@blamejs/pki 0.2.16 → 0.2.18

package/lib/composite-sig.js

@@ -0,0 +1,240 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The composite ML-DSA signature engine
+// (draft-ietf-lamps-pq-composite-sigs for the construction; draft-ietf-lamps-cms-composite-sigs
+// binds it to CMS), shared by certification-path validation (X.509 composite certificates,
+// lib/path-validate.js) and CMS (composite SignerInfo, lib/cms-verify.js / lib/cms-sign.js).
+//
+// A composite signature pairs a post-quantum ML-DSA with a traditional RSA / ECDSA / EdDSA so the
+// signature stays trustworthy if EITHER primitive is later broken. The public key is the raw
+// concatenation mldsaPK || tradPK (sec. 4.1) in the SPKI BIT STRING; the signature is
+// mldsaSig || tradSig (sec. 4.3). Verification (sec. 2) reconstructs
+//   M' = Prefix || Label || len(ctx) || ctx || PH(M),
+// verifies the ML-DSA component over M' with ctx = the composite Label, verifies the traditional
+// component over M' under its own hash, and accepts IFF BOTH pass (THREAT-MODEL: all components
+// must verify -- never an AND-to-OR downgrade). The ML-DSA component is the fixed-length FIRST
+// half; the split point is its length.
+//
+// Error-parameterized like the guard / validator families: each consumer passes its own typed
+// error CONSTRUCTOR `E` and its domain codes (path validation passes PathError + path/*; CMS
+// passes CmsError + cms/*), so the shared engine keeps no domain of its own. compositeVerify keeps
+// the { ok, code, error } verdict shape; the codes are caller-supplied.
+
+var asn1 = require("./asn1-der");
+var oid = require("./oid");
+var webcrypto = require("./webcrypto");
+var validator = require("./validator-all");
+var edwardsPoint = require("./edwards-point");
+var subtle = webcrypto.webcrypto.subtle;
+var _b = asn1.build;
+
+// A caught error's OWN code if it shares the caller's domain prefix (the fallback's namespace,
+// e.g. path/ or cms/), else the fallback -- a foreign code (asn1/*) maps to the fallback so the
+// verdict stays in the caller's error namespace. Mirrors path-validate's original pathCode when
+// the fallback is a path/* code.
+function _codeOf(e, fallback) {
+  var prefix = fallback.slice(0, fallback.indexOf("/") + 1);
+  return (e && typeof e.code === "string" && e.code.indexOf(prefix) === 0) ? e.code : fallback;
+}
+
+var COMPOSITE_PREFIX = Buffer.from("CompositeAlgorithmSignatures2025", "ascii");
+var MLDSA_COMPONENT = {
+  "ML-DSA-44": { pk: 1312, sig: 2420, oid: "id-ml-dsa-44" },
+  "ML-DSA-65": { pk: 1952, sig: 3309, oid: "id-ml-dsa-65" },
+  "ML-DSA-87": { pk: 2592, sig: 4627, oid: "id-ml-dsa-87" },
+};
+var EC_CURVE_OID = { "P-256": "prime256v1", "P-384": "secp384r1", "P-521": "secp521r1" };
+// The WebCrypto pre-hash name (ph) -> the CMS digest-algorithm name (the SignerInfo digestAlgorithm,
+// draft-ietf-lamps-cms-composite-sigs Table 1). The SINGLE source of truth for the CMS binding's
+// digest -- both the verify coherence gate and the sign digestAlgorithm read phCms, never a second
+// name map inlined at the CMS boundary.
+var PH_CMS = { "SHA-256": "sha256", "SHA-512": "sha512", "SHAKE256": "shake256" };
+var COMPOSITE_ALGS = {};
+// _comp(name, mldsa, ph, label, trad). `trad` is exactly one component shape:
+//   { ec, hash } | { eddsa } | { rsaPss, hash, salt } | { rsaPkcs1, hash } |
+//   { unsupported } for the arms Node's WebCrypto surface cannot verify (brainpool
