@blamejs/pki 0.2.17 → 0.2.19

package/CHANGELOG.md

@@ -4,7 +4,34 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## v0.2.17 — 2026-07-14
+## v0.2.19 — 2026-07-14
+
+The RFC 3161 Time-Stamp Protocol surface is complete: pki.tsp.request and pki.tsp.response build and parse the protocol's request and response messages, and pki.tsp.verify verifies a timestamp token end to end -- the CMS signature, the message imprint, the ESSCertID(V2) certificate binding, the critical timeStamping-only extendedKeyUsage, and full validation of the TSA certificate at the token's own genTime.
+
+### Added
+
+- pki.tsp.request builds an RFC 3161 TimeStampReq around a message imprint, with the optional nonce, requested TSA policy, certReq, and extensions -- canonical DER, the DEFAULT-FALSE certReq omitted unless true -- and pki.tsp.parseRequest parses one (a new TimeStampReq decoder, also exposed as pki.schema.tsp.parseRequest). pki.tsp.response builds a TimeStampResp -- a granted status wrapping the token pki.tsp.sign produces, or a rejection carrying a PKIStatus, status text, and PKIFailureInfo names -- and pki.tsp.parseResponse parses one; the section 2.4.2 status-to-token coupling (a granted response carries a token, any other status must not) is enforced on build and parse alike. These are the byte payloads an RFC 3161 transport carries, completing the protocol message surface around pki.tsp.sign and pki.schema.tsp.parseToken.
+- pki.tsp.verify(token, data, opts) verifies a timestamp token and returns a verdict carrying the verified genTime, serial number, and TSTInfo fields. It checks the CMS signature over the exact signed bytes, recomputes the message imprint from the supplied data (or compares a precomputed imprint), requires the encapsulated content be a TSTInfo, binds the token to the TSA certificate by recomputing the ESSCertID(V2) certificate hash (RFC 5816) and matching its issuerSerial when present, and enforces RFC 3161 section 2.3 on the TSA certificate: its extendedKeyUsage must be present, critical, and contain exactly id-kp-timeStamping, and -- when the certificate asserts a keyUsage -- that keyUsage must permit signing, so a certificate not issued for timestamping cannot mint a trusted token. When a trust anchor is supplied, the TSA certificate chain -- ordered from the token's embedded certificates, so a TSA under an intermediate CA validates -- receives full certification-path validation at the token's genTime, including optional revocation; when the request carried a nonce, the token must echo it. Every checked field is read from the verified encapsulated content, never a caller-supplied parsed object; a well-formed token failing any check is a fail-closed { valid: false } verdict with a stable reason code.
+
+### Fixed
+
+- CMS signer-certificate lookup now matches the certificate's issuer name in addition to its serial number when a signer is identified by issuerAndSerialNumber (RFC 5652); the issuer comparison was previously inert, so a signer was located by serial number alone. The verification verdict is unchanged -- the signature check remains the authority -- but the correct signer certificate is now selected precisely.
+- Malformed input to several verifiers now fails closed with a typed pki.errors.PkiError instead of a raw TypeError: a signer or issuer distinguished name carrying an embedded control byte (the RFC 5280 section 7.1 name comparison, CVE-2009-2408) and oversized or malformed JSON are rejected with a domain error code across pki.cms.verify, pki.tsp.verify, pki.jose, pki.sigstore, and pki.webcrypto key import.
+
+## v0.2.18 — 2026-07-14
+
+Composite ML-DSA signatures join CMS SignedData: pki.cms.sign and pki.cms.verify now produce and verify a composite SignerInfo -- a post-quantum ML-DSA paired with a traditional RSA, ECDSA, or EdDSA -- accepted only when BOTH components verify.
+
+### Added
+
+- pki.cms.verify verifies, and pki.cms.sign produces, a composite ML-DSA CMS SignerInfo (draft-ietf-lamps-cms-composite-sigs) pairing ML-DSA-44/65/87 with a traditional RSA (PKCS#1 v1.5 or PSS), ECDSA (P-256/384/521), or EdDSA (Ed25519) component. The signature is accepted only when BOTH the post-quantum and traditional components verify over the domain-separated message representative; the digestAlgorithm is the parameter set's paired pre-hash, and the composite public-key OID must match the signatureAlgorithm. Fifteen algorithm arms verify and sign today; the two brainpool-curve arms and the one SHAKE256-pre-hash arm are recognized but fail closed to a typed error (their curve / digest is outside the WebCrypto surface).
+- pki.cms.sign accepts a composite signer as { cert, key: { mldsa, trad } } -- the two component private keys as PKCS#8 -- since a composite private key has no single native representation; it signs both components over the RFC 5652 section 5.4 preimage and emits the fixed-order composite signature the verifier consumes.
+
+### Fixed
+
+- EdDSA (Ed25519 / Ed448) public keys are validated as a canonical, on-curve, full-order Edwards point before any signature is verified with them, across certification-path validation (pki.path.validate) -- a certificate signature or a CRL / OCSP-response signature checked during revocation -- composite CMS SignerInfo components, and JWS verification (pki.jose.verify). A low-order key -- for example the identity point, which the underlying platform imports without complaint and which verifies a forged signature for every message -- is rejected up front, so it can no longer certify a forged certificate chain, forge a CRL or OCSP response, satisfy the traditional half of a composite signature, or make a forged JWS verify. Certificate and revocation verification share one key-import routine, so the check cannot be applied to one surface and skipped on another.
+
+## v0.2.17 — 2026-07-13
 
 Post-quantum SLH-DSA joins CMS SignedData: pki.cms.sign and pki.cms.verify now sign and verify with all twelve FIPS 205 SLH-DSA parameter sets (RFC 9814), freely mixed with the classical and ML-DSA signers in one message.
 

