@blamejs/pki 0.2.21 → 0.2.23

package/lib/cms-sign.js

@@ -17,101 +17,25 @@ var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
-var pkcs8 = require("./schema-pkcs8");
 var pkix = require("./schema-pkix");
-var webcrypto = require("./webcrypto");
-var subtle = webcrypto.webcrypto.subtle;
-var validator = require("./validator-all");
-var compositeSig = require("./composite-sig");
 var frameworkError = require("./framework-error");
 
+var signScheme = require("./sign-scheme");
 var CmsError = frameworkError.CmsError;
 var b = asn1.build;
 function _err(code, message, cause) { return new CmsError(code, message, cause); }
+// The domain error factory the shared sign-scheme resolver/signer throws through (kind ->
+// cms/<kind>), so its faults keep the cms/* codes.
+function _signE(kind, message, cause) { return new CmsError("cms/" + kind, message, cause); }
 function O(name) { return oid.byName(name); }
 
-// A digest-algorithm name -> the WebCrypto hash (sign path). SHAKE256 has no WebCrypto hash, so
-// the message digest is always computed with node:crypto (below), uniform across the family.
-var HASH = { sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" };
 var NODE_DIGEST = { sha256: "sha256", sha384: "sha384", sha512: "sha512", shake128: "shake128", shake256: "shake256" };
 var SHAKE_OUT = { shake128: 32, shake256: 64 };   // SHAKE output lengths: SHAKE128 256-bit (RFC 9814 sec. 4), SHAKE256 512-bit (RFC 8419 sec. 2.3 / RFC 9814)
-var PSS_SALT = { "SHA-256": 32, "SHA-384": 48, "SHA-512": 64 };
-var ECDSA_ALG = { sha256: "ecdsaWithSHA256", sha384: "ecdsaWithSHA384", sha512: "ecdsaWithSHA512" };
-var HASH_NAME_BY_OID = {};
-HASH_NAME_BY_OID[O("sha256")] = "sha256";
-HASH_NAME_BY_OID[O("sha384")] = "sha384";
-HASH_NAME_BY_OID[O("sha512")] = "sha512";
-var EC_BY_CURVE_OID = {};
-EC_BY_CURVE_OID[O("prime256v1")] = { curve: "P-256", coordLen: 32 };
-EC_BY_CURVE_OID[O("secp384r1")] = { curve: "P-384", coordLen: 48 };
-EC_BY_CURVE_OID[O("secp521r1")] = { curve: "P-521", coordLen: 66 };
-// ML-DSA (RFC 9882): the signer cert SPKI algorithm OID -> its WebCrypto name. Registry-keyed
-// (Hard rule #2, no dotted-decimal literal). The same OID identifies both the key and the signature.
-var MLDSA_BY_OID = {};
-MLDSA_BY_OID[O("id-ml-dsa-44")] = "ML-DSA-44";
-MLDSA_BY_OID[O("id-ml-dsa-65")] = "ML-DSA-65";
-MLDSA_BY_OID[O("id-ml-dsa-87")] = "ML-DSA-87";
-// The message-digest algorithms suitable for each ML-DSA parameter set (RFC 9882 sec. 3.3 /
-// Table 1): a digest MUST offer at least the parameter set's collision strength (lambda) and at
-// least 2*lambda bits of output. SHA-512 is suitable for all sets; SHAKE256 (512-bit output) too.
-// Below-strength digests downgrade the signature to the weaker of the two (the whichever-is-lower
-// rule), so they are refused fail-closed on sign and verify -- the RFC's "verifiers MAY reject".
-var MLDSA_SUITABLE_DIGEST = {
-  "ML-DSA-44": { sha256: 1, sha384: 1, sha512: 1, shake256: 1 },
-  "ML-DSA-65": { sha384: 1, sha512: 1, shake256: 1 },
-  "ML-DSA-87": { sha512: 1, shake256: 1 },
-};
-// SLH-DSA (RFC 9814): the twelve pure FIPS 205 sets. The signer cert SPKI algorithm OID -> its
-// WebCrypto set name ("SLH-DSA-"+SET, mirroring webcrypto's SLH_DSA_NODE / path-validate) + the
-// RFC 9814 sec. 4 pinned message digest for that set. The sig and key share one OID; the digest is
-// FIXED per set (no caller choice, unlike ML-DSA's suitable-set). Registry-keyed (Hard rule #2).
-var SLHDSA_BY_OID = {};
-[["sha2-128s", "sha256"], ["sha2-128f", "sha256"], ["sha2-192s", "sha512"], ["sha2-192f", "sha512"],
- ["sha2-256s", "sha512"], ["sha2-256f", "sha512"], ["shake-128s", "shake128"], ["shake-128f", "shake128"],
- ["shake-192s", "shake256"], ["shake-192f", "shake256"], ["shake-256s", "shake256"], ["shake-256f", "shake256"]
-].forEach(function (r) { SLHDSA_BY_OID[O("id-slh-dsa-" + r[0])] = { wc: "SLH-DSA-" + r[0].toUpperCase(), digest: r[1] }; });
 
