@blamejs/pki 0.2.17 → 0.2.19

package/lib/composite-sig.js

@@ -0,0 +1,240 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The composite ML-DSA signature engine
+// (draft-ietf-lamps-pq-composite-sigs for the construction; draft-ietf-lamps-cms-composite-sigs
+// binds it to CMS), shared by certification-path validation (X.509 composite certificates,
+// lib/path-validate.js) and CMS (composite SignerInfo, lib/cms-verify.js / lib/cms-sign.js).
+//
+// A composite signature pairs a post-quantum ML-DSA with a traditional RSA / ECDSA / EdDSA so the
+// signature stays trustworthy if EITHER primitive is later broken. The public key is the raw
+// concatenation mldsaPK || tradPK (sec. 4.1) in the SPKI BIT STRING; the signature is
+// mldsaSig || tradSig (sec. 4.3). Verification (sec. 2) reconstructs
+//   M' = Prefix || Label || len(ctx) || ctx || PH(M),
+// verifies the ML-DSA component over M' with ctx = the composite Label, verifies the traditional
+// component over M' under its own hash, and accepts IFF BOTH pass (THREAT-MODEL: all components
+// must verify -- never an AND-to-OR downgrade). The ML-DSA component is the fixed-length FIRST
+// half; the split point is its length.
+//
+// Error-parameterized like the guard / validator families: each consumer passes its own typed
+// error CONSTRUCTOR `E` and its domain codes (path validation passes PathError + path/*; CMS
+// passes CmsError + cms/*), so the shared engine keeps no domain of its own. compositeVerify keeps
+// the { ok, code, error } verdict shape; the codes are caller-supplied.
+
+var asn1 = require("./asn1-der");
+var oid = require("./oid");
+var webcrypto = require("./webcrypto");
+var validator = require("./validator-all");
+var edwardsPoint = require("./edwards-point");
+var subtle = webcrypto.webcrypto.subtle;
+var _b = asn1.build;
+
+// A caught error's OWN code if it shares the caller's domain prefix (the fallback's namespace,
+// e.g. path/ or cms/), else the fallback -- a foreign code (asn1/*) maps to the fallback so the
+// verdict stays in the caller's error namespace. Mirrors path-validate's original pathCode when
+// the fallback is a path/* code.
+function _codeOf(e, fallback) {
+  var prefix = fallback.slice(0, fallback.indexOf("/") + 1);
+  return (e && typeof e.code === "string" && e.code.indexOf(prefix) === 0) ? e.code : fallback;
+}
+
+var COMPOSITE_PREFIX = Buffer.from("CompositeAlgorithmSignatures2025", "ascii");
+var MLDSA_COMPONENT = {
+  "ML-DSA-44": { pk: 1312, sig: 2420, oid: "id-ml-dsa-44" },
+  "ML-DSA-65": { pk: 1952, sig: 3309, oid: "id-ml-dsa-65" },
+  "ML-DSA-87": { pk: 2592, sig: 4627, oid: "id-ml-dsa-87" },
+};
+var EC_CURVE_OID = { "P-256": "prime256v1", "P-384": "secp384r1", "P-521": "secp521r1" };
+// The WebCrypto pre-hash name (ph) -> the CMS digest-algorithm name (the SignerInfo digestAlgorithm,
+// draft-ietf-lamps-cms-composite-sigs Table 1). The SINGLE source of truth for the CMS binding's
+// digest -- both the verify coherence gate and the sign digestAlgorithm read phCms, never a second
+// name map inlined at the CMS boundary.
+var PH_CMS = { "SHA-256": "sha256", "SHA-512": "sha512", "SHAKE256": "shake256" };
+var COMPOSITE_ALGS = {};
+// _comp(name, mldsa, ph, label, trad). `trad` is exactly one component shape:
+//   { ec, hash } | { eddsa } | { rsaPss, hash, salt } | { rsaPkcs1, hash } |
+//   { unsupported } for the arms Node's WebCrypto surface cannot verify (brainpool
+//   curves; the SHAKE256/64 pre-hash) -- registered + params-guarded, deferred at
+//   verify to the caller's unsupported-algorithm code rather than silently accepted.
+function _comp(name, mldsa, ph, label, trad) {
+  var sz = MLDSA_COMPONENT[mldsa];
+  COMPOSITE_ALGS[oid.byName(name)] = {
+    name: name, mldsa: mldsa, mldsaPk: sz.pk, mldsaSig: sz.sig, mldsaOid: sz.oid,
+    ph: ph, phCms: PH_CMS[ph], label: Buffer.from(label, "ascii"), trad: trad,
+  };
+}
+_comp("id-MLDSA44-RSA2048-PSS-SHA256", "ML-DSA-44", "SHA-256", "COMPSIG-MLDSA44-RSA2048-PSS-SHA256", { rsaPss: true, hash: "SHA-256", salt: 32, rsaBits: 2048 });
+_comp("id-MLDSA44-RSA2048-PKCS15-SHA256", "ML-DSA-44", "SHA-256", "COMPSIG-MLDSA44-RSA2048-PKCS15-SHA256", { rsaPkcs1: true, hash: "SHA-256", rsaBits: 2048 });
+_comp("id-MLDSA44-Ed25519-SHA512", "ML-DSA-44", "SHA-512", "COMPSIG-MLDSA44-Ed25519-SHA512", { eddsa: "Ed25519" });
+_comp("id-MLDSA44-ECDSA-P256-SHA256", "ML-DSA-44", "SHA-256", "COMPSIG-MLDSA44-ECDSA-P256-SHA256", { ec: "P-256", hash: "SHA-256" });
+_comp("id-MLDSA65-RSA3072-PSS-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-RSA3072-PSS-SHA512", { rsaPss: true, hash: "SHA-256", salt: 32, rsaBits: 3072 });
+_comp("id-MLDSA65-RSA3072-PKCS15-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-RSA3072-PKCS15-SHA512", { rsaPkcs1: true, hash: "SHA-256", rsaBits: 3072 });
+_comp("id-MLDSA65-RSA4096-PSS-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-RSA4096-PSS-SHA512", { rsaPss: true, hash: "SHA-384", salt: 48, rsaBits: 4096 });
+_comp("id-MLDSA65-RSA4096-PKCS15-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-RSA4096-PKCS15-SHA512", { rsaPkcs1: true, hash: "SHA-384", rsaBits: 4096 });
+_comp("id-MLDSA65-ECDSA-P256-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-ECDSA-P256-SHA512", { ec: "P-256", hash: "SHA-256" });
+_comp("id-MLDSA65-ECDSA-P384-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-ECDSA-P384-SHA512", { ec: "P-384", hash: "SHA-384" });
+_comp("id-MLDSA65-ECDSA-brainpoolP256r1-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-ECDSA-BP256-SHA512", { unsupported: "brainpoolP256r1 is not in the WebCrypto ECDSA curve set" });
+_comp("id-MLDSA65-Ed25519-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-Ed25519-SHA512", { eddsa: "Ed25519" });