+//   curves; the SHAKE256/64 pre-hash) -- registered + params-guarded, deferred at
+//   verify to the caller's unsupported-algorithm code rather than silently accepted.
+function _comp(name, mldsa, ph, label, trad) {
+  var sz = MLDSA_COMPONENT[mldsa];
+  COMPOSITE_ALGS[oid.byName(name)] = {
+    name: name, mldsa: mldsa, mldsaPk: sz.pk, mldsaSig: sz.sig, mldsaOid: sz.oid,
+    ph: ph, phCms: PH_CMS[ph], label: Buffer.from(label, "ascii"), trad: trad,
+  };
+}
+_comp("id-MLDSA44-RSA2048-PSS-SHA256", "ML-DSA-44", "SHA-256", "COMPSIG-MLDSA44-RSA2048-PSS-SHA256", { rsaPss: true, hash: "SHA-256", salt: 32, rsaBits: 2048 });
+_comp("id-MLDSA44-RSA2048-PKCS15-SHA256", "ML-DSA-44", "SHA-256", "COMPSIG-MLDSA44-RSA2048-PKCS15-SHA256", { rsaPkcs1: true, hash: "SHA-256", rsaBits: 2048 });
+_comp("id-MLDSA44-Ed25519-SHA512", "ML-DSA-44", "SHA-512", "COMPSIG-MLDSA44-Ed25519-SHA512", { eddsa: "Ed25519" });
+_comp("id-MLDSA44-ECDSA-P256-SHA256", "ML-DSA-44", "SHA-256", "COMPSIG-MLDSA44-ECDSA-P256-SHA256", { ec: "P-256", hash: "SHA-256" });
+_comp("id-MLDSA65-RSA3072-PSS-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-RSA3072-PSS-SHA512", { rsaPss: true, hash: "SHA-256", salt: 32, rsaBits: 3072 });
+_comp("id-MLDSA65-RSA3072-PKCS15-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-RSA3072-PKCS15-SHA512", { rsaPkcs1: true, hash: "SHA-256", rsaBits: 3072 });
+_comp("id-MLDSA65-RSA4096-PSS-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-RSA4096-PSS-SHA512", { rsaPss: true, hash: "SHA-384", salt: 48, rsaBits: 4096 });
+_comp("id-MLDSA65-RSA4096-PKCS15-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-RSA4096-PKCS15-SHA512", { rsaPkcs1: true, hash: "SHA-384", rsaBits: 4096 });
+_comp("id-MLDSA65-ECDSA-P256-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-ECDSA-P256-SHA512", { ec: "P-256", hash: "SHA-256" });
+_comp("id-MLDSA65-ECDSA-P384-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-ECDSA-P384-SHA512", { ec: "P-384", hash: "SHA-384" });
+_comp("id-MLDSA65-ECDSA-brainpoolP256r1-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-ECDSA-BP256-SHA512", { unsupported: "brainpoolP256r1 is not in the WebCrypto ECDSA curve set" });
+_comp("id-MLDSA65-Ed25519-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-Ed25519-SHA512", { eddsa: "Ed25519" });
+_comp("id-MLDSA87-ECDSA-P384-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-ECDSA-P384-SHA512", { ec: "P-384", hash: "SHA-384" });
+_comp("id-MLDSA87-ECDSA-brainpoolP384r1-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-ECDSA-BP384-SHA512", { unsupported: "brainpoolP384r1 is not in the WebCrypto ECDSA curve set" });
+_comp("id-MLDSA87-Ed448-SHAKE256", "ML-DSA-87", "SHAKE256", "COMPSIG-MLDSA87-Ed448-SHAKE256", { unsupported: "the SHAKE256/64 pre-hash is not in the WebCrypto digest set" });
+_comp("id-MLDSA87-RSA3072-PSS-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-RSA3072-PSS-SHA512", { rsaPss: true, hash: "SHA-256", salt: 32, rsaBits: 3072 });
+_comp("id-MLDSA87-RSA4096-PSS-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-RSA4096-PSS-SHA512", { rsaPss: true, hash: "SHA-384", salt: 48, rsaBits: 4096 });
+_comp("id-MLDSA87-ECDSA-P521-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-ECDSA-P521-SHA512", { ec: "P-521", hash: "SHA-512" });
+
+// Wrap a raw component public key in the SPKI its WebCrypto import expects, so each half is
