@blamejs/pki 0.1.11 → 0.1.12

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.1.12 — 2026-07-05
+
+SLH-DSA object identifiers corrected and completed to all twelve FIPS 205 parameter sets.
+
+### Fixed
+
+- SLH-DSA OID resolution — id-slh-dsa-shake-128s and id-slh-dsa-shake-256s were mapped to the arcs of id-slh-dsa-sha2-256s (.24) and id-slh-dsa-shake-128f (.27), so pki.oid.name / pki.oid.byName resolved them incorrectly. All twelve Pure SLH-DSA parameter sets (sha2-128s/128f/192s/192f/256s/256f and shake-128s/128f/192s/192f/256s/256f) are now registered at their correct arcs .20 through .31 per RFC 9909 §3; the previously-absent nine sets now resolve as well. WebCrypto SLH-DSA sign/verify was unaffected — it selects by algorithm name, not through the OID registry.
+
 ## v0.1.11 — 2026-07-05
 
 An OCSP request and response parser joins the pki.schema family.

package/lib/oid.js

@@ -118,10 +118,17 @@ var FAMILIES = {
     sha256: 1, sha384: 2, sha512: 3, "sha3-256": 8, "sha3-512": 10, shake256: 12 } },
 
   // NIST signature algorithms — FIPS 204 ML-DSA + FIPS 205 SLH-DSA share the
-  // signature arc 2.16.840.1.101.3.4.3.
+  // signature arc 2.16.840.1.101.3.4.3. The 12 Pure SLH-DSA parameter sets are
+  // assigned sequentially (RFC 9909 §3): the SHA-2 sets .20-.25, then the SHAKE
+  // sets .26-.31.
   nistSig: { base: [2, 16, 840, 1, 101, 3, 4, 3], of: {
     "id-ml-dsa-44": 17, "id-ml-dsa-65": 18, "id-ml-dsa-87": 19,
-    "id-slh-dsa-sha2-128s": 20, "id-slh-dsa-shake-128s": 24, "id-slh-dsa-shake-256s": 27 } },
+    "id-slh-dsa-sha2-128s": 20, "id-slh-dsa-sha2-128f": 21,
+    "id-slh-dsa-sha2-192s": 22, "id-slh-dsa-sha2-192f": 23,
+    "id-slh-dsa-sha2-256s": 24, "id-slh-dsa-sha2-256f": 25,
+    "id-slh-dsa-shake-128s": 26, "id-slh-dsa-shake-128f": 27,
+    "id-slh-dsa-shake-192s": 28, "id-slh-dsa-shake-192f": 29,
+    "id-slh-dsa-shake-256s": 30, "id-slh-dsa-shake-256f": 31 } },
 
   // NIST KEM — FIPS 203 ML-KEM (arc 2.16.840.1.101.3.4.4).
   nistKem: { base: [2, 16, 840, 1, 101, 3, 4, 4], of: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:f4519864-8754-4475-8ee0-b2556afddae1",
+  "serialNumber": "urn:uuid:88d4b070-1605-4f2d-84b3-a7851ac00842",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-05T20:10:05.842Z",
+    "timestamp": "2026-07-05T20:47:24.516Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.1.11",
+      "bom-ref": "@blamejs/pki@0.1.12",
       "type": "application",
       "name": "pki",
-      "version": "0.1.11",
+      "version": "0.1.12",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.1.11",
+      "purl": "pkg:npm/%40blamejs/pki@0.1.12",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.1.11",
+      "ref": "@blamejs/pki@0.1.12",
       "dependsOn": []
     }
   ]