+_comp("id-MLDSA87-ECDSA-P384-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-ECDSA-P384-SHA512", { ec: "P-384", hash: "SHA-384" });
+_comp("id-MLDSA87-ECDSA-brainpoolP384r1-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-ECDSA-BP384-SHA512", { unsupported: "brainpoolP384r1 is not in the WebCrypto ECDSA curve set" });
+_comp("id-MLDSA87-Ed448-SHAKE256", "ML-DSA-87", "SHAKE256", "COMPSIG-MLDSA87-Ed448-SHAKE256", { unsupported: "the SHAKE256/64 pre-hash is not in the WebCrypto digest set" });
+_comp("id-MLDSA87-RSA3072-PSS-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-RSA3072-PSS-SHA512", { rsaPss: true, hash: "SHA-256", salt: 32, rsaBits: 3072 });
+_comp("id-MLDSA87-RSA4096-PSS-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-RSA4096-PSS-SHA512", { rsaPss: true, hash: "SHA-384", salt: 48, rsaBits: 4096 });
+_comp("id-MLDSA87-ECDSA-P521-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-ECDSA-P521-SHA512", { ec: "P-521", hash: "SHA-512" });
+
+// Wrap a raw component public key in the SPKI its WebCrypto import expects, so each half is
+// verified through the SAME import + verify seam the classical path uses (no second parallel
+// verify path). tradPK for RSA is the RSAPublicKey DER; for EC the uncompressed point; for EdDSA
+// the raw public key.
+function _spkiFor(algNode, keyBytes) { return _b.sequence([algNode, _b.bitString(keyBytes, 0)]); }
+function _mldsaSpki(mldsaOid, raw) { return _spkiFor(_b.sequence([_b.oid(oid.byName(mldsaOid))]), raw); }
+function _ecSpki(curve, point) { return _spkiFor(_b.sequence([_b.oid(oid.byName("ecPublicKey")), _b.oid(oid.byName(EC_CURVE_OID[curve]))]), point); }
+function _edSpki(name, raw) { return _spkiFor(_b.sequence([_b.oid(oid.byName(name))]), raw); }
+function _rsaSpki(rsaPub) { return _spkiFor(_b.sequence([_b.oid(oid.byName("rsaEncryption")), _b.nullValue()]), rsaPub); }
+
+// The exact modulus bit length of an RSAPublicKey (SEQUENCE { modulus, exponent }).
+function _rsaModulusBits(rsaPubDer) {
+  return asn1.read.integer(asn1.decode(rsaPubDer).children[0]).toString(2).length;
+}
+
+// M' = Prefix || Label || len(ctx) || ctx || PH(M) (draft sec. 2 / RFC 8410-style domain
+// separation). ctx is a single-octet-length-prefixed application context; X.509 path validation
+// and CMS both use the empty context. Shared by verify AND sign so the two cannot diverge.
+function compositeMprime(d, phBuf, ctx) {
+  ctx = ctx || Buffer.alloc(0);
+  return Buffer.concat([COMPOSITE_PREFIX, d.label, Buffer.from([ctx.length]), ctx, Buffer.from(phBuf)]);
+}
+
+function _verifyTradComponent(trad, tradPK, tradSig, mprime, E, badSig) {
+  if (trad.ec) {
+    // draft sec. 5.1: the EC point MUST be the uncompressed X9.62 form (leading 0x04).
+    // A compressed / hybrid point is a non-conforming composite component encoding.
+    if (tradPK.length < 1 || tradPK[0] !== 0x04) return Promise.resolve(false);
+    return subtle.importKey("spki", _ecSpki(trad.ec, tradPK), { name: "ECDSA" }, false, ["verify"]).then(function (k) {
+      // The traditional ECDSA signature is DER Ecdsa-Sig-Value; convert to P1363 through the shared
+      // order-aware reader that also rejects r/s outside [1,n-1] (CVE-2022-21449).
+      var p1363 = validator.sig.ecdsaDerToP1363(tradSig, trad.ec, E, badSig);
+      return subtle.verify({ name: "ECDSA", hash: trad.hash }, k, p1363, mprime);
+    });
+  }
+  if (trad.eddsa) {
+    // node/OpenSSL imports any Ed25519/Ed448 SPKI without validating the point, and a low-order
+    // (e.g. all-zeroes) key verifies a forged signature -- which would collapse the composite AND
+    // to ML-DSA-only. Reject a non-full-order point before verify, through the same shared
+    // edwards-point gate every other EdDSA verify path in the toolkit routes through, surfacing a
+    // coded fault (like the ECDSA order-bound belt) rather than a silent false.
+    if (!edwardsPoint.validate(tradPK, trad.eddsa === "Ed25519" ? 6 : 7)) {
+      throw new E(badSig, "the composite EdDSA component public key is not a valid, full-order Edwards point");
+    }
+    return subtle.importKey("spki", _edSpki(trad.eddsa, tradPK), { name: trad.eddsa }, false, ["verify"])
+      .then(function (k) { return subtle.verify({ name: trad.eddsa }, k, tradSig, mprime); });
+  }
+  if (trad.rsaPss || trad.rsaPkcs1) {
+    // The composite OID fixes the RSA modulus size: a downgraded or mismatched modulus under the
+    // declared OID (an id-MLDSA44-RSA2048-* whose component is really 1024-bit) is rejected BEFORE
+    // verify, so a weak RSA component cannot satisfy an arm that promises 2048/3072/4096 bits. A
+    // malformed RSAPublicKey rejects the same way.
+    var bits;
+    try { bits = _rsaModulusBits(tradPK); }
+    catch (_e) { return Promise.resolve(false); }
+    if (bits !== trad.rsaBits) return Promise.resolve(false);
+    if (trad.rsaPss) {
+      return subtle.importKey("spki", _rsaSpki(tradPK), { name: "RSA-PSS", hash: trad.hash }, false, ["verify"])
+        .then(function (k) { return subtle.verify({ name: "RSA-PSS", saltLength: trad.salt }, k, tradSig, mprime); });
+    }
+    return subtle.importKey("spki", _rsaSpki(tradPK), { name: "RSASSA-PKCS1-v1_5", hash: trad.hash }, false, ["verify"])
+      .then(function (k) { return subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, k, tradSig, mprime); });
+  }
+  // Coverage residual -- unreachable: compositeVerify returns early for a trad.unsupported arm, so
+  // _verifyTradComponent runs only for arms that set exactly one of ec/eddsa/rsaPss/rsaPkcs1.
+  return Promise.resolve(false);
+}
+