+// verified through the SAME import + verify seam the classical path uses (no second parallel
+// verify path). tradPK for RSA is the RSAPublicKey DER; for EC the uncompressed point; for EdDSA
+// the raw public key.
+function _spkiFor(algNode, keyBytes) { return _b.sequence([algNode, _b.bitString(keyBytes, 0)]); }
+function _mldsaSpki(mldsaOid, raw) { return _spkiFor(_b.sequence([_b.oid(oid.byName(mldsaOid))]), raw); }
+function _ecSpki(curve, point) { return _spkiFor(_b.sequence([_b.oid(oid.byName("ecPublicKey")), _b.oid(oid.byName(EC_CURVE_OID[curve]))]), point); }
+function _edSpki(name, raw) { return _spkiFor(_b.sequence([_b.oid(oid.byName(name))]), raw); }
+function _rsaSpki(rsaPub) { return _spkiFor(_b.sequence([_b.oid(oid.byName("rsaEncryption")), _b.nullValue()]), rsaPub); }
+
+// The exact modulus bit length of an RSAPublicKey (SEQUENCE { modulus, exponent }).
+function _rsaModulusBits(rsaPubDer) {
+  return asn1.read.integer(asn1.decode(rsaPubDer).children[0]).toString(2).length;
+}
+
+// M' = Prefix || Label || len(ctx) || ctx || PH(M) (draft sec. 2 / RFC 8410-style domain
+// separation). ctx is a single-octet-length-prefixed application context; X.509 path validation
+// and CMS both use the empty context. Shared by verify AND sign so the two cannot diverge.
+function compositeMprime(d, phBuf, ctx) {
+  ctx = ctx || Buffer.alloc(0);
+  return Buffer.concat([COMPOSITE_PREFIX, d.label, Buffer.from([ctx.length]), ctx, Buffer.from(phBuf)]);
+}
+
+function _verifyTradComponent(trad, tradPK, tradSig, mprime, E, badSig) {
+  if (trad.ec) {
+    // draft sec. 5.1: the EC point MUST be the uncompressed X9.62 form (leading 0x04).
+    // A compressed / hybrid point is a non-conforming composite component encoding.
+    if (tradPK.length < 1 || tradPK[0] !== 0x04) return Promise.resolve(false);
+    return subtle.importKey("spki", _ecSpki(trad.ec, tradPK), { name: "ECDSA" }, false, ["verify"]).then(function (k) {
+      // The traditional ECDSA signature is DER Ecdsa-Sig-Value; convert to P1363 through the shared
+      // order-aware reader that also rejects r/s outside [1,n-1] (CVE-2022-21449).
+      var p1363 = validator.sig.ecdsaDerToP1363(tradSig, trad.ec, E, badSig);
+      return subtle.verify({ name: "ECDSA", hash: trad.hash }, k, p1363, mprime);
+    });
+  }
+  if (trad.eddsa) {
+    // node/OpenSSL imports any Ed25519/Ed448 SPKI without validating the point, and a low-order
+    // (e.g. all-zeroes) key verifies a forged signature -- which would collapse the composite AND
+    // to ML-DSA-only. Reject a non-full-order point before verify, through the same shared
+    // edwards-point gate every other EdDSA verify path in the toolkit routes through, surfacing a
+    // coded fault (like the ECDSA order-bound belt) rather than a silent false.
+    if (!edwardsPoint.validate(tradPK, trad.eddsa === "Ed25519" ? 6 : 7)) {
+      throw new E(badSig, "the composite EdDSA component public key is not a valid, full-order Edwards point");
+    }
+    return subtle.importKey("spki", _edSpki(trad.eddsa, tradPK), { name: trad.eddsa }, false, ["verify"])
+      .then(function (k) { return subtle.verify({ name: trad.eddsa }, k, tradSig, mprime); });
+  }
+  if (trad.rsaPss || trad.rsaPkcs1) {
+    // The composite OID fixes the RSA modulus size: a downgraded or mismatched modulus under the
+    // declared OID (an id-MLDSA44-RSA2048-* whose component is really 1024-bit) is rejected BEFORE
