@blamejs/pki 0.2.17 → 0.2.18

package/CHANGELOG.md

@@ -4,7 +4,20 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## v0.2.17 — 2026-07-14
+## v0.2.18 — 2026-07-14
+
+Composite ML-DSA signatures join CMS SignedData: pki.cms.sign and pki.cms.verify now produce and verify a composite SignerInfo -- a post-quantum ML-DSA paired with a traditional RSA, ECDSA, or EdDSA -- accepted only when BOTH components verify.
+
+### Added
+
+- pki.cms.verify verifies, and pki.cms.sign produces, a composite ML-DSA CMS SignerInfo (draft-ietf-lamps-cms-composite-sigs) pairing ML-DSA-44/65/87 with a traditional RSA (PKCS#1 v1.5 or PSS), ECDSA (P-256/384/521), or EdDSA (Ed25519) component. The signature is accepted only when BOTH the post-quantum and traditional components verify over the domain-separated message representative; the digestAlgorithm is the parameter set's paired pre-hash, and the composite public-key OID must match the signatureAlgorithm. Fifteen algorithm arms verify and sign today; the two brainpool-curve arms and the one SHAKE256-pre-hash arm are recognized but fail closed to a typed error (their curve / digest is outside the WebCrypto surface).
+- pki.cms.sign accepts a composite signer as { cert, key: { mldsa, trad } } -- the two component private keys as PKCS#8 -- since a composite private key has no single native representation; it signs both components over the RFC 5652 section 5.4 preimage and emits the fixed-order composite signature the verifier consumes.
+
+### Fixed
+
+- EdDSA (Ed25519 / Ed448) public keys are validated as a canonical, on-curve, full-order Edwards point before any signature is verified with them, across certification-path validation (pki.path.validate) -- a certificate signature or a CRL / OCSP-response signature checked during revocation -- composite CMS SignerInfo components, and JWS verification (pki.jose.verify). A low-order key -- for example the identity point, which the underlying platform imports without complaint and which verifies a forged signature for every message -- is rejected up front, so it can no longer certify a forged certificate chain, forge a CRL or OCSP response, satisfy the traditional half of a composite signature, or make a forged JWS verify. Certificate and revocation verification share one key-import routine, so the check cannot be applied to one surface and skipped on another.
+
+## v0.2.17 — 2026-07-13
 
 Post-quantum SLH-DSA joins CMS SignedData: pki.cms.sign and pki.cms.verify now sign and verify with all twelve FIPS 205 SLH-DSA parameter sets (RFC 9814), freely mixed with the classical and ML-DSA signers in one message.
 

package/README.md

@@ -221,7 +221,7 @@ is callable today; nothing below is a stub.
 | `pki.schema.smime` | Decode S/MIME ESS signed-attribute values (RFC 5035 / RFC 8551) — `parseSigningCertificate` / `parseSigningCertificateV2` bind a signature to its signing certificate (cert hash, hash algorithm, issuer `GeneralNames` + serial), `parseSmimeCapabilities` decodes the ordered capability list, and `decodeAttribute` OID-dispatches a CMS attribute (enforcing the single-value rule, recognize-and-defer for unknown types). A companion decoder for CMS signed attributes, not an auto-routed format, fail-closed — `parseSigningCertificate`, `parseSigningCertificateV2`, `parseSmimeCapabilities`, `decodeAttribute` |
 | `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk` / `encode` / `embeddedDer` plus the schema combinators |
 | `pki.path` | RFC 5280 §6 certification-path validation — `validate` runs the §6.1 state machine (signature chaining across RSA, ECDSA, EdDSA, ML-DSA, SLH-DSA and hybrid composite ML-DSA signatures — a composite is accepted only when **both** its post-quantum and traditional components verify; validity windows, name chaining, basic constraints and path length, key usage, name constraints, the certificate-policy tree) over an ordered path and a trust anchor, returning a structured verdict with per-check reason codes, and enforces a `pki.trust` anchor's per-purpose distrust-after dates and delegator purposes via `checkPurpose`; `crlChecker` supplies CRL-based revocation — including partitioned/sharded CRLs, whose §6.3.3 Distribution Point ↔ IDP correspondence lets a corresponding full-reason shard establish non-revocation — and `ocspChecker` supplies OCSP-based revocation (RFC 6960 — CertID binding, responder authorization, signature, currency) over the same pluggable hook. Pure and re-entrant, fail-closed — `validate`, `crlChecker`, `ocspChecker` |
-| `pki.cms` | RFC 5652 §5 CMS SignedData signing + signature verification — `sign(content, signers, opts)` produces a SignedData (attached or detached, one or many signers, RSA / RSASSA-PSS / ECDSA / EdDSA and the post-quantum ML-DSA-44/65/87 (RFC 9882) and SLH-DSA (all twelve FIPS 205 sets, RFC 9814)); it builds the signed attributes (content-type, message-digest, signing-time) as canonical DER, signs the exact §5.4 preimage, and emits a DER `Buffer` or PEM. `verify(input, opts)` parses a SignedData over the strict `pki.schema.cms` codec, locates each SignerInfo's signer certificate by its issuerAndSerialNumber or subjectKeyIdentifier, and checks the signature over the exact §5.4 preimage: when signed attributes are present it confirms the message-digest attribute equals the content digest and verifies over the DER re-encoding of the SignedAttributes (the on-wire `[0]` tag replaced by a universal SET OF), otherwise directly over the content. It returns a per-signer verdict with the matched signer certificate; it does not chain that certificate to a trust anchor — that is the caller's step through `pki.path.validate`. Fail-closed with typed `cms/*` errors — `sign`, `verify` |
+| `pki.cms` | RFC 5652 §5 CMS SignedData signing + signature verification — `sign(content, signers, opts)` produces a SignedData (attached or detached, one or many signers, RSA / RSASSA-PSS / ECDSA / EdDSA, the post-quantum ML-DSA-44/65/87 (RFC 9882) and SLH-DSA (all twelve FIPS 205 sets, RFC 9814), and composite ML-DSA (pairing ML-DSA with a traditional RSA / ECDSA / EdDSA — accepted only when **both** components verify — draft-ietf-lamps-cms-composite-sigs)); it builds the signed attributes (content-type, message-digest, signing-time) as canonical DER, signs the exact §5.4 preimage, and emits a DER `Buffer` or PEM. `verify(input, opts)` parses a SignedData over the strict `pki.schema.cms` codec, locates each SignerInfo's signer certificate by its issuerAndSerialNumber or subjectKeyIdentifier, and checks the signature over the exact §5.4 preimage: when signed attributes are present it confirms the message-digest attribute equals the content digest and verifies over the DER re-encoding of the SignedAttributes (the on-wire `[0]` tag replaced by a universal SET OF), otherwise directly over the content. It returns a per-signer verdict with the matched signer certificate; it does not chain that certificate to a trust anchor — that is the caller's step through `pki.path.validate`. Fail-closed with typed `cms/*` errors — `sign`, `verify` |
 | `pki.tsp` | RFC 3161 timestamp token creation — `sign(messageImprint, tsa, opts)` produces a TimeStampToken: a CMS SignedData (over `pki.cms.sign`) whose content is a `TSTInfo` carrying the timestamped message imprint, the TSA policy, a serial number, and `genTime` (with optional accuracy / nonce / ordering), plus the RFC 3161 §2.4.2 signing-certificate attribute binding the token to the TSA certificate. The producing side of `pki.schema.tsp.parseToken`; SHA-2 imprints, and any `pki.cms.sign` TSA key — `sign` |
 | `pki.ct` | RFC 6962 Certificate Transparency SCTs — `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries in the SCT extension (a TLS-presentation-language payload inside the §3.3 double DER wrap) into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature; `reconstructSignedData` rebuilds the exact `digitally-signed` preimage; `verifySct` verifies an SCT signature against a log's public key by reconstructing the signed data, routing an ECDSA signature through the strict DER-conformance gate, and verifying through the crypto engine — resolving true or false, and throwing a typed error on a structural fault. Structure decoded, crypto fail-closed — `parseSctList`, `reconstructSignedData`, `verifySct` |
 | `pki.merkle` | RFC 6962 / RFC 9162 Merkle-tree proof verification — `leafHash` / `nodeHash` / `emptyRootHash` build the domain-separated (0x00 leaf / 0x01 node) SHA-256 tree hashes; `verifyInclusion` folds an audit proof back to a root and `verifyConsistency` reconstructs both the old and new root (the append-only guarantee), each constant-time-compared to a trusted checkpoint root. Fail-closed on bad geometry, sync hashing, transport-free — `leafHash`, `nodeHash`, `emptyRootHash`, `verifyInclusion`, `verifyConsistency` |

package/lib/cms-sign.js

@@ -22,6 +22,7 @@ var pkix = require("./schema-pkix");
 var webcrypto = require("./webcrypto");
 var subtle = webcrypto.webcrypto.subtle;
 var validator = require("./validator-all");
+var compositeSig = require("./composite-sig");
 var frameworkError = require("./framework-error");
 
 var CmsError = frameworkError.CmsError;
@@ -126,6 +127,17 @@ function _digest(digestName, content) {
 function _scheme(cert, so, noSignedAttrs) {
   var alg = cert.subjectPublicKeyInfo.algorithm;
   var keyOid = alg.oid;
+  var comp = compositeSig.COMPOSITE_ALGS[keyOid];
+  if (comp) {
+    // Composite ML-DSA (draft-ietf-lamps-cms-composite-sigs): the arm DICTATES the CMS
+    // digestAlgorithm (its pre-hash, Table 1) -- unlike RSA/ECDSA the digest is not a caller
+    // choice, so a conflicting so.digestAlgorithm is rejected. The 3 arms Node's WebCrypto surface
+    // cannot sign (brainpool curves; the SHAKE256/64 pre-hash) fail closed at config time -- never
+    // a partial single-component signature.
+    if (comp.trad.unsupported) throw _err("cms/unsupported-algorithm", "composite " + comp.name + ": " + comp.trad.unsupported);
+    if (so.digestAlgorithm && so.digestAlgorithm !== comp.phCms) throw _err("cms/bad-input", "composite " + comp.name + " fixes the digestAlgorithm to " + comp.phCms + " (draft-ietf-lamps-cms-composite-sigs sec. 3.4); " + JSON.stringify(so.digestAlgorithm) + " conflicts");
+    return { composite: comp, digest: comp.phCms, digestAlgId: _algId(comp.phCms, "absent"), sigAlgId: _algId(comp.name, "absent") };
+  }
   if (keyOid === O("rsaEncryption") || keyOid === O("rsassaPss")) {
     var isPssKey = keyOid === O("rsassaPss");
     // An id-RSASSA-PSS key MAY pin its permitted hash in the SPKI params (RFC 4055 sec. 1.2): honor
@@ -242,47 +254,76 @@ function _buildSignerInfo(signer, content, eContentType, opts) {
     : b.sequence([b.raw(_issuerBytes(cert)), b.integer(cert.serialNumber)]);        // IssuerAndSerialNumber
   var version = useSki ? 3 : 1;
 