+// Verify a composite signature: `spkiBytes` the issuer SPKI DER, `sigBytes` the raw signatureValue
+// (mldsaSig || tradSig), `message` the signed region. `E` the caller's error constructor;
+// `unsupported`/`badSig` its domain codes. Returns { ok, code?, error? } (a false is a verdict).
+function compositeVerify(spkiBytes, sigBytes, message, d, E, unsupported, badSig) {
+  if (d.trad.unsupported) {
+    return Promise.resolve({ ok: false, code: unsupported,
+      error: new E(unsupported, "composite " + d.name + ": " + d.trad.unsupported) });
+  }
+  var rawKey;
+  try {
+    var bs = asn1.read.bitString(asn1.decode(spkiBytes).children[1]);
+    // The composite subjectPublicKey is an octet-aligned concatenation (no unused bits); a non-zero
+    // unused-bit count is malformed.
+    if (bs.unusedBits !== 0) throw new E(badSig, "composite subjectPublicKey has unused bits");
+    rawKey = bs.bytes;
+  } catch (e) { return Promise.resolve({ ok: false, code: _codeOf(e, badSig), error: e }); }
+  // The ML-DSA half is fixed-length and FIRST; the traditional half is the remainder. Both must be
+  // non-empty for a well-formed composite.
+  if (rawKey.length <= d.mldsaPk || sigBytes.length <= d.mldsaSig) {
+    return Promise.resolve({ ok: false, code: badSig,
+      error: new E(badSig, "composite key/signature shorter than the fixed ML-DSA component") });
+  }
+  var mldsaPK = rawKey.subarray(0, d.mldsaPk), tradPK = rawKey.subarray(d.mldsaPk);
+  var mldsaSig = sigBytes.subarray(0, d.mldsaSig), tradSig = sigBytes.subarray(d.mldsaSig);
+  return subtle.digest({ name: d.ph }, message).then(function (phBuf) {
+    var mprime = compositeMprime(d, phBuf);
+    var mldsaP = subtle.importKey("spki", _mldsaSpki(d.mldsaOid, mldsaPK), { name: d.mldsa }, false, ["verify"])
+      .then(function (mk) { return subtle.verify({ name: d.mldsa, context: d.label }, mk, mldsaSig, mprime); });
+    var tradP = _verifyTradComponent(d.trad, tradPK, tradSig, mprime, E, badSig);
+    return Promise.all([mldsaP, tradP]).then(function (r) { return { ok: r[0] === true && r[1] === true }; });
+  }).catch(function (e) { return { ok: false, code: _codeOf(e, badSig), error: e }; });
+}
+
+// Resolve the composite descriptor for a signatureAlgorithm, or null if the OID is not composite.
+// A composite OID MUST carry absent parameters (draft-ietf-lamps-pq-composite-sigs sec. 5.3); the
+// public-key algorithm OID equals the signature OID, so the caller enforces sameKeyOid.
+function resolveCompositeDescriptor(sigAlg, E, unsupported) {
+  var comp = COMPOSITE_ALGS[sigAlg.oid];
+  if (!comp) return null;
+  // Coverage residual -- unreachable through the shipped consumer: the only caller (path-validate)
+  // reaches here with a sigAlg from a parsed structure whose shared AlgorithmIdentifier decoder
+  // already rejects a composite OID carrying parameters (the _PARAMS_ABSENT gate), so `parameters`
+  // is always absent here. Kept as defense-in-depth. (CMS does its own inline params check.)
+  if (sigAlg.parameters !== null && sigAlg.parameters !== undefined) {
+    throw new E(unsupported, "composite signature algorithm parameters must be absent (draft-ietf-lamps-pq-composite-sigs sec. 5.3)");
+  }
+  return { composite: comp, sameKeyOid: true };
+}
+
+// Sign a composite signature over `message`: `keys` = { mldsa, trad } component private keys as
+// PKCS#8 DER (Node has no composite private-key type). Signs the ML-DSA half over M' with ctx =
+// the composite Label (the same domain-separated preimage compositeVerify reconstructs), signs the
+// traditional half over M', and returns mldsaSig || tradSig. The caller rejects an unsupported arm
+// before calling (d.trad.unsupported).
+function compositeSign(d, keys, message, ctx) {
+  return subtle.digest({ name: d.ph }, message).then(function (phBuf) {
+    var mprime = compositeMprime(d, phBuf, ctx);
+    var mldsaP = subtle.importKey("pkcs8", keys.mldsa, { name: d.mldsa }, false, ["sign"])
+      .then(function (k) { return subtle.sign({ name: d.mldsa, context: d.label }, k, mprime); });
+    var tradP = _signTradComponent(d.trad, keys.trad, mprime);
+    return Promise.all([mldsaP, tradP]).then(function (s) { return Buffer.concat([Buffer.from(s[0]), Buffer.from(s[1])]); });
+  });
+}
+function _signTradComponent(trad, pkcs8, mprime) {
+  if (trad.ec) {
+    return subtle.importKey("pkcs8", pkcs8, { name: "ECDSA", namedCurve: trad.ec }, false, ["sign"])
+      .then(function (k) { return subtle.sign({ name: "ECDSA", hash: trad.hash }, k, mprime); })
+      // WebCrypto emits P1363 r||s; the composite trad-ECDSA signature is DER Ecdsa-Sig-Value, so
+      // re-encode through the shared canonical-DER gate (the inverse of the verify path's read).
+      .then(function (raw) { var r = Buffer.from(raw); return validator.sig.rawToEcdsaDer(r, r.length / 2); });
+  }
+  if (trad.eddsa) {
+    return subtle.importKey("pkcs8", pkcs8, { name: trad.eddsa }, false, ["sign"])
+      .then(function (k) { return subtle.sign({ name: trad.eddsa }, k, mprime); }).then(function (s) { return Buffer.from(s); });
+  }
+  var imp = trad.rsaPss ? { name: "RSA-PSS", hash: trad.hash } : { name: "RSASSA-PKCS1-v1_5", hash: trad.hash };
+  var alg = trad.rsaPss ? { name: "RSA-PSS", saltLength: trad.salt } : { name: "RSASSA-PKCS1-v1_5" };
+  return subtle.importKey("pkcs8", pkcs8, imp, false, ["sign"]).then(function (k) { return subtle.sign(alg, k, mprime); }).then(function (s) { return Buffer.from(s); });
+}
+
+module.exports = {
+  COMPOSITE_ALGS: COMPOSITE_ALGS,
+  compositeVerify: compositeVerify,
+  resolveCompositeDescriptor: resolveCompositeDescriptor,
+  compositeMprime: compositeMprime,
+  compositeSign: compositeSign,
+};

