@blamejs/pki 0.1.20 → 0.1.21

package/CHANGELOG.md

@@ -4,6 +4,21 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.1.21 — 2026-07-09
+
+SLH-DSA signatures verify in certification-path validation, and the post-quantum / EdDSA parameters-absent rule is enforced across every format.
+
+### Added
+
+- SLH-DSA signature verification in pki.path.validate — all twelve FIPS 205 parameter sets (id-slh-dsa-sha2-{128,192,256}{s,f} and the SHAKE sets). A certificate or CRL signed with SLH-DSA now verifies by importing the issuer's SLH-DSA public key and checking the one-shot signature over the raw signed region; the same rows serve both the certificate signature check and the CRL revocation checker. ML-DSA and the classical RSA / ECDSA / EdDSA set were already wired.
+- pki.oid.paramsMustBeAbsent(oid) — a predicate that reports whether an AlgorithmIdentifier bearing the given OID must encode its parameters field as absent (the ML-DSA and SLH-DSA families and the RFC 8410 Edwards / Montgomery curves). It is the single source the shared AlgorithmIdentifier decoder consults.
+- The OID registry now names the twelve pre-hash HashSLH-DSA identifiers (id-hash-slh-dsa-*, RFC 9909 §3), so a certificate or CRL that carries a HashSLH-DSA algorithm resolves to a name and is covered by the parameters-absent rule.
+
+### Fixed
+
+- The shared AlgorithmIdentifier decoder now rejects a present parameters field on the algorithms whose parameters MUST be absent — ML-DSA, SLH-DSA, Ed25519, Ed448, X25519, and X448 (RFC 9909 §3, RFC 9814 §4, RFC 9881 §2, RFC 8410 §3) — failing closed with a <format>/bad-algorithm-parameters code. Previously a stray explicit NULL or arbitrary bytes in that field were surfaced raw. The rule is enforced once in the shared decoder, so every format that names an algorithm inherits it; a conforming identifier, which omits the field, is unaffected.
+- Certification-path validation now enforces issuer-key / signature-algorithm consistency for the one-shot families whose public-key OID equals the signature OID — EdDSA, ML-DSA, and SLH-DSA — rejecting a mismatch with a path/algorithm-mismatch reason (RFC 9814 §4). Because the underlying WebCrypto import binds a public key of a different type to the requested algorithm name and verifies with the real key, a certificate or CRL signed by one key type but labelling its signatureAlgorithm as another one-shot type could otherwise validate; the check closes that algorithm-confusion path for both the certificate signature and the CRL revocation checker.
+
 ## v0.1.20 — 2026-07-09
 
 An RFC 6962 Certificate Transparency SCT-list parser joins the toolkit.

package/lib/oid.js

@@ -217,9 +217,10 @@ var FAMILIES = {
     sha256: 1, sha384: 2, sha512: 3, "sha3-256": 8, "sha3-512": 10, shake256: 12 } },
 