+  return Promise.resolve().then(function () {
+    if (opts.signedAttributes === false) return content;   // sign the content directly (no signed attributes)
+    // Signed attributes (RFC 5652 sec. 5.3): content-type == eContentType, message-digest ==
+    // digest(content), and (by default) signing-time. build.set canonical-DER SET-OF-sorts them.
+    // Each attribute type appears AT MOST ONCE across the whole set (RFC 5652 sec. 5.3);
+    // `seenTypes` catches a caller-supplied attribute that duplicates a built-in or another.
+    var seenTypes = {};
+    function _pushAttr(typeOid, values) {
+      if (seenTypes[typeOid]) throw _err("cms/bad-input", "signedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + typeOid);
+      seenTypes[typeOid] = 1;
+      attrs.push(b.sequence([b.oid(typeOid), b.set(values)]));
+    }
+    var attrs = [];
+    _pushAttr(O("contentType"), [b.oid(eContentType)]);
+    _pushAttr(O("messageDigest"), [b.octetString(_digest(scheme.digest, content))]);
+    if (opts.signingTime !== false) _pushAttr(O("signingTime"), [_timeValue(opts.signingTime)]);
+    // Caller-supplied signed attributes (e.g. an RFC 3161 signing-certificate attribute): each
+    // { type: <OID name or dotted string>, values: [<DER value Buffer>] }. build.set sorts them in.
+    (opts.additionalSignedAttributes || []).forEach(function (a) {
+      var vals = (a.values || []).map(function (v) { return _toBuf(v, "a signed attribute value"); });
+      if (!vals.length) throw _err("cms/bad-input", "a signed attribute must carry at least one value (RFC 5652 -- Attribute values is SET SIZE (1..MAX))");
+      _pushAttr(/^\d+(\.\d+)+$/.test(a.type) ? a.type : O(a.type), vals);
+    });
+    var setOf = b.set(attrs);   // SET OF (tag 0x31) -- the exact bytes the signature covers (sec. 5.4)
+    var wire = Buffer.from(setOf); wire[0] = 0xA0;   // the on-wire [0] IMPLICIT tag
+    return { setOf: setOf, wire: wire };
+  }).then(function (toSign) {
+    var signedBytes = toSign.setOf ? toSign.setOf : toSign;   // SET-OF form for signing (sec. 5.4)
+    return _signScheme(scheme, so, signedBytes).then(function (sig) {
+      var fields = [b.integer(BigInt(version)), sid, scheme.digestAlgId];
+      if (toSign.wire) fields.push(toSign.wire);              // [0] IMPLICIT signedAttrs
+      fields.push(scheme.sigAlgId, b.octetString(sig));
+      return { si: b.sequence(fields), digestAlgId: scheme.digestAlgId, version: version, certDer: certDer };
+    });
+  });
+}
+
+// Sign the sec. 5.4 preimage under the resolved scheme -> the raw signature bytes for the
+// SignerInfo signature OCTET STRING. The classical path imports the single signer key and signs
+// (re-encoding ECDSA to canonical DER); the composite path signs BOTH component keys over the
+// domain-separated M' and returns mldsaSig || tradSig (composite-sig.js owns the construction).
+function _signScheme(scheme, so, signedBytes) {
+  if (scheme.composite) {
+    return compositeSig.compositeSign(scheme.composite, _normCompositeKeys(so.key, scheme.composite), signedBytes).then(function (sig) { return Buffer.from(sig); });
+  }
   return _importKey(so.key, scheme.imp).then(function (priv) {
-    return Promise.resolve().then(function () {
-      if (opts.signedAttributes === false) return content;   // sign the content directly (no signed attributes)
-      // Signed attributes (RFC 5652 sec. 5.3): content-type == eContentType, message-digest ==
-      // digest(content), and (by default) signing-time. build.set canonical-DER SET-OF-sorts them.
-      // Each attribute type appears AT MOST ONCE across the whole set (RFC 5652 sec. 5.3);
-      // `seenTypes` catches a caller-supplied attribute that duplicates a built-in or another.
-      var seenTypes = {};
-      function _pushAttr(typeOid, values) {
-        if (seenTypes[typeOid]) throw _err("cms/bad-input", "signedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + typeOid);
-        seenTypes[typeOid] = 1;
-        attrs.push(b.sequence([b.oid(typeOid), b.set(values)]));
-      }
-      var attrs = [];
-      _pushAttr(O("contentType"), [b.oid(eContentType)]);
-      _pushAttr(O("messageDigest"), [b.octetString(_digest(scheme.digest, content))]);
-      if (opts.signingTime !== false) _pushAttr(O("signingTime"), [_timeValue(opts.signingTime)]);
-      // Caller-supplied signed attributes (e.g. an RFC 3161 signing-certificate attribute): each
-      // { type: <OID name or dotted string>, values: [<DER value Buffer>] }. build.set sorts them in.
-      (opts.additionalSignedAttributes || []).forEach(function (a) {
-        var vals = (a.values || []).map(function (v) { return _toBuf(v, "a signed attribute value"); });
-        if (!vals.length) throw _err("cms/bad-input", "a signed attribute must carry at least one value (RFC 5652 -- Attribute values is SET SIZE (1..MAX))");
-        _pushAttr(/^\d+(\.\d+)+$/.test(a.type) ? a.type : O(a.type), vals);
-      });
-      var setOf = b.set(attrs);   // SET OF (tag 0x31) -- the exact bytes the signature covers (sec. 5.4)
-      var wire = Buffer.from(setOf); wire[0] = 0xA0;   // the on-wire [0] IMPLICIT tag
-      return { setOf: setOf, wire: wire };
-    }).then(function (toSign) {
-      var signedBytes = toSign.setOf ? toSign.setOf : toSign;   // SET-OF form for signing (sec. 5.4)
-      return subtle.sign(scheme.sign, priv, signedBytes).then(function (sigRaw) {
-        var sig = Buffer.from(sigRaw);
-        if (scheme.ecdsaDer) sig = validator.sig.rawToEcdsaDer(sig, scheme.coordLen);
-        var fields = [b.integer(BigInt(version)), sid, scheme.digestAlgId];
-        if (toSign.wire) fields.push(toSign.wire);              // [0] IMPLICIT signedAttrs
-        fields.push(scheme.sigAlgId, b.octetString(sig));
-        return { si: b.sequence(fields), digestAlgId: scheme.digestAlgId, version: version, certDer: certDer };
-      });
+    return subtle.sign(scheme.sign, priv, signedBytes).then(function (sigRaw) {
+      var sig = Buffer.from(sigRaw);
+      if (scheme.ecdsaDer) sig = validator.sig.rawToEcdsaDer(sig, scheme.coordLen);
+      return sig;
     });
   });
 }
 
+// A composite signer key is the two component private keys { mldsa, trad } as PKCS#8 (Node has no
+// single composite key type; the CMS draft is silent on key import). A missing/wrong-typed
+// component fails closed at config time -- never a partial single-component signature.
+function _normCompositeKeys(key, comp) {
+  if (!key || typeof key !== "object" || Buffer.isBuffer(key) || key instanceof Uint8Array || key.mldsa == null || key.trad == null) {
+    throw _err("cms/bad-input", "a composite " + comp.name + " signer key must be { mldsa: <PKCS#8>, trad: <PKCS#8> }");
+  }
+  return { mldsa: _normPkcs8(key.mldsa, "the composite ML-DSA component key"), trad: _normPkcs8(key.trad, "the composite traditional component key") };
+}
+function _normPkcs8(k, label) {
+  if (Buffer.isBuffer(k)) return k;
+  if (k instanceof Uint8Array) return Buffer.from(k);
+  if (typeof k === "string") { try { return pkcs8.pemDecode(k); } catch (e) { throw _err("cms/bad-input", label + " PEM could not be decoded", e); } }
+  throw _err("cms/bad-input", label + " must be a PKCS#8 DER Buffer, Uint8Array, or PEM string");
+}
+
 // A signing-time Time value: UTCTime before 2050, GeneralizedTime from 2050 (RFC 5652 sec. 11.3 /
 // RFC 5280 sec. 4.1.2.5). A caller Date overrides; false omits the attribute (handled above).
 function _timeValue(when) {

package/lib/cms-verify.js

@@ -13,9 +13,11 @@
  *   confirms the message-digest attribute equals the digest of the content and verifies the
  *   signature over the DER re-encoding of the SignedAttributes (the on-wire `[0]` tag replaced
  *   by a universal SET OF); otherwise it verifies directly over the content. Attached and
- *   detached content, single and multiple signers, and RSA / RSASSA-PSS / ECDSA / EdDSA and the
- *   post-quantum ML-DSA (ML-DSA-44/65/87, RFC 9882) plus SLH-DSA (the twelve FIPS 205 sets, RFC 9814)
- *   are covered. It reports a per-signer verdict;
+ *   detached content, single and multiple signers, and RSA / RSASSA-PSS / ECDSA / EdDSA, the
+ *   post-quantum ML-DSA (ML-DSA-44/65/87, RFC 9882) and SLH-DSA (the twelve FIPS 205 sets, RFC 9814),
+ *   and composite ML-DSA (pairing ML-DSA with a traditional RSA / ECDSA / EdDSA, accepted only when
+ *   BOTH components verify -- draft-ietf-lamps-cms-composite-sigs) are covered. It reports a
+ *   per-signer verdict;
  *   it does NOT chain the signer certificate to a trust anchor -- that is the caller's step through
  *   `pki.path.validate`.
  * @spec RFC 5652
@@ -36,6 +38,7 @@ var cmsSign = require("./cms-sign");
 var MLDSA_SUITABLE_DIGEST = cmsSign.MLDSA_SUITABLE_DIGEST;   // shared sign/verify digest-strength policy (RFC 9882 sec. 3.3)
 var SLHDSA_BY_OID = cmsSign.SLHDSA_BY_OID;                   // shared SLH-DSA set -> { wc, digest } (RFC 9814 sec. 4 pinned digest)
 var validator = require("./validator-all");
+var compositeSig = require("./composite-sig");
 var guard = require("./guard-all");
 var frameworkError = require("./framework-error");
 
@@ -266,18 +269,11 @@ function _verifySignature(scheme, hashName, sigBytes, spki, signedBytes, curveOi
     .then(function (k) { return subtle.verify({ name: scheme.name }, k, sigBytes, signedBytes); });
 }
 
-// The raw Edwards point an OKP SPKI carries (its BIT STRING body, past the unused-bits octet)
-// MUST be a valid, canonical, full-order point -- reject an off-curve or low-order key before
-// it verifies a signature (WebCrypto import does not check it). Curve from the WebCrypto name.
+// The EdDSA signer key's point MUST be a valid, canonical, full-order Edwards point -- reject an
+// off-curve or low-order key before it verifies a signature (WebCrypto import does not check it).
+// Routed through the shared edwards-point gate every EdDSA verify path uses; curve from the name.
 function _requireValidEdPoint(spkiBytes, name) {
-  var content;
-  try {
-    content = asn1.decode(spkiBytes).children[1].content;
-  } catch (e) { throw _err("cms/bad-signature", "the EdDSA public key is not a well-formed SPKI", e); }
-  var point = content && content.length ? content.subarray(1) : Buffer.alloc(0);
-  if (!edwardsPoint.validate(point, name === "Ed25519" ? 6 : 7)) {
-    throw _err("cms/bad-signature", "the EdDSA public key is not a valid, full-order Edwards point");
-  }
+  edwardsPoint.validateSpki(spkiBytes, name === "Ed25519" ? 6 : 7, CmsError, "cms/bad-signature");
 }
 