package/lib/edwards-point.js

@@ -18,6 +18,8 @@
 // Pure BigInt modular arithmetic (constant-time is not a goal here: the input is a public
 // key, and the verdict is a public validity bit, not a secret).
 
+var asn1 = require("./asn1-der");
+
 // ---- field parameters ------------------------------------------------------
 var P25519 = (1n << 255n) - 19n;
 // d = -121665 / 121666 (mod p); sqrt(-1) = 2^((p-1)/4) (mod p).
@@ -88,4 +90,21 @@ function validate(raw, crv) {
   return true;
 }
 
-module.exports = { validate: validate };
+// validateSpki(spkiBytes, crv, E, code) -> throws new E(code, ...) unless the
+// SubjectPublicKeyInfo's subjectPublicKey (its BIT STRING body, past the unused-bits octet) is a
+// canonical, on-curve, full-order Edwards point for the OKP curve (6 = Ed25519, 7 = Ed448). This
+// is the one home every EdDSA verify path routes an SPKI through before importKey/verify -- node
+// imports a low-order (e.g. all-zeroes) OKP SPKI without complaint and such a key verifies a
+// forged signature. Error-parameterized like the guard family: the caller passes its own typed
+// error CONSTRUCTOR `E` and domain `code`, so the shared gate keeps no error domain of its own.
+function validateSpki(spkiBytes, crv, E, code) {
+  var point;
+  try {
+    point = asn1.decode(spkiBytes).children[1].content.subarray(1);
+  } catch (e) { throw new E(code, "the EdDSA public key is not a well-formed SubjectPublicKeyInfo", e); }
+  if (!validate(point, crv)) {
+    throw new E(code, "the EdDSA public key is not a valid, full-order Edwards point");
+  }
+}
+
+module.exports = { validate: validate, validateSpki: validateSpki };

package/lib/jose.js

@@ -39,6 +39,7 @@ var constants = require("./constants");
 var webcrypto = require("./webcrypto").webcrypto;
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
+var edwardsPoint = require("./edwards-point");
 
 var JoseError = frameworkError.JoseError;
 function E(code, message, cause) { return new JoseError(code, message, cause); }
@@ -116,7 +117,7 @@ function parseJson(input) {
   // The strict bounded reader (byte + depth caps, duplicate-member reject at every
   // depth, __proto__-safe own-property assignment, fatal UTF-8, RFC 8259 grammar)
   // lives once in the shared JSON guard; the frozen jose/* codes are threaded through.
-  return guard.json.parse(input, JoseError, {
+  return guard.json.parse(input, E, {
     maxBytes: LIMITS.JSON_MAX_BYTES, maxDepth: LIMITS.JSON_MAX_DEPTH,
     badJson: "jose/bad-json", tooDeep: "jose/too-deep", duplicateMember: "jose/duplicate-member",
     tooLarge: "jose/too-large", badInput: "jose/bad-input", label: "the JSON document",
@@ -267,6 +268,12 @@ function _assertKeyType(algRow, jwk) {
   if (jwk.kty !== algRow.kty) throw E("jose/bad-alg", "the key type " + JSON.stringify(jwk.kty) + " does not match the algorithm");
   if (algRow.kty === "EC" && jwk.crv !== algRow.crv) throw E("jose/bad-alg", "the EC curve does not match the algorithm");
   if (algRow.kty === "OKP" && jwk.crv !== "Ed25519" && jwk.crv !== "Ed448") throw E("jose/bad-alg", "unsupported OKP curve " + JSON.stringify(jwk.crv));
+  // node/OpenSSL import a low-order (e.g. identity) OKP point without complaint and it verifies a
+  // forged signature; reject a non-full-order Edwards point through the shared gate, the same check
+  // every EdDSA verify path in the toolkit applies.
+  if (algRow.kty === "OKP" && typeof jwk.x === "string" && !edwardsPoint.validate(b64uDecode(jwk.x), jwk.crv === "Ed25519" ? 6 : 7)) {
+    throw E("jose/bad-key", "the OKP public key is not a valid, full-order Edwards point");
+  }
   // An AKP (ML-DSA) JWK carries its parameter set in `alg` (RFC 9964); it MUST match
   // the algorithm's set, or an ML-DSA-44 key could embed an ML-DSA-65 public JWK.
   if (algRow.kty === "AKP" && jwk.alg !== algRow.subtle) throw E("jose/bad-alg", "the AKP parameter set " + JSON.stringify(jwk.alg) + " does not match the algorithm " + algRow.subtle);

package/lib/path-validate.js

@@ -40,6 +40,9 @@ var crl = require("./schema-crl");
 var ocsp = require("./schema-ocsp");
 var guard = require("./guard-all");
 var constants = require("./constants");
+var validator = require("./validator-all");
+var compositeSig = require("./composite-sig");
+var edwardsPoint = require("./edwards-point");
 
 var PathError = errors.PathError;
 function E(code, message, cause) { return new PathError(code, message, cause); }
@@ -114,6 +117,10 @@ function _sig(name, verify, imp, params, ecdsa, sameKeyOid) {
   var entry = { verify: verify, imp: imp, params: params };
   if (ecdsa) entry.ecdsa = true;
   if (sameKeyOid) entry.sameKeyOid = true;
+  // EdDSA descriptors carry the Edwards curve id (6 = Ed25519, 7 = Ed448) so the verify path
+  // validates the issuer point through the shared gate without re-branching on the algorithm name.
+  if (verify.name === "Ed25519") entry.eddsa = 6;
+  else if (verify.name === "Ed448") entry.eddsa = 7;
   SIG_ALGS[oid.byName(name)] = entry;
 }
 // RSASSA-PKCS1-v1_5 -- parameters MUST be NULL.
@@ -151,13 +158,8 @@ HASH_BY_OID[oid.byName("sha256")] = "SHA-256";
 HASH_BY_OID[oid.byName("sha384")] = "SHA-384";
 HASH_BY_OID[oid.byName("sha512")] = "SHA-512";
 
-var CURVE_FIELD_BYTES = { "P-256": 32, "P-384": 48, "P-521": 66 };
-// Curve group orders n -- a valid ECDSA signature has r,s in [1, n-1].
-var CURVE_ORDER = {
-  "P-256": BigInt("0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551"),
-  "P-384": BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973"),
-  "P-521": BigInt("0x01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409"),
-};
+// The order-aware ECDSA DER->P1363 converter + its CURVE_FIELD_BYTES / CURVE_ORDER tables now
+// live in validator-sig.js (validator.sig.ecdsaDerToP1363), shared with the composite engine.
 