   // NIST signature algorithms — FIPS 204 ML-DSA + FIPS 205 SLH-DSA share the
-  // signature arc 2.16.840.1.101.3.4.3. The 12 Pure SLH-DSA parameter sets are
-  // assigned sequentially (RFC 9909 §3): the SHA-2 sets .20-.25, then the SHAKE
-  // sets .26-.31.
+  // signature arc 2.16.840.1.101.3.4.3. RFC 9909 §3 assigns the 12 Pure SLH-DSA
+  // sets .20-.31 (SHA-2 .20-.25, SHAKE .26-.31) and the 12 pre-hash HashSLH-DSA
+  // sets .35-.46, each pairing a parameter set with its message-digest hash. The
+  // parameters MUST be absent for every one of them (enforced via paramsMustBeAbsent).
   nistSig: { base: [2, 16, 840, 1, 101, 3, 4, 3], of: {
     "id-ml-dsa-44": 17, "id-ml-dsa-65": 18, "id-ml-dsa-87": 19,
     "id-slh-dsa-sha2-128s": 20, "id-slh-dsa-sha2-128f": 21,
@@ -227,7 +228,13 @@ var FAMILIES = {
     "id-slh-dsa-sha2-256s": 24, "id-slh-dsa-sha2-256f": 25,
     "id-slh-dsa-shake-128s": 26, "id-slh-dsa-shake-128f": 27,
     "id-slh-dsa-shake-192s": 28, "id-slh-dsa-shake-192f": 29,
-    "id-slh-dsa-shake-256s": 30, "id-slh-dsa-shake-256f": 31 } },
+    "id-slh-dsa-shake-256s": 30, "id-slh-dsa-shake-256f": 31,
+    "id-hash-slh-dsa-sha2-128s-with-sha256": 35, "id-hash-slh-dsa-sha2-128f-with-sha256": 36,
+    "id-hash-slh-dsa-sha2-192s-with-sha512": 37, "id-hash-slh-dsa-sha2-192f-with-sha512": 38,
+    "id-hash-slh-dsa-sha2-256s-with-sha512": 39, "id-hash-slh-dsa-sha2-256f-with-sha512": 40,
+    "id-hash-slh-dsa-shake-128s-with-shake128": 41, "id-hash-slh-dsa-shake-128f-with-shake128": 42,
+    "id-hash-slh-dsa-shake-192s-with-shake256": 43, "id-hash-slh-dsa-shake-192f-with-shake256": 44,
+    "id-hash-slh-dsa-shake-256s-with-shake256": 45, "id-hash-slh-dsa-shake-256f-with-shake256": 46 } },
 
   // NIST KEM — FIPS 203 ML-KEM (arc 2.16.840.1.101.3.4.4).
   nistKem: { base: [2, 16, 840, 1, 101, 3, 4, 4], of: {
@@ -402,10 +409,58 @@ function fromDER(input) {
   return asn1.read.oid(node);
 }
 
+// Algorithm identifiers whose `parameters` field MUST be absent — no explicit
+// NULL, no bytes. The FIPS 204 ML-DSA and FIPS 205 SLH-DSA signature families
+// and the RFC 8410 Edwards / Montgomery curves each carry this MUST: RFC 9909 §3
+// (SLH-DSA in X.509), RFC 9814 §4 (SLH-DSA in CMS), RFC 9881 §2 (ML-DSA in X.509),
+// RFC 8410 §3 (Ed25519 / Ed448 / X25519 / X448). Built by NAME through the same
+// registry every caller uses, so a typo fails closed at load rather than silently
+// dropping a member. One set drives the single shared AlgorithmIdentifier reject
+// (schema-pkix), so every format consumer inherits the rule with no per-format code.
+var _PARAMS_ABSENT = new Set();
+[
+  "id-ml-dsa-44", "id-ml-dsa-65", "id-ml-dsa-87",
+  "id-slh-dsa-sha2-128s", "id-slh-dsa-sha2-128f", "id-slh-dsa-sha2-192s",
+  "id-slh-dsa-sha2-192f", "id-slh-dsa-sha2-256s", "id-slh-dsa-sha2-256f",
+  "id-slh-dsa-shake-128s", "id-slh-dsa-shake-128f", "id-slh-dsa-shake-192s",
+  "id-slh-dsa-shake-192f", "id-slh-dsa-shake-256s", "id-slh-dsa-shake-256f",
+  // Pre-hash HashSLH-DSA sets (RFC 9909 §3) — parameters MUST be absent too.
+  "id-hash-slh-dsa-sha2-128s-with-sha256", "id-hash-slh-dsa-sha2-128f-with-sha256",
+  "id-hash-slh-dsa-sha2-192s-with-sha512", "id-hash-slh-dsa-sha2-192f-with-sha512",
+  "id-hash-slh-dsa-sha2-256s-with-sha512", "id-hash-slh-dsa-sha2-256f-with-sha512",
+  "id-hash-slh-dsa-shake-128s-with-shake128", "id-hash-slh-dsa-shake-128f-with-shake128",
+  "id-hash-slh-dsa-shake-192s-with-shake256", "id-hash-slh-dsa-shake-192f-with-shake256",
+  "id-hash-slh-dsa-shake-256s-with-shake256", "id-hash-slh-dsa-shake-256f-with-shake256",
+  "Ed25519", "Ed448", "X25519", "X448",
+].forEach(function (nm) { _PARAMS_ABSENT.add(byName(nm)); });
+
+/**
+ * @primitive  pki.oid.paramsMustBeAbsent
+ * @signature  pki.oid.paramsMustBeAbsent(dotted) -> boolean
+ * @since      0.1.21
+ * @status     experimental
+ * @spec       RFC 9909, RFC 9814, RFC 9881, RFC 8410
+ * @related    pki.oid.name, pki.oid.byName
+ *
+ * True when an AlgorithmIdentifier bearing this OID MUST encode its `parameters`
+ * field as ABSENT (not an explicit NULL, not any bytes): the FIPS 204 ML-DSA and
+ * FIPS 205 SLH-DSA signature families and the RFC 8410 Edwards / Montgomery
+ * curves. The shared AlgorithmIdentifier decoder consults this and fails closed
+ * on a present-parameters violation, so every format inherits the rule.
+ *
+ * @example
+ *   pki.oid.paramsMustBeAbsent(pki.oid.byName("id-slh-dsa-sha2-128s")); // -> true
+ *   pki.oid.paramsMustBeAbsent(pki.oid.byName("rsaEncryption"));        // -> false
+ */
+function paramsMustBeAbsent(dotted) {
+  return _PARAMS_ABSENT.has(dotted);
+}
+
 module.exports = {
   name:           name,
   byName:         byName,
   has:            has,
+  paramsMustBeAbsent: paramsMustBeAbsent,
   register:       register,
   registerFamily: registerFamily,
   all:            all,