package/README.md

@@ -209,7 +209,7 @@ is callable today; nothing below is a stub.
 | `pki.schema.pkcs8` | Parse DER / PEM PKCS#8 private keys per RFC 5208 / 5958 — algorithm, raw key bytes, attributes, optional public key, fail-closed; encrypted keys recognized (not decrypted) — `parse`, `parseEncrypted`, `pemDecode`, `pemEncode` |
 | `pki.schema.cms` | Parse DER / PEM CMS per RFC 5652 / 5083 / 9629 — SignedData (§5, signer infos + raw signed-attribute bytes for external verification), EnvelopedData (§6, all five RecipientInfo kinds incl. RFC 5753 key-agreement and RFC 9629 KEM recipients with ML-KEM validation), EncryptedData (§8), AuthenticatedData (§9, MAC surface + raw `authAttrsBytes`), and AuthEnvelopedData (RFC 5083, with RFC 5084 AES-GCM/CCM parameter validation); §11 attribute placement enforced, countersignatures validated recursively, certificates / CRLs validated against the closed CHOICE sets and kept raw, every result tagged `contentTypeName`, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.ocsp` | Parse DER / PEM OCSP requests and responses per RFC 6960 — per-certificate status (good / revoked / unknown), responder identity, raw tbs bytes for external verification, certificates kept raw, fail-closed; non-basic response types recognized (not decoded) — `parseRequest`, `parseResponse`, `pemDecode`, `pemEncode` |
-| `pki.schema.tsp` | Parse DER / PEM RFC 3161 timestamp responses and tokens — the TSTInfo payload (imprint, genTime with sub-second precision, serial, nonce, accuracy), the status-to-token coupling, and the token wrapper composed over CMS with the single-signer rule, fail-closed — `parse`, `parseTstInfo`, `parseToken`, `pemDecode`, `pemEncode` |
+| `pki.schema.tsp` | Parse DER / PEM RFC 3161 timestamp requests, responses, and tokens — the TimeStampReq a client sends (imprint, requested policy, nonce, certReq), the TSTInfo payload (imprint, genTime with sub-second precision, serial, nonce, accuracy), the status-to-token coupling, and the token wrapper composed over CMS with the single-signer rule, fail-closed — `parse`, `parseRequest`, `parseResponse`, `parseTstInfo`, `parseToken`, `pemDecode`, `pemEncode` |
 | `pki.schema.attrcert` | Parse DER / PEM RFC 5755 attribute certificates — the holder and issuer identities (validated GeneralNames), the validity window (real `Date`s), the privilege attributes (role / group / clearance) and extensions, with the raw signed region for a verifier; the obsolete v1 form is recognized and deferred, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.crmf` | Parse DER / PEM RFC 4211 certificate request messages (CertReqMessages — the CMP / EST enrollment body) — the requested-certificate template (subject, public key, validity, extensions), proof-of-possession, and registration controls, with the raw `CertRequest` region a POP verifier hashes; names dual-accepted (IMPLICIT and EXPLICIT), fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.pkcs12` | Parse DER / BER / PEM RFC 7292 PKCS#12 (PFX) stores — key bags via the PKCS#8 parser, shrouded keys (algorithm surfaced, ciphertext opaque), cert / CRL / secret bags raw and byte-exact, encrypted and enveloped safes structurally via CMS, `friendlyName` / `localKeyId` decoded, and the exact MAC byte range (`macedBytes`) plus RFC 9579 PBMAC1 recognition for external verification; BER accepted exactly where §4.1 requires it, fail-closed — `parse`, `pemDecode`, `pemEncode` |
@@ -221,8 +221,8 @@ is callable today; nothing below is a stub.
 | `pki.schema.smime` | Decode S/MIME ESS signed-attribute values (RFC 5035 / RFC 8551) — `parseSigningCertificate` / `parseSigningCertificateV2` bind a signature to its signing certificate (cert hash, hash algorithm, issuer `GeneralNames` + serial), `parseSmimeCapabilities` decodes the ordered capability list, and `decodeAttribute` OID-dispatches a CMS attribute (enforcing the single-value rule, recognize-and-defer for unknown types). A companion decoder for CMS signed attributes, not an auto-routed format, fail-closed — `parseSigningCertificate`, `parseSigningCertificateV2`, `parseSmimeCapabilities`, `decodeAttribute` |
 | `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk` / `encode` / `embeddedDer` plus the schema combinators |
 | `pki.path` | RFC 5280 §6 certification-path validation — `validate` runs the §6.1 state machine (signature chaining across RSA, ECDSA, EdDSA, ML-DSA, SLH-DSA and hybrid composite ML-DSA signatures — a composite is accepted only when **both** its post-quantum and traditional components verify; validity windows, name chaining, basic constraints and path length, key usage, name constraints, the certificate-policy tree) over an ordered path and a trust anchor, returning a structured verdict with per-check reason codes, and enforces a `pki.trust` anchor's per-purpose distrust-after dates and delegator purposes via `checkPurpose`; `crlChecker` supplies CRL-based revocation — including partitioned/sharded CRLs, whose §6.3.3 Distribution Point ↔ IDP correspondence lets a corresponding full-reason shard establish non-revocation — and `ocspChecker` supplies OCSP-based revocation (RFC 6960 — CertID binding, responder authorization, signature, currency) over the same pluggable hook. Pure and re-entrant, fail-closed — `validate`, `crlChecker`, `ocspChecker` |
-| `pki.cms` | RFC 5652 §5 CMS SignedData signing + signature verification — `sign(content, signers, opts)` produces a SignedData (attached or detached, one or many signers, RSA / RSASSA-PSS / ECDSA / EdDSA and the post-quantum ML-DSA-44/65/87 (RFC 9882) and SLH-DSA (all twelve FIPS 205 sets, RFC 9814)); it builds the signed attributes (content-type, message-digest, signing-time) as canonical DER, signs the exact §5.4 preimage, and emits a DER `Buffer` or PEM. `verify(input, opts)` parses a SignedData over the strict `pki.schema.cms` codec, locates each SignerInfo's signer certificate by its issuerAndSerialNumber or subjectKeyIdentifier, and checks the signature over the exact §5.4 preimage: when signed attributes are present it confirms the message-digest attribute equals the content digest and verifies over the DER re-encoding of the SignedAttributes (the on-wire `[0]` tag replaced by a universal SET OF), otherwise directly over the content. It returns a per-signer verdict with the matched signer certificate; it does not chain that certificate to a trust anchor — that is the caller's step through `pki.path.validate`. Fail-closed with typed `cms/*` errors — `sign`, `verify` |
