@blamejs/pki 0.2.16 → 0.2.18

package/CHANGELOG.md

@@ -4,7 +4,33 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## v0.2.16 — 2026-07-14
+## v0.2.18 — 2026-07-14
+
+Composite ML-DSA signatures join CMS SignedData: pki.cms.sign and pki.cms.verify now produce and verify a composite SignerInfo -- a post-quantum ML-DSA paired with a traditional RSA, ECDSA, or EdDSA -- accepted only when BOTH components verify.
+
+### Added
+
+- pki.cms.verify verifies, and pki.cms.sign produces, a composite ML-DSA CMS SignerInfo (draft-ietf-lamps-cms-composite-sigs) pairing ML-DSA-44/65/87 with a traditional RSA (PKCS#1 v1.5 or PSS), ECDSA (P-256/384/521), or EdDSA (Ed25519) component. The signature is accepted only when BOTH the post-quantum and traditional components verify over the domain-separated message representative; the digestAlgorithm is the parameter set's paired pre-hash, and the composite public-key OID must match the signatureAlgorithm. Fifteen algorithm arms verify and sign today; the two brainpool-curve arms and the one SHAKE256-pre-hash arm are recognized but fail closed to a typed error (their curve / digest is outside the WebCrypto surface).
+- pki.cms.sign accepts a composite signer as { cert, key: { mldsa, trad } } -- the two component private keys as PKCS#8 -- since a composite private key has no single native representation; it signs both components over the RFC 5652 section 5.4 preimage and emits the fixed-order composite signature the verifier consumes.
+
+### Fixed
+
+- EdDSA (Ed25519 / Ed448) public keys are validated as a canonical, on-curve, full-order Edwards point before any signature is verified with them, across certification-path validation (pki.path.validate) -- a certificate signature or a CRL / OCSP-response signature checked during revocation -- composite CMS SignerInfo components, and JWS verification (pki.jose.verify). A low-order key -- for example the identity point, which the underlying platform imports without complaint and which verifies a forged signature for every message -- is rejected up front, so it can no longer certify a forged certificate chain, forge a CRL or OCSP response, satisfy the traditional half of a composite signature, or make a forged JWS verify. Certificate and revocation verification share one key-import routine, so the check cannot be applied to one surface and skipped on another.
+
+## v0.2.17 — 2026-07-13
+
+Post-quantum SLH-DSA joins CMS SignedData: pki.cms.sign and pki.cms.verify now sign and verify with all twelve FIPS 205 SLH-DSA parameter sets (RFC 9814), freely mixed with the classical and ML-DSA signers in one message.
+
+### Added
+
+- pki.cms.sign and pki.cms.verify sign and verify a CMS SignedData with the twelve pure FIPS 205 SLH-DSA parameter sets (id-slh-dsa-sha2-128s/f, -192s/f, -256s/f and the SHAKE equivalents), RFC 9814: pure mode, empty context, AlgorithmIdentifier parameters absent, over attached or detached content and single or multiple signers -- freely mixed with RSA, RSASSA-PSS, ECDSA, EdDSA, and ML-DSA signers in one message. The signer identifier is issuerAndSerialNumber or subjectKeyIdentifier, and the output is a DER Buffer or PEM.
+- The CMS message-digest algorithm for an SLH-DSA signer is fixed to the parameter set's paired digest (RFC 9814 section 4); signing emits it automatically and rejects a caller digest that contradicts the set, so the SignedData carries the conformant digest for the chosen parameter set.
+
+### Changed
+
+- CMS signature verification's one-shot signer-key agreement check (a single algorithm identifier naming both the key and the signature) now covers SLH-DSA alongside EdDSA and ML-DSA: an SLH-DSA SignerInfo whose signer certificate public-key parameter set disagrees with the signatureAlgorithm fails closed with a typed error.
+
+## v0.2.16 — 2026-07-13
 
 Post-quantum ML-DSA joins CMS SignedData: pki.cms.sign and pki.cms.verify now sign and verify with ML-DSA-44/65/87 (RFC 9882), freely mixed with the classical signers in one message.
 