package/lib/path-validate.js

@@ -86,9 +86,16 @@ var SIG_ALGS = {};
 // NULL must be present — RSASSA-PKCS1-v1_5, RFC 4055 §5) or "absent" (parameters
 // must be omitted — ECDSA/EdDSA/ML-DSA, RFC 5758/8410). A cert deviating from
 // its algorithm's required shape is malformed and rejected before verify.
-function _sig(name, verify, imp, params, ecdsa) {
+// `sameKeyOid` marks the one-shot families whose PUBLIC-KEY algorithm OID is the
+// SAME as the signature algorithm OID — EdDSA, ML-DSA, SLH-DSA. For these, Node's
+// WebCrypto imports an SPKI of ANOTHER type under the requested name and verifies
+// with the real key (it does NOT reject a mismatched SPKI the way it does for
+// RSA/ECDSA), so the issuer-key <-> signature-algorithm consistency (RFC 9814 §4)
+// must be checked structurally: the SPKI OID must equal the signature OID.
+function _sig(name, verify, imp, params, ecdsa, sameKeyOid) {
   var entry = { verify: verify, imp: imp, params: params };
   if (ecdsa) entry.ecdsa = true;
+  if (sameKeyOid) entry.sameKeyOid = true;
   SIG_ALGS[oid.byName(name)] = entry;
 }
 // RSASSA-PKCS1-v1_5 — parameters MUST be NULL.
@@ -99,13 +106,22 @@ _sig("sha512WithRSAEncryption", { name: "RSASSA-PKCS1-v1_5", hash: "SHA-512" },
 _sig("ecdsaWithSHA256", { name: "ECDSA", hash: "SHA-256" }, { name: "ECDSA" }, "absent", true);
 _sig("ecdsaWithSHA384", { name: "ECDSA", hash: "SHA-384" }, { name: "ECDSA" }, "absent", true);
 _sig("ecdsaWithSHA512", { name: "ECDSA", hash: "SHA-512" }, { name: "ECDSA" }, "absent", true);
-// EdDSA (one-shot, no hash parameter) — params absent.
-_sig("Ed25519", { name: "Ed25519" }, { name: "Ed25519" }, "absent");
-_sig("Ed448", { name: "Ed448" }, { name: "Ed448" }, "absent");
-// ML-DSA (FIPS 204) — params absent.
-_sig("id-ml-dsa-44", { name: "ML-DSA-44" }, { name: "ML-DSA-44" }, "absent");
-_sig("id-ml-dsa-65", { name: "ML-DSA-65" }, { name: "ML-DSA-65" }, "absent");
-_sig("id-ml-dsa-87", { name: "ML-DSA-87" }, { name: "ML-DSA-87" }, "absent");
+// EdDSA (one-shot, no hash parameter) — params absent; key OID == sig OID.
+_sig("Ed25519", { name: "Ed25519" }, { name: "Ed25519" }, "absent", false, true);
+_sig("Ed448", { name: "Ed448" }, { name: "Ed448" }, "absent", false, true);
+// ML-DSA (FIPS 204) — params absent; key OID == sig OID.
+_sig("id-ml-dsa-44", { name: "ML-DSA-44" }, { name: "ML-DSA-44" }, "absent", false, true);
+_sig("id-ml-dsa-65", { name: "ML-DSA-65" }, { name: "ML-DSA-65" }, "absent", false, true);
+_sig("id-ml-dsa-87", { name: "ML-DSA-87" }, { name: "ML-DSA-87" }, "absent", false, true);
+// SLH-DSA (FIPS 205) — params absent; key OID == sig OID. The twelve pure sets;
+// the RFC 9909 §3 OID name maps to the WebCrypto set name by id-slh-dsa-<set> ->
+// SLH-DSA-<SET> (the webcrypto SLH_DSA_NODE keys). One-shot verify like ML-DSA.