+    // verify, so a weak RSA component cannot satisfy an arm that promises 2048/3072/4096 bits. A
+    // malformed RSAPublicKey rejects the same way.
+    var bits;
+    try { bits = _rsaModulusBits(tradPK); }
+    catch (_e) { return Promise.resolve(false); }
+    if (bits !== trad.rsaBits) return Promise.resolve(false);
+    if (trad.rsaPss) {
+      return subtle.importKey("spki", _rsaSpki(tradPK), { name: "RSA-PSS", hash: trad.hash }, false, ["verify"])
+        .then(function (k) { return subtle.verify({ name: "RSA-PSS", saltLength: trad.salt }, k, tradSig, mprime); });
+    }
+    return subtle.importKey("spki", _rsaSpki(tradPK), { name: "RSASSA-PKCS1-v1_5", hash: trad.hash }, false, ["verify"])
+      .then(function (k) { return subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, k, tradSig, mprime); });
+  }
+  // Coverage residual -- unreachable: compositeVerify returns early for a trad.unsupported arm, so
+  // _verifyTradComponent runs only for arms that set exactly one of ec/eddsa/rsaPss/rsaPkcs1.
+  return Promise.resolve(false);
+}
+
+// Verify a composite signature: `spkiBytes` the issuer SPKI DER, `sigBytes` the raw signatureValue
+// (mldsaSig || tradSig), `message` the signed region. `E` the caller's error constructor;
+// `unsupported`/`badSig` its domain codes. Returns { ok, code?, error? } (a false is a verdict).
+function compositeVerify(spkiBytes, sigBytes, message, d, E, unsupported, badSig) {
+  if (d.trad.unsupported) {
+    return Promise.resolve({ ok: false, code: unsupported,
+      error: new E(unsupported, "composite " + d.name + ": " + d.trad.unsupported) });
+  }
+  var rawKey;
+  try {
+    var bs = asn1.read.bitString(asn1.decode(spkiBytes).children[1]);
+    // The composite subjectPublicKey is an octet-aligned concatenation (no unused bits); a non-zero
+    // unused-bit count is malformed.
+    if (bs.unusedBits !== 0) throw new E(badSig, "composite subjectPublicKey has unused bits");
+    rawKey = bs.bytes;
+  } catch (e) { return Promise.resolve({ ok: false, code: _codeOf(e, badSig), error: e }); }
+  // The ML-DSA half is fixed-length and FIRST; the traditional half is the remainder. Both must be
+  // non-empty for a well-formed composite.
+  if (rawKey.length <= d.mldsaPk || sigBytes.length <= d.mldsaSig) {
+    return Promise.resolve({ ok: false, code: badSig,
+      error: new E(badSig, "composite key/signature shorter than the fixed ML-DSA component") });
+  }
+  var mldsaPK = rawKey.subarray(0, d.mldsaPk), tradPK = rawKey.subarray(d.mldsaPk);
+  var mldsaSig = sigBytes.subarray(0, d.mldsaSig), tradSig = sigBytes.subarray(d.mldsaSig);
+  return subtle.digest({ name: d.ph }, message).then(function (phBuf) {
+    var mprime = compositeMprime(d, phBuf);
+    var mldsaP = subtle.importKey("spki", _mldsaSpki(d.mldsaOid, mldsaPK), { name: d.mldsa }, false, ["verify"])
+      .then(function (mk) { return subtle.verify({ name: d.mldsa, context: d.label }, mk, mldsaSig, mprime); });
+    var tradP = _verifyTradComponent(d.trad, tradPK, tradSig, mprime, E, badSig);
+    return Promise.all([mldsaP, tradP]).then(function (r) { return { ok: r[0] === true && r[1] === true }; });
+  }).catch(function (e) { return { ok: false, code: _codeOf(e, badSig), error: e }; });
+}
+
+// Resolve the composite descriptor for a signatureAlgorithm, or null if the OID is not composite.