package/README.md

@@ -221,7 +221,7 @@ is callable today; nothing below is a stub.
 | `pki.schema.smime` | Decode S/MIME ESS signed-attribute values (RFC 5035 / RFC 8551) — `parseSigningCertificate` / `parseSigningCertificateV2` bind a signature to its signing certificate (cert hash, hash algorithm, issuer `GeneralNames` + serial), `parseSmimeCapabilities` decodes the ordered capability list, and `decodeAttribute` OID-dispatches a CMS attribute (enforcing the single-value rule, recognize-and-defer for unknown types). A companion decoder for CMS signed attributes, not an auto-routed format, fail-closed — `parseSigningCertificate`, `parseSigningCertificateV2`, `parseSmimeCapabilities`, `decodeAttribute` |
 | `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk` / `encode` / `embeddedDer` plus the schema combinators |
 | `pki.path` | RFC 5280 §6 certification-path validation — `validate` runs the §6.1 state machine (signature chaining across RSA, ECDSA, EdDSA, ML-DSA, SLH-DSA and hybrid composite ML-DSA signatures — a composite is accepted only when **both** its post-quantum and traditional components verify; validity windows, name chaining, basic constraints and path length, key usage, name constraints, the certificate-policy tree) over an ordered path and a trust anchor, returning a structured verdict with per-check reason codes, and enforces a `pki.trust` anchor's per-purpose distrust-after dates and delegator purposes via `checkPurpose`; `crlChecker` supplies CRL-based revocation — including partitioned/sharded CRLs, whose §6.3.3 Distribution Point ↔ IDP correspondence lets a corresponding full-reason shard establish non-revocation — and `ocspChecker` supplies OCSP-based revocation (RFC 6960 — CertID binding, responder authorization, signature, currency) over the same pluggable hook. Pure and re-entrant, fail-closed — `validate`, `crlChecker`, `ocspChecker` |
-| `pki.cms` | RFC 5652 §5 CMS SignedData signing + signature verification — `sign(content, signers, opts)` produces a SignedData (attached or detached, one or many signers, RSA / RSASSA-PSS / ECDSA / EdDSA and the post-quantum ML-DSA-44/65/87 per RFC 9882); it builds the signed attributes (content-type, message-digest, signing-time) as canonical DER, signs the exact §5.4 preimage, and emits a DER `Buffer` or PEM. `verify(input, opts)` parses a SignedData over the strict `pki.schema.cms` codec, locates each SignerInfo's signer certificate by its issuerAndSerialNumber or subjectKeyIdentifier, and checks the signature over the exact §5.4 preimage: when signed attributes are present it confirms the message-digest attribute equals the content digest and verifies over the DER re-encoding of the SignedAttributes (the on-wire `[0]` tag replaced by a universal SET OF), otherwise directly over the content. It returns a per-signer verdict with the matched signer certificate; it does not chain that certificate to a trust anchor — that is the caller's step through `pki.path.validate`. Fail-closed with typed `cms/*` errors — `sign`, `verify` |
+| `pki.cms` | RFC 5652 §5 CMS SignedData signing + signature verification — `sign(content, signers, opts)` produces a SignedData (attached or detached, one or many signers, RSA / RSASSA-PSS / ECDSA / EdDSA, the post-quantum ML-DSA-44/65/87 (RFC 9882) and SLH-DSA (all twelve FIPS 205 sets, RFC 9814), and composite ML-DSA (pairing ML-DSA with a traditional RSA / ECDSA / EdDSA — accepted only when **both** components verify — draft-ietf-lamps-cms-composite-sigs)); it builds the signed attributes (content-type, message-digest, signing-time) as canonical DER, signs the exact §5.4 preimage, and emits a DER `Buffer` or PEM. `verify(input, opts)` parses a SignedData over the strict `pki.schema.cms` codec, locates each SignerInfo's signer certificate by its issuerAndSerialNumber or subjectKeyIdentifier, and checks the signature over the exact §5.4 preimage: when signed attributes are present it confirms the message-digest attribute equals the content digest and verifies over the DER re-encoding of the SignedAttributes (the on-wire `[0]` tag replaced by a universal SET OF), otherwise directly over the content. It returns a per-signer verdict with the matched signer certificate; it does not chain that certificate to a trust anchor — that is the caller's step through `pki.path.validate`. Fail-closed with typed `cms/*` errors — `sign`, `verify` |
 | `pki.tsp` | RFC 3161 timestamp token creation — `sign(messageImprint, tsa, opts)` produces a TimeStampToken: a CMS SignedData (over `pki.cms.sign`) whose content is a `TSTInfo` carrying the timestamped message imprint, the TSA policy, a serial number, and `genTime` (with optional accuracy / nonce / ordering), plus the RFC 3161 §2.4.2 signing-certificate attribute binding the token to the TSA certificate. The producing side of `pki.schema.tsp.parseToken`; SHA-2 imprints, and any `pki.cms.sign` TSA key — `sign` |
 | `pki.ct` | RFC 6962 Certificate Transparency SCTs — `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries in the SCT extension (a TLS-presentation-language payload inside the §3.3 double DER wrap) into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature; `reconstructSignedData` rebuilds the exact `digitally-signed` preimage; `verifySct` verifies an SCT signature against a log's public key by reconstructing the signed data, routing an ECDSA signature through the strict DER-conformance gate, and verifying through the crypto engine — resolving true or false, and throwing a typed error on a structural fault. Structure decoded, crypto fail-closed — `parseSctList`, `reconstructSignedData`, `verifySct` |
 | `pki.merkle` | RFC 6962 / RFC 9162 Merkle-tree proof verification — `leafHash` / `nodeHash` / `emptyRootHash` build the domain-separated (0x00 leaf / 0x01 node) SHA-256 tree hashes; `verifyInclusion` folds an audit proof back to a root and `verifyConsistency` reconstructs both the old and new root (the append-only guarantee), each constant-time-compared to a trusted checkpoint root. Fail-closed on bad geometry, sync hashing, transport-free — `leafHash`, `nodeHash`, `emptyRootHash`, `verifyInclusion`, `verifyConsistency` |

package/lib/asn1-der.js

@@ -109,6 +109,7 @@ function _className(bits) {
     case CLASS_APPLICATION: return "application";
     case CLASS_CONTEXT:     return "context";
     case CLASS_PRIVATE:     return "private";
+    // Coverage residual -- tagClassBits is (first & 0xc0), always one of the 4 enumerated class values; the default arm is unreachable defensive code.
     default:                return "universal";
   }
 }
@@ -394,6 +395,7 @@ function _readIntegerLikeContent(node, typeName, who) {
     if (c[0] === 0xff && (c[1] & 0x80) !== 0) throw new Asn1Error("asn1/non-minimal-integer", "non-minimal negative " + typeName);
   }
   var neg = (c[0] & 0x80) !== 0;
+  // Coverage residual -- the c.length===0 guard above throws, so c.length is always >=1 here; the 0n alternate is unreachable.
   var mag = c.length ? BigInt("0x" + Buffer.from(c).toString("hex")) : 0n;
   return neg ? mag - (1n << BigInt(c.length * 8)) : mag;
 }
@@ -734,6 +736,7 @@ function readTime(node, opts) {
   var d = new Date(0);
   d.setUTCFullYear(year, month - 1, day);
   d.setUTCHours(hour, min, sec, ms);
+  // Coverage residual -- regex-validated fields are finite integers and Date rolls over (never NaN); out-of-range is caught by the component round-trip check below.
   if (isNaN(d.getTime())) throw new Asn1Error("asn1/bad-time", "unparseable time " + JSON.stringify(s));
   // Date/setUTC* silently roll over out-of-range fields (Feb 30 -> Mar 2,
   // month 13 -> next Jan, hour 25 -> +1 day). Reject unless every component
@@ -767,6 +770,7 @@ function encodeLength(n) {
 // `children` (not `content`), so the content is those children's DER concatenated;
 // the identifier becomes the SEQUENCE tag and the length is canonical DER.
 function sequenceTlv(node) {
+  // Coverage residual -- a decoded node with content==null is always constructed with a children array; the || [] guards a non-decoder-built node and is unreachable via decode.
   var content = node.content != null ? node.content : Buffer.concat((node.children || []).map(function (c) { return c.bytes; }));
   return Buffer.concat([Buffer.from([TAGS.SEQUENCE | CONSTRUCTED_BIT]), encodeLength(content.length), content]);
 }

package/lib/cms-sign.js

@@ -22,6 +22,7 @@ var pkix = require("./schema-pkix");
 var webcrypto = require("./webcrypto");
 var subtle = webcrypto.webcrypto.subtle;
 var validator = require("./validator-all");
+var compositeSig = require("./composite-sig");
 var frameworkError = require("./framework-error");
 