 // The EC named-curve OID carried in a signer cert's SubjectPublicKeyInfo, or null (non-EC).
@@ -308,6 +304,11 @@ function _decodeSignedAttrs(setOfBytes) {
 // Verify one SignerInfo. Returns { ok, sid, cert, ... } -- a resolved false is a verdict; a
 // structural failure carries a code.
 function _verifyOne(si, content, eContentType, parsedCerts) {
+  // A composite ML-DSA SignerInfo (draft-ietf-lamps-cms-composite-sigs) is keyed by its composite
+  // OID, not a SIG_SCHEME name; intercept it before the classical dispatch (its verify has no
+  // single external signature hash, so it never routes through the SIG_SCHEME/sigHash gate below).
+  var composite = compositeSig.COMPOSITE_ALGS[si.signatureAlgorithm.oid];
+  if (composite) return _verifyComposite(si, composite, content, eContentType, parsedCerts);
   var scheme = SIG_SCHEME[si.signatureAlgorithm.name];
   if (!scheme) return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "unsupported signature algorithm " + JSON.stringify(si.signatureAlgorithm.name) });
   var digestHash = DIGEST_HASH[si.digestAlgorithm.name];
@@ -355,6 +356,17 @@ function _verifyOne(si, content, eContentType, parsedCerts) {
   if (!signers.length) return Promise.resolve({ ok: false, code: "cms/signer-cert-not-found", sid: si.sid, message: "no certificate matches this SignerInfo's signer identifier" });
   var sigBytes = _toBuf(si.signature, "the SignerInfo signature");
 
+  return _computeSignedBytes(si, content, eContentType).then(function (signedBytes) {
+    if (signedBytes && signedBytes.mismatch) return { ok: false, code: signedBytes.mismatch.code, sid: si.sid, cert: signers[0].der, message: signedBytes.mismatch.message };
+    return _verifyAgainstCandidates(scheme, sigHash, sigBytes, signedBytes, si.sid, signers, pss ? pss.saltLength : 0, scheme.sameKeyOid ? oid.byName(si.signatureAlgorithm.name) : null);
+  });
+}
+
+// The exact bytes the signature covers (RFC 5652 sec. 5.4), shared by the classical and composite
+// verify paths so both bind the message-digest / content-type checks to the VERIFIED preimage (not
+// the caller-mutable parsed si.signedAttrs). Resolves the signed bytes, or { mismatch } when a
+// content-type / message-digest attribute disagrees.
+function _computeSignedBytes(si, content, eContentType) {
   return Promise.resolve().then(function () {
     if (!si.signedAttrsBytes) return content;   // no signed attributes: sign over the content directly
     // With signed attributes: decode them from the EXACT bytes the signature covers -- the
@@ -389,12 +401,79 @@ function _verifyOne(si, content, eContentType, parsedCerts) {
       if (!d.equals(declared)) return { mismatch: { code: "cms/message-digest-mismatch", message: "the message-digest attribute does not match the content digest" } };
       return reTagged;
     });
-  }).then(function (signedBytes) {
+  });
+}
+
+// Verify a composite ML-DSA SignerInfo (draft-ietf-lamps-cms-composite-sigs). The composite
+// verify engine lives in composite-sig.js (shared with certification-path validation); this branch
+// enforces the CMS-specific rules the X.509 path does not: params-absent on the signatureAlgorithm
+// (sec. 3.4, defense-in-depth over the parse-time _PARAMS_ABSENT gate), the unsupported-arm refusal,
+// and the sec. 3.4/sec. 5 coherence gate binding the SignerInfo digestAlgorithm to the arm's Table-1
+// pre-hash. It reuses the sec. 5.4 preimage + message-digest binding UNCHANGED, then dispatches
+// compositeVerify per candidate certificate (BOTH components must verify -- never an AND->OR
+// downgrade).
+function _verifyComposite(si, comp, content, eContentType, parsedCerts) {
+  if (si.signatureAlgorithm.parameters !== null && si.signatureAlgorithm.parameters !== undefined) {
+    return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the composite signatureAlgorithm parameters must be absent (draft-ietf-lamps-cms-composite-sigs sec. 3.4)" });
+  }
+  // The 3 arms Node's WebCrypto surface cannot verify (brainpool curves; the SHAKE256/64 pre-hash)
+  // fail closed -- never a silent single-component accept (the AND->OR downgrade this feature prevents).
+  if (comp.trad.unsupported) {
+    return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "composite " + comp.name + ": " + comp.trad.unsupported });
+  }
+  // draft sec. 3.4: for a composite SignerInfo the digestAlgorithm parameters MUST be OMITTED
+  // (id-sha256/id-sha512 and id-shake256) -- stricter than the generic RFC 5754 absent-OR-NULL rule
+  // (which the classical/ML-DSA paths follow), because the composite draft explicitly requires the
+  // field omitted. A present parameter -- even a DER NULL -- is non-conformant and fails closed
+  // (it is outside the signed preimage, so a parser differential must not verify).
+  var dp = si.digestAlgorithm.parameters;
+  if (dp !== null && dp !== undefined) {
+    return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the composite " + si.digestAlgorithm.name + " digestAlgorithm parameters must be omitted (draft-ietf-lamps-cms-composite-sigs sec. 3.4)" });
+  }
+  // sec. 3.4 / sec. 5 (the one CMS-specific MUST the X.509 path does not cover): the SignerInfo
+  // digestAlgorithm MUST equal the arm's pre-hash (Table 1) -- compositeVerify takes the pre-hash
+  // from the OID-keyed descriptor, so a disagreeing digestAlgorithm would recompute the
+  // message-digest attribute under the WRONG algorithm. The sec. 5 SHOULD-reject is taken
+  // fail-closed; the MAY-verify-anyway leniency is deliberately not taken.
+  if (si.digestAlgorithm.name !== comp.phCms) {
+    return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the SignerInfo digestAlgorithm " + JSON.stringify(si.digestAlgorithm.name) + " is not the composite " + comp.name + " pre-hash " + JSON.stringify(comp.phCms) + " (draft-ietf-lamps-cms-composite-sigs sec. 3.4)" });
+  }
+  var signers = _findSignerCerts(si.sid, parsedCerts);
+  if (!signers.length) return Promise.resolve({ ok: false, code: "cms/signer-cert-not-found", sid: si.sid, message: "no certificate matches this SignerInfo's signer identifier" });
+  var sigBytes = _toBuf(si.signature, "the SignerInfo signature");
+  return _computeSignedBytes(si, content, eContentType).then(function (signedBytes) {
     if (signedBytes && signedBytes.mismatch) return { ok: false, code: signedBytes.mismatch.code, sid: si.sid, cert: signers[0].der, message: signedBytes.mismatch.message };
-    return _verifyAgainstCandidates(scheme, sigHash, sigBytes, signedBytes, si.sid, signers, pss ? pss.saltLength : 0, scheme.sameKeyOid ? oid.byName(si.signatureAlgorithm.name) : null);
+    return _verifyCompositeAgainstCandidates(comp, sigBytes, signedBytes, si.sid, signers, si.signatureAlgorithm.oid);
   });
 }
 
+// Dispatch compositeVerify against EACH matching candidate; the signer is valid iff one candidate
+// verifies both components. A candidate whose SPKI composite OID != the SignerInfo signatureAlgorithm
+// OID is skipped with a precise verdict (RFC 9814 sec. 4 key<->signature agreement); a candidate that
+// returns a structural fault code (bad split length, unsupported) falls through, its code surfaced if
+// none verifies. A clean both-components-checked failure (the AND-downgrade) is a code-less false.
+function _verifyCompositeAgainstCandidates(comp, sigBytes, signedBytes, sid, candidates, expectedKeyOid) {
+  var lastErr = null;
+  function attempt(idx) {
+    if (idx >= candidates.length) {
+      return lastErr ? { ok: false, code: lastErr.code, sid: sid, cert: candidates[0].der, message: lastErr.message }
+        : { ok: false, sid: sid, cert: candidates[0].der };
+    }
+    var c = candidates[idx];
+    if (c.cert.subjectPublicKeyInfo.algorithm.oid !== expectedKeyOid) {
+      lastErr = _err("cms/unsupported-algorithm", "the signer certificate public-key algorithm does not match the SignerInfo signatureAlgorithm");
+      return attempt(idx + 1);
+    }
+    return compositeSig.compositeVerify(c.cert.subjectPublicKeyInfo.bytes, sigBytes, signedBytes, comp, CmsError, "cms/unsupported-algorithm", "cms/bad-signature")
+      .then(function (r) {
+        if (r.ok === true) return { ok: true, sid: sid, cert: c.der };
+        if (r.code) lastErr = (r.error instanceof CmsError) ? r.error : _err(r.code, r.error && r.error.message ? r.error.message : "the composite signature could not be evaluated");
+        return attempt(idx + 1);
+      });
+  }
+  return attempt(0);
+}
+
 /**
  * @primitive  pki.cms.verify
  * @signature  pki.cms.verify(input, opts?) -> Promise<{ valid, signers }>
@@ -412,7 +491,9 @@ function _verifyOne(si, content, eContentType, parsedCerts) {
  * a `code` on a structural failure; `valid` is true when there is at least one signer and
  * every signer verified. RSA (PKCS#1 v1.5 and RSASSA-PSS), ECDSA, EdDSA, and the post-quantum
  * ML-DSA (ML-DSA-44/65/87, RFC 9882) and SLH-DSA (the twelve FIPS 205 sets, RFC 9814) -- pure mode,
- * empty context -- signatures are recognized.
+ * empty context -- signatures are recognized, as is composite ML-DSA
+ * (draft-ietf-lamps-cms-composite-sigs), which pairs ML-DSA with a traditional RSA / ECDSA / EdDSA
+ * and verifies only when BOTH components pass (never an AND-to-OR downgrade).
  *
  * @opts  content  The detached content (a `Buffer`) when the SignedData carries no
  *                 encapsulated eContent. Required for a detached signature.
@@ -459,10 +540,6 @@ function _addCert(out, der) {
 // because an upstream contract already narrows the shape:
 //   * `cert.extensions || []` -- x509.parse always surfaces `extensions` as an array (empty
 //     when absent), so the `|| []` fallback never fires.
-//   * `_requireValidEdPoint`'s SPKI-decode catch and its empty-content `Buffer.alloc(0)`
-//     fallback -- a signer certificate accepted by x509.parse always carries a well-formed,
-//     non-empty SubjectPublicKeyInfo BIT STRING, so the decode never throws and the content is
-//     never empty here.
 //   * `_decodeSignedAttrs`'s `tagNumber !== SET` / `!children` guard -- the caller forces the
 //     leading byte to a universal SET OF before decoding, so `asn1.decode` yields a SET whose
 //     `children` is always an array; the guard is belt-and-suspenders against a future caller.
@@ -485,13 +562,15 @@ function _addCert(out, der) {
  * S/MIME signed mail, RFC 3161 timestamp tokens, and code signing rest on, and exactly what
  * `pki.cms.verify` consumes and OpenSSL `cms -verify` validates. Each `signers[i]` is
  * `{ cert, key, digestAlgorithm?, pss? }`: `cert` the signer certificate (PEM or DER), `key`
- * its private key (a WebCrypto `CryptoKey` or a PKCS#8 DER `Buffer` / PEM string). The
+ * its private key (a WebCrypto `CryptoKey` or a PKCS#8 DER `Buffer` / PEM string; for a composite
+ * ML-DSA signer, the two component keys `{ mldsa, trad }`, each PKCS#8). The
  * signature covers the RFC 5652 sec. 5.4 preimage: with signed attributes (the default) the
  * message-digest attribute is bound to the content digest and the signature is over the
  * canonical DER SET OF SignedAttributes; otherwise over the content directly. RSA (PKCS#1 v1.5
  * and, with `pss`, RSASSA-PSS), ECDSA (P-256/384/521), Ed25519, Ed448, and the post-quantum ML-DSA
  * (ML-DSA-44/65/87, RFC 9882) and SLH-DSA (the twelve FIPS 205 sets, RFC 9814 -- the message digest
- * pinned per parameter set) are covered.
+ * pinned per parameter set) are covered, as is composite ML-DSA (draft-ietf-lamps-cms-composite-sigs)
+ * -- the arm's pre-hash fixes the digestAlgorithm and the two component keys are signed together.
  *
  * @opts  detached          Omit the encapsulated content (a detached signature; the verifier
  *                          supplies the content). Default false.