+["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
+ "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
+].forEach(function (set) {
+  var wc = "SLH-DSA-" + set.toUpperCase();
+  _sig("id-slh-dsa-" + set, { name: wc }, { name: wc }, "absent", false, true);
+});
 
 // RSASSA-PSS resolves its hash + salt from the AlgorithmIdentifier parameters.
 var OID_RSA_PSS = oid.byName("rsassaPss");
@@ -238,6 +254,24 @@ function resolveDescriptor(sigAlg) {
   return d;
 }
 
+// RFC 9814 §4 issuer-key <-> signature-algorithm consistency (algorithm-confusion
+// defense). For the one-shot families whose public key shares the signature OID
+// (EdDSA, ML-DSA, SLH-DSA), Node's WebCrypto imports an SPKI of a DIFFERENT type
+// under the requested name and verifies with the real key — so an Ed25519-signed
+// certificate labelled SLH-DSA would otherwise validate. Enforce structurally:
+// the issuer SPKI's algorithm OID MUST equal the signature algorithm OID. (For
+// RSA/ECDSA — different key vs signature OIDs — WebCrypto's import already rejects
+// a mismatched key type, so `sameKeyOid` is not set and this is a no-op.)
+function assertKeyMatchesSigAlg(spkiBytes, sigOid, d) {
+  if (!d || !d.sameKeyOid) return;
+  var keyOid;
+  try { keyOid = asn1.read.oid(asn1.decode(spkiBytes).children[0].children[0]); }
+  catch (e) { throw E("path/algorithm-mismatch", "cannot read the issuer public-key algorithm identifier", e); }
+  if (keyOid !== sigOid) {
+    throw E("path/algorithm-mismatch", "issuer public-key algorithm " + keyOid + " does not match the signature algorithm " + sigOid + " (RFC 9814 §4 - algorithm confusion)");
+  }
+}
+
 // DER Ecdsa-Sig-Value SEQUENCE { r, s } -> fixed-width r||s (P1363), rejecting
 // r or s outside [1, n-1] (CVE-2022-21449 "Psychic Signatures").
 function ecdsaDerToP1363(der, curve) {
@@ -270,8 +304,10 @@ function ecdsaDerToP1363(der, curve) {
 // Verify cert.signatureValue over cert.tbsBytes with the working public key.
 function builtinVerify(state, cert) {
   var d;
-  try { d = resolveDescriptor(cert.signatureAlgorithm); }
-  catch (e) { return Promise.resolve({ ok: false, code: pathCode(e, "path/unsupported-algorithm"), error: e }); }
+  try {
+    d = resolveDescriptor(cert.signatureAlgorithm);
+    assertKeyMatchesSigAlg(state.workingPublicKey, cert.signatureAlgorithm.oid, d);
+  } catch (e) { return Promise.resolve({ ok: false, code: pathCode(e, "path/unsupported-algorithm"), error: e }); }
   // The signature is an octet-aligned BIT STRING (no unused bits) for every
   // supported algorithm; a non-zero unused-bit count is malformed.
   if (cert.signatureValue.unusedBits !== 0) return Promise.resolve({ ok: false, code: "path/bad-signature" });
@@ -1387,8 +1423,10 @@ function crlEntryReason(entry) {
 