 var OID_DATA = O("data");
 var OID_SIGNED_DATA = O("signedData");
 var OID_SKI = O("subjectKeyIdentifier");
 
-// An AlgorithmIdentifier { OID } (absent parameters) or { OID, NULL }.
-function _algId(name, shape) { return shape === "null" ? b.sequence([b.oid(O(name)), b.nullValue()]) : b.sequence([b.oid(O(name))]); }
-// The RSASSA-PSS AlgorithmIdentifier with the params SEQUENCE cms.verify's _resolvePss accepts:
-// an explicit SHA-2 hashAlgorithm, MGF1 keyed to the same hash, the hash-length saltLength, and
-// the default trailerField (omitted). RFC 4055.
-function _pssAlgId(digestName) {
-  var hashAlg = b.sequence([b.oid(O(digestName)), b.nullValue()]);
-  var mgf = b.sequence([b.oid(O("mgf1")), hashAlg]);
-  var params = b.sequence([b.explicit(0, hashAlg), b.explicit(1, mgf), b.explicit(2, b.integer(BigInt(PSS_SALT[HASH[digestName]])))]);
-  return b.sequence([b.oid(O("rsassaPss")), params]);
-}
-
-// An id-RSASSA-PSS SubjectPublicKeyInfo MAY pin the permitted hash in its RSASSA-PSS-params
-// (RFC 4055 sec. 1.2 / sec. 3.1): a key generated for SHA-384 cannot sign under SHA-256. Read the
-// pinned digest name from the SPKI algorithm parameters so signing honors the key's restriction
-// instead of hard-coding SHA-256. Absent params (an unrestricted key) or an unrecognized hash
-// returns null -- the caller then falls back to its opts.digestAlgorithm or the SHA-256 default.
-function _pssHashFromSpki(cert) {
-  var params = cert.subjectPublicKeyInfo.algorithm.parameters;
-  if (params == null) return null;                              // an unrestricted id-RSASSA-PSS key
-  // params is the raw parameters TLV the strict codec already validated when it parsed the cert,
-  // so re-decoding a single valid TLV cannot throw. Read the pinned hash structurally, defaulting
-  // to null (caller falls back) whenever the shape is not the expected RSASSA-PSS-params.
-  var node = asn1.decode(params);
-  if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children) return null;
-  var hashField = node.children.filter(function (c) { return c.tagClass === "context" && c.tagNumber === 0; })[0];
-  if (!hashField || !hashField.children || !hashField.children[0] || !hashField.children[0].children) return null;
-  var oidNode = hashField.children[0].children[0];             // [0] EXPLICIT AlgorithmIdentifier { hash OID, ... }
-  if (!oidNode || oidNode.tagClass !== "universal" || oidNode.tagNumber !== asn1.TAGS.OBJECT_IDENTIFIER) return null;
-  var pinnedOid = asn1.read.oid(oidNode);
-  var name = HASH_NAME_BY_OID[pinnedOid];
-  // A recognized SHA-2 pin resolves to its name; an unsupported pinned hash (e.g. SHA-3) fails
-  // closed -- we cannot honor the key's restriction, so we never silently sign under a different
-  // digest the key forbids.
-  if (!name) throw _err("cms/unsupported-algorithm", "the id-RSASSA-PSS signer key pins an unsupported hash algorithm (" + pinnedOid + ")");
-  return name;
-}
 
 // The message digest of the content under the digest algorithm (SHA-2 or SHAKE256).
 function _digest(digestName, content) {
@@ -121,83 +45,6 @@ function _digest(digestName, content) {
   return h.update(content).digest();
 }
 