-| `pki.tsp` | RFC 3161 timestamp token creation — `sign(messageImprint, tsa, opts)` produces a TimeStampToken: a CMS SignedData (over `pki.cms.sign`) whose content is a `TSTInfo` carrying the timestamped message imprint, the TSA policy, a serial number, and `genTime` (with optional accuracy / nonce / ordering), plus the RFC 3161 §2.4.2 signing-certificate attribute binding the token to the TSA certificate. The producing side of `pki.schema.tsp.parseToken`; SHA-2 imprints, and any `pki.cms.sign` TSA key — `sign` |
+| `pki.cms` | RFC 5652 §5 CMS SignedData signing + signature verification — `sign(content, signers, opts)` produces a SignedData (attached or detached, one or many signers, RSA / RSASSA-PSS / ECDSA / EdDSA, the post-quantum ML-DSA-44/65/87 (RFC 9882) and SLH-DSA (all twelve FIPS 205 sets, RFC 9814), and composite ML-DSA (pairing ML-DSA with a traditional RSA / ECDSA / EdDSA — accepted only when **both** components verify — draft-ietf-lamps-cms-composite-sigs)); it builds the signed attributes (content-type, message-digest, signing-time) as canonical DER, signs the exact §5.4 preimage, and emits a DER `Buffer` or PEM. `verify(input, opts)` parses a SignedData over the strict `pki.schema.cms` codec, locates each SignerInfo's signer certificate by its issuerAndSerialNumber or subjectKeyIdentifier, and checks the signature over the exact §5.4 preimage: when signed attributes are present it confirms the message-digest attribute equals the content digest and verifies over the DER re-encoding of the SignedAttributes (the on-wire `[0]` tag replaced by a universal SET OF), otherwise directly over the content. It returns a per-signer verdict with the matched signer certificate; it does not chain that certificate to a trust anchor — that is the caller's step through `pki.path.validate`. Fail-closed with typed `cms/*` errors — `sign`, `verify` |
+| `pki.tsp` | RFC 3161 Time-Stamp Protocol — `sign(messageImprint, tsa, opts)` produces a TimeStampToken: a CMS SignedData (over `pki.cms.sign`) whose content is a `TSTInfo` carrying the timestamped message imprint, the TSA policy, a serial number, and `genTime` (with optional accuracy / nonce / ordering), plus the RFC 3161 §2.4.2 signing-certificate attribute binding the token to the TSA certificate (SHA-2 imprints, any `pki.cms.sign` TSA key). `request` / `parseRequest` build and parse the TimeStampReq a client sends (imprint, requested policy, nonce, certReq), `response` / `parseResponse` the TimeStampResp a TSA returns — a granted status wrapping a token, or a rejection with PKIStatus and failure info, the §2.4.2 status↔token coupling enforced in both directions. `verify(token, data, opts)` verifies a token fail-closed: the CMS signature over the exact signed bytes, the message imprint recomputed from the data, the TSTInfo content type, the ESSCertID(V2) binding to the TSA certificate, the §2.3 critical timeStamping-only extendedKeyUsage, the request nonce when used, and — with a trust anchor supplied — full certification-path validation of the TSA certificate at the token's `genTime`, returning `{ valid, genTime, serialNumber, tstInfo, … }` — `sign`, `request`, `parseRequest`, `response`, `parseResponse`, `verify` |
 | `pki.ct` | RFC 6962 Certificate Transparency SCTs — `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries in the SCT extension (a TLS-presentation-language payload inside the §3.3 double DER wrap) into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature; `reconstructSignedData` rebuilds the exact `digitally-signed` preimage; `verifySct` verifies an SCT signature against a log's public key by reconstructing the signed data, routing an ECDSA signature through the strict DER-conformance gate, and verifying through the crypto engine — resolving true or false, and throwing a typed error on a structural fault. Structure decoded, crypto fail-closed — `parseSctList`, `reconstructSignedData`, `verifySct` |
 | `pki.merkle` | RFC 6962 / RFC 9162 Merkle-tree proof verification — `leafHash` / `nodeHash` / `emptyRootHash` build the domain-separated (0x00 leaf / 0x01 node) SHA-256 tree hashes; `verifyInclusion` folds an audit proof back to a root and `verifyConsistency` reconstructs both the old and new root (the append-only guarantee), each constant-time-compared to a trusted checkpoint root. Fail-closed on bad geometry, sync hashing, transport-free — `leafHash`, `nodeHash`, `emptyRootHash`, `verifyInclusion`, `verifyConsistency` |
 | `pki.trust` | Mozilla / CCADB trust-store ingestion — `parseCertdata` reads the NSS `certdata.txt` object stream and `parseCcadbCsv` the CCADB CSV export into one identical constraint-carrying anchor shape: the per-purpose trust bits (only `CKT_NSS_TRUSTED_DELEGATOR` grants) and the per-purpose distrust-after dates the bare root list omits. Certificate and trust objects pair by byte-exact issuer + serial (never adjacency) and are cross-checked against the parsed DER, so metadata can never attach to the wrong root; `anchor()` hands an entry to `pki.path.validate({ trustAnchor, checkPurpose })`. Offline, fail-closed, bounded — `parseCertdata`, `parseCcadbCsv`, `anchor` |
@@ -343,7 +343,7 @@ SCTs), `pki.hpke` (RFC 9180), `pki.shbs` (HSS/LMS stateful hash signatures),
 `pki.merkle` (RFC 9162 transparency proofs), `pki.sigstore` (offline npm-provenance
 verification), `pki.webauthn` (WebAuthn / passkey attestation verification),
 `pki.cms` (RFC 5652 SignedData signing + signature verification), `pki.tsp` (RFC 3161
-timestamp token creation), and the
+timestamping — requests, responses, token creation and verification), and the
 `jose` / `acme` / `est` enrollment surfaces. Each composes
 the shared structure, foundation, and crypto layers directly. Alongside the schema
 engine, the fail-closed **guard family** (`guard-*`) centralizes each CVE-class

