4':   'ecdsa-with-SHA512',
+            '1.3.101.112':           'ed25519',
+            '1.3.101.113':           'ed448'
+        };
+        // Strip OIDs that fw doesn't know (paranoia : keeps fw as
+        // single source of truth for what's a valid OID).
+        for (const oid of Object.keys(_verbose)) {
+            if (!asn1Oid.lookup(oid)) delete _verbose[oid];
+        }
+        const SIG_ALG_OIDS_VERBOSE = Object.freeze(_verbose);
+
+        // RFC 3161 constants — also in fw's pkcs9 / pkcs7 categories,
+        // re-exposed here for caller ergonomics.
+        const OID_TST_INFO     = '1.2.840.113549.1.9.16.1.4';
+        const OID_AA_TIMESTAMP = '1.2.840.113549.1.9.16.2.14';
+
+        // ── Helpers ──────────────────────────────────────────────────
+
+        /** DN attribute OID → short form (CN, O, OU, C, …). */
+        function shortOid(oid) {
+            const e = asn1Oid.lookup(oid);
+            if (e && e.category === 'x509-dn') return e.shortName;
+            // PKCS#9 emailAddress is also rendered as 'E' in DNs.
+            if (oid === '1.2.840.113549.1.9.1') return 'E';
+            return oid;
+        }
+
+        function lookupDigest(oid)     { return DIGEST_OIDS[oid]          || null; }
+        function lookupSigAlg(oid)     { return SIG_DISPATCH_OIDS[oid]    || null; }
+        function lookupKeyAlg(oid)     { return KEY_ALG_OIDS[oid]         || null; }
+        function lookupSigVerbose(oid) { return SIG_ALG_OIDS_VERBOSE[oid] || null; }
+
+        return {
+            DIGEST_OIDS, SIG_DISPATCH_OIDS,
+            KEY_ALG_OIDS, SIG_ALG_OIDS_VERBOSE,
+            OID_TST_INFO, OID_AA_TIMESTAMP,
+            lookupDigest, lookupSigAlg, lookupKeyAlg, lookupSigVerbose,
+            shortOid
+        };
+    }
+};

package/src/sig/sha1.js

@@ -0,0 +1,142 @@
+// Copyright (c) 2026 AwaCloud SAS
+// Author: Matthieu Bouilloux
+// SPDX-License-Identifier: AGPL-3.0-only
+// Dual-licensed; see the NOTICE file for licensing and any additional terms.
+
+/**
+ * @fileoverview SHA-1 hash function (FIPS 180-4 §6.1) — PDF-local
+ * legacy module.
+ *
+ * **Why this lives in pdf and not fw** : SHA-1 is cryptographically
+ * broken for collision resistance. It MUST NOT be used for new
+ * signatures, MACs, or password hashing. The only reason this module
+ * exists in the workspace is **PDF legacy compatibility** — ISO
+ * 32000-2 §12.8.4.3 mandates SHA-1 of the signature value as the DSS
+ * `/VRI` dict key. Keeping the implementation in `@awacloud/pdf` instead of
+ * `@awacloud/fw` makes the legacy-only nature obvious to anyone reading
+ * fw's hash family (sha256/384/512 only).
+ *
+ * Exposes the same surface as fw's hash modules (`hash(data)` one-shot
+ * and `fn` constructor) so the dispatch idiom stays uniform.
+ *
+ * Factory descriptor — deps `['bitArray', 'utf8']`. Pattern aligned
+ * on `@awacloud/fw/crypto/hash/sha256.js`.
+ *
+ * @module pdf/sig/sha1
+ */
+
+import { bitArray } from '@awacloud/fw/crypto/utils/bitArray.js';
+import { utf8 } from '@awacloud/fw/io/codec/utf8.js';
+
+export const pdfSha1 = {
+    name: 'pdfSha1',
+    dependencies: ['bitArray', 'utf8'],
+    deps: [bitArray, utf8],
+    factory(bitArray, utf8) {
+
+        const _INIT = [
+            0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476, 0xc3d2e1f0
+        ];
+
+        // K[0..3] — round constants (FIPS 180-4 §4.2.1).