 // The algorithm OID of an AlgorithmIdentifier SEQUENCE { algorithm OID,
 // parameters OPTIONAL }. STRICT: a universal SEQUENCE with the OID and AT MOST
@@ -261,20 +263,11 @@ function isDerNull(p) { return p && p.length === 2 && p[0] === 0x05 && p[1] ===
 
 function resolveDescriptor(sigAlg) {
   if (sigAlg.oid === OID_RSA_PSS) return resolveRsaPss(sigAlg.parameters);
-  var comp = COMPOSITE_ALGS[sigAlg.oid];
-  if (comp) {
-    // draft-ietf-lamps-pq-composite-sigs sec. 5.3: parameters MUST be absent.
-    // Coverage residual -- unreachable: every sigAlg reaching resolveDescriptor is a
-    // field of a parsed x509/CRL/OCSP structure, and the shared AlgorithmIdentifier
-    // decoder (schema-pkix) rejects a composite OID carrying parameters at parse time
-    // (oid.paramsMustBeAbsent), so `parameters` is always absent here. Defense in depth.
-    if (sigAlg.parameters !== null && sigAlg.parameters !== undefined) {
-      throw E("path/unsupported-algorithm", "composite signature algorithm parameters must be absent (draft-ietf-lamps-pq-composite-sigs sec. 5.3)");
-    }
-    // The composite public-key algorithm OID equals the signature OID; enforce
-    // the RFC 9814-style key<->signature consistency structurally (sameKeyOid).
-    return { composite: comp, sameKeyOid: true };
-  }
+  // Composite ML-DSA: the OID-keyed registry + the parameters-absent check
+  // (draft-ietf-lamps-pq-composite-sigs sec. 5.3) live in composite-sig.js, shared with
+  // CMS. sameKeyOid enforces the RFC 9814 sec. 4 key<->signature OID consistency.
+  var comp = compositeSig.resolveCompositeDescriptor(sigAlg, PathError, "path/unsupported-algorithm");
+  if (comp) return comp;
   var d = SIG_ALGS[sigAlg.oid];
   if (!d) throw E("path/unsupported-algorithm", "no verify descriptor for signature algorithm " + (sigAlg.name || sigAlg.oid));
   // The signatureAlgorithm's parameters MUST match the algorithm's fixed shape:
@@ -304,177 +297,15 @@ function assertKeyMatchesSigAlg(spkiBytes, sigOid, d) {
   }
 }
 
-// DER Ecdsa-Sig-Value SEQUENCE { r, s } -> fixed-width r||s (P1363), rejecting
-// r or s outside [1, n-1] (CVE-2022-21449 "Psychic Signatures").
-function ecdsaDerToP1363(der, curve) {
-  var width = CURVE_FIELD_BYTES[curve];
-  var order = CURVE_ORDER[curve];
-  // Coverage residual -- unreachable: `curve` is a WebCrypto-imported ECDSA
-  // namedCurve (P-256/384/521) or a composite trad.ec from the same set; all three
-  // are present in the width/order tables, so no import yields an untabulated curve.
-  if (!width || !order) throw E("path/bad-signature", "unsupported ECDSA curve " + curve);
-  var n;
-  try { n = asn1.decode(der); }
-  catch (e) { throw E("path/bad-signature", "ECDSA signature is not a DER SEQUENCE(r,s)", e); }
-  if (n.tagClass !== "universal" || n.tagNumber !== asn1.TAGS.SEQUENCE || !n.children || n.children.length !== 2) {
-    throw E("path/bad-signature", "ECDSA signature must be a SEQUENCE of exactly two INTEGERs");
-  }
-  var r = asn1.read.integer(n.children[0]);
-  var s = asn1.read.integer(n.children[1]);
-  if (r < 1n || s < 1n || r >= order || s >= order) {
-    throw E("path/bad-signature", "ECDSA signature component out of range [1, n-1] (CVE-2022-21449)");
-  }
-  function pad(v) {
-    var hex = v.toString(16);
-    if (hex.length % 2) hex = "0" + hex;
-    var buf = Buffer.from(hex, "hex");
-    // Coverage residual -- unreachable: the preceding [1, order-1] range gate bounds
-    // r and s below the curve order, which fits within `width` bytes.
-    if (buf.length > width) throw E("path/bad-signature", "ECDSA signature component wider than the curve field");
-    var out = Buffer.alloc(width);
-    buf.copy(out, width - buf.length);
-    return out;
-  }
-  return Buffer.concat([pad(r), pad(s)]);
-}
+// ecdsaDerToP1363 relocated to validator-sig.js; the composite trad-ECDSA and classical ECDSA
+// paths call validator.sig.ecdsaDerToP1363(sig, curve, PathError, "path/bad-signature").
 