package/lib/cms-sign.js

@@ -22,6 +22,7 @@ var pkix = require("./schema-pkix");
 var webcrypto = require("./webcrypto");
 var subtle = webcrypto.webcrypto.subtle;
 var validator = require("./validator-all");
+var compositeSig = require("./composite-sig");
 var frameworkError = require("./framework-error");
 
 var CmsError = frameworkError.CmsError;
@@ -126,6 +127,17 @@ function _digest(digestName, content) {
 function _scheme(cert, so, noSignedAttrs) {
   var alg = cert.subjectPublicKeyInfo.algorithm;
   var keyOid = alg.oid;
+  var comp = compositeSig.COMPOSITE_ALGS[keyOid];
+  if (comp) {
+    // Composite ML-DSA (draft-ietf-lamps-cms-composite-sigs): the arm DICTATES the CMS
+    // digestAlgorithm (its pre-hash, Table 1) -- unlike RSA/ECDSA the digest is not a caller
+    // choice, so a conflicting so.digestAlgorithm is rejected. The 3 arms Node's WebCrypto surface
+    // cannot sign (brainpool curves; the SHAKE256/64 pre-hash) fail closed at config time -- never
+    // a partial single-component signature.
+    if (comp.trad.unsupported) throw _err("cms/unsupported-algorithm", "composite " + comp.name + ": " + comp.trad.unsupported);
+    if (so.digestAlgorithm && so.digestAlgorithm !== comp.phCms) throw _err("cms/bad-input", "composite " + comp.name + " fixes the digestAlgorithm to " + comp.phCms + " (draft-ietf-lamps-cms-composite-sigs sec. 3.4); " + JSON.stringify(so.digestAlgorithm) + " conflicts");
+    return { composite: comp, digest: comp.phCms, digestAlgId: _algId(comp.phCms, "absent"), sigAlgId: _algId(comp.name, "absent") };
+  }
   if (keyOid === O("rsaEncryption") || keyOid === O("rsassaPss")) {
     var isPssKey = keyOid === O("rsassaPss");
     // An id-RSASSA-PSS key MAY pin its permitted hash in the SPKI params (RFC 4055 sec. 1.2): honor
@@ -242,47 +254,76 @@ function _buildSignerInfo(signer, content, eContentType, opts) {
     : b.sequence([b.raw(_issuerBytes(cert)), b.integer(cert.serialNumber)]);        // IssuerAndSerialNumber
   var version = useSki ? 3 : 1;
 