+// A composite OID MUST carry absent parameters (draft-ietf-lamps-pq-composite-sigs sec. 5.3); the
+// public-key algorithm OID equals the signature OID, so the caller enforces sameKeyOid.
+function resolveCompositeDescriptor(sigAlg, E, unsupported) {
+  var comp = COMPOSITE_ALGS[sigAlg.oid];
+  if (!comp) return null;
+  // Coverage residual -- unreachable through the shipped consumer: the only caller (path-validate)
+  // reaches here with a sigAlg from a parsed structure whose shared AlgorithmIdentifier decoder
+  // already rejects a composite OID carrying parameters (the _PARAMS_ABSENT gate), so `parameters`
+  // is always absent here. Kept as defense-in-depth. (CMS does its own inline params check.)
+  if (sigAlg.parameters !== null && sigAlg.parameters !== undefined) {
+    throw new E(unsupported, "composite signature algorithm parameters must be absent (draft-ietf-lamps-pq-composite-sigs sec. 5.3)");
+  }
+  return { composite: comp, sameKeyOid: true };
+}
+
+// Sign a composite signature over `message`: `keys` = { mldsa, trad } component private keys as
+// PKCS#8 DER (Node has no composite private-key type). Signs the ML-DSA half over M' with ctx =
+// the composite Label (the same domain-separated preimage compositeVerify reconstructs), signs the
+// traditional half over M', and returns mldsaSig || tradSig. The caller rejects an unsupported arm
+// before calling (d.trad.unsupported).
+function compositeSign(d, keys, message, ctx) {
+  return subtle.digest({ name: d.ph }, message).then(function (phBuf) {
+    var mprime = compositeMprime(d, phBuf, ctx);
+    var mldsaP = subtle.importKey("pkcs8", keys.mldsa, { name: d.mldsa }, false, ["sign"])
+      .then(function (k) { return subtle.sign({ name: d.mldsa, context: d.label }, k, mprime); });
+    var tradP = _signTradComponent(d.trad, keys.trad, mprime);
+    return Promise.all([mldsaP, tradP]).then(function (s) { return Buffer.concat([Buffer.from(s[0]), Buffer.from(s[1])]); });
+  });
+}
+function _signTradComponent(trad, pkcs8, mprime) {
+  if (trad.ec) {
+    return subtle.importKey("pkcs8", pkcs8, { name: "ECDSA", namedCurve: trad.ec }, false, ["sign"])
+      .then(function (k) { return subtle.sign({ name: "ECDSA", hash: trad.hash }, k, mprime); })
+      // WebCrypto emits P1363 r||s; the composite trad-ECDSA signature is DER Ecdsa-Sig-Value, so
+      // re-encode through the shared canonical-DER gate (the inverse of the verify path's read).
+      .then(function (raw) { var r = Buffer.from(raw); return validator.sig.rawToEcdsaDer(r, r.length / 2); });
+  }
+  if (trad.eddsa) {
+    return subtle.importKey("pkcs8", pkcs8, { name: trad.eddsa }, false, ["sign"])
+      .then(function (k) { return subtle.sign({ name: trad.eddsa }, k, mprime); }).then(function (s) { return Buffer.from(s); });
+  }
+  var imp = trad.rsaPss ? { name: "RSA-PSS", hash: trad.hash } : { name: "RSASSA-PKCS1-v1_5", hash: trad.hash };
+  var alg = trad.rsaPss ? { name: "RSA-PSS", saltLength: trad.salt } : { name: "RSASSA-PKCS1-v1_5" };
+  return subtle.importKey("pkcs8", pkcs8, imp, false, ["sign"]).then(function (k) { return subtle.sign(alg, k, mprime); }).then(function (s) { return Buffer.from(s); });
+}
+
+module.exports = {
+  COMPOSITE_ALGS: COMPOSITE_ALGS,
+  compositeVerify: compositeVerify,
+  resolveCompositeDescriptor: resolveCompositeDescriptor,
+  compositeMprime: compositeMprime,
+  compositeSign: compositeSign,
+};