-// Resolve the sign scheme from the signer certificate's public-key algorithm + per-signer opts:
-// the digest, the digestAlgorithm and signatureAlgorithm AlgorithmIdentifiers (with the exact
-// parameter shape cms.verify requires), and the WebCrypto import + sign algorithms.
-function _scheme(cert, so, noSignedAttrs) {
-  var alg = cert.subjectPublicKeyInfo.algorithm;
-  var keyOid = alg.oid;
-  var comp = compositeSig.COMPOSITE_ALGS[keyOid];
-  if (comp) {
-    // Composite ML-DSA (draft-ietf-lamps-cms-composite-sigs): the arm DICTATES the CMS
-    // digestAlgorithm (its pre-hash, Table 1) -- unlike RSA/ECDSA the digest is not a caller
-    // choice, so a conflicting so.digestAlgorithm is rejected. The 3 arms Node's WebCrypto surface
-    // cannot sign (brainpool curves; the SHAKE256/64 pre-hash) fail closed at config time -- never
-    // a partial single-component signature.
-    if (comp.trad.unsupported) throw _err("cms/unsupported-algorithm", "composite " + comp.name + ": " + comp.trad.unsupported);
-    if (so.digestAlgorithm && so.digestAlgorithm !== comp.phCms) throw _err("cms/bad-input", "composite " + comp.name + " fixes the digestAlgorithm to " + comp.phCms + " (draft-ietf-lamps-cms-composite-sigs sec. 3.4); " + JSON.stringify(so.digestAlgorithm) + " conflicts");
-    return { composite: comp, digest: comp.phCms, digestAlgId: _algId(comp.phCms, "absent"), sigAlgId: _algId(comp.name, "absent") };
-  }
-  if (keyOid === O("rsaEncryption") || keyOid === O("rsassaPss")) {
-    var isPssKey = keyOid === O("rsassaPss");
-    // An id-RSASSA-PSS key MAY pin its permitted hash in the SPKI params (RFC 4055 sec. 1.2): honor
-    // that over the SHA-256 default so Node/OpenSSL does not reject the otherwise-valid signer with
-    // ERR_OSSL_DIGEST_NOT_ALLOWED. An explicit digestAlgorithm that contradicts the pin is rejected
-    // fail-closed rather than silently signed under a digest the key forbids.
-    var pinned = isPssKey ? _pssHashFromSpki(cert) : null;
-    if (pinned && so.digestAlgorithm && so.digestAlgorithm !== pinned) throw _err("cms/bad-input", "the signer key restricts the RSASSA-PSS digest to " + pinned + ", but digestAlgorithm " + JSON.stringify(so.digestAlgorithm) + " was requested");
-    var d = so.digestAlgorithm || pinned || "sha256";
-    if (!HASH[d]) throw _err("cms/unsupported-algorithm", "unsupported RSA digest algorithm " + JSON.stringify(d));
-    // A general rsaEncryption key signs PKCS#1 v1.5 by default, or RSASSA-PSS when opts.pss is set.
-    if (so.pss || isPssKey) return { digest: d, digestAlgId: _algId(d, "absent"), sigAlgId: _pssAlgId(d), imp: { name: "RSA-PSS", hash: HASH[d] }, sign: { name: "RSA-PSS", saltLength: PSS_SALT[HASH[d]] }, ecdsaDer: false };
-    return { digest: d, digestAlgId: _algId(d, "absent"), sigAlgId: _algId("rsaEncryption", "null"), imp: { name: "RSASSA-PKCS1-v1_5", hash: HASH[d] }, sign: { name: "RSASSA-PKCS1-v1_5" }, ecdsaDer: false };
-  }
-  if (keyOid === O("ecPublicKey")) {
-    var curveOid;
-    try { curveOid = asn1.read.oid(asn1.decode(alg.parameters)); }
-    catch (e) { throw _err("cms/unsupported-algorithm", "the signer EC key parameters are not a named-curve OID", e); }
-    var ec = EC_BY_CURVE_OID[curveOid];
-    if (!ec) throw _err("cms/unsupported-algorithm", "the signer key is on an unsupported EC curve");
-    var de = so.digestAlgorithm || "sha256";
-    if (!HASH[de]) throw _err("cms/unsupported-algorithm", "unsupported ECDSA digest algorithm " + JSON.stringify(de));
-    return { digest: de, digestAlgId: _algId(de, "absent"), sigAlgId: _algId(ECDSA_ALG[de], "absent"), imp: { name: "ECDSA", namedCurve: ec.curve }, sign: { name: "ECDSA", hash: HASH[de] }, ecdsaDer: true, coordLen: ec.coordLen };
-  }
-  if (keyOid === O("Ed25519") || keyOid === O("Ed448")) {
-    var name = keyOid === O("Ed25519") ? "Ed25519" : "Ed448";