+  return Promise.resolve().then(function () {
+    if (opts.signedAttributes === false) return content;   // sign the content directly (no signed attributes)
+    // Signed attributes (RFC 5652 sec. 5.3): content-type == eContentType, message-digest ==
+    // digest(content), and (by default) signing-time. build.set canonical-DER SET-OF-sorts them.
+    // Each attribute type appears AT MOST ONCE across the whole set (RFC 5652 sec. 5.3);
+    // `seenTypes` catches a caller-supplied attribute that duplicates a built-in or another.
+    var seenTypes = {};
+    function _pushAttr(typeOid, values) {
+      if (seenTypes[typeOid]) throw _err("cms/bad-input", "signedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + typeOid);
+      seenTypes[typeOid] = 1;
+      attrs.push(b.sequence([b.oid(typeOid), b.set(values)]));
+    }
+    var attrs = [];
+    _pushAttr(O("contentType"), [b.oid(eContentType)]);
+    _pushAttr(O("messageDigest"), [b.octetString(_digest(scheme.digest, content))]);
+    if (opts.signingTime !== false) _pushAttr(O("signingTime"), [_timeValue(opts.signingTime)]);
+    // Caller-supplied signed attributes (e.g. an RFC 3161 signing-certificate attribute): each
+    // { type: <OID name or dotted string>, values: [<DER value Buffer>] }. build.set sorts them in.
+    (opts.additionalSignedAttributes || []).forEach(function (a) {
+      var vals = (a.values || []).map(function (v) { return _toBuf(v, "a signed attribute value"); });
+      if (!vals.length) throw _err("cms/bad-input", "a signed attribute must carry at least one value (RFC 5652 -- Attribute values is SET SIZE (1..MAX))");
+      _pushAttr(/^\d+(\.\d+)+$/.test(a.type) ? a.type : O(a.type), vals);
+    });
+    var setOf = b.set(attrs);   // SET OF (tag 0x31) -- the exact bytes the signature covers (sec. 5.4)
+    var wire = Buffer.from(setOf); wire[0] = 0xA0;   // the on-wire [0] IMPLICIT tag
+    return { setOf: setOf, wire: wire };
+  }).then(function (toSign) {
+    var signedBytes = toSign.setOf ? toSign.setOf : toSign;   // SET-OF form for signing (sec. 5.4)
+    return _signScheme(scheme, so, signedBytes).then(function (sig) {
+      var fields = [b.integer(BigInt(version)), sid, scheme.digestAlgId];
+      if (toSign.wire) fields.push(toSign.wire);              // [0] IMPLICIT signedAttrs
+      fields.push(scheme.sigAlgId, b.octetString(sig));
+      return { si: b.sequence(fields), digestAlgId: scheme.digestAlgId, version: version, certDer: certDer };
+    });
+  });
+}
+
+// Sign the sec. 5.4 preimage under the resolved scheme -> the raw signature bytes for the
+// SignerInfo signature OCTET STRING. The classical path imports the single signer key and signs
+// (re-encoding ECDSA to canonical DER); the composite path signs BOTH component keys over the
+// domain-separated M' and returns mldsaSig || tradSig (composite-sig.js owns the construction).
+function _signScheme(scheme, so, signedBytes) {
+  if (scheme.composite) {
+    return compositeSig.compositeSign(scheme.composite, _normCompositeKeys(so.key, scheme.composite), signedBytes).then(function (sig) { return Buffer.from(sig); });
+  }
   return _importKey(so.key, scheme.imp).then(function (priv) {
-    return Promise.resolve().then(function () {
-      if (opts.signedAttributes === false) return content;   // sign the content directly (no signed attributes)
-      // Signed attributes (RFC 5652 sec. 5.3): content-type == eContentType, message-digest ==
-      // digest(content), and (by default) signing-time. build.set canonical-DER SET-OF-sorts them.
-      // Each attribute type appears AT MOST ONCE across the whole set (RFC 5652 sec. 5.3);
-      // `seenTypes` catches a caller-supplied attribute that duplicates a built-in or another.
-      var seenTypes = {};
-      function _pushAttr(typeOid, values) {
-        if (seenTypes[typeOid]) throw _err("cms/bad-input", "signedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + typeOid);
-        seenTypes[typeOid] = 1;
-        attrs.push(b.sequence([b.oid(typeOid), b.set(values)]));
-      }
-      var attrs = [];
-      _pushAttr(O("contentType"), [b.oid(eContentType)]);
-      _pushAttr(O("messageDigest"), [b.octetString(_digest(scheme.digest, content))]);
-      if (opts.signingTime !== false) _pushAttr(O("signingTime"), [_timeValue(opts.signingTime)]);
-      // Caller-supplied signed attributes (e.g. an RFC 3161 signing-certificate attribute): each
-      // { type: <OID name or dotted string>, values: [<DER value Buffer>] }. build.set sorts them in.
-      (opts.additionalSignedAttributes || []).forEach(function (a) {
-        var vals = (a.values || []).map(function (v) { return _toBuf(v, "a signed attribute value"); });
-        if (!vals.length) throw _err("cms/bad-input", "a signed attribute must carry at least one value (RFC 5652 -- Attribute values is SET SIZE (1..MAX))");
-        _pushAttr(/^\d+(\.\d+)+$/.test(a.type) ? a.type : O(a.type), vals);
-      });
-      var setOf = b.set(attrs);   // SET OF (tag 0x31) -- the exact bytes the signature covers (sec. 5.4)
-      var wire = Buffer.from(setOf); wire[0] = 0xA0;   // the on-wire [0] IMPLICIT tag
-      return { setOf: setOf, wire: wire };
-    }).then(function (toSign) {
-      var signedBytes = toSign.setOf ? toSign.setOf : toSign;   // SET-OF form for signing (sec. 5.4)
-      return subtle.sign(scheme.sign, priv, signedBytes).then(function (sigRaw) {
-        var sig = Buffer.from(sigRaw);
-        if (scheme.ecdsaDer) sig = validator.sig.rawToEcdsaDer(sig, scheme.coordLen);
-        var fields = [b.integer(BigInt(version)), sid, scheme.digestAlgId];
-        if (toSign.wire) fields.push(toSign.wire);              // [0] IMPLICIT signedAttrs
-        fields.push(scheme.sigAlgId, b.octetString(sig));
-        return { si: b.sequence(fields), digestAlgId: scheme.digestAlgId, version: version, certDer: certDer };
-      });
+    return subtle.sign(scheme.sign, priv, signedBytes).then(function (sigRaw) {
+      var sig = Buffer.from(sigRaw);
+      if (scheme.ecdsaDer) sig = validator.sig.rawToEcdsaDer(sig, scheme.coordLen);
+      return sig;
     });
   });
 }
 
+// A composite signer key is the two component private keys { mldsa, trad } as PKCS#8 (Node has no
+// single composite key type; the CMS draft is silent on key import). A missing/wrong-typed
+// component fails closed at config time -- never a partial single-component signature.
+function _normCompositeKeys(key, comp) {
+  if (!key || typeof key !== "object" || Buffer.isBuffer(key) || key instanceof Uint8Array || key.mldsa == null || key.trad == null) {
+    throw _err("cms/bad-input", "a composite " + comp.name + " signer key must be { mldsa: <PKCS#8>, trad: <PKCS#8> }");
+  }
+  return { mldsa: _normPkcs8(key.mldsa, "the composite ML-DSA component key"), trad: _normPkcs8(key.trad, "the composite traditional component key") };
+}
+function _normPkcs8(k, label) {
+  if (Buffer.isBuffer(k)) return k;
+  if (k instanceof Uint8Array) return Buffer.from(k);
+  if (typeof k === "string") { try { return pkcs8.pemDecode(k); } catch (e) { throw _err("cms/bad-input", label + " PEM could not be decoded", e); } }
+  throw _err("cms/bad-input", label + " must be a PKCS#8 DER Buffer, Uint8Array, or PEM string");
+}
+
 // A signing-time Time value: UTCTime before 2050, GeneralizedTime from 2050 (RFC 5652 sec. 11.3 /
 // RFC 5280 sec. 4.1.2.5). A caller Date overrides; false omits the attribute (handled above).
 function _timeValue(when) {