 var CmsError = frameworkError.CmsError;
@@ -32,8 +33,8 @@ function O(name) { return oid.byName(name); }
 // A digest-algorithm name -> the WebCrypto hash (sign path). SHAKE256 has no WebCrypto hash, so
 // the message digest is always computed with node:crypto (below), uniform across the family.
 var HASH = { sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" };
-var NODE_DIGEST = { sha256: "sha256", sha384: "sha384", sha512: "sha512", shake256: "shake256" };
-var SHAKE_OUT = { shake256: 64 };   // RFC 8419 sec. 2.3 -- Ed448 uses SHAKE256 with 512-bit output
+var NODE_DIGEST = { sha256: "sha256", sha384: "sha384", sha512: "sha512", shake128: "shake128", shake256: "shake256" };
+var SHAKE_OUT = { shake128: 32, shake256: 64 };   // SHAKE output lengths: SHAKE128 256-bit (RFC 9814 sec. 4), SHAKE256 512-bit (RFC 8419 sec. 2.3 / RFC 9814)
 var PSS_SALT = { "SHA-256": 32, "SHA-384": 48, "SHA-512": 64 };
 var ECDSA_ALG = { sha256: "ecdsaWithSHA256", sha384: "ecdsaWithSHA384", sha512: "ecdsaWithSHA512" };
 var HASH_NAME_BY_OID = {};
@@ -60,6 +61,15 @@ var MLDSA_SUITABLE_DIGEST = {
   "ML-DSA-65": { sha384: 1, sha512: 1, shake256: 1 },
   "ML-DSA-87": { sha512: 1, shake256: 1 },
 };
+// SLH-DSA (RFC 9814): the twelve pure FIPS 205 sets. The signer cert SPKI algorithm OID -> its
+// WebCrypto set name ("SLH-DSA-"+SET, mirroring webcrypto's SLH_DSA_NODE / path-validate) + the
+// RFC 9814 sec. 4 pinned message digest for that set. The sig and key share one OID; the digest is
+// FIXED per set (no caller choice, unlike ML-DSA's suitable-set). Registry-keyed (Hard rule #2).
+var SLHDSA_BY_OID = {};
+[["sha2-128s", "sha256"], ["sha2-128f", "sha256"], ["sha2-192s", "sha512"], ["sha2-192f", "sha512"],
+ ["sha2-256s", "sha512"], ["sha2-256f", "sha512"], ["shake-128s", "shake128"], ["shake-128f", "shake128"],
+ ["shake-192s", "shake256"], ["shake-192f", "shake256"], ["shake-256s", "shake256"], ["shake-256f", "shake256"]
+].forEach(function (r) { SLHDSA_BY_OID[O("id-slh-dsa-" + r[0])] = { wc: "SLH-DSA-" + r[0].toUpperCase(), digest: r[1] }; });
 
 var OID_DATA = O("data");
 var OID_SIGNED_DATA = O("signedData");
@@ -117,6 +127,17 @@ function _digest(digestName, content) {
 function _scheme(cert, so, noSignedAttrs) {
   var alg = cert.subjectPublicKeyInfo.algorithm;
   var keyOid = alg.oid;
+  var comp = compositeSig.COMPOSITE_ALGS[keyOid];
+  if (comp) {
+    // Composite ML-DSA (draft-ietf-lamps-cms-composite-sigs): the arm DICTATES the CMS
+    // digestAlgorithm (its pre-hash, Table 1) -- unlike RSA/ECDSA the digest is not a caller
+    // choice, so a conflicting so.digestAlgorithm is rejected. The 3 arms Node's WebCrypto surface
+    // cannot sign (brainpool curves; the SHAKE256/64 pre-hash) fail closed at config time -- never
+    // a partial single-component signature.
+    if (comp.trad.unsupported) throw _err("cms/unsupported-algorithm", "composite " + comp.name + ": " + comp.trad.unsupported);
+    if (so.digestAlgorithm && so.digestAlgorithm !== comp.phCms) throw _err("cms/bad-input", "composite " + comp.name + " fixes the digestAlgorithm to " + comp.phCms + " (draft-ietf-lamps-cms-composite-sigs sec. 3.4); " + JSON.stringify(so.digestAlgorithm) + " conflicts");
+    return { composite: comp, digest: comp.phCms, digestAlgId: _algId(comp.phCms, "absent"), sigAlgId: _algId(comp.name, "absent") };
+  }
   if (keyOid === O("rsaEncryption") || keyOid === O("rsassaPss")) {
     var isPssKey = keyOid === O("rsassaPss");
     // An id-RSASSA-PSS key MAY pin its permitted hash in the SPKI params (RFC 4055 sec. 1.2): honor
@@ -167,6 +188,14 @@ function _scheme(cert, so, noSignedAttrs) {
     }
     return { digest: md, digestAlgId: _algId(md, "absent"), sigAlgId: _algId(oid.name(keyOid), "absent"), imp: { name: mlName }, sign: { name: mlName }, ecdsaDer: false };
   }
+  if (SLHDSA_BY_OID[keyOid]) {
+    // SLH-DSA (RFC 9814): a one-shot post-quantum signature, pure mode, empty context. The message
+    // digest is FIXED per parameter set (sec. 4) -- emit it, and reject a contradicting caller
+    // digestAlgorithm fail-closed rather than carry a non-conformant digest.
+    var slh = SLHDSA_BY_OID[keyOid];
+    if (so.digestAlgorithm && so.digestAlgorithm !== slh.digest) throw _err("cms/bad-input", "SLH-DSA " + slh.wc + " requires the " + slh.digest + " message digest (RFC 9814 sec. 4); digestAlgorithm " + JSON.stringify(so.digestAlgorithm) + " conflicts");
+    return { digest: slh.digest, digestAlgId: _algId(slh.digest, "absent"), sigAlgId: _algId(oid.name(keyOid), "absent"), imp: { name: slh.wc }, sign: { name: slh.wc }, ecdsaDer: false };
+  }
   throw _err("cms/unsupported-algorithm", "unsupported signer key algorithm " + keyOid);
 }
 
@@ -225,47 +254,76 @@ function _buildSignerInfo(signer, content, eContentType, opts) {
     : b.sequence([b.raw(_issuerBytes(cert)), b.integer(cert.serialNumber)]);        // IssuerAndSerialNumber
   var version = useSki ? 3 : 1;
 