+        const _KEY = [
+            0x5a827999, 0x6ed9eba1, 0x8f1bbcdc, 0xca62c1d6
+        ];
+
+        // Closure-based constructor — worker-safe (no `this.` in factory
+        // body). `fn(other?)` returns an object with `_h`/`_buffer`/
+        // `_length`/`reset`/`update`/`finalize` closing over locals.
+        function fn(other) {
+            let h, buffer, length;
+            function reset() {
+                h = _INIT.slice(0);
+                buffer = [];
+                length = 0;
+                return self;
+            }
+            function _block(w) {
+                let a = h[0], b = h[1], c = h[2], d = h[3], e = h[4];
+                const W = new Array(80);
+                for (let i = 0; i < 16; i++) W[i] = w[i] | 0;
+                for (let i = 16; i < 80; i++) {
+                    const x = W[i - 3] ^ W[i - 8] ^ W[i - 14] ^ W[i - 16];
+                    W[i] = (x << 1) | (x >>> 31);
+                }
+                for (let i = 0; i < 80; i++) {
+                    let f, kt;
+                    if (i < 20)      { f = (b & c) | ((~b) & d);           kt = _KEY[0]; }
+                    else if (i < 40) { f = b ^ c ^ d;                       kt = _KEY[1]; }
+                    else if (i < 60) { f = (b & c) | (b & d) | (c & d);     kt = _KEY[2]; }
+                    else             { f = b ^ c ^ d;                       kt = _KEY[3]; }
+                    const t = (((a << 5) | (a >>> 27)) + f + e + kt + W[i]) | 0;
+                    e = d;
+                    d = c;
+                    c = ((b << 30) | (b >>> 2)) | 0;
+                    b = a;
+                    a = t;
+                }
+                h[0] = (h[0] + a) | 0;
+                h[1] = (h[1] + b) | 0;
+                h[2] = (h[2] + c) | 0;
+                h[3] = (h[3] + d) | 0;
+                h[4] = (h[4] + e) | 0;
+            }
+            function update(data) {
+                if (typeof data === 'string') {
+                    data = bitArray.ui8_to_ba(utf8.toBytes(data));
+                }
+                buffer = bitArray.concat(buffer, data);
+                const ol = length;
+                const nl = length = ol + bitArray.bitLength(data);
+                if (nl > 9007199254740991) {
+                    console.warn('[crypto] INVALID: sha1: cannot hash more than 2^53 - 1 bits');
+                    return false;
+                }
+                const c = new Uint32Array(buffer);
+                let j = 0;
+                for (let i = 512 + ol - ((512 + ol) & 511); i <= nl; i += 512) {
+                    _block(c.subarray(16 * j, 16 * (j + 1)));
+                    j += 1;
+                }
+                buffer.splice(0, 16 * j);
+                return self;
+            }
+            function finalize() {
+                buffer = bitArray.concat(buffer, [bitArray.partial(1, 1)]);
+                for (let i = buffer.length + 2; i & 15; i++) {
+                    buffer.push(0);
+                }
+                buffer.push(Math.floor(length / 0x100000000));
+                buffer.push(length | 0);
+                while (buffer.length) {
+                    _block(buffer.splice(0, 16));
+                }
+                const out = h;
+                reset();
+                return out;
+            }
+            const self = {
+                blockSize: 512,
+                reset, update, finalize,
+                // Expose state for clone — caller uses `fn(otherInstance)`.
+                get _h()      { return h; },
+                get _buffer() { return buffer; },
+                get _length() { return length; }
+            };
+            if (other) {
+                h      = other._h.slice(0);
+                buffer = other._buffer.slice(0);
+                length = other._length;
+            } else {
+                reset();
+            }
+            return self;
+        }
+
+        function hash(data) {
+            return fn().update(data).finalize();
+        }
+
+        return { fn, hash };
+    }
+};