package/lib/cms-verify.js

@@ -13,9 +13,11 @@
  *   confirms the message-digest attribute equals the digest of the content and verifies the
  *   signature over the DER re-encoding of the SignedAttributes (the on-wire `[0]` tag replaced
  *   by a universal SET OF); otherwise it verifies directly over the content. Attached and
- *   detached content, single and multiple signers, and RSA / RSASSA-PSS / ECDSA / EdDSA and the
- *   post-quantum ML-DSA (ML-DSA-44/65/87, RFC 9882) plus SLH-DSA (the twelve FIPS 205 sets, RFC 9814)
- *   are covered. It reports a per-signer verdict;
+ *   detached content, single and multiple signers, and RSA / RSASSA-PSS / ECDSA / EdDSA, the
+ *   post-quantum ML-DSA (ML-DSA-44/65/87, RFC 9882) and SLH-DSA (the twelve FIPS 205 sets, RFC 9814),
+ *   and composite ML-DSA (pairing ML-DSA with a traditional RSA / ECDSA / EdDSA, accepted only when
+ *   BOTH components verify -- draft-ietf-lamps-cms-composite-sigs) are covered. It reports a
+ *   per-signer verdict;
  *   it does NOT chain the signer certificate to a trust anchor -- that is the caller's step through
  *   `pki.path.validate`.
  * @spec RFC 5652
@@ -36,6 +38,7 @@ var cmsSign = require("./cms-sign");
 var MLDSA_SUITABLE_DIGEST = cmsSign.MLDSA_SUITABLE_DIGEST;   // shared sign/verify digest-strength policy (RFC 9882 sec. 3.3)
 var SLHDSA_BY_OID = cmsSign.SLHDSA_BY_OID;                   // shared SLH-DSA set -> { wc, digest } (RFC 9814 sec. 4 pinned digest)
 var validator = require("./validator-all");
+var compositeSig = require("./composite-sig");
 var guard = require("./guard-all");
 var frameworkError = require("./framework-error");
 
@@ -117,7 +120,7 @@ function _findSignerCerts(sid, parsedCerts) {
     if (sid.subjectKeyIdentifier != null) {
       if (c.ski && c.ski.equals(_toBuf(sid.subjectKeyIdentifier, "sid.subjectKeyIdentifier"))) out.push(c);
     } else if (sid.issuer && sid.serialNumberHex != null) {
-      if (c.cert.serialNumberHex === sid.serialNumberHex && guard.name.dnEqual(c.cert.issuer, sid.issuer, CmsError, "cms/bad-name")) out.push(c);
+      if (c.cert.serialNumberHex === sid.serialNumberHex && guard.name.dnEqual(c.cert.issuer.rdns, sid.issuer.rdns, _err, "cms/bad-name", "the signer certificate issuer")) out.push(c);
     }
   }
   return out;
@@ -266,18 +269,11 @@ function _verifySignature(scheme, hashName, sigBytes, spki, signedBytes, curveOi
     .then(function (k) { return subtle.verify({ name: scheme.name }, k, sigBytes, signedBytes); });
 }
 
-// The raw Edwards point an OKP SPKI carries (its BIT STRING body, past the unused-bits octet)
-// MUST be a valid, canonical, full-order point -- reject an off-curve or low-order key before
-// it verifies a signature (WebCrypto import does not check it). Curve from the WebCrypto name.
+// The EdDSA signer key's point MUST be a valid, canonical, full-order Edwards point -- reject an
+// off-curve or low-order key before it verifies a signature (WebCrypto import does not check it).
+// Routed through the shared edwards-point gate every EdDSA verify path uses; curve from the name.
 function _requireValidEdPoint(spkiBytes, name) {
-  var content;
-  try {
-    content = asn1.decode(spkiBytes).children[1].content;
-  } catch (e) { throw _err("cms/bad-signature", "the EdDSA public key is not a well-formed SPKI", e); }
-  var point = content && content.length ? content.subarray(1) : Buffer.alloc(0);
-  if (!edwardsPoint.validate(point, name === "Ed25519" ? 6 : 7)) {
-    throw _err("cms/bad-signature", "the EdDSA public key is not a valid, full-order Edwards point");
-  }
+  edwardsPoint.validateSpki(spkiBytes, name === "Ed25519" ? 6 : 7, CmsError, "cms/bad-signature");
 }
 
 // The EC named-curve OID carried in a signer cert's SubjectPublicKeyInfo, or null (non-EC).
@@ -308,6 +304,11 @@ function _decodeSignedAttrs(setOfBytes) {
 // Verify one SignerInfo. Returns { ok, sid, cert, ... } -- a resolved false is a verdict; a
 // structural failure carries a code.
 function _verifyOne(si, content, eContentType, parsedCerts) {
+  // A composite ML-DSA SignerInfo (draft-ietf-lamps-cms-composite-sigs) is keyed by its composite
+  // OID, not a SIG_SCHEME name; intercept it before the classical dispatch (its verify has no
+  // single external signature hash, so it never routes through the SIG_SCHEME/sigHash gate below).
+  var composite = compositeSig.COMPOSITE_ALGS[si.signatureAlgorithm.oid];
+  if (composite) return _verifyComposite(si, composite, content, eContentType, parsedCerts);
   var scheme = SIG_SCHEME[si.signatureAlgorithm.name];
   if (!scheme) return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "unsupported signature algorithm " + JSON.stringify(si.signatureAlgorithm.name) });
   var digestHash = DIGEST_HASH[si.digestAlgorithm.name];
@@ -355,6 +356,17 @@ function _verifyOne(si, content, eContentType, parsedCerts) {
   if (!signers.length) return Promise.resolve({ ok: false, code: "cms/signer-cert-not-found", sid: si.sid, message: "no certificate matches this SignerInfo's signer identifier" });
   var sigBytes = _toBuf(si.signature, "the SignerInfo signature");
 