+  return Promise.resolve().then(function () {
+    if (opts.signedAttributes === false) return content;   // sign the content directly (no signed attributes)
+    // Signed attributes (RFC 5652 sec. 5.3): content-type == eContentType, message-digest ==
+    // digest(content), and (by default) signing-time. build.set canonical-DER SET-OF-sorts them.
+    // Each attribute type appears AT MOST ONCE across the whole set (RFC 5652 sec. 5.3);
+    // `seenTypes` catches a caller-supplied attribute that duplicates a built-in or another.
+    var seenTypes = {};
+    function _pushAttr(typeOid, values) {
+      if (seenTypes[typeOid]) throw _err("cms/bad-input", "signedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + typeOid);
+      seenTypes[typeOid] = 1;
+      attrs.push(b.sequence([b.oid(typeOid), b.set(values)]));
+    }
+    var attrs = [];
+    _pushAttr(O("contentType"), [b.oid(eContentType)]);
+    _pushAttr(O("messageDigest"), [b.octetString(_digest(scheme.digest, content))]);
+    if (opts.signingTime !== false) _pushAttr(O("signingTime"), [_timeValue(opts.signingTime)]);
+    // Caller-supplied signed attributes (e.g. an RFC 3161 signing-certificate attribute): each
+    // { type: <OID name or dotted string>, values: [<DER value Buffer>] }. build.set sorts them in.
+    (opts.additionalSignedAttributes || []).forEach(function (a) {
+      var vals = (a.values || []).map(function (v) { return _toBuf(v, "a signed attribute value"); });
+      if (!vals.length) throw _err("cms/bad-input", "a signed attribute must carry at least one value (RFC 5652 -- Attribute values is SET SIZE (1..MAX))");
+      _pushAttr(/^\d+(\.\d+)+$/.test(a.type) ? a.type : O(a.type), vals);
+    });
+    var setOf = b.set(attrs);   // SET OF (tag 0x31) -- the exact bytes the signature covers (sec. 5.4)
+    var wire = Buffer.from(setOf); wire[0] = 0xA0;   // the on-wire [0] IMPLICIT tag
+    return { setOf: setOf, wire: wire };
+  }).then(function (toSign) {
+    var signedBytes = toSign.setOf ? toSign.setOf : toSign;   // SET-OF form for signing (sec. 5.4)
+    return _signScheme(scheme, so, signedBytes).then(function (sig) {
+      var fields = [b.integer(BigInt(version)), sid, scheme.digestAlgId];
+      if (toSign.wire) fields.push(toSign.wire);              // [0] IMPLICIT signedAttrs
+      fields.push(scheme.sigAlgId, b.octetString(sig));
+      return { si: b.sequence(fields), digestAlgId: scheme.digestAlgId, version: version, certDer: certDer };
+    });
+  });
+}
+
+// Sign the sec. 5.4 preimage under the resolved scheme -> the raw signature bytes for the
+// SignerInfo signature OCTET STRING. The classical path imports the single signer key and signs
+// (re-encoding ECDSA to canonical DER); the composite path signs BOTH component keys over the
+// domain-separated M' and returns mldsaSig || tradSig (composite-sig.js owns the construction).
+function _signScheme(scheme, so, signedBytes) {
+  if (scheme.composite) {
+    return compositeSig.compositeSign(scheme.composite, _normCompositeKeys(so.key, scheme.composite), signedBytes).then(function (sig) { return Buffer.from(sig); });
+  }
   return _importKey(so.key, scheme.imp).then(function (priv) {
-    return Promise.resolve().then(function () {
-      if (opts.signedAttributes === false) return content;   // sign the content directly (no signed attributes)
-      // Signed attributes (RFC 5652 sec. 5.3): content-type == eContentType, message-digest ==
-      // digest(content), and (by default) signing-time. build.set canonical-DER SET-OF-sorts them.
-      // Each attribute type appears AT MOST ONCE across the whole set (RFC 5652 sec. 5.3);
-      // `seenTypes` catches a caller-supplied attribute that duplicates a built-in or another.
-      var seenTypes = {};
-      function _pushAttr(typeOid, values) {
-        if (seenTypes[typeOid]) throw _err("cms/bad-input", "signedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + typeOid);
-        seenTypes[typeOid] = 1;
-        attrs.push(b.sequence([b.oid(typeOid), b.set(values)]));
-      }
-      var attrs = [];
-      _pushAttr(O("contentType"), [b.oid(eContentType)]);
-      _pushAttr(O("messageDigest"), [b.octetString(_digest(scheme.digest, content))]);
-      if (opts.signingTime !== false) _pushAttr(O("signingTime"), [_timeValue(opts.signingTime)]);
-      // Caller-supplied signed attributes (e.g. an RFC 3161 signing-certificate attribute): each
-      // { type: <OID name or dotted string>, values: [<DER value Buffer>] }. build.set sorts them in.
-      (opts.additionalSignedAttributes || []).forEach(function (a) {
-        var vals = (a.values || []).map(function (v) { return _toBuf(v, "a signed attribute value"); });
-        if (!vals.length) throw _err("cms/bad-input", "a signed attribute must carry at least one value (RFC 5652 -- Attribute values is SET SIZE (1..MAX))");
-        _pushAttr(/^\d+(\.\d+)+$/.test(a.type) ? a.type : O(a.type), vals);
-      });
-      var setOf = b.set(attrs);   // SET OF (tag 0x31) -- the exact bytes the signature covers (sec. 5.4)
-      var wire = Buffer.from(setOf); wire[0] = 0xA0;   // the on-wire [0] IMPLICIT tag
-      return { setOf: setOf, wire: wire };
-    }).then(function (toSign) {
-      var signedBytes = toSign.setOf ? toSign.setOf : toSign;   // SET-OF form for signing (sec. 5.4)
-      return subtle.sign(scheme.sign, priv, signedBytes).then(function (sigRaw) {
-        var sig = Buffer.from(sigRaw);
-        if (scheme.ecdsaDer) sig = validator.sig.rawToEcdsaDer(sig, scheme.coordLen);
-        var fields = [b.integer(BigInt(version)), sid, scheme.digestAlgId];
-        if (toSign.wire) fields.push(toSign.wire);              // [0] IMPLICIT signedAttrs
-        fields.push(scheme.sigAlgId, b.octetString(sig));
-        return { si: b.sequence(fields), digestAlgId: scheme.digestAlgId, version: version, certDer: certDer };
-      });
+    return subtle.sign(scheme.sign, priv, signedBytes).then(function (sigRaw) {
+      var sig = Buffer.from(sigRaw);
+      if (scheme.ecdsaDer) sig = validator.sig.rawToEcdsaDer(sig, scheme.coordLen);
+      return sig;
     });
   });
 }
 
