@blamejs/pki 0.2.17 → 0.2.19

package/lib/validator-sig.js

@@ -71,4 +71,51 @@ function rawToEcdsaDer(raw, coordLen) {
   return asn1.build.sequence([asn1.build.integer(r), asn1.build.integer(s)]);
 }
 
-module.exports = { ecdsaSigToRaw: ecdsaSigToRaw, rawToEcdsaDer: rawToEcdsaDer };
+// The curve group orders n -- a valid ECDSA signature has r, s in [1, n-1].
+var CURVE_FIELD_BYTES = { "P-256": 32, "P-384": 48, "P-521": 66 };
+var CURVE_ORDER = {
+  "P-256": BigInt("0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551"),
+  "P-384": BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973"),
+  "P-521": BigInt("0x01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409"),
+};
+
+// ecdsaDerToP1363(der, curve, E, code) -> the DER ECDSA-Sig-Value converted to raw r||s (P1363),
+// each coordinate left-padded to the curve field width, rejecting r or s outside [1, n-1] against
+// the curve ORDER (CVE-2022-21449 "Psychic Signatures" -- the r/s = 0 case AND the >= n upper
+// bound). `curve` is a WebCrypto namedCurve (P-256/384/521). This is the ORDER-AWARE gate a
+// verifier that knows the curve order MUST use; it is STRICTER than ecdsaSigToRaw above, which
+// bounds r/s only by the field SIZE (>= 1, <= coordLen bytes) and does not know the order. A
+// signature whose r or s is >= n is rejected here but passes ecdsaSigToRaw -- do not conflate them.
+// @enforced-by behavioral -- the RED conformance vectors (r/s = 0, r/s >= n, non-minimal, over-size)
+// and the composite-signature + path-validation KATs are the guard.
+function ecdsaDerToP1363(der, curve, E, code) {
+  var width = CURVE_FIELD_BYTES[curve];
+  var order = CURVE_ORDER[curve];
+  if (!width || !order) throw new E(code, "unsupported ECDSA curve " + curve);
+  var n;
+  try { n = asn1.decode(der); }
+  catch (e) { throw new E(code, "ECDSA signature is not a DER SEQUENCE(r,s)", e); }
+  if (n.tagClass !== "universal" || n.tagNumber !== asn1.TAGS.SEQUENCE || !n.children || n.children.length !== 2) {
+    throw new E(code, "ECDSA signature must be a SEQUENCE of exactly two INTEGERs");
+  }
+  var r = asn1.read.integer(n.children[0]);
+  var s = asn1.read.integer(n.children[1]);
+  if (r < 1n || s < 1n || r >= order || s >= order) {
+    throw new E(code, "ECDSA signature component out of range [1, n-1] (CVE-2022-21449)");
+  }
+  function pad(v) {
+    var hex = v.toString(16);
+    if (hex.length % 2) hex = "0" + hex;
+    var buf = Buffer.from(hex, "hex");
+    // Coverage residual -- unreachable: a component needing more than `width` bytes is >=
+    // 2^(8*width) > n (the curve order n < 2^(8*width) for P-256/384/521), so it is already
+    // rejected by the r/s >= order check above; this width guard is a defense-in-depth backstop.
+    if (buf.length > width) throw new E(code, "ECDSA signature component wider than the curve field");
+    var out = Buffer.alloc(width);
+    buf.copy(out, width - buf.length);
+    return out;
+  }
+  return Buffer.concat([pad(r), pad(s)]);
+}
+
+module.exports = { ecdsaSigToRaw: ecdsaSigToRaw, rawToEcdsaDer: rawToEcdsaDer, ecdsaDerToP1363: ecdsaDerToP1363 };

package/lib/webcrypto.js

@@ -627,7 +627,7 @@ SubtleCrypto.prototype.unwrapKey = async function unwrapKey(format, wrappedKey,
     // notice. The shared JSON guard parses strictly (bounded, fatal UTF-8, and a
     // smuggled duplicate member rejected rather than resolved last-wins), and its
     // failure surfaces as the module's typed webcrypto/data (W3C: DataError).
-    keyData = guard.json.parse(bytes, WebCryptoError, {
+    keyData = guard.json.parse(bytes, _wcErr, {
       maxBytes: constants.LIMITS.JSON_MAX_BYTES, maxDepth: constants.LIMITS.JSON_MAX_DEPTH,
       badJson: "webcrypto/data", tooDeep: "webcrypto/data", duplicateMember: "webcrypto/data",
       tooLarge: "webcrypto/data", badInput: "webcrypto/data", label: "the unwrapped JWK",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.2.17",
+  "version": "0.2.19",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:e4cc4e90-fbb7-4869-9baf-d6ce16b67d7f",
+  "serialNumber": "urn:uuid:d6e0649c-f4db-4241-8784-6f3c9d3d663f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-14T04:28:56.898Z",
+    "timestamp": "2026-07-14T16:14:40.970Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.2.17",
+      "bom-ref": "@blamejs/pki@0.2.19",
       "type": "application",
       "name": "pki",
-      "version": "0.2.17",
+      "version": "0.2.19",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.2.17",
+      "purl": "pkg:npm/%40blamejs/pki@0.2.19",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.2.17",
+      "ref": "@blamejs/pki@0.2.19",
       "dependsOn": []
     }
   ]