package/lib/edwards-point.js

@@ -18,6 +18,8 @@
 // Pure BigInt modular arithmetic (constant-time is not a goal here: the input is a public
 // key, and the verdict is a public validity bit, not a secret).
 
+var asn1 = require("./asn1-der");
+
 // ---- field parameters ------------------------------------------------------
 var P25519 = (1n << 255n) - 19n;
 // d = -121665 / 121666 (mod p); sqrt(-1) = 2^((p-1)/4) (mod p).
@@ -88,4 +90,21 @@ function validate(raw, crv) {
   return true;
 }
 
-module.exports = { validate: validate };
+// validateSpki(spkiBytes, crv, E, code) -> throws new E(code, ...) unless the
+// SubjectPublicKeyInfo's subjectPublicKey (its BIT STRING body, past the unused-bits octet) is a
+// canonical, on-curve, full-order Edwards point for the OKP curve (6 = Ed25519, 7 = Ed448). This
+// is the one home every EdDSA verify path routes an SPKI through before importKey/verify -- node
+// imports a low-order (e.g. all-zeroes) OKP SPKI without complaint and such a key verifies a
+// forged signature. Error-parameterized like the guard family: the caller passes its own typed
+// error CONSTRUCTOR `E` and domain `code`, so the shared gate keeps no error domain of its own.
+function validateSpki(spkiBytes, crv, E, code) {
+  var point;
+  try {
+    point = asn1.decode(spkiBytes).children[1].content.subarray(1);
+  } catch (e) { throw new E(code, "the EdDSA public key is not a well-formed SubjectPublicKeyInfo", e); }
+  if (!validate(point, crv)) {
+    throw new E(code, "the EdDSA public key is not a valid, full-order Edwards point");
+  }
+}
+
+module.exports = { validate: validate, validateSpki: validateSpki };

package/lib/inspect.js

@@ -63,6 +63,12 @@ function _hexColon(buf, opts) {
   return lines.join("\n");
 }
 
+// Coverage residual -- two _hexColon default arms are unreachable through the public API:
+//   * `opts = opts || {}` -- all call sites pass an explicit opts object literal, so the
+//     `|| {}` default never fires.
+//   * `" ".repeat(opts.indent || 0)` -- every wrap-mode caller passes a positive indent
+//     (pad.length + 8 >= 8, or inner.length == 16), so `opts.indent` is never falsy.
+
 // Control-byte neutralization for a GeneralName string value routes through the
 // guard family (the guard-shape-reinlined detector protects the shape).
 // @guard-via guard\.name\.escape
@@ -217,6 +223,28 @@ function _gnRaw(buf) {
   } catch (_e) { return _hexColon(buf, {}); }
 }
 
+// Coverage residual -- the GeneralName render fallbacks are unreachable because the strict
+// generalName decoder and each caller already narrow the shape (the _gnRaw catch above is
+// separately documented):
+//   * _ipString `if (!Buffer.isBuffer(buf)) return "";` -- every caller passes a Buffer (the
+//     recursion slices a Buffer, _gn guards Buffer.isBuffer(g.value), _gnRaw passes
+//     asn1.decode(...).content).
+//   * _ipString trailing `return _hexColon(buf, {});` -- generalName enforces iPAddress to
+//     4/16 octets (8/32 for a name-constraints subtree base), so length is only ever 4/8/16/32.
+//   * _gn `if (!g || typeof g !== "object") return "";` -- every _gn call maps a decoder-produced
+//     GeneralName object; the decoders never emit a null element.
+//   * _gn directoryName `: ((g.value && g.value.dn) || "")` -- a decoded directoryName [4] always
+//     carries a Name with an rdns array, so the rdns arm is always taken.
+//   * _gn otherName `: "<unsupported>"` -- a decoded GeneralName always carries its raw bytes TLV.
+//   * _gn `|| ("tag" + t)` -- GeneralName CHOICE tags are 0..8, all mapped in NAMES.GENERAL_NAME;
+//     generalName rejects a tag outside 0..8.
+//   * _gn `? _hexColon(g.value, {})` -- iPAddress [7] is the only choice whose decoded value is a
+//     Buffer, handled at the t === 7 branch before this ternary; other tags' value is string or null.
+//   * _gn trailing `: ""` -- a decoded GeneralName always carries a bytes Buffer, so the
+//     Buffer.isBuffer(g.bytes) arm is always taken.
+//   * _gnRaw `if (!Buffer.isBuffer(buf)) return "";` -- the sole caller (the CRL-DP fullName loop)
+//     guards Buffer.isBuffer(nm) before calling _gnRaw.
+
 // Shared value renderers reused by more than one extension key.
 function _renderAltName(decoded, inner) {
   return inner + (decoded.names || []).map(_gn).join(", ");
@@ -254,6 +282,18 @@ function _renderCrlDp(decoded, inner) {
   return dpLines.join("\n");
 }
 