package/lib/composite-sig.js

@@ -0,0 +1,240 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The composite ML-DSA signature engine
+// (draft-ietf-lamps-pq-composite-sigs for the construction; draft-ietf-lamps-cms-composite-sigs
+// binds it to CMS), shared by certification-path validation (X.509 composite certificates,
+// lib/path-validate.js) and CMS (composite SignerInfo, lib/cms-verify.js / lib/cms-sign.js).
+//
+// A composite signature pairs a post-quantum ML-DSA with a traditional RSA / ECDSA / EdDSA so the
+// signature stays trustworthy if EITHER primitive is later broken. The public key is the raw
+// concatenation mldsaPK || tradPK (sec. 4.1) in the SPKI BIT STRING; the signature is
+// mldsaSig || tradSig (sec. 4.3). Verification (sec. 2) reconstructs
+//   M' = Prefix || Label || len(ctx) || ctx || PH(M),
+// verifies the ML-DSA component over M' with ctx = the composite Label, verifies the traditional
+// component over M' under its own hash, and accepts IFF BOTH pass (THREAT-MODEL: all components
+// must verify -- never an AND-to-OR downgrade). The ML-DSA component is the fixed-length FIRST
+// half; the split point is its length.
+//
+// Error-parameterized like the guard / validator families: each consumer passes its own typed
+// error CONSTRUCTOR `E` and its domain codes (path validation passes PathError + path/*; CMS
+// passes CmsError + cms/*), so the shared engine keeps no domain of its own. compositeVerify keeps
+// the { ok, code, error } verdict shape; the codes are caller-supplied.
+
+var asn1 = require("./asn1-der");
+var oid = require("./oid");
+var webcrypto = require("./webcrypto");
+var validator = require("./validator-all");
+var edwardsPoint = require("./edwards-point");
+var subtle = webcrypto.webcrypto.subtle;
+var _b = asn1.build;
+
+// A caught error's OWN code if it shares the caller's domain prefix (the fallback's namespace,
+// e.g. path/ or cms/), else the fallback -- a foreign code (asn1/*) maps to the fallback so the
+// verdict stays in the caller's error namespace. Mirrors path-validate's original pathCode when
+// the fallback is a path/* code.
+function _codeOf(e, fallback) {
+  var prefix = fallback.slice(0, fallback.indexOf("/") + 1);
+  return (e && typeof e.code === "string" && e.code.indexOf(prefix) === 0) ? e.code : fallback;
+}
+
+var COMPOSITE_PREFIX = Buffer.from("CompositeAlgorithmSignatures2025", "ascii");
+var MLDSA_COMPONENT = {
+  "ML-DSA-44": { pk: 1312, sig: 2420, oid: "id-ml-dsa-44" },
+  "ML-DSA-65": { pk: 1952, sig: 3309, oid: "id-ml-dsa-65" },
+  "ML-DSA-87": { pk: 2592, sig: 4627, oid: "id-ml-dsa-87" },
+};
+var EC_CURVE_OID = { "P-256": "prime256v1", "P-384": "secp384r1", "P-521": "secp521r1" };
+// The WebCrypto pre-hash name (ph) -> the CMS digest-algorithm name (the SignerInfo digestAlgorithm,
+// draft-ietf-lamps-cms-composite-sigs Table 1). The SINGLE source of truth for the CMS binding's
+// digest -- both the verify coherence gate and the sign digestAlgorithm read phCms, never a second
+// name map inlined at the CMS boundary.
+var PH_CMS = { "SHA-256": "sha256", "SHA-512": "sha512", "SHAKE256": "shake256" };
+var COMPOSITE_ALGS = {};
+// _comp(name, mldsa, ph, label, trad). `trad` is exactly one component shape:
+//   { ec, hash } | { eddsa } | { rsaPss, hash, salt } | { rsaPkcs1, hash } |
+//   { unsupported } for the arms Node's WebCrypto surface cannot verify (brainpool
+//   curves; the SHAKE256/64 pre-hash) -- registered + params-guarded, deferred at
+//   verify to the caller's unsupported-algorithm code rather than silently accepted.
+function _comp(name, mldsa, ph, label, trad) {
+  var sz = MLDSA_COMPONENT[mldsa];
+  COMPOSITE_ALGS[oid.byName(name)] = {
+    name: name, mldsa: mldsa, mldsaPk: sz.pk, mldsaSig: sz.sig, mldsaOid: sz.oid,
+    ph: ph, phCms: PH_CMS[ph], label: Buffer.from(label, "ascii"), trad: trad,
+  };
+}
+_comp("id-MLDSA44-RSA2048-PSS-SHA256", "ML-DSA-44", "SHA-256", "COMPSIG-MLDSA44-RSA2048-PSS-SHA256", { rsaPss: true, hash: "SHA-256", salt: 32, rsaBits: 2048 });
+_comp("id-MLDSA44-RSA2048-PKCS15-SHA256", "ML-DSA-44", "SHA-256", "COMPSIG-MLDSA44-RSA2048-PKCS15-SHA256", { rsaPkcs1: true, hash: "SHA-256", rsaBits: 2048 });
+_comp("id-MLDSA44-Ed25519-SHA512", "ML-DSA-44", "SHA-512", "COMPSIG-MLDSA44-Ed25519-SHA512", { eddsa: "Ed25519" });
+_comp("id-MLDSA44-ECDSA-P256-SHA256", "ML-DSA-44", "SHA-256", "COMPSIG-MLDSA44-ECDSA-P256-SHA256", { ec: "P-256", hash: "SHA-256" });
+_comp("id-MLDSA65-RSA3072-PSS-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-RSA3072-PSS-SHA512", { rsaPss: true, hash: "SHA-256", salt: 32, rsaBits: 3072 });
+_comp("id-MLDSA65-RSA3072-PKCS15-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-RSA3072-PKCS15-SHA512", { rsaPkcs1: true, hash: "SHA-256", rsaBits: 3072 });
+_comp("id-MLDSA65-RSA4096-PSS-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-RSA4096-PSS-SHA512", { rsaPss: true, hash: "SHA-384", salt: 48, rsaBits: 4096 });
+_comp("id-MLDSA65-RSA4096-PKCS15-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-RSA4096-PKCS15-SHA512", { rsaPkcs1: true, hash: "SHA-384", rsaBits: 4096 });
+_comp("id-MLDSA65-ECDSA-P256-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-ECDSA-P256-SHA512", { ec: "P-256", hash: "SHA-256" });
+_comp("id-MLDSA65-ECDSA-P384-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-ECDSA-P384-SHA512", { ec: "P-384", hash: "SHA-384" });
+_comp("id-MLDSA65-ECDSA-brainpoolP256r1-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-ECDSA-BP256-SHA512", { unsupported: "brainpoolP256r1 is not in the WebCrypto ECDSA curve set" });
+_comp("id-MLDSA65-Ed25519-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-Ed25519-SHA512", { eddsa: "Ed25519" });
+_comp("id-MLDSA87-ECDSA-P384-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-ECDSA-P384-SHA512", { ec: "P-384", hash: "SHA-384" });
+_comp("id-MLDSA87-ECDSA-brainpoolP384r1-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-ECDSA-BP384-SHA512", { unsupported: "brainpoolP384r1 is not in the WebCrypto ECDSA curve set" });
+_comp("id-MLDSA87-Ed448-SHAKE256", "ML-DSA-87", "SHAKE256", "COMPSIG-MLDSA87-Ed448-SHAKE256", { unsupported: "the SHAKE256/64 pre-hash is not in the WebCrypto digest set" });
+_comp("id-MLDSA87-RSA3072-PSS-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-RSA3072-PSS-SHA512", { rsaPss: true, hash: "SHA-256", salt: 32, rsaBits: 3072 });
+_comp("id-MLDSA87-RSA4096-PSS-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-RSA4096-PSS-SHA512", { rsaPss: true, hash: "SHA-384", salt: 48, rsaBits: 4096 });
+_comp("id-MLDSA87-ECDSA-P521-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-ECDSA-P521-SHA512", { ec: "P-521", hash: "SHA-512" });
+
+// Wrap a raw component public key in the SPKI its WebCrypto import expects, so each half is
+// verified through the SAME import + verify seam the classical path uses (no second parallel
+// verify path). tradPK for RSA is the RSAPublicKey DER; for EC the uncompressed point; for EdDSA
+// the raw public key.
+function _spkiFor(algNode, keyBytes) { return _b.sequence([algNode, _b.bitString(keyBytes, 0)]); }
+function _mldsaSpki(mldsaOid, raw) { return _spkiFor(_b.sequence([_b.oid(oid.byName(mldsaOid))]), raw); }
+function _ecSpki(curve, point) { return _spkiFor(_b.sequence([_b.oid(oid.byName("ecPublicKey")), _b.oid(oid.byName(EC_CURVE_OID[curve]))]), point); }
+function _edSpki(name, raw) { return _spkiFor(_b.sequence([_b.oid(oid.byName(name))]), raw); }
+function _rsaSpki(rsaPub) { return _spkiFor(_b.sequence([_b.oid(oid.byName("rsaEncryption")), _b.nullValue()]), rsaPub); }
+
+// The exact modulus bit length of an RSAPublicKey (SEQUENCE { modulus, exponent }).
+function _rsaModulusBits(rsaPubDer) {
+  return asn1.read.integer(asn1.decode(rsaPubDer).children[0]).toString(2).length;
+}
+
+// M' = Prefix || Label || len(ctx) || ctx || PH(M) (draft sec. 2 / RFC 8410-style domain
+// separation). ctx is a single-octet-length-prefixed application context; X.509 path validation
+// and CMS both use the empty context. Shared by verify AND sign so the two cannot diverge.
+function compositeMprime(d, phBuf, ctx) {
+  ctx = ctx || Buffer.alloc(0);
+  return Buffer.concat([COMPOSITE_PREFIX, d.label, Buffer.from([ctx.length]), ctx, Buffer.from(phBuf)]);
+}
+
+function _verifyTradComponent(trad, tradPK, tradSig, mprime, E, badSig) {
+  if (trad.ec) {
+    // draft sec. 5.1: the EC point MUST be the uncompressed X9.62 form (leading 0x04).
+    // A compressed / hybrid point is a non-conforming composite component encoding.
+    if (tradPK.length < 1 || tradPK[0] !== 0x04) return Promise.resolve(false);