 // ---- composite ML-DSA signatures (draft-ietf-lamps-pq-composite-sigs) -------
-// A composite signature pairs a post-quantum ML-DSA with a traditional RSA /
-// ECDSA / EdDSA. The public key is the raw concatenation mldsaPK || tradPK
-// (sec. 4.1) in the SPKI BIT STRING; the signature is mldsaSig || tradSig
-// (sec. 4.3) in the signatureValue BIT STRING. Both are surfaced RAW by the
-// x509 parser (no sub-walk). Verification (sec. 2): reconstruct
-//   M' = Prefix || Label || len(ctx) || ctx || PH(M),
-// verify the ML-DSA component over M' with ctx = the composite Label, verify the
-// traditional component over M' under its own hash, and accept IFF BOTH pass
-// (THREAT-MODEL: all components must verify -- never an AND-to-OR downgrade). The
-// ML-DSA component is the fixed-length FIRST half; the split point is its length.
-var COMPOSITE_PREFIX = Buffer.from("CompositeAlgorithmSignatures2025", "ascii");
-var MLDSA_COMPONENT = {
-  "ML-DSA-44": { pk: 1312, sig: 2420, oid: "id-ml-dsa-44" },
-  "ML-DSA-65": { pk: 1952, sig: 3309, oid: "id-ml-dsa-65" },
-  "ML-DSA-87": { pk: 2592, sig: 4627, oid: "id-ml-dsa-87" },
-};
-var EC_CURVE_OID = { "P-256": "prime256v1", "P-384": "secp384r1", "P-521": "secp521r1" };
-var COMPOSITE_ALGS = {};
-// _comp(name, mldsa, ph, label, trad). `trad` is exactly one component shape:
-//   { ec, hash } | { eddsa } | { rsaPss, hash, salt } | { rsaPkcs1, hash } |
-//   { unsupported } for the arms Node's WebCrypto surface cannot verify (brainpool
-//   curves; the SHAKE256/64 pre-hash) -- registered + params-guarded, deferred at
-//   verify to path/unsupported-algorithm rather than silently accepted.
-function _comp(name, mldsa, ph, label, trad) {
-  var sz = MLDSA_COMPONENT[mldsa];
-  COMPOSITE_ALGS[oid.byName(name)] = {
-    name: name, mldsa: mldsa, mldsaPk: sz.pk, mldsaSig: sz.sig, mldsaOid: sz.oid,
-    ph: ph, label: Buffer.from(label, "ascii"), trad: trad,
-  };
-}
-_comp("id-MLDSA44-RSA2048-PSS-SHA256", "ML-DSA-44", "SHA-256", "COMPSIG-MLDSA44-RSA2048-PSS-SHA256", { rsaPss: true, hash: "SHA-256", salt: 32, rsaBits: 2048 });
-_comp("id-MLDSA44-RSA2048-PKCS15-SHA256", "ML-DSA-44", "SHA-256", "COMPSIG-MLDSA44-RSA2048-PKCS15-SHA256", { rsaPkcs1: true, hash: "SHA-256", rsaBits: 2048 });
-_comp("id-MLDSA44-Ed25519-SHA512", "ML-DSA-44", "SHA-512", "COMPSIG-MLDSA44-Ed25519-SHA512", { eddsa: "Ed25519" });
-_comp("id-MLDSA44-ECDSA-P256-SHA256", "ML-DSA-44", "SHA-256", "COMPSIG-MLDSA44-ECDSA-P256-SHA256", { ec: "P-256", hash: "SHA-256" });
-_comp("id-MLDSA65-RSA3072-PSS-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-RSA3072-PSS-SHA512", { rsaPss: true, hash: "SHA-256", salt: 32, rsaBits: 3072 });
-_comp("id-MLDSA65-RSA3072-PKCS15-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-RSA3072-PKCS15-SHA512", { rsaPkcs1: true, hash: "SHA-256", rsaBits: 3072 });
-_comp("id-MLDSA65-RSA4096-PSS-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-RSA4096-PSS-SHA512", { rsaPss: true, hash: "SHA-384", salt: 48, rsaBits: 4096 });
-_comp("id-MLDSA65-RSA4096-PKCS15-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-RSA4096-PKCS15-SHA512", { rsaPkcs1: true, hash: "SHA-384", rsaBits: 4096 });
-_comp("id-MLDSA65-ECDSA-P256-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-ECDSA-P256-SHA512", { ec: "P-256", hash: "SHA-256" });
-_comp("id-MLDSA65-ECDSA-P384-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-ECDSA-P384-SHA512", { ec: "P-384", hash: "SHA-384" });
-_comp("id-MLDSA65-ECDSA-brainpoolP256r1-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-ECDSA-BP256-SHA512", { unsupported: "brainpoolP256r1 is not in the WebCrypto ECDSA curve set" });
-_comp("id-MLDSA65-Ed25519-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-Ed25519-SHA512", { eddsa: "Ed25519" });
-_comp("id-MLDSA87-ECDSA-P384-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-ECDSA-P384-SHA512", { ec: "P-384", hash: "SHA-384" });
-_comp("id-MLDSA87-ECDSA-brainpoolP384r1-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-ECDSA-BP384-SHA512", { unsupported: "brainpoolP384r1 is not in the WebCrypto ECDSA curve set" });
-_comp("id-MLDSA87-Ed448-SHAKE256", "ML-DSA-87", "SHAKE256", "COMPSIG-MLDSA87-Ed448-SHAKE256", { unsupported: "the SHAKE256/64 pre-hash is not in the WebCrypto digest set" });
-_comp("id-MLDSA87-RSA3072-PSS-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-RSA3072-PSS-SHA512", { rsaPss: true, hash: "SHA-256", salt: 32, rsaBits: 3072 });
-_comp("id-MLDSA87-RSA4096-PSS-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-RSA4096-PSS-SHA512", { rsaPss: true, hash: "SHA-384", salt: 48, rsaBits: 4096 });
-_comp("id-MLDSA87-ECDSA-P521-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-ECDSA-P521-SHA512", { ec: "P-521", hash: "SHA-512" });
-
-var _b = asn1.build;
-// Wrap a raw component public key in the SPKI its WebCrypto import expects, so
-// each half is verified through the SAME import + verify seam the classical path
-// uses (no second parallel verify path). tradPK for RSA is the RSAPublicKey DER;
-// for EC the uncompressed point; for EdDSA the raw public key.
-function _spkiFor(algNode, keyBytes) { return _b.sequence([algNode, _b.bitString(keyBytes, 0)]); }
-function _mldsaSpki(mldsaOid, raw) { return _spkiFor(_b.sequence([_b.oid(oid.byName(mldsaOid))]), raw); }
-function _ecSpki(curve, point) { return _spkiFor(_b.sequence([_b.oid(oid.byName("ecPublicKey")), _b.oid(oid.byName(EC_CURVE_OID[curve]))]), point); }
-function _edSpki(name, raw) { return _spkiFor(_b.sequence([_b.oid(oid.byName(name))]), raw); }