 function verifyCrlSignature(theCrl, issuer) {
   var d;
-  try { d = resolveDescriptor(theCrl.signatureAlgorithm); }
-  catch (_e) { return Promise.resolve(false); }
+  try {
+    d = resolveDescriptor(theCrl.signatureAlgorithm);
+    assertKeyMatchesSigAlg(issuer.workingPublicKey, theCrl.signatureAlgorithm.oid, d);
+  } catch (_e) { return Promise.resolve(false); }
   if (theCrl.signatureValue.unusedBits !== 0) return Promise.resolve(false);   // non-octet-aligned signature
   var key;
   return subtle.importKey("spki", issuer.workingPublicKey, d.imp, false, ["verify"]).then(function (k) {

package/lib/schema-pkix.js

@@ -156,6 +156,15 @@ function algorithmIdentifier(ns, opts) {
     arity: { min: 1 }, code: ns.prefix + "/bad-algorithm-identifier", what: "AlgorithmIdentifier",
     build: function (m, ctx) {
       var dotted = m.fields.algorithm.value;
+      // RFC 9909 §3 / RFC 9814 §4 / RFC 9881 §2 / RFC 8410 §3: for the PQC
+      // signature families (ML-DSA, SLH-DSA) and the Edwards/Montgomery curves,
+      // the `parameters` field MUST be absent — no explicit NULL, no bytes.
+      // Enforced ONCE here so every consumer of the shared AlgorithmIdentifier
+      // inherits the rule; the guard-parity bug class is structurally impossible.
+      if (m.fields.parameters.present && ctx.oid.paramsMustBeAbsent(dotted)) {
+        throw ctx.E(ctx.prefix + "/bad-algorithm-parameters",
+          "the " + (ctx.oid.name(dotted) || dotted) + " AlgorithmIdentifier parameters field MUST be absent (RFC 9909 §3 / RFC 9814 §4 / RFC 9881 §2 / RFC 8410 §3)");
+      }
       return { oid: dotted, name: ctx.oid.name(dotted) || null, parameters: m.fields.parameters.present ? m.fields.parameters.node.bytes : null };
     },
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.1.20",
+  "version": "0.1.21",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:f23ca197-835e-4ec8-8d04-486fb3d9deac",
+  "serialNumber": "urn:uuid:bcaea9d8-cd0d-4a9f-8ac3-72b3efecc8be",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-09T14:17:20.162Z",
+    "timestamp": "2026-07-09T15:12:46.820Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.1.20",
+      "bom-ref": "@blamejs/pki@0.1.21",
       "type": "application",
       "name": "pki",
-      "version": "0.1.20",
+      "version": "0.1.21",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.1.20",
+      "purl": "pkg:npm/%40blamejs/pki@0.1.21",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.1.20",
+      "ref": "@blamejs/pki@0.1.21",
       "dependsOn": []
     }
   ]