+    return subtle.importKey("spki", _ecSpki(trad.ec, tradPK), { name: "ECDSA" }, false, ["verify"]).then(function (k) {
+      // The traditional ECDSA signature is DER Ecdsa-Sig-Value; convert to P1363 through the shared
+      // order-aware reader that also rejects r/s outside [1,n-1] (CVE-2022-21449).
+      var p1363 = validator.sig.ecdsaDerToP1363(tradSig, trad.ec, E, badSig);
+      return subtle.verify({ name: "ECDSA", hash: trad.hash }, k, p1363, mprime);
+    });
+  }
+  if (trad.eddsa) {
+    // node/OpenSSL imports any Ed25519/Ed448 SPKI without validating the point, and a low-order
+    // (e.g. all-zeroes) key verifies a forged signature -- which would collapse the composite AND
+    // to ML-DSA-only. Reject a non-full-order point before verify, through the same shared
+    // edwards-point gate every other EdDSA verify path in the toolkit routes through, surfacing a
+    // coded fault (like the ECDSA order-bound belt) rather than a silent false.
+    if (!edwardsPoint.validate(tradPK, trad.eddsa === "Ed25519" ? 6 : 7)) {
+      throw new E(badSig, "the composite EdDSA component public key is not a valid, full-order Edwards point");
+    }
+    return subtle.importKey("spki", _edSpki(trad.eddsa, tradPK), { name: trad.eddsa }, false, ["verify"])
+      .then(function (k) { return subtle.verify({ name: trad.eddsa }, k, tradSig, mprime); });
+  }
+  if (trad.rsaPss || trad.rsaPkcs1) {
+    // The composite OID fixes the RSA modulus size: a downgraded or mismatched modulus under the
+    // declared OID (an id-MLDSA44-RSA2048-* whose component is really 1024-bit) is rejected BEFORE
+    // verify, so a weak RSA component cannot satisfy an arm that promises 2048/3072/4096 bits. A
+    // malformed RSAPublicKey rejects the same way.
+    var bits;
+    try { bits = _rsaModulusBits(tradPK); }
+    catch (_e) { return Promise.resolve(false); }
+    if (bits !== trad.rsaBits) return Promise.resolve(false);
+    if (trad.rsaPss) {
+      return subtle.importKey("spki", _rsaSpki(tradPK), { name: "RSA-PSS", hash: trad.hash }, false, ["verify"])
+        .then(function (k) { return subtle.verify({ name: "RSA-PSS", saltLength: trad.salt }, k, tradSig, mprime); });
+    }
+    return subtle.importKey("spki", _rsaSpki(tradPK), { name: "RSASSA-PKCS1-v1_5", hash: trad.hash }, false, ["verify"])
+      .then(function (k) { return subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, k, tradSig, mprime); });
+  }
+  // Coverage residual -- unreachable: compositeVerify returns early for a trad.unsupported arm, so
+  // _verifyTradComponent runs only for arms that set exactly one of ec/eddsa/rsaPss/rsaPkcs1.
+  return Promise.resolve(false);
+}
+
+// Verify a composite signature: `spkiBytes` the issuer SPKI DER, `sigBytes` the raw signatureValue
+// (mldsaSig || tradSig), `message` the signed region. `E` the caller's error constructor;
+// `unsupported`/`badSig` its domain codes. Returns { ok, code?, error? } (a false is a verdict).
+function compositeVerify(spkiBytes, sigBytes, message, d, E, unsupported, badSig) {
+  if (d.trad.unsupported) {
+    return Promise.resolve({ ok: false, code: unsupported,
+      error: new E(unsupported, "composite " + d.name + ": " + d.trad.unsupported) });
+  }
+  var rawKey;
+  try {
+    var bs = asn1.read.bitString(asn1.decode(spkiBytes).children[1]);
+    // The composite subjectPublicKey is an octet-aligned concatenation (no unused bits); a non-zero
+    // unused-bit count is malformed.
+    if (bs.unusedBits !== 0) throw new E(badSig, "composite subjectPublicKey has unused bits");
+    rawKey = bs.bytes;
+  } catch (e) { return Promise.resolve({ ok: false, code: _codeOf(e, badSig), error: e }); }
+  // The ML-DSA half is fixed-length and FIRST; the traditional half is the remainder. Both must be
+  // non-empty for a well-formed composite.
+  if (rawKey.length <= d.mldsaPk || sigBytes.length <= d.mldsaSig) {
+    return Promise.resolve({ ok: false, code: badSig,
+      error: new E(badSig, "composite key/signature shorter than the fixed ML-DSA component") });
+  }
+  var mldsaPK = rawKey.subarray(0, d.mldsaPk), tradPK = rawKey.subarray(d.mldsaPk);
+  var mldsaSig = sigBytes.subarray(0, d.mldsaSig), tradSig = sigBytes.subarray(d.mldsaSig);
+  return subtle.digest({ name: d.ph }, message).then(function (phBuf) {
+    var mprime = compositeMprime(d, phBuf);
+    var mldsaP = subtle.importKey("spki", _mldsaSpki(d.mldsaOid, mldsaPK), { name: d.mldsa }, false, ["verify"])
+      .then(function (mk) { return subtle.verify({ name: d.mldsa, context: d.label }, mk, mldsaSig, mprime); });
+    var tradP = _verifyTradComponent(d.trad, tradPK, tradSig, mprime, E, badSig);
+    return Promise.all([mldsaP, tradP]).then(function (r) { return { ok: r[0] === true && r[1] === true }; });
+  }).catch(function (e) { return { ok: false, code: _codeOf(e, badSig), error: e }; });
+}
+
+// Resolve the composite descriptor for a signatureAlgorithm, or null if the OID is not composite.
+// A composite OID MUST carry absent parameters (draft-ietf-lamps-pq-composite-sigs sec. 5.3); the
+// public-key algorithm OID equals the signature OID, so the caller enforces sameKeyOid.
+function resolveCompositeDescriptor(sigAlg, E, unsupported) {
+  var comp = COMPOSITE_ALGS[sigAlg.oid];
+  if (!comp) return null;
+  // Coverage residual -- unreachable through the shipped consumer: the only caller (path-validate)
+  // reaches here with a sigAlg from a parsed structure whose shared AlgorithmIdentifier decoder
+  // already rejects a composite OID carrying parameters (the _PARAMS_ABSENT gate), so `parameters`
+  // is always absent here. Kept as defense-in-depth. (CMS does its own inline params check.)
+  if (sigAlg.parameters !== null && sigAlg.parameters !== undefined) {
+    throw new E(unsupported, "composite signature algorithm parameters must be absent (draft-ietf-lamps-pq-composite-sigs sec. 5.3)");
+  }
+  return { composite: comp, sameKeyOid: true };
+}
+
+// Sign a composite signature over `message`: `keys` = { mldsa, trad } component private keys as
+// PKCS#8 DER (Node has no composite private-key type). Signs the ML-DSA half over M' with ctx =
+// the composite Label (the same domain-separated preimage compositeVerify reconstructs), signs the
+// traditional half over M', and returns mldsaSig || tradSig. The caller rejects an unsupported arm
+// before calling (d.trad.unsupported).
+function compositeSign(d, keys, message, ctx) {
+  return subtle.digest({ name: d.ph }, message).then(function (phBuf) {
+    var mprime = compositeMprime(d, phBuf, ctx);
+    var mldsaP = subtle.importKey("pkcs8", keys.mldsa, { name: d.mldsa }, false, ["sign"])
+      .then(function (k) { return subtle.sign({ name: d.mldsa, context: d.label }, k, mprime); });
+    var tradP = _signTradComponent(d.trad, keys.trad, mprime);
+    return Promise.all([mldsaP, tradP]).then(function (s) { return Buffer.concat([Buffer.from(s[0]), Buffer.from(s[1])]); });
+  });
+}
+function _signTradComponent(trad, pkcs8, mprime) {
+  if (trad.ec) {
+    return subtle.importKey("pkcs8", pkcs8, { name: "ECDSA", namedCurve: trad.ec }, false, ["sign"])
+      .then(function (k) { return subtle.sign({ name: "ECDSA", hash: trad.hash }, k, mprime); })
+      // WebCrypto emits P1363 r||s; the composite trad-ECDSA signature is DER Ecdsa-Sig-Value, so
+      // re-encode through the shared canonical-DER gate (the inverse of the verify path's read).
+      .then(function (raw) { var r = Buffer.from(raw); return validator.sig.rawToEcdsaDer(r, r.length / 2); });
+  }
+  if (trad.eddsa) {
+    return subtle.importKey("pkcs8", pkcs8, { name: trad.eddsa }, false, ["sign"])
+      .then(function (k) { return subtle.sign({ name: trad.eddsa }, k, mprime); }).then(function (s) { return Buffer.from(s); });
+  }
+  var imp = trad.rsaPss ? { name: "RSA-PSS", hash: trad.hash } : { name: "RSASSA-PKCS1-v1_5", hash: trad.hash };
+  var alg = trad.rsaPss ? { name: "RSA-PSS", saltLength: trad.salt } : { name: "RSASSA-PKCS1-v1_5" };
+  return subtle.importKey("pkcs8", pkcs8, imp, false, ["sign"]).then(function (k) { return subtle.sign(alg, k, mprime); }).then(function (s) { return Buffer.from(s); });
+}
+
+module.exports = {
+  COMPOSITE_ALGS: COMPOSITE_ALGS,
+  compositeVerify: compositeVerify,
+  resolveCompositeDescriptor: resolveCompositeDescriptor,
+  compositeMprime: compositeMprime,
+  compositeSign: compositeSign,
+};

package/lib/edwards-point.js

@@ -18,6 +18,8 @@
 // Pure BigInt modular arithmetic (constant-time is not a goal here: the input is a public
 // key, and the verdict is a public validity bit, not a secret).
 