+// Coverage residual -- the shared alt-name / CRL-DP render fallbacks are unreachable because the
+// strict decoders already narrow the shape:
+//   * _renderAltName `(decoded.names || [])` -- the subjectAltName/issuerAltName decoder always
+//     yields a names array.
+//   * _renderCrlDp `(decoded || [])` -- the cRLDistributionPoints/freshestCRL decoder always
+//     yields an array.
+//   * _renderCrlDp `: _gn(nm)` -- distributionPointName surfaces fullName entries as raw
+//     GeneralName Buffers, so Buffer.isBuffer(nm) is always true.
+//   * _renderCrlDp `if (!wrote) ... "(distribution point)"` -- crlDistributionPoints throws unless
+//     a distributionPoint (always fullName/rdn) or cRLIssuer (sets wrote) is present, so !wrote
+//     never holds.
+
 // Declarative extension-value renderer registry: extension name -> (decoded, inner) ->
 // text. Data-driven dispatch (the schema family's "registry, not switch" shape) so a
 // new extension is a row rather than another hand-coded branch, and the set an
@@ -365,6 +405,35 @@ var EXT_RENDERERS = {
   },
 };
 
+// Coverage residual -- the EXT_RENDERERS entry fallbacks are unreachable because each shared
+// decoder (and asn1.read.oid) already narrows the shape before the renderer runs:
+//   * extKeyUsage `catch (_e) { /* unregistered EKU OID */ }` and certificatePolicies
+//     `catch (_e) { /* unregistered qualifier */ }` -- oid.name returns undefined (never throws)
+//     for a well-formed unregistered OID; it throws only on a non-dotted argument, and both OIDs
+//     come from asn1.read.oid (always a valid dotted OID).
+//   * certificatePolicies `(asn1.decode(p.qualifiersBytes).children || [])` -- asn1.decode of the
+//     assertPolicyQualifiers-validated qualifiers SEQUENCE always yields a children array.
+//   * certificatePolicies `: Buffer.alloc(0)` -- assertPolicyQualifiers requires every
+//     PolicyQualifierInfo to be a 2-child SEQUENCE, so pqi.children[1] is always a present node
+//     carrying a bytes Buffer.
+//   * certificatePolicies outer `catch (_e) { ... _hexColon(p.qualifiersBytes, {}) ... }` --
+//     certificatePolicies already validated qualifiersBytes as a SEQUENCE of 2-child PQIs each
+//     leading with a valid OID, so the re-decode + asn1.read.oid cannot throw.
+//   * policyConstraints `: inner + "(empty)"` -- policyConstraints rejects an empty SEQUENCE
+//     (>= 1 context field), so requireExplicitPolicy or inhibitPolicyMapping is non-null;
+//     pc.length is never 0.
+//   * SCT `(decoded.scts || [])` / `(decoded.unknownScts || [])` -- ct.parseSctList always returns
+//     both arrays.
+//   * SCT `: 0` -- every scts entry is a decoded v1 SCT with numeric version 0 (unknown-version
+//     SCTs go to unknownScts and are not iterated here).
+//   * SCT `: inner + "(empty SCT list)"` -- ct.parseSctList rejects an empty list and routes every
+//     SerializedSCT into scts/unknownScts, so at least one line is always emitted.
+//   * subjectKeyIdentifier `: (decoded.bytes || Buffer.alloc(0))` -- the subjectKeyIdentifier
+//     decoder returns the KeyIdentifier as a Buffer, so Buffer.isBuffer(decoded) is always true.
+//   * authorityKeyIdentifier `: BigInt(decoded.authorityCertSerialNumber)` -- the AKI decoder reads
+//     authorityCertSerialNumber via asn1.read.integerImplicit (a bigint), so typeof === "bigint"
+//     is always true.
+
 function _renderExtValue(ext, decoded, inner) {
   var fn = EXT_RENDERERS[ext.name];
   return fn ? fn(decoded, inner) : null;   // no registered renderer -> caller hex-dumps
@@ -476,6 +545,8 @@ function certificate(input) {
   L.push("        Subject: " + _dnString(c.subject));
   L.push("        Subject Public Key Info:");
   L.push(_keyBlock(c.subjectPublicKeyInfo, "            "));
+  // Coverage residual -- `c.extensions || []` is unreachable: both input paths guarantee an array
+  // (x509.parse yields one; the pre-parsed fast path requires Array.isArray(extensions) in _looksParsed).
   if ((c.extensions || []).length) {
     L.push("        X509v3 extensions:");
     c.extensions.forEach(function (ext) { L.push(_extension(ext, "            ")); });