-function _rsaSpki(rsaPub) { return _spkiFor(_b.sequence([_b.oid(oid.byName("rsaEncryption")), _b.nullValue()]), rsaPub); }
-
-// The exact modulus bit length of an RSAPublicKey (SEQUENCE { modulus, exponent }).
-function _rsaModulusBits(rsaPubDer) {
-  return asn1.read.integer(asn1.decode(rsaPubDer).children[0]).toString(2).length;
-}
-
-function _verifyTradComponent(trad, tradPK, tradSig, mprime) {
-  if (trad.ec) {
-    // draft sec. 5.1: the EC point MUST be the uncompressed X9.62 form (leading 0x04).
-    // A compressed / hybrid point is a non-conforming composite component encoding.
-    if (tradPK.length < 1 || tradPK[0] !== 0x04) return Promise.resolve(false);
-    return subtle.importKey("spki", _ecSpki(trad.ec, tradPK), { name: "ECDSA" }, false, ["verify"]).then(function (k) {
-      // The traditional ECDSA signature is DER Ecdsa-Sig-Value; convert to P1363
-      // through the shared reader that also rejects r/s outside [1,n-1] (CVE-2022-21449).
-      var p1363 = ecdsaDerToP1363(tradSig, trad.ec);
-      return subtle.verify({ name: "ECDSA", hash: trad.hash }, k, p1363, mprime);
-    });
-  }
-  if (trad.eddsa) {
-    return subtle.importKey("spki", _edSpki(trad.eddsa, tradPK), { name: trad.eddsa }, false, ["verify"])
-      .then(function (k) { return subtle.verify({ name: trad.eddsa }, k, tradSig, mprime); });
-  }
-  if (trad.rsaPss || trad.rsaPkcs1) {
-    // The composite OID fixes the RSA modulus size: a downgraded or mismatched modulus
-    // under the declared OID (an id-MLDSA44-RSA2048-* whose component is really 1024-bit)
-    // is rejected BEFORE verify, so a weak RSA component cannot satisfy an arm that
-    // promises 2048/3072/4096 bits. A malformed RSAPublicKey rejects the same way.
-    var bits;
-    try { bits = _rsaModulusBits(tradPK); }
-    catch (_e) { return Promise.resolve(false); }
-    if (bits !== trad.rsaBits) return Promise.resolve(false);
-    if (trad.rsaPss) {
-      return subtle.importKey("spki", _rsaSpki(tradPK), { name: "RSA-PSS", hash: trad.hash }, false, ["verify"])
-        .then(function (k) { return subtle.verify({ name: "RSA-PSS", saltLength: trad.salt }, k, tradSig, mprime); });
-    }
-    return subtle.importKey("spki", _rsaSpki(tradPK), { name: "RSASSA-PKCS1-v1_5", hash: trad.hash }, false, ["verify"])
-      .then(function (k) { return subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, k, tradSig, mprime); });
-  }
-  // Coverage residual -- unreachable: compositeVerify returns early for a
-  // trad.unsupported arm, so _verifyTradComponent runs only for arms that set
-  // exactly one of ec/eddsa/rsaPss/rsaPkcs1; this final fallthrough is a backstop.
-  return Promise.resolve(false);
-}
-
-// Verify a composite signature: `spkiBytes` the issuer SPKI DER, `sigBytes` the
-// raw signatureValue (mldsaSig || tradSig), `message` the signed region (tbsBytes).
-function compositeVerify(spkiBytes, sigBytes, message, d) {
-  if (d.trad.unsupported) {
-    return Promise.resolve({ ok: false, code: "path/unsupported-algorithm",
-      error: E("path/unsupported-algorithm", "composite " + d.name + ": " + d.trad.unsupported) });
-  }
-  var rawKey;
-  try {
-    var bs = asn1.read.bitString(asn1.decode(spkiBytes).children[1]);
-    // The composite subjectPublicKey is an octet-aligned concatenation (no unused
-    // bits); a non-zero unused-bit count is malformed.
-    if (bs.unusedBits !== 0) throw E("path/bad-signature", "composite subjectPublicKey has unused bits");
-    rawKey = bs.bytes;
-  } catch (e) { return Promise.resolve({ ok: false, code: pathCode(e, "path/bad-signature"), error: e }); }
-  // The ML-DSA half is fixed-length and FIRST; the traditional half is the
-  // remainder. Both must be non-empty for a well-formed composite.
-  if (rawKey.length <= d.mldsaPk || sigBytes.length <= d.mldsaSig) {
-    return Promise.resolve({ ok: false, code: "path/bad-signature",
-      error: E("path/bad-signature", "composite key/signature shorter than the fixed ML-DSA component") });
-  }
-  var mldsaPK = rawKey.subarray(0, d.mldsaPk), tradPK = rawKey.subarray(d.mldsaPk);
-  var mldsaSig = sigBytes.subarray(0, d.mldsaSig), tradSig = sigBytes.subarray(d.mldsaSig);
-  return subtle.digest({ name: d.ph }, message).then(function (phBuf) {
-    // M' = Prefix || Label || len(ctx)=0 || ctx="" || PH(M). In X.509 path
-    // validation the application context is empty (a caller ctx is out of scope).
-    var mprime = Buffer.concat([COMPOSITE_PREFIX, d.label, Buffer.from([0]), Buffer.from(phBuf)]);
-    var mldsaP = subtle.importKey("spki", _mldsaSpki(d.mldsaOid, mldsaPK), { name: d.mldsa }, false, ["verify"])
-      .then(function (mk) { return subtle.verify({ name: d.mldsa, context: d.label }, mk, mldsaSig, mprime); });
-    var tradP = _verifyTradComponent(d.trad, tradPK, tradSig, mprime);
-    return Promise.all([mldsaP, tradP]).then(function (r) { return { ok: r[0] === true && r[1] === true }; });
-  }).catch(function (e) { return { ok: false, code: pathCode(e, "path/bad-signature"), error: e }; });
-}
+// The composite verify/sign engine + the COMPOSITE_ALGS OID-keyed registry live in
+// composite-sig.js (shared with CMS composite SignerInfo). Path validation composes it:
+// resolveDescriptor (above) delegates to compositeSig.resolveCompositeDescriptor, the
+// certificate + OCSP verify paths to compositeSig.compositeVerify, and
+// compositeKeyUsageCheck (below) enforces the sec. 5.2 signature-only keyUsage restriction.
 