+var asn1 = require("./asn1-der");
+
 // ---- field parameters ------------------------------------------------------
 var P25519 = (1n << 255n) - 19n;
 // d = -121665 / 121666 (mod p); sqrt(-1) = 2^((p-1)/4) (mod p).
@@ -88,4 +90,21 @@ function validate(raw, crv) {
   return true;
 }
 
-module.exports = { validate: validate };
+// validateSpki(spkiBytes, crv, E, code) -> throws new E(code, ...) unless the
+// SubjectPublicKeyInfo's subjectPublicKey (its BIT STRING body, past the unused-bits octet) is a
+// canonical, on-curve, full-order Edwards point for the OKP curve (6 = Ed25519, 7 = Ed448). This
+// is the one home every EdDSA verify path routes an SPKI through before importKey/verify -- node
+// imports a low-order (e.g. all-zeroes) OKP SPKI without complaint and such a key verifies a
+// forged signature. Error-parameterized like the guard family: the caller passes its own typed
+// error CONSTRUCTOR `E` and domain `code`, so the shared gate keeps no error domain of its own.
+function validateSpki(spkiBytes, crv, E, code) {
+  var point;
+  try {
+    point = asn1.decode(spkiBytes).children[1].content.subarray(1);
+  } catch (e) { throw new E(code, "the EdDSA public key is not a well-formed SubjectPublicKeyInfo", e); }
+  if (!validate(point, crv)) {
+    throw new E(code, "the EdDSA public key is not a valid, full-order Edwards point");
+  }
+}
+
+module.exports = { validate: validate, validateSpki: validateSpki };

package/lib/jose.js

@@ -39,6 +39,7 @@ var constants = require("./constants");
 var webcrypto = require("./webcrypto").webcrypto;
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
+var edwardsPoint = require("./edwards-point");
 
 var JoseError = frameworkError.JoseError;
 function E(code, message, cause) { return new JoseError(code, message, cause); }
@@ -267,6 +268,12 @@ function _assertKeyType(algRow, jwk) {
   if (jwk.kty !== algRow.kty) throw E("jose/bad-alg", "the key type " + JSON.stringify(jwk.kty) + " does not match the algorithm");
   if (algRow.kty === "EC" && jwk.crv !== algRow.crv) throw E("jose/bad-alg", "the EC curve does not match the algorithm");
   if (algRow.kty === "OKP" && jwk.crv !== "Ed25519" && jwk.crv !== "Ed448") throw E("jose/bad-alg", "unsupported OKP curve " + JSON.stringify(jwk.crv));
+  // node/OpenSSL import a low-order (e.g. identity) OKP point without complaint and it verifies a
+  // forged signature; reject a non-full-order Edwards point through the shared gate, the same check
+  // every EdDSA verify path in the toolkit applies.
+  if (algRow.kty === "OKP" && typeof jwk.x === "string" && !edwardsPoint.validate(b64uDecode(jwk.x), jwk.crv === "Ed25519" ? 6 : 7)) {
+    throw E("jose/bad-key", "the OKP public key is not a valid, full-order Edwards point");
+  }
   // An AKP (ML-DSA) JWK carries its parameter set in `alg` (RFC 9964); it MUST match
   // the algorithm's set, or an ML-DSA-44 key could embed an ML-DSA-65 public JWK.
   if (algRow.kty === "AKP" && jwk.alg !== algRow.subtle) throw E("jose/bad-alg", "the AKP parameter set " + JSON.stringify(jwk.alg) + " does not match the algorithm " + algRow.subtle);

package/lib/path-validate.js

@@ -40,6 +40,9 @@ var crl = require("./schema-crl");
 var ocsp = require("./schema-ocsp");
 var guard = require("./guard-all");
 var constants = require("./constants");
+var validator = require("./validator-all");
+var compositeSig = require("./composite-sig");
+var edwardsPoint = require("./edwards-point");
 
 var PathError = errors.PathError;
 function E(code, message, cause) { return new PathError(code, message, cause); }
@@ -114,6 +117,10 @@ function _sig(name, verify, imp, params, ecdsa, sameKeyOid) {
   var entry = { verify: verify, imp: imp, params: params };
   if (ecdsa) entry.ecdsa = true;
   if (sameKeyOid) entry.sameKeyOid = true;
+  // EdDSA descriptors carry the Edwards curve id (6 = Ed25519, 7 = Ed448) so the verify path
+  // validates the issuer point through the shared gate without re-branching on the algorithm name.
+  if (verify.name === "Ed25519") entry.eddsa = 6;
+  else if (verify.name === "Ed448") entry.eddsa = 7;
   SIG_ALGS[oid.byName(name)] = entry;
 }
 // RSASSA-PKCS1-v1_5 -- parameters MUST be NULL.
@@ -151,13 +158,8 @@ HASH_BY_OID[oid.byName("sha256")] = "SHA-256";
 HASH_BY_OID[oid.byName("sha384")] = "SHA-384";
 HASH_BY_OID[oid.byName("sha512")] = "SHA-512";
 
-var CURVE_FIELD_BYTES = { "P-256": 32, "P-384": 48, "P-521": 66 };
-// Curve group orders n -- a valid ECDSA signature has r,s in [1, n-1].
-var CURVE_ORDER = {
-  "P-256": BigInt("0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551"),
-  "P-384": BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973"),
-  "P-521": BigInt("0x01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409"),
-};
+// The order-aware ECDSA DER->P1363 converter + its CURVE_FIELD_BYTES / CURVE_ORDER tables now
+// live in validator-sig.js (validator.sig.ecdsaDerToP1363), shared with the composite engine.
 
 // The algorithm OID of an AlgorithmIdentifier SEQUENCE { algorithm OID,
 // parameters OPTIONAL }. STRICT: a universal SEQUENCE with the OID and AT MOST
@@ -261,20 +263,11 @@ function isDerNull(p) { return p && p.length === 2 && p[0] === 0x05 && p[1] ===
 
 function resolveDescriptor(sigAlg) {
   if (sigAlg.oid === OID_RSA_PSS) return resolveRsaPss(sigAlg.parameters);
-  var comp = COMPOSITE_ALGS[sigAlg.oid];
-  if (comp) {
-    // draft-ietf-lamps-pq-composite-sigs sec. 5.3: parameters MUST be absent.
-    // Coverage residual -- unreachable: every sigAlg reaching resolveDescriptor is a
-    // field of a parsed x509/CRL/OCSP structure, and the shared AlgorithmIdentifier
-    // decoder (schema-pkix) rejects a composite OID carrying parameters at parse time
-    // (oid.paramsMustBeAbsent), so `parameters` is always absent here. Defense in depth.
-    if (sigAlg.parameters !== null && sigAlg.parameters !== undefined) {
-      throw E("path/unsupported-algorithm", "composite signature algorithm parameters must be absent (draft-ietf-lamps-pq-composite-sigs sec. 5.3)");
-    }
-    // The composite public-key algorithm OID equals the signature OID; enforce
-    // the RFC 9814-style key<->signature consistency structurally (sameKeyOid).
-    return { composite: comp, sameKeyOid: true };
-  }
+  // Composite ML-DSA: the OID-keyed registry + the parameters-absent check
+  // (draft-ietf-lamps-pq-composite-sigs sec. 5.3) live in composite-sig.js, shared with
+  // CMS. sameKeyOid enforces the RFC 9814 sec. 4 key<->signature OID consistency.
+  var comp = compositeSig.resolveCompositeDescriptor(sigAlg, PathError, "path/unsupported-algorithm");
+  if (comp) return comp;
   var d = SIG_ALGS[sigAlg.oid];
   if (!d) throw E("path/unsupported-algorithm", "no verify descriptor for signature algorithm " + (sigAlg.name || sigAlg.oid));
   // The signatureAlgorithm's parameters MUST match the algorithm's fixed shape:
@@ -304,177 +297,15 @@ function assertKeyMatchesSigAlg(spkiBytes, sigOid, d) {
   }
 }
 
-// DER Ecdsa-Sig-Value SEQUENCE { r, s } -> fixed-width r||s (P1363), rejecting
-// r or s outside [1, n-1] (CVE-2022-21449 "Psychic Signatures").
-function ecdsaDerToP1363(der, curve) {
-  var width = CURVE_FIELD_BYTES[curve];
-  var order = CURVE_ORDER[curve];
-  // Coverage residual -- unreachable: `curve` is a WebCrypto-imported ECDSA
-  // namedCurve (P-256/384/521) or a composite trad.ec from the same set; all three
-  // are present in the width/order tables, so no import yields an untabulated curve.
-  if (!width || !order) throw E("path/bad-signature", "unsupported ECDSA curve " + curve);
-  var n;
-  try { n = asn1.decode(der); }
-  catch (e) { throw E("path/bad-signature", "ECDSA signature is not a DER SEQUENCE(r,s)", e); }
-  if (n.tagClass !== "universal" || n.tagNumber !== asn1.TAGS.SEQUENCE || !n.children || n.children.length !== 2) {
-    throw E("path/bad-signature", "ECDSA signature must be a SEQUENCE of exactly two INTEGERs");
-  }
-  var r = asn1.read.integer(n.children[0]);
-  var s = asn1.read.integer(n.children[1]);
-  if (r < 1n || s < 1n || r >= order || s >= order) {
-    throw E("path/bad-signature", "ECDSA signature component out of range [1, n-1] (CVE-2022-21449)");
-  }
-  function pad(v) {
-    var hex = v.toString(16);
-    if (hex.length % 2) hex = "0" + hex;
-    var buf = Buffer.from(hex, "hex");
-    // Coverage residual -- unreachable: the preceding [1, order-1] range gate bounds
-    // r and s below the curve order, which fits within `width` bytes.
-    if (buf.length > width) throw E("path/bad-signature", "ECDSA signature component wider than the curve field");
-    var out = Buffer.alloc(width);
-    buf.copy(out, width - buf.length);
-    return out;
-  }
-  return Buffer.concat([pad(r), pad(s)]);
-}
+// ecdsaDerToP1363 relocated to validator-sig.js; the composite trad-ECDSA and classical ECDSA
+// paths call validator.sig.ecdsaDerToP1363(sig, curve, PathError, "path/bad-signature").
 