+// A composite signer key is the two component private keys { mldsa, trad } as PKCS#8 (Node has no
+// single composite key type; the CMS draft is silent on key import). A missing/wrong-typed
+// component fails closed at config time -- never a partial single-component signature.
+function _normCompositeKeys(key, comp) {
+  if (!key || typeof key !== "object" || Buffer.isBuffer(key) || key instanceof Uint8Array || key.mldsa == null || key.trad == null) {
+    throw _err("cms/bad-input", "a composite " + comp.name + " signer key must be { mldsa: <PKCS#8>, trad: <PKCS#8> }");
+  }
+  return { mldsa: _normPkcs8(key.mldsa, "the composite ML-DSA component key"), trad: _normPkcs8(key.trad, "the composite traditional component key") };
+}
+function _normPkcs8(k, label) {
+  if (Buffer.isBuffer(k)) return k;
+  if (k instanceof Uint8Array) return Buffer.from(k);
+  if (typeof k === "string") { try { return pkcs8.pemDecode(k); } catch (e) { throw _err("cms/bad-input", label + " PEM could not be decoded", e); } }
+  throw _err("cms/bad-input", label + " must be a PKCS#8 DER Buffer, Uint8Array, or PEM string");
+}
+
 // A signing-time Time value: UTCTime before 2050, GeneralizedTime from 2050 (RFC 5652 sec. 11.3 /
 // RFC 5280 sec. 4.1.2.5). A caller Date overrides; false omits the attribute (handled above).
 function _timeValue(when) {
@@ -360,4 +418,4 @@ function _toBuf(v, what) {
 // MLDSA_SUITABLE_DIGEST is shared with cms-verify (which requires this module) so the per-
 // parameter-set digest-strength policy has ONE home -- a digest accepted on sign is exactly the
 // set accepted on verify, and neither side can drift from the other (RFC 9882 sec. 3.3).
-module.exports = { sign: sign, MLDSA_SUITABLE_DIGEST: MLDSA_SUITABLE_DIGEST };
+module.exports = { sign: sign, MLDSA_SUITABLE_DIGEST: MLDSA_SUITABLE_DIGEST, SLHDSA_BY_OID: SLHDSA_BY_OID };

package/lib/cms-verify.js

@@ -13,12 +13,16 @@
  *   confirms the message-digest attribute equals the digest of the content and verifies the
  *   signature over the DER re-encoding of the SignedAttributes (the on-wire `[0]` tag replaced
  *   by a universal SET OF); otherwise it verifies directly over the content. Attached and
- *   detached content, single and multiple signers, and RSA / RSASSA-PSS / ECDSA / EdDSA and the
- *   post-quantum ML-DSA (ML-DSA-44/65/87, RFC 9882) are covered. It reports a per-signer verdict;
+ *   detached content, single and multiple signers, and RSA / RSASSA-PSS / ECDSA / EdDSA, the
+ *   post-quantum ML-DSA (ML-DSA-44/65/87, RFC 9882) and SLH-DSA (the twelve FIPS 205 sets, RFC 9814),
+ *   and composite ML-DSA (pairing ML-DSA with a traditional RSA / ECDSA / EdDSA, accepted only when
+ *   BOTH components verify -- draft-ietf-lamps-cms-composite-sigs) are covered. It reports a
+ *   per-signer verdict;
  *   it does NOT chain the signer certificate to a trust anchor -- that is the caller's step through
  *   `pki.path.validate`.
  * @spec RFC 5652
  * @spec RFC 9882
+ * @spec RFC 9814
  * @card Verify a CMS SignedData signature (S/MIME, timestamps, code signing).
  */
 
@@ -32,7 +36,9 @@ var subtle = webcrypto.webcrypto.subtle;
 var edwardsPoint = require("./edwards-point");
 var cmsSign = require("./cms-sign");
 var MLDSA_SUITABLE_DIGEST = cmsSign.MLDSA_SUITABLE_DIGEST;   // shared sign/verify digest-strength policy (RFC 9882 sec. 3.3)
+var SLHDSA_BY_OID = cmsSign.SLHDSA_BY_OID;                   // shared SLH-DSA set -> { wc, digest } (RFC 9814 sec. 4 pinned digest)
 var validator = require("./validator-all");
+var compositeSig = require("./composite-sig");
 var guard = require("./guard-all");
 var frameworkError = require("./framework-error");
 
@@ -46,7 +52,7 @@ var OID_CONTENT_TYPE = oid.byName("contentType");
 var DIGEST_HASH = { sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" };
 // SHAKE256 (RFC 8419 sec. 2.3, the Ed448 message digest) has no WebCrypto hash, so it is computed
 // with node:crypto; its 512-bit (64-byte) output length is fixed by the profile.
-var SHAKE_OUT = { shake256: 64 };
+var SHAKE_OUT = { shake128: 32, shake256: 64 };   // SHAKE128 256-bit (RFC 9814 sec. 4), SHAKE256 512-bit
 // Is `name` a message-digest algorithm this verifier supports (SHA-2 family or SHAKE256)?
 function _supportedDigest(name) { return !!(DIGEST_HASH[name] || SHAKE_OUT[name]); }
 // The digest of `content` under the named algorithm, resolved to a Buffer.
@@ -81,6 +87,12 @@ var SIG_SCHEME = {
   ecdsaWithSHA384: { kind: "ec", hash: "SHA-384", params: "absent" },
   ecdsaWithSHA512: { kind: "ec", hash: "SHA-512", params: "absent" },
 };
+// SLH-DSA (RFC 9814): the twelve pure FIPS 205 sets, seeded like webcrypto's SLH_DSA_NODE. Each is
+// a one-shot family (kind "slhdsa"), params absent, sig-OID == key-OID (sameKeyOid). The WebCrypto
+// name is "SLH-DSA-"+SET, matching path-validate's transform (drift rule sec. 5 -- one name map).
+["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
+ "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
+].forEach(function (s) { SIG_SCHEME["id-slh-dsa-" + s] = { kind: "slhdsa", name: "SLH-DSA-" + s.toUpperCase(), params: "absent", sameKeyOid: true, digest: SLHDSA_BY_OID[oid.byName("id-slh-dsa-" + s)].digest }; });
 // The signatureAlgorithm parameters match the algorithm's fixed shape (RFC 5754). A DER NULL
 // is exactly `05 00`; "absent" is the parameters field omitted entirely.
 function _isDerNull(p) { return Buffer.isBuffer(p) && p.length === 2 && p[0] === 0x05 && p[1] === 0x00; }
@@ -241,10 +253,11 @@ function _verifySignature(scheme, hashName, sigBytes, spki, signedBytes, curveOi
     return subtle.importKey("spki", spki, { name: "ECDSA", namedCurve: ec.curve }, false, ["verify"])
       .then(function (k) { return subtle.verify({ name: "ECDSA", hash: hashName }, k, raw, signedBytes); });
   }
-  if (scheme.kind === "mldsa") {
-    // ML-DSA (RFC 9882): a one-shot post-quantum verify, pure mode, empty context -- no external
-    // signature hash and no Edwards-point validation (FIPS 204 sec. 5.3; node structurally
-    // validates the SPKI on import). The signature is raw and fixed-length (not ECDSA-DER).
+  if (scheme.kind === "mldsa" || scheme.kind === "slhdsa") {
+    // ML-DSA (RFC 9882) / SLH-DSA (RFC 9814): a one-shot post-quantum verify, pure mode, empty
+    // context -- no external signature hash and no Edwards-point validation (FIPS 204 sec. 5.3 /
+    // FIPS 205 sec. 10.3; node structurally validates the SPKI on import). The signature is raw and
+    // fixed-length (not ECDSA-DER).
     return subtle.importKey("spki", spki, { name: scheme.name }, false, ["verify"])
       .then(function (k) { return subtle.verify({ name: scheme.name }, k, sigBytes, signedBytes); });
   }
@@ -256,18 +269,11 @@ function _verifySignature(scheme, hashName, sigBytes, spki, signedBytes, curveOi
     .then(function (k) { return subtle.verify({ name: scheme.name }, k, sigBytes, signedBytes); });
 }
 