package/lib/jose.js

@@ -39,6 +39,7 @@ var constants = require("./constants");
 var webcrypto = require("./webcrypto").webcrypto;
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
+var edwardsPoint = require("./edwards-point");
 
 var JoseError = frameworkError.JoseError;
 function E(code, message, cause) { return new JoseError(code, message, cause); }
@@ -267,6 +268,12 @@ function _assertKeyType(algRow, jwk) {
   if (jwk.kty !== algRow.kty) throw E("jose/bad-alg", "the key type " + JSON.stringify(jwk.kty) + " does not match the algorithm");
   if (algRow.kty === "EC" && jwk.crv !== algRow.crv) throw E("jose/bad-alg", "the EC curve does not match the algorithm");
   if (algRow.kty === "OKP" && jwk.crv !== "Ed25519" && jwk.crv !== "Ed448") throw E("jose/bad-alg", "unsupported OKP curve " + JSON.stringify(jwk.crv));
+  // node/OpenSSL import a low-order (e.g. identity) OKP point without complaint and it verifies a
+  // forged signature; reject a non-full-order Edwards point through the shared gate, the same check
+  // every EdDSA verify path in the toolkit applies.
+  if (algRow.kty === "OKP" && typeof jwk.x === "string" && !edwardsPoint.validate(b64uDecode(jwk.x), jwk.crv === "Ed25519" ? 6 : 7)) {
+    throw E("jose/bad-key", "the OKP public key is not a valid, full-order Edwards point");
+  }
   // An AKP (ML-DSA) JWK carries its parameter set in `alg` (RFC 9964); it MUST match
   // the algorithm's set, or an ML-DSA-44 key could embed an ML-DSA-65 public JWK.
   if (algRow.kty === "AKP" && jwk.alg !== algRow.subtle) throw E("jose/bad-alg", "the AKP parameter set " + JSON.stringify(jwk.alg) + " does not match the algorithm " + algRow.subtle);

package/lib/oid.js

@@ -284,7 +284,7 @@ var FAMILIES = {
 
   // NIST hash functions (SHA-2, SHA-3, SHAKE).
   nistHash: { base: [2, 16, 840, 1, 101, 3, 4, 2], of: {
-    sha256: 1, sha384: 2, sha512: 3, "sha3-256": 8, "sha3-512": 10, shake256: 12 } },
+    sha256: 1, sha384: 2, sha512: 3, "sha3-256": 8, "sha3-512": 10, shake128: 11, shake256: 12 } },
 
   // NIST signature algorithms -- FIPS 204 ML-DSA + FIPS 205 SLH-DSA share the
   // signature arc 2.16.840.1.101.3.4.3. RFC 9909 sec. 3 assigns the 12 Pure SLH-DSA