 // ---- composite ML-DSA signatures (draft-ietf-lamps-pq-composite-sigs) -------
-// A composite signature pairs a post-quantum ML-DSA with a traditional RSA /
-// ECDSA / EdDSA. The public key is the raw concatenation mldsaPK || tradPK
-// (sec. 4.1) in the SPKI BIT STRING; the signature is mldsaSig || tradSig
-// (sec. 4.3) in the signatureValue BIT STRING. Both are surfaced RAW by the
-// x509 parser (no sub-walk). Verification (sec. 2): reconstruct
-//   M' = Prefix || Label || len(ctx) || ctx || PH(M),
-// verify the ML-DSA component over M' with ctx = the composite Label, verify the
-// traditional component over M' under its own hash, and accept IFF BOTH pass
-// (THREAT-MODEL: all components must verify -- never an AND-to-OR downgrade). The
-// ML-DSA component is the fixed-length FIRST half; the split point is its length.
-var COMPOSITE_PREFIX = Buffer.from("CompositeAlgorithmSignatures2025", "ascii");
-var MLDSA_COMPONENT = {
-  "ML-DSA-44": { pk: 1312, sig: 2420, oid: "id-ml-dsa-44" },
-  "ML-DSA-65": { pk: 1952, sig: 3309, oid: "id-ml-dsa-65" },
-  "ML-DSA-87": { pk: 2592, sig: 4627, oid: "id-ml-dsa-87" },
-};
-var EC_CURVE_OID = { "P-256": "prime256v1", "P-384": "secp384r1", "P-521": "secp521r1" };
-var COMPOSITE_ALGS = {};
-// _comp(name, mldsa, ph, label, trad). `trad` is exactly one component shape:
-//   { ec, hash } | { eddsa } | { rsaPss, hash, salt } | { rsaPkcs1, hash } |
-//   { unsupported } for the arms Node's WebCrypto surface cannot verify (brainpool
-//   curves; the SHAKE256/64 pre-hash) -- registered + params-guarded, deferred at
-//   verify to path/unsupported-algorithm rather than silently accepted.
-function _comp(name, mldsa, ph, label, trad) {
-  var sz = MLDSA_COMPONENT[mldsa];
-  COMPOSITE_ALGS[oid.byName(name)] = {
-    name: name, mldsa: mldsa, mldsaPk: sz.pk, mldsaSig: sz.sig, mldsaOid: sz.oid,
-    ph: ph, label: Buffer.from(label, "ascii"), trad: trad,
-  };
-}
-_comp("id-MLDSA44-RSA2048-PSS-SHA256", "ML-DSA-44", "SHA-256", "COMPSIG-MLDSA44-RSA2048-PSS-SHA256", { rsaPss: true, hash: "SHA-256", salt: 32, rsaBits: 2048 });
-_comp("id-MLDSA44-RSA2048-PKCS15-SHA256", "ML-DSA-44", "SHA-256", "COMPSIG-MLDSA44-RSA2048-PKCS15-SHA256", { rsaPkcs1: true, hash: "SHA-256", rsaBits: 2048 });
-_comp("id-MLDSA44-Ed25519-SHA512", "ML-DSA-44", "SHA-512", "COMPSIG-MLDSA44-Ed25519-SHA512", { eddsa: "Ed25519" });
-_comp("id-MLDSA44-ECDSA-P256-SHA256", "ML-DSA-44", "SHA-256", "COMPSIG-MLDSA44-ECDSA-P256-SHA256", { ec: "P-256", hash: "SHA-256" });
-_comp("id-MLDSA65-RSA3072-PSS-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-RSA3072-PSS-SHA512", { rsaPss: true, hash: "SHA-256", salt: 32, rsaBits: 3072 });
-_comp("id-MLDSA65-RSA3072-PKCS15-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-RSA3072-PKCS15-SHA512", { rsaPkcs1: true, hash: "SHA-256", rsaBits: 3072 });
-_comp("id-MLDSA65-RSA4096-PSS-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-RSA4096-PSS-SHA512", { rsaPss: true, hash: "SHA-384", salt: 48, rsaBits: 4096 });
-_comp("id-MLDSA65-RSA4096-PKCS15-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-RSA4096-PKCS15-SHA512", { rsaPkcs1: true, hash: "SHA-384", rsaBits: 4096 });
-_comp("id-MLDSA65-ECDSA-P256-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-ECDSA-P256-SHA512", { ec: "P-256", hash: "SHA-256" });
-_comp("id-MLDSA65-ECDSA-P384-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-ECDSA-P384-SHA512", { ec: "P-384", hash: "SHA-384" });
-_comp("id-MLDSA65-ECDSA-brainpoolP256r1-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-ECDSA-BP256-SHA512", { unsupported: "brainpoolP256r1 is not in the WebCrypto ECDSA curve set" });
-_comp("id-MLDSA65-Ed25519-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-Ed25519-SHA512", { eddsa: "Ed25519" });
-_comp("id-MLDSA87-ECDSA-P384-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-ECDSA-P384-SHA512", { ec: "P-384", hash: "SHA-384" });
-_comp("id-MLDSA87-ECDSA-brainpoolP384r1-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-ECDSA-BP384-SHA512", { unsupported: "brainpoolP384r1 is not in the WebCrypto ECDSA curve set" });
-_comp("id-MLDSA87-Ed448-SHAKE256", "ML-DSA-87", "SHAKE256", "COMPSIG-MLDSA87-Ed448-SHAKE256", { unsupported: "the SHAKE256/64 pre-hash is not in the WebCrypto digest set" });
-_comp("id-MLDSA87-RSA3072-PSS-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-RSA3072-PSS-SHA512", { rsaPss: true, hash: "SHA-256", salt: 32, rsaBits: 3072 });
-_comp("id-MLDSA87-RSA4096-PSS-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-RSA4096-PSS-SHA512", { rsaPss: true, hash: "SHA-384", salt: 48, rsaBits: 4096 });
-_comp("id-MLDSA87-ECDSA-P521-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-ECDSA-P521-SHA512", { ec: "P-521", hash: "SHA-512" });
-
-var _b = asn1.build;
-// Wrap a raw component public key in the SPKI its WebCrypto import expects, so
-// each half is verified through the SAME import + verify seam the classical path
-// uses (no second parallel verify path). tradPK for RSA is the RSAPublicKey DER;
-// for EC the uncompressed point; for EdDSA the raw public key.
-function _spkiFor(algNode, keyBytes) { return _b.sequence([algNode, _b.bitString(keyBytes, 0)]); }
-function _mldsaSpki(mldsaOid, raw) { return _spkiFor(_b.sequence([_b.oid(oid.byName(mldsaOid))]), raw); }
-function _ecSpki(curve, point) { return _spkiFor(_b.sequence([_b.oid(oid.byName("ecPublicKey")), _b.oid(oid.byName(EC_CURVE_OID[curve]))]), point); }
-function _edSpki(name, raw) { return _spkiFor(_b.sequence([_b.oid(oid.byName(name))]), raw); }
-function _rsaSpki(rsaPub) { return _spkiFor(_b.sequence([_b.oid(oid.byName("rsaEncryption")), _b.nullValue()]), rsaPub); }
-
-// The exact modulus bit length of an RSAPublicKey (SEQUENCE { modulus, exponent }).
-function _rsaModulusBits(rsaPubDer) {
-  return asn1.read.integer(asn1.decode(rsaPubDer).children[0]).toString(2).length;
-}
-
-function _verifyTradComponent(trad, tradPK, tradSig, mprime) {
-  if (trad.ec) {
-    // draft sec. 5.1: the EC point MUST be the uncompressed X9.62 form (leading 0x04).
-    // A compressed / hybrid point is a non-conforming composite component encoding.
-    if (tradPK.length < 1 || tradPK[0] !== 0x04) return Promise.resolve(false);
-    return subtle.importKey("spki", _ecSpki(trad.ec, tradPK), { name: "ECDSA" }, false, ["verify"]).then(function (k) {
-      // The traditional ECDSA signature is DER Ecdsa-Sig-Value; convert to P1363
-      // through the shared reader that also rejects r/s outside [1,n-1] (CVE-2022-21449).
-      var p1363 = ecdsaDerToP1363(tradSig, trad.ec);
-      return subtle.verify({ name: "ECDSA", hash: trad.hash }, k, p1363, mprime);
-    });
-  }
-  if (trad.eddsa) {
-    return subtle.importKey("spki", _edSpki(trad.eddsa, tradPK), { name: trad.eddsa }, false, ["verify"])
-      .then(function (k) { return subtle.verify({ name: trad.eddsa }, k, tradSig, mprime); });
-  }
-  if (trad.rsaPss || trad.rsaPkcs1) {
-    // The composite OID fixes the RSA modulus size: a downgraded or mismatched modulus
-    // under the declared OID (an id-MLDSA44-RSA2048-* whose component is really 1024-bit)
-    // is rejected BEFORE verify, so a weak RSA component cannot satisfy an arm that
-    // promises 2048/3072/4096 bits. A malformed RSAPublicKey rejects the same way.
-    var bits;
-    try { bits = _rsaModulusBits(tradPK); }
-    catch (_e) { return Promise.resolve(false); }
-    if (bits !== trad.rsaBits) return Promise.resolve(false);
-    if (trad.rsaPss) {
-      return subtle.importKey("spki", _rsaSpki(tradPK), { name: "RSA-PSS", hash: trad.hash }, false, ["verify"])
-        .then(function (k) { return subtle.verify({ name: "RSA-PSS", saltLength: trad.salt }, k, tradSig, mprime); });
-    }
-    return subtle.importKey("spki", _rsaSpki(tradPK), { name: "RSASSA-PKCS1-v1_5", hash: trad.hash }, false, ["verify"])
-      .then(function (k) { return subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, k, tradSig, mprime); });
-  }
-  // Coverage residual -- unreachable: compositeVerify returns early for a
-  // trad.unsupported arm, so _verifyTradComponent runs only for arms that set
-  // exactly one of ec/eddsa/rsaPss/rsaPkcs1; this final fallthrough is a backstop.
-  return Promise.resolve(false);
-}
-
-// Verify a composite signature: `spkiBytes` the issuer SPKI DER, `sigBytes` the
-// raw signatureValue (mldsaSig || tradSig), `message` the signed region (tbsBytes).
-function compositeVerify(spkiBytes, sigBytes, message, d) {
-  if (d.trad.unsupported) {
-    return Promise.resolve({ ok: false, code: "path/unsupported-algorithm",
-      error: E("path/unsupported-algorithm", "composite " + d.name + ": " + d.trad.unsupported) });
-  }
-  var rawKey;
-  try {
-    var bs = asn1.read.bitString(asn1.decode(spkiBytes).children[1]);
-    // The composite subjectPublicKey is an octet-aligned concatenation (no unused
-    // bits); a non-zero unused-bit count is malformed.
-    if (bs.unusedBits !== 0) throw E("path/bad-signature", "composite subjectPublicKey has unused bits");
-    rawKey = bs.bytes;
-  } catch (e) { return Promise.resolve({ ok: false, code: pathCode(e, "path/bad-signature"), error: e }); }
-  // The ML-DSA half is fixed-length and FIRST; the traditional half is the
-  // remainder. Both must be non-empty for a well-formed composite.
-  if (rawKey.length <= d.mldsaPk || sigBytes.length <= d.mldsaSig) {
-    return Promise.resolve({ ok: false, code: "path/bad-signature",
-      error: E("path/bad-signature", "composite key/signature shorter than the fixed ML-DSA component") });
-  }
-  var mldsaPK = rawKey.subarray(0, d.mldsaPk), tradPK = rawKey.subarray(d.mldsaPk);
-  var mldsaSig = sigBytes.subarray(0, d.mldsaSig), tradSig = sigBytes.subarray(d.mldsaSig);
-  return subtle.digest({ name: d.ph }, message).then(function (phBuf) {
-    // M' = Prefix || Label || len(ctx)=0 || ctx="" || PH(M). In X.509 path
-    // validation the application context is empty (a caller ctx is out of scope).
-    var mprime = Buffer.concat([COMPOSITE_PREFIX, d.label, Buffer.from([0]), Buffer.from(phBuf)]);
-    var mldsaP = subtle.importKey("spki", _mldsaSpki(d.mldsaOid, mldsaPK), { name: d.mldsa }, false, ["verify"])
-      .then(function (mk) { return subtle.verify({ name: d.mldsa, context: d.label }, mk, mldsaSig, mprime); });
-    var tradP = _verifyTradComponent(d.trad, tradPK, tradSig, mprime);
-    return Promise.all([mldsaP, tradP]).then(function (r) { return { ok: r[0] === true && r[1] === true }; });
-  }).catch(function (e) { return { ok: false, code: pathCode(e, "path/bad-signature"), error: e }; });
-}
+// The composite verify/sign engine + the COMPOSITE_ALGS OID-keyed registry live in
+// composite-sig.js (shared with CMS composite SignerInfo). Path validation composes it:
+// resolveDescriptor (above) delegates to compositeSig.resolveCompositeDescriptor, the
+// certificate + OCSP verify paths to compositeSig.compositeVerify, and
+// compositeKeyUsageCheck (below) enforces the sec. 5.2 signature-only keyUsage restriction.
 