-// The raw Edwards point an OKP SPKI carries (its BIT STRING body, past the unused-bits octet)
-// MUST be a valid, canonical, full-order point -- reject an off-curve or low-order key before
-// it verifies a signature (WebCrypto import does not check it). Curve from the WebCrypto name.
+// The EdDSA signer key's point MUST be a valid, canonical, full-order Edwards point -- reject an
+// off-curve or low-order key before it verifies a signature (WebCrypto import does not check it).
+// Routed through the shared edwards-point gate every EdDSA verify path uses; curve from the name.
 function _requireValidEdPoint(spkiBytes, name) {
-  var content;
-  try {
-    content = asn1.decode(spkiBytes).children[1].content;
-  } catch (e) { throw _err("cms/bad-signature", "the EdDSA public key is not a well-formed SPKI", e); }
-  var point = content && content.length ? content.subarray(1) : Buffer.alloc(0);
-  if (!edwardsPoint.validate(point, name === "Ed25519" ? 6 : 7)) {
-    throw _err("cms/bad-signature", "the EdDSA public key is not a valid, full-order Edwards point");
-  }
+  edwardsPoint.validateSpki(spkiBytes, name === "Ed25519" ? 6 : 7, CmsError, "cms/bad-signature");
 }
 
 // The EC named-curve OID carried in a signer cert's SubjectPublicKeyInfo, or null (non-EC).
@@ -298,6 +304,11 @@ function _decodeSignedAttrs(setOfBytes) {
 // Verify one SignerInfo. Returns { ok, sid, cert, ... } -- a resolved false is a verdict; a
 // structural failure carries a code.
 function _verifyOne(si, content, eContentType, parsedCerts) {
+  // A composite ML-DSA SignerInfo (draft-ietf-lamps-cms-composite-sigs) is keyed by its composite
+  // OID, not a SIG_SCHEME name; intercept it before the classical dispatch (its verify has no
+  // single external signature hash, so it never routes through the SIG_SCHEME/sigHash gate below).
+  var composite = compositeSig.COMPOSITE_ALGS[si.signatureAlgorithm.oid];
+  if (composite) return _verifyComposite(si, composite, content, eContentType, parsedCerts);
   var scheme = SIG_SCHEME[si.signatureAlgorithm.name];
   if (!scheme) return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "unsupported signature algorithm " + JSON.stringify(si.signatureAlgorithm.name) });
   var digestHash = DIGEST_HASH[si.digestAlgorithm.name];
@@ -317,27 +328,45 @@ function _verifyOne(si, content, eContentType, parsedCerts) {
   var dp = si.digestAlgorithm.parameters;
   var mldsaNoAttrs = scheme.kind === "mldsa" && !si.signedAttrsBytes;
   if (!mldsaNoAttrs && dp !== null && dp !== undefined && !_isDerNull(dp)) return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the " + si.digestAlgorithm.name + " digest algorithm parameters must be absent or DER NULL (RFC 5754 sec. 2)" });
-  // The SHAKE256 digest algorithm identifier carries NO parameters at all -- not even a DER NULL
-  // (RFC 8702 sec. 3.1) -- so for an ML-DSA SignerInfo with signed attributes a present shake256
-  // parameter fails closed. The SHA-2 ML-DSA digests (id-sha256/384/512) follow RFC 5754, which
-  // requires a verifier to accept absent OR NULL (the generic rule above); RFC 9882's omit-on-encode
-  // rule binds the signer, not the verifier, so a SHA-2 NULL is not tightened here.
-  if (scheme.kind === "mldsa" && si.signedAttrsBytes && si.digestAlgorithm.name === "shake256" && dp !== null && dp !== undefined) return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the SHAKE256 digestAlgorithm parameters must be absent (RFC 8702 sec. 3.1)" });
+  // A SHAKE digest algorithm identifier (id-shake128 / id-shake256) carries NO parameters at all --
+  // not even a DER NULL (RFC 8702 sec. 3.1) -- so for a one-shot PQC SignerInfo (ML-DSA per RFC 9882,
+  // SLH-DSA per RFC 9814 sec. 4, both citing RFC 8702) with signed attributes a present SHAKE
+  // parameter fails closed. The SHA-2 digests (id-sha256/384/512) follow RFC 5754, which requires a
+  // verifier to accept absent OR NULL (the generic rule above); the RFCs' omit-on-encode rule binds
+  // the signer, not the verifier, so a SHA-2 NULL is not tightened here.
+  if ((scheme.kind === "mldsa" || scheme.kind === "slhdsa") && si.signedAttrsBytes && (si.digestAlgorithm.name === "shake128" || si.digestAlgorithm.name === "shake256") && dp !== null && dp !== undefined) return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "a SHAKE digestAlgorithm carries no parameters (RFC 8702 sec. 3.1)" });
   var sigHash = pss ? pss.hash : (scheme.hash || digestHash);
   // The signature hash is required for every non-EdDSA scheme (EdDSA hashes internally);
   // the content digest is required whenever signed attributes are present, for every scheme
   // (the message-digest attribute is computed under digestAlgorithm). Either gap is a
   // fail-closed unsupported-algorithm verdict, never a foreign-domain throw from the digest.
-  if ((scheme.kind !== "eddsa" && scheme.kind !== "mldsa" && !sigHash) || (si.signedAttrsBytes && !_supportedDigest(si.digestAlgorithm.name))) return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "unsupported digest algorithm " + JSON.stringify(si.digestAlgorithm.name) });
+  if ((scheme.kind !== "eddsa" && scheme.kind !== "mldsa" && scheme.kind !== "slhdsa" && !sigHash) || (si.signedAttrsBytes && !_supportedDigest(si.digestAlgorithm.name))) return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "unsupported digest algorithm " + JSON.stringify(si.digestAlgorithm.name) });
   // ML-DSA (RFC 9882 sec. 3.3): with signed attributes present, the message-digest algorithm MUST
   // meet the parameter set's security strength -- a below-strength digest is the weaker link and is
   // rejected fail-closed (the RFC's "verifiers MAY reject", taken by the strict-verifier posture).
   // With signed attributes absent the digestAlgorithm has no meaning (sec. 3.3) and is not checked.
   if (scheme.kind === "mldsa" && si.signedAttrsBytes && !MLDSA_SUITABLE_DIGEST[scheme.name][si.digestAlgorithm.name]) return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the " + si.digestAlgorithm.name + " message digest is below the security strength of " + scheme.name + " (RFC 9882 sec. 3.3)" });
+  // RFC 9814 sec. 4: an SLH-DSA SignerInfo's message-digest algorithm is the one paired with the
+  // parameter set (the sec. 4 list, always at least twice the tree-hash size); the signer emits it
+  // and this strict verifier requires it, so a digest that does not match the set's paired hash fails
+  // closed -- otherwise a signer could compute the message-digest attribute under a weaker hash the
+  // set does not pair. Gated on signed attributes (absent -> the digest is not consulted, sec. 4).
+  if (scheme.kind === "slhdsa" && si.signedAttrsBytes && si.digestAlgorithm.name !== scheme.digest) return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "SLH-DSA " + scheme.name + " requires the " + scheme.digest + " message digest (RFC 9814 sec. 4)" });
   var signers = _findSignerCerts(si.sid, parsedCerts);
   if (!signers.length) return Promise.resolve({ ok: false, code: "cms/signer-cert-not-found", sid: si.sid, message: "no certificate matches this SignerInfo's signer identifier" });
   var sigBytes = _toBuf(si.signature, "the SignerInfo signature");
 