+  return _computeSignedBytes(si, content, eContentType).then(function (signedBytes) {
+    if (signedBytes && signedBytes.mismatch) return { ok: false, code: signedBytes.mismatch.code, sid: si.sid, cert: signers[0].der, message: signedBytes.mismatch.message };
+    return _verifyAgainstCandidates(scheme, sigHash, sigBytes, signedBytes, si.sid, signers, pss ? pss.saltLength : 0, scheme.sameKeyOid ? oid.byName(si.signatureAlgorithm.name) : null);
+  });
+}
+
+// The exact bytes the signature covers (RFC 5652 sec. 5.4), shared by the classical and composite
+// verify paths so both bind the message-digest / content-type checks to the VERIFIED preimage (not
+// the caller-mutable parsed si.signedAttrs). Resolves the signed bytes, or { mismatch } when a
+// content-type / message-digest attribute disagrees.
+function _computeSignedBytes(si, content, eContentType) {
   return Promise.resolve().then(function () {
     if (!si.signedAttrsBytes) return content;   // no signed attributes: sign over the content directly
     // With signed attributes: decode them from the EXACT bytes the signature covers -- the
@@ -389,12 +401,79 @@ function _verifyOne(si, content, eContentType, parsedCerts) {
       if (!d.equals(declared)) return { mismatch: { code: "cms/message-digest-mismatch", message: "the message-digest attribute does not match the content digest" } };
       return reTagged;
     });
-  }).then(function (signedBytes) {
+  });
+}
+
+// Verify a composite ML-DSA SignerInfo (draft-ietf-lamps-cms-composite-sigs). The composite
+// verify engine lives in composite-sig.js (shared with certification-path validation); this branch
+// enforces the CMS-specific rules the X.509 path does not: params-absent on the signatureAlgorithm
+// (sec. 3.4, defense-in-depth over the parse-time _PARAMS_ABSENT gate), the unsupported-arm refusal,
+// and the sec. 3.4/sec. 5 coherence gate binding the SignerInfo digestAlgorithm to the arm's Table-1
+// pre-hash. It reuses the sec. 5.4 preimage + message-digest binding UNCHANGED, then dispatches
+// compositeVerify per candidate certificate (BOTH components must verify -- never an AND->OR
+// downgrade).
+function _verifyComposite(si, comp, content, eContentType, parsedCerts) {
+  if (si.signatureAlgorithm.parameters !== null && si.signatureAlgorithm.parameters !== undefined) {
+    return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the composite signatureAlgorithm parameters must be absent (draft-ietf-lamps-cms-composite-sigs sec. 3.4)" });
+  }
+  // The 3 arms Node's WebCrypto surface cannot verify (brainpool curves; the SHAKE256/64 pre-hash)
+  // fail closed -- never a silent single-component accept (the AND->OR downgrade this feature prevents).
+  if (comp.trad.unsupported) {
+    return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "composite " + comp.name + ": " + comp.trad.unsupported });
+  }
+  // draft sec. 3.4: for a composite SignerInfo the digestAlgorithm parameters MUST be OMITTED
+  // (id-sha256/id-sha512 and id-shake256) -- stricter than the generic RFC 5754 absent-OR-NULL rule
+  // (which the classical/ML-DSA paths follow), because the composite draft explicitly requires the
+  // field omitted. A present parameter -- even a DER NULL -- is non-conformant and fails closed
+  // (it is outside the signed preimage, so a parser differential must not verify).
+  var dp = si.digestAlgorithm.parameters;
+  if (dp !== null && dp !== undefined) {
+    return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the composite " + si.digestAlgorithm.name + " digestAlgorithm parameters must be omitted (draft-ietf-lamps-cms-composite-sigs sec. 3.4)" });
+  }
+  // sec. 3.4 / sec. 5 (the one CMS-specific MUST the X.509 path does not cover): the SignerInfo
+  // digestAlgorithm MUST equal the arm's pre-hash (Table 1) -- compositeVerify takes the pre-hash
+  // from the OID-keyed descriptor, so a disagreeing digestAlgorithm would recompute the
+  // message-digest attribute under the WRONG algorithm. The sec. 5 SHOULD-reject is taken
+  // fail-closed; the MAY-verify-anyway leniency is deliberately not taken.
+  if (si.digestAlgorithm.name !== comp.phCms) {
+    return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the SignerInfo digestAlgorithm " + JSON.stringify(si.digestAlgorithm.name) + " is not the composite " + comp.name + " pre-hash " + JSON.stringify(comp.phCms) + " (draft-ietf-lamps-cms-composite-sigs sec. 3.4)" });
+  }
+  var signers = _findSignerCerts(si.sid, parsedCerts);
+  if (!signers.length) return Promise.resolve({ ok: false, code: "cms/signer-cert-not-found", sid: si.sid, message: "no certificate matches this SignerInfo's signer identifier" });
+  var sigBytes = _toBuf(si.signature, "the SignerInfo signature");
+  return _computeSignedBytes(si, content, eContentType).then(function (signedBytes) {
     if (signedBytes && signedBytes.mismatch) return { ok: false, code: signedBytes.mismatch.code, sid: si.sid, cert: signers[0].der, message: signedBytes.mismatch.message };
-    return _verifyAgainstCandidates(scheme, sigHash, sigBytes, signedBytes, si.sid, signers, pss ? pss.saltLength : 0, scheme.sameKeyOid ? oid.byName(si.signatureAlgorithm.name) : null);
+    return _verifyCompositeAgainstCandidates(comp, sigBytes, signedBytes, si.sid, signers, si.signatureAlgorithm.oid);
   });
 }
 