 // draft-ietf-lamps-pq-composite-sigs sec. 5.2: a certificate whose SubjectPublicKeyInfo
 // carries a composite ML-DSA OID, IF it has a keyUsage extension, MUST assert at least
@@ -500,6 +331,19 @@ function compositeKeyUsageCheck(cert) {
   return { ok: true };
 }
 
+// Import a descriptor's verification key, validating an EdDSA point FIRST: node/OpenSSL import a
+// low-order (e.g. identity or all-zeroes) Ed25519/Ed448 SPKI without complaint and such a key
+// verifies a forged signature. This is the ONE seam both the certificate path and the revocation
+// (CRL / OCSP-response) path import through, so neither can skip the point gate -- a low-order
+// issuer / responder key fails the caller closed (a rejected promise the caller maps to a bad
+// verdict), never verifying a forged chain or a forged revocation.
+function _importVerifyKey(spkiBytes, d) {
+  try {
+    if (d.eddsa) edwardsPoint.validateSpki(spkiBytes, d.eddsa, PathError, "path/bad-signature");
+  } catch (e) { return Promise.reject(e); }
+  return subtle.importKey("spki", spkiBytes, d.imp, false, ["verify"]);
+}
+
 // Verify cert.signatureValue over cert.tbsBytes with the working public key.
 function builtinVerify(state, cert) {
   var d;
@@ -513,12 +357,12 @@ function builtinVerify(state, cert) {
   // A composite signature verifies its ML-DSA and traditional halves and accepts
   // IFF both pass -- delegated to the composite combinator (which reuses this
   // file's ECDSA range-check + the same import/verify seam).
-  if (d.composite) return compositeVerify(state.workingPublicKey, cert.signatureValue.bytes, cert.tbsBytes, d.composite);
+  if (d.composite) return compositeSig.compositeVerify(state.workingPublicKey, cert.signatureValue.bytes, cert.tbsBytes, d.composite, PathError, "path/unsupported-algorithm", "path/bad-signature");
   var key;
-  return subtle.importKey("spki", state.workingPublicKey, d.imp, false, ["verify"]).then(function (k) {
+  return _importVerifyKey(state.workingPublicKey, d).then(function (k) {
     key = k;
     var sig = cert.signatureValue.bytes;
-    if (d.ecdsa) sig = ecdsaDerToP1363(sig, key.algorithm.namedCurve);
+    if (d.ecdsa) sig = validator.sig.ecdsaDerToP1363(sig, key.algorithm.namedCurve, PathError, "path/bad-signature");
     return subtle.verify(d.verify, key, sig, cert.tbsBytes);
   }).then(function (ok) {
     return { ok: ok === true };
@@ -1365,7 +1209,7 @@ async function validate(path, opts) {
     // draft-ietf-lamps-pq-composite-sigs sec. 5.2: a composite-keyed certificate's
     // keyUsage must be signature-only (no dual-usage). Runs for the target AND every
     // intermediate whose own subject key is composite.
-    if (COMPOSITE_ALGS[cert.subjectPublicKeyInfo.algorithm.oid]) {
+    if (compositeSig.COMPOSITE_ALGS[cert.subjectPublicKeyInfo.algorithm.oid]) {
       var cku = compositeKeyUsageCheck(cert);
       checks.push({ name: "compositeKeyUsage", ok: cku.ok, code: cku.ok ? undefined : cku.code });
       if (!cku.ok) failed = true;
@@ -1946,10 +1790,10 @@ function _verifyWithSpki(sigAlg, rawSig, spkiBytes, tbsBytes) {
   // A composite-signed CRL / OCSP response verifies through the same combinator
   // (both halves must pass) that the certificate path uses -- one composite verify,
   // never a second parallel one.
-  if (d.composite) return compositeVerify(spkiBytes, rawSig, tbsBytes, d.composite).then(function (r) { return r.ok === true; });
-  return subtle.importKey("spki", spkiBytes, d.imp, false, ["verify"]).then(function (key) {
+  if (d.composite) return compositeSig.compositeVerify(spkiBytes, rawSig, tbsBytes, d.composite, PathError, "path/unsupported-algorithm", "path/bad-signature").then(function (r) { return r.ok === true; });
+  return _importVerifyKey(spkiBytes, d).then(function (key) {
     var sig = rawSig;
-    if (d.ecdsa) sig = ecdsaDerToP1363(sig, key.algorithm.namedCurve);
+    if (d.ecdsa) sig = validator.sig.ecdsaDerToP1363(sig, key.algorithm.namedCurve, PathError, "path/bad-signature");
     return subtle.verify(d.verify, key, sig, tbsBytes);
   }).then(function (ok) { return ok === true; }, function () { return false; });
 }
@@ -2113,7 +1957,7 @@ async function ocspAuthorizeResponder(basicResponse, cert, issuer, issuerKeyBits
     // A composite-keyed delegate is an out-of-path signer cert and gets the same
     // composite keyUsage gate the path certificates do (draft sec. 5.2): a dual-usage
     // composite responder key (a forbidden encryption bit set) is not authorized.
-    if (COMPOSITE_ALGS[rc.subjectPublicKeyInfo.algorithm.oid] && !compositeKeyUsageCheck(rc).ok) continue;
+    if (compositeSig.COMPOSITE_ALGS[rc.subjectPublicKeyInfo.algorithm.oid] && !compositeKeyUsageCheck(rc).ok) continue;
     return ocspResponderSpki(rc, issuer);
   }
   return null;

package/lib/validator-sig.js

@@ -71,4 +71,51 @@ function rawToEcdsaDer(raw, coordLen) {
   return asn1.build.sequence([asn1.build.integer(r), asn1.build.integer(s)]);
 }
 
-module.exports = { ecdsaSigToRaw: ecdsaSigToRaw, rawToEcdsaDer: rawToEcdsaDer };
+// The curve group orders n -- a valid ECDSA signature has r, s in [1, n-1].
+var CURVE_FIELD_BYTES = { "P-256": 32, "P-384": 48, "P-521": 66 };
+var CURVE_ORDER = {
+  "P-256": BigInt("0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551"),
+  "P-384": BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973"),
+  "P-521": BigInt("0x01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409"),
+};
+
+// ecdsaDerToP1363(der, curve, E, code) -> the DER ECDSA-Sig-Value converted to raw r||s (P1363),
+// each coordinate left-padded to the curve field width, rejecting r or s outside [1, n-1] against
+// the curve ORDER (CVE-2022-21449 "Psychic Signatures" -- the r/s = 0 case AND the >= n upper
+// bound). `curve` is a WebCrypto namedCurve (P-256/384/521). This is the ORDER-AWARE gate a
+// verifier that knows the curve order MUST use; it is STRICTER than ecdsaSigToRaw above, which
+// bounds r/s only by the field SIZE (>= 1, <= coordLen bytes) and does not know the order. A
+// signature whose r or s is >= n is rejected here but passes ecdsaSigToRaw -- do not conflate them.
+// @enforced-by behavioral -- the RED conformance vectors (r/s = 0, r/s >= n, non-minimal, over-size)
+// and the composite-signature + path-validation KATs are the guard.
+function ecdsaDerToP1363(der, curve, E, code) {
+  var width = CURVE_FIELD_BYTES[curve];
+  var order = CURVE_ORDER[curve];
+  if (!width || !order) throw new E(code, "unsupported ECDSA curve " + curve);
+  var n;
+  try { n = asn1.decode(der); }
+  catch (e) { throw new E(code, "ECDSA signature is not a DER SEQUENCE(r,s)", e); }
+  if (n.tagClass !== "universal" || n.tagNumber !== asn1.TAGS.SEQUENCE || !n.children || n.children.length !== 2) {
+    throw new E(code, "ECDSA signature must be a SEQUENCE of exactly two INTEGERs");
+  }
+  var r = asn1.read.integer(n.children[0]);
+  var s = asn1.read.integer(n.children[1]);
+  if (r < 1n || s < 1n || r >= order || s >= order) {
+    throw new E(code, "ECDSA signature component out of range [1, n-1] (CVE-2022-21449)");
+  }
+  function pad(v) {
+    var hex = v.toString(16);
+    if (hex.length % 2) hex = "0" + hex;
+    var buf = Buffer.from(hex, "hex");
+    // Coverage residual -- unreachable: a component needing more than `width` bytes is >=
+    // 2^(8*width) > n (the curve order n < 2^(8*width) for P-256/384/521), so it is already
+    // rejected by the r/s >= order check above; this width guard is a defense-in-depth backstop.
+    if (buf.length > width) throw new E(code, "ECDSA signature component wider than the curve field");
+    var out = Buffer.alloc(width);
+    buf.copy(out, width - buf.length);
+    return out;
+  }
+  return Buffer.concat([pad(r), pad(s)]);
+}
+
+module.exports = { ecdsaSigToRaw: ecdsaSigToRaw, rawToEcdsaDer: rawToEcdsaDer, ecdsaDerToP1363: ecdsaDerToP1363 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.2.17",
+  "version": "0.2.18",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:e4cc4e90-fbb7-4869-9baf-d6ce16b67d7f",
+  "serialNumber": "urn:uuid:bec63d3e-7332-4a32-bcc8-ac8614e7402a",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-14T04:28:56.898Z",
+    "timestamp": "2026-07-14T07:20:40.274Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.2.17",
+      "bom-ref": "@blamejs/pki@0.2.18",
       "type": "application",
       "name": "pki",
-      "version": "0.2.17",
+      "version": "0.2.18",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.2.17",
+      "purl": "pkg:npm/%40blamejs/pki@0.2.18",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.2.17",
+      "ref": "@blamejs/pki@0.2.18",
       "dependsOn": []
     }
   ]