+  return _computeSignedBytes(si, content, eContentType).then(function (signedBytes) {
+    if (signedBytes && signedBytes.mismatch) return { ok: false, code: signedBytes.mismatch.code, sid: si.sid, cert: signers[0].der, message: signedBytes.mismatch.message };
+    return _verifyAgainstCandidates(scheme, sigHash, sigBytes, signedBytes, si.sid, signers, pss ? pss.saltLength : 0, scheme.sameKeyOid ? oid.byName(si.signatureAlgorithm.name) : null);
+  });
+}
+
+// The exact bytes the signature covers (RFC 5652 sec. 5.4), shared by the classical and composite
+// verify paths so both bind the message-digest / content-type checks to the VERIFIED preimage (not
+// the caller-mutable parsed si.signedAttrs). Resolves the signed bytes, or { mismatch } when a
+// content-type / message-digest attribute disagrees.
+function _computeSignedBytes(si, content, eContentType) {
   return Promise.resolve().then(function () {
     if (!si.signedAttrsBytes) return content;   // no signed attributes: sign over the content directly
     // With signed attributes: decode them from the EXACT bytes the signature covers -- the
@@ -372,12 +401,79 @@ function _verifyOne(si, content, eContentType, parsedCerts) {
       if (!d.equals(declared)) return { mismatch: { code: "cms/message-digest-mismatch", message: "the message-digest attribute does not match the content digest" } };
       return reTagged;
     });
-  }).then(function (signedBytes) {
+  });
+}
+
+// Verify a composite ML-DSA SignerInfo (draft-ietf-lamps-cms-composite-sigs). The composite
+// verify engine lives in composite-sig.js (shared with certification-path validation); this branch
+// enforces the CMS-specific rules the X.509 path does not: params-absent on the signatureAlgorithm
+// (sec. 3.4, defense-in-depth over the parse-time _PARAMS_ABSENT gate), the unsupported-arm refusal,
+// and the sec. 3.4/sec. 5 coherence gate binding the SignerInfo digestAlgorithm to the arm's Table-1
+// pre-hash. It reuses the sec. 5.4 preimage + message-digest binding UNCHANGED, then dispatches
+// compositeVerify per candidate certificate (BOTH components must verify -- never an AND->OR
+// downgrade).
+function _verifyComposite(si, comp, content, eContentType, parsedCerts) {
+  if (si.signatureAlgorithm.parameters !== null && si.signatureAlgorithm.parameters !== undefined) {
+    return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the composite signatureAlgorithm parameters must be absent (draft-ietf-lamps-cms-composite-sigs sec. 3.4)" });
+  }
+  // The 3 arms Node's WebCrypto surface cannot verify (brainpool curves; the SHAKE256/64 pre-hash)
+  // fail closed -- never a silent single-component accept (the AND->OR downgrade this feature prevents).
+  if (comp.trad.unsupported) {
+    return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "composite " + comp.name + ": " + comp.trad.unsupported });
+  }
+  // draft sec. 3.4: for a composite SignerInfo the digestAlgorithm parameters MUST be OMITTED
+  // (id-sha256/id-sha512 and id-shake256) -- stricter than the generic RFC 5754 absent-OR-NULL rule
+  // (which the classical/ML-DSA paths follow), because the composite draft explicitly requires the
+  // field omitted. A present parameter -- even a DER NULL -- is non-conformant and fails closed
+  // (it is outside the signed preimage, so a parser differential must not verify).
+  var dp = si.digestAlgorithm.parameters;
+  if (dp !== null && dp !== undefined) {
+    return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the composite " + si.digestAlgorithm.name + " digestAlgorithm parameters must be omitted (draft-ietf-lamps-cms-composite-sigs sec. 3.4)" });
+  }
+  // sec. 3.4 / sec. 5 (the one CMS-specific MUST the X.509 path does not cover): the SignerInfo
+  // digestAlgorithm MUST equal the arm's pre-hash (Table 1) -- compositeVerify takes the pre-hash
+  // from the OID-keyed descriptor, so a disagreeing digestAlgorithm would recompute the
+  // message-digest attribute under the WRONG algorithm. The sec. 5 SHOULD-reject is taken
+  // fail-closed; the MAY-verify-anyway leniency is deliberately not taken.
+  if (si.digestAlgorithm.name !== comp.phCms) {
+    return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the SignerInfo digestAlgorithm " + JSON.stringify(si.digestAlgorithm.name) + " is not the composite " + comp.name + " pre-hash " + JSON.stringify(comp.phCms) + " (draft-ietf-lamps-cms-composite-sigs sec. 3.4)" });
+  }
+  var signers = _findSignerCerts(si.sid, parsedCerts);
+  if (!signers.length) return Promise.resolve({ ok: false, code: "cms/signer-cert-not-found", sid: si.sid, message: "no certificate matches this SignerInfo's signer identifier" });
+  var sigBytes = _toBuf(si.signature, "the SignerInfo signature");
+  return _computeSignedBytes(si, content, eContentType).then(function (signedBytes) {
     if (signedBytes && signedBytes.mismatch) return { ok: false, code: signedBytes.mismatch.code, sid: si.sid, cert: signers[0].der, message: signedBytes.mismatch.message };
-    return _verifyAgainstCandidates(scheme, sigHash, sigBytes, signedBytes, si.sid, signers, pss ? pss.saltLength : 0, scheme.sameKeyOid ? oid.byName(si.signatureAlgorithm.name) : null);
+    return _verifyCompositeAgainstCandidates(comp, sigBytes, signedBytes, si.sid, signers, si.signatureAlgorithm.oid);
   });
 }
 