+// Dispatch compositeVerify against EACH matching candidate; the signer is valid iff one candidate
+// verifies both components. A candidate whose SPKI composite OID != the SignerInfo signatureAlgorithm
+// OID is skipped with a precise verdict (RFC 9814 sec. 4 key<->signature agreement); a candidate that
+// returns a structural fault code (bad split length, unsupported) falls through, its code surfaced if
+// none verifies. A clean both-components-checked failure (the AND-downgrade) is a code-less false.
+function _verifyCompositeAgainstCandidates(comp, sigBytes, signedBytes, sid, candidates, expectedKeyOid) {
+  var lastErr = null;
+  function attempt(idx) {
+    if (idx >= candidates.length) {
+      return lastErr ? { ok: false, code: lastErr.code, sid: sid, cert: candidates[0].der, message: lastErr.message }
+        : { ok: false, sid: sid, cert: candidates[0].der };
+    }
+    var c = candidates[idx];
+    if (c.cert.subjectPublicKeyInfo.algorithm.oid !== expectedKeyOid) {
+      lastErr = _err("cms/unsupported-algorithm", "the signer certificate public-key algorithm does not match the SignerInfo signatureAlgorithm");
+      return attempt(idx + 1);
+    }
+    return compositeSig.compositeVerify(c.cert.subjectPublicKeyInfo.bytes, sigBytes, signedBytes, comp, CmsError, "cms/unsupported-algorithm", "cms/bad-signature")
+      .then(function (r) {
+        if (r.ok === true) return { ok: true, sid: sid, cert: c.der };
+        if (r.code) lastErr = (r.error instanceof CmsError) ? r.error : _err(r.code, r.error && r.error.message ? r.error.message : "the composite signature could not be evaluated");
+        return attempt(idx + 1);
+      });
+  }
+  return attempt(0);
+}
+
 /**
  * @primitive  pki.cms.verify
  * @signature  pki.cms.verify(input, opts?) -> Promise<{ valid, signers }>
@@ -412,7 +491,9 @@ function _verifyOne(si, content, eContentType, parsedCerts) {
  * a `code` on a structural failure; `valid` is true when there is at least one signer and
  * every signer verified. RSA (PKCS#1 v1.5 and RSASSA-PSS), ECDSA, EdDSA, and the post-quantum
  * ML-DSA (ML-DSA-44/65/87, RFC 9882) and SLH-DSA (the twelve FIPS 205 sets, RFC 9814) -- pure mode,
- * empty context -- signatures are recognized.
+ * empty context -- signatures are recognized, as is composite ML-DSA
+ * (draft-ietf-lamps-cms-composite-sigs), which pairs ML-DSA with a traditional RSA / ECDSA / EdDSA
+ * and verifies only when BOTH components pass (never an AND-to-OR downgrade).
  *
  * @opts  content  The detached content (a `Buffer`) when the SignedData carries no
  *                 encapsulated eContent. Required for a detached signature.
@@ -459,10 +540,6 @@ function _addCert(out, der) {
 // because an upstream contract already narrows the shape:
 //   * `cert.extensions || []` -- x509.parse always surfaces `extensions` as an array (empty
 //     when absent), so the `|| []` fallback never fires.
-//   * `_requireValidEdPoint`'s SPKI-decode catch and its empty-content `Buffer.alloc(0)`
-//     fallback -- a signer certificate accepted by x509.parse always carries a well-formed,
-//     non-empty SubjectPublicKeyInfo BIT STRING, so the decode never throws and the content is
-//     never empty here.
 //   * `_decodeSignedAttrs`'s `tagNumber !== SET` / `!children` guard -- the caller forces the
 //     leading byte to a universal SET OF before decoding, so `asn1.decode` yields a SET whose
 //     `children` is always an array; the guard is belt-and-suspenders against a future caller.
@@ -485,13 +562,15 @@ function _addCert(out, der) {
  * S/MIME signed mail, RFC 3161 timestamp tokens, and code signing rest on, and exactly what
  * `pki.cms.verify` consumes and OpenSSL `cms -verify` validates. Each `signers[i]` is
  * `{ cert, key, digestAlgorithm?, pss? }`: `cert` the signer certificate (PEM or DER), `key`
- * its private key (a WebCrypto `CryptoKey` or a PKCS#8 DER `Buffer` / PEM string). The
+ * its private key (a WebCrypto `CryptoKey` or a PKCS#8 DER `Buffer` / PEM string; for a composite
+ * ML-DSA signer, the two component keys `{ mldsa, trad }`, each PKCS#8). The
  * signature covers the RFC 5652 sec. 5.4 preimage: with signed attributes (the default) the
  * message-digest attribute is bound to the content digest and the signature is over the
  * canonical DER SET OF SignedAttributes; otherwise over the content directly. RSA (PKCS#1 v1.5
  * and, with `pss`, RSASSA-PSS), ECDSA (P-256/384/521), Ed25519, Ed448, and the post-quantum ML-DSA
  * (ML-DSA-44/65/87, RFC 9882) and SLH-DSA (the twelve FIPS 205 sets, RFC 9814 -- the message digest
- * pinned per parameter set) are covered.
+ * pinned per parameter set) are covered, as is composite ML-DSA (draft-ietf-lamps-cms-composite-sigs)
+ * -- the arm's pre-hash fixes the digestAlgorithm and the two component keys are signed together.
  *
  * @opts  detached          Omit the encapsulated content (a detached signature; the verifier
  *                          supplies the content). Default false.