 // draft-ietf-lamps-pq-composite-sigs sec. 5.2: a certificate whose SubjectPublicKeyInfo
 // carries a composite ML-DSA OID, IF it has a keyUsage extension, MUST assert at least
@@ -500,6 +331,19 @@ function compositeKeyUsageCheck(cert) {
   return { ok: true };
 }
 
+// Import a descriptor's verification key, validating an EdDSA point FIRST: node/OpenSSL import a
+// low-order (e.g. identity or all-zeroes) Ed25519/Ed448 SPKI without complaint and such a key
+// verifies a forged signature. This is the ONE seam both the certificate path and the revocation
+// (CRL / OCSP-response) path import through, so neither can skip the point gate -- a low-order
+// issuer / responder key fails the caller closed (a rejected promise the caller maps to a bad
+// verdict), never verifying a forged chain or a forged revocation.
+function _importVerifyKey(spkiBytes, d) {
+  try {
+    if (d.eddsa) edwardsPoint.validateSpki(spkiBytes, d.eddsa, PathError, "path/bad-signature");
+  } catch (e) { return Promise.reject(e); }
+  return subtle.importKey("spki", spkiBytes, d.imp, false, ["verify"]);
+}
+
 // Verify cert.signatureValue over cert.tbsBytes with the working public key.
 function builtinVerify(state, cert) {
   var d;
@@ -513,12 +357,12 @@ function builtinVerify(state, cert) {
   // A composite signature verifies its ML-DSA and traditional halves and accepts
   // IFF both pass -- delegated to the composite combinator (which reuses this
   // file's ECDSA range-check + the same import/verify seam).
-  if (d.composite) return compositeVerify(state.workingPublicKey, cert.signatureValue.bytes, cert.tbsBytes, d.composite);
+  if (d.composite) return compositeSig.compositeVerify(state.workingPublicKey, cert.signatureValue.bytes, cert.tbsBytes, d.composite, PathError, "path/unsupported-algorithm", "path/bad-signature");
   var key;
-  return subtle.importKey("spki", state.workingPublicKey, d.imp, false, ["verify"]).then(function (k) {
+  return _importVerifyKey(state.workingPublicKey, d).then(function (k) {
     key = k;
     var sig = cert.signatureValue.bytes;
-    if (d.ecdsa) sig = ecdsaDerToP1363(sig, key.algorithm.namedCurve);
+    if (d.ecdsa) sig = validator.sig.ecdsaDerToP1363(sig, key.algorithm.namedCurve, PathError, "path/bad-signature");
     return subtle.verify(d.verify, key, sig, cert.tbsBytes);
   }).then(function (ok) {
     return { ok: ok === true };
@@ -1365,7 +1209,7 @@ async function validate(path, opts) {
     // draft-ietf-lamps-pq-composite-sigs sec. 5.2: a composite-keyed certificate's
     // keyUsage must be signature-only (no dual-usage). Runs for the target AND every
     // intermediate whose own subject key is composite.
-    if (COMPOSITE_ALGS[cert.subjectPublicKeyInfo.algorithm.oid]) {
+    if (compositeSig.COMPOSITE_ALGS[cert.subjectPublicKeyInfo.algorithm.oid]) {
       var cku = compositeKeyUsageCheck(cert);
       checks.push({ name: "compositeKeyUsage", ok: cku.ok, code: cku.ok ? undefined : cku.code });
       if (!cku.ok) failed = true;
@@ -1946,10 +1790,10 @@ function _verifyWithSpki(sigAlg, rawSig, spkiBytes, tbsBytes) {
   // A composite-signed CRL / OCSP response verifies through the same combinator
   // (both halves must pass) that the certificate path uses -- one composite verify,
   // never a second parallel one.
-  if (d.composite) return compositeVerify(spkiBytes, rawSig, tbsBytes, d.composite).then(function (r) { return r.ok === true; });
-  return subtle.importKey("spki", spkiBytes, d.imp, false, ["verify"]).then(function (key) {
+  if (d.composite) return compositeSig.compositeVerify(spkiBytes, rawSig, tbsBytes, d.composite, PathError, "path/unsupported-algorithm", "path/bad-signature").then(function (r) { return r.ok === true; });
+  return _importVerifyKey(spkiBytes, d).then(function (key) {
     var sig = rawSig;
-    if (d.ecdsa) sig = ecdsaDerToP1363(sig, key.algorithm.namedCurve);
+    if (d.ecdsa) sig = validator.sig.ecdsaDerToP1363(sig, key.algorithm.namedCurve, PathError, "path/bad-signature");
     return subtle.verify(d.verify, key, sig, tbsBytes);
   }).then(function (ok) { return ok === true; }, function () { return false; });
 }
@@ -2113,7 +1957,7 @@ async function ocspAuthorizeResponder(basicResponse, cert, issuer, issuerKeyBits
     // A composite-keyed delegate is an out-of-path signer cert and gets the same
     // composite keyUsage gate the path certificates do (draft sec. 5.2): a dual-usage
     // composite responder key (a forbidden encryption bit set) is not authorized.
-    if (COMPOSITE_ALGS[rc.subjectPublicKeyInfo.algorithm.oid] && !compositeKeyUsageCheck(rc).ok) continue;
+    if (compositeSig.COMPOSITE_ALGS[rc.subjectPublicKeyInfo.algorithm.oid] && !compositeKeyUsageCheck(rc).ok) continue;
     return ocspResponderSpki(rc, issuer);
   }
   return null;

package/lib/schema-all.js

@@ -301,7 +301,7 @@ module.exports = {
   pkcs12: { parse: pkcs12.parse, pemDecode: pkcs12.pemDecode, pemEncode: pkcs12.pemEncode },
   cms:  { parse: cms.parse, pemDecode: cms.pemDecode, pemEncode: cms.pemEncode },
   ocsp: { parseRequest: ocsp.parseRequest, parseResponse: ocsp.parseResponse, pemDecode: ocsp.pemDecode, pemEncode: ocsp.pemEncode },
-  tsp: { parse: tsp.parse, parseTstInfo: tsp.parseTstInfo, parseToken: tsp.parseToken, pemDecode: tsp.pemDecode, pemEncode: tsp.pemEncode },
+  tsp: { parse: tsp.parse, parseResponse: tsp.parseResponse, parseRequest: tsp.parseRequest, parseTstInfo: tsp.parseTstInfo, parseToken: tsp.parseToken, pemDecode: tsp.pemDecode, pemEncode: tsp.pemEncode },
   crmf: { parse: crmf.parse, pemDecode: crmf.pemDecode, pemEncode: crmf.pemEncode },
   cmp: { parse: cmp.parse, pemDecode: cmp.pemDecode, pemEncode: cmp.pemEncode },
   csrattrs: { parse: csrattrs.parse },