+// Dispatch compositeVerify against EACH matching candidate; the signer is valid iff one candidate
+// verifies both components. A candidate whose SPKI composite OID != the SignerInfo signatureAlgorithm
+// OID is skipped with a precise verdict (RFC 9814 sec. 4 key<->signature agreement); a candidate that
+// returns a structural fault code (bad split length, unsupported) falls through, its code surfaced if
+// none verifies. A clean both-components-checked failure (the AND-downgrade) is a code-less false.
+function _verifyCompositeAgainstCandidates(comp, sigBytes, signedBytes, sid, candidates, expectedKeyOid) {
+  var lastErr = null;
+  function attempt(idx) {
+    if (idx >= candidates.length) {
+      return lastErr ? { ok: false, code: lastErr.code, sid: sid, cert: candidates[0].der, message: lastErr.message }
+        : { ok: false, sid: sid, cert: candidates[0].der };
+    }
+    var c = candidates[idx];
+    if (c.cert.subjectPublicKeyInfo.algorithm.oid !== expectedKeyOid) {
+      lastErr = _err("cms/unsupported-algorithm", "the signer certificate public-key algorithm does not match the SignerInfo signatureAlgorithm");
+      return attempt(idx + 1);
+    }
+    return compositeSig.compositeVerify(c.cert.subjectPublicKeyInfo.bytes, sigBytes, signedBytes, comp, CmsError, "cms/unsupported-algorithm", "cms/bad-signature")
+      .then(function (r) {
+        if (r.ok === true) return { ok: true, sid: sid, cert: c.der };
+        if (r.code) lastErr = (r.error instanceof CmsError) ? r.error : _err(r.code, r.error && r.error.message ? r.error.message : "the composite signature could not be evaluated");
+        return attempt(idx + 1);
+      });
+  }
+  return attempt(0);
+}
+
 /**
  * @primitive  pki.cms.verify
  * @signature  pki.cms.verify(input, opts?) -> Promise<{ valid, signers }>
@@ -385,6 +481,7 @@ function _verifyOne(si, content, eContentType, parsedCerts) {
  * @status     experimental
  * @spec       RFC 5652
  * @spec       RFC 9882
+ * @spec       RFC 9814
  * @defends    cms-signature-forgery (CWE-347)
  * @related    pki.schema.cms.parse, pki.path.validate
  *
@@ -393,7 +490,10 @@ function _verifyOne(si, content, eContentType, parsedCerts) {
  * `signers[i]` is `{ ok, sid, cert }` (`cert` the matched signer certificate DER) or carries
  * a `code` on a structural failure; `valid` is true when there is at least one signer and
  * every signer verified. RSA (PKCS#1 v1.5 and RSASSA-PSS), ECDSA, EdDSA, and the post-quantum
- * ML-DSA (ML-DSA-44/65/87, RFC 9882 -- pure mode, empty context) signatures are recognized.
+ * ML-DSA (ML-DSA-44/65/87, RFC 9882) and SLH-DSA (the twelve FIPS 205 sets, RFC 9814) -- pure mode,
+ * empty context -- signatures are recognized, as is composite ML-DSA
+ * (draft-ietf-lamps-cms-composite-sigs), which pairs ML-DSA with a traditional RSA / ECDSA / EdDSA
+ * and verifies only when BOTH components pass (never an AND-to-OR downgrade).
  *
  * @opts  content  The detached content (a `Buffer`) when the SignedData carries no
  *                 encapsulated eContent. Required for a detached signature.
@@ -440,10 +540,6 @@ function _addCert(out, der) {
 // because an upstream contract already narrows the shape:
 //   * `cert.extensions || []` -- x509.parse always surfaces `extensions` as an array (empty
 //     when absent), so the `|| []` fallback never fires.
-//   * `_requireValidEdPoint`'s SPKI-decode catch and its empty-content `Buffer.alloc(0)`
-//     fallback -- a signer certificate accepted by x509.parse always carries a well-formed,
-//     non-empty SubjectPublicKeyInfo BIT STRING, so the decode never throws and the content is
-//     never empty here.
 //   * `_decodeSignedAttrs`'s `tagNumber !== SET` / `!children` guard -- the caller forces the
 //     leading byte to a universal SET OF before decoding, so `asn1.decode` yields a SET whose
 //     `children` is always an array; the guard is belt-and-suspenders against a future caller.
@@ -459,19 +555,22 @@ function _addCert(out, der) {
  * @status     experimental
  * @spec       RFC 5652
  * @spec       RFC 9882
+ * @spec       RFC 9814
  * @related    pki.cms.verify, pki.schema.cms.parse
  *
  * Produce a CMS SignedData (RFC 5652 sec. 5) over `content` (a `Buffer`) -- the structure
  * S/MIME signed mail, RFC 3161 timestamp tokens, and code signing rest on, and exactly what
  * `pki.cms.verify` consumes and OpenSSL `cms -verify` validates. Each `signers[i]` is
  * `{ cert, key, digestAlgorithm?, pss? }`: `cert` the signer certificate (PEM or DER), `key`
- * its private key (a WebCrypto `CryptoKey` or a PKCS#8 DER `Buffer` / PEM string). The
+ * its private key (a WebCrypto `CryptoKey` or a PKCS#8 DER `Buffer` / PEM string; for a composite
+ * ML-DSA signer, the two component keys `{ mldsa, trad }`, each PKCS#8). The
  * signature covers the RFC 5652 sec. 5.4 preimage: with signed attributes (the default) the
  * message-digest attribute is bound to the content digest and the signature is over the
  * canonical DER SET OF SignedAttributes; otherwise over the content directly. RSA (PKCS#1 v1.5
  * and, with `pss`, RSASSA-PSS), ECDSA (P-256/384/521), Ed25519, Ed448, and the post-quantum ML-DSA
- * (ML-DSA-44/65/87, RFC 9882 -- pure mode; SHA-512 message digest by default, SHAKE256 optional)
- * are covered.
+ * (ML-DSA-44/65/87, RFC 9882) and SLH-DSA (the twelve FIPS 205 sets, RFC 9814 -- the message digest
+ * pinned per parameter set) are covered, as is composite ML-DSA (draft-ietf-lamps-cms-composite-sigs)
+ * -- the arm's pre-hash fixes the digestAlgorithm and the two component keys are signed together.
  *
  * @opts  detached          Omit the encapsulated content (a detached signature; the verifier
  *                          supplies the content). Default false.