-    var dd = so.digestAlgorithm || (name === "Ed25519" ? "sha512" : "shake256");
-    if (!NODE_DIGEST[dd]) throw _err("cms/unsupported-algorithm", "unsupported " + name + " digest algorithm " + JSON.stringify(dd));
-    return { digest: dd, digestAlgId: _algId(dd, "absent"), sigAlgId: _algId(name, "absent"), imp: { name: name }, sign: { name: name }, ecdsaDer: false };
-  }
-  if (MLDSA_BY_OID[keyOid]) {
-    // ML-DSA (RFC 9882): a one-shot post-quantum signature, pure mode, empty context. The signature
-    // covers the same sec. 5.4 preimage as every other scheme; digestAlgorithm names the message-
-    // digest algorithm (SHA-512 by default -- the sec. 3.3 MUST / interop default), which must be
-    // suitable for the parameter set (Q1 -- enforced on sign, refusing a below-strength digest).
-    var mlName = MLDSA_BY_OID[keyOid];
-    // RFC 9882 sec. 3.3: without signed attributes the digestAlgorithm has no meaning, but the
-    // signer MUST still emit SHA-512 to avoid an interoperability failure -- so force it (ignoring
-    // any caller digestAlgorithm) rather than carry a value a strict peer would reject. With signed
-    // attributes the digest must be suitable for the parameter set (Q1 -- enforced on sign).
-    var md;
-    if (noSignedAttrs) {
-      md = "sha512";
-    } else {
-      md = so.digestAlgorithm || "sha512";
-      if (!NODE_DIGEST[md]) throw _err("cms/unsupported-algorithm", "unsupported ML-DSA message digest " + JSON.stringify(md));
-      if (!MLDSA_SUITABLE_DIGEST[mlName][md]) throw _err("cms/unsupported-algorithm", "the " + md + " message digest is below the security strength of " + mlName + " (RFC 9882 sec. 3.3)");
-    }
-    return { digest: md, digestAlgId: _algId(md, "absent"), sigAlgId: _algId(oid.name(keyOid), "absent"), imp: { name: mlName }, sign: { name: mlName }, ecdsaDer: false };
-  }
-  if (SLHDSA_BY_OID[keyOid]) {
-    // SLH-DSA (RFC 9814): a one-shot post-quantum signature, pure mode, empty context. The message
-    // digest is FIXED per parameter set (sec. 4) -- emit it, and reject a contradicting caller
-    // digestAlgorithm fail-closed rather than carry a non-conformant digest.
-    var slh = SLHDSA_BY_OID[keyOid];
-    if (so.digestAlgorithm && so.digestAlgorithm !== slh.digest) throw _err("cms/bad-input", "SLH-DSA " + slh.wc + " requires the " + slh.digest + " message digest (RFC 9814 sec. 4); digestAlgorithm " + JSON.stringify(so.digestAlgorithm) + " conflicts");
-    return { digest: slh.digest, digestAlgId: _algId(slh.digest, "absent"), sigAlgId: _algId(oid.name(keyOid), "absent"), imp: { name: slh.wc }, sign: { name: slh.wc }, ecdsaDer: false };
-  }
-  throw _err("cms/unsupported-algorithm", "unsupported signer key algorithm " + keyOid);
-}
 
 // The raw issuer Name TLV from a parsed certificate (byte-identical to the cert, so the sid the
 // verifier canonically compares matches exactly). The issuer is the Name after the optional
@@ -215,30 +62,6 @@ function _skiValue(cert) {
   catch (e) { throw _err("cms/no-ski", "the signer certificate's subjectKeyIdentifier extension value is not an OCTET STRING", e); }
 }
 
-// A caller-supplied CryptoKey carries its OWN algorithm (name, and for RSA the baked-in hash,
-// for ECDSA the curve). A PKCS#8 key is imported under the resolved scheme, so it always agrees;
-// but a pre-imported CryptoKey whose algorithm disagrees with the certificate's scheme would
-// silently sign under a different hash than the digestAlgorithm advertises -- an inconsistent,
-// non-verifiable CMS. Reject the mismatch fail-closed.
-function _assertKeyMatchesScheme(key, imp) {
-  var ka = key.algorithm || {};
-  if (ka.name !== imp.name) throw _err("cms/bad-input", "the signer CryptoKey algorithm (" + ka.name + ") does not match the certificate's key algorithm (" + imp.name + ")");
-  if (imp.hash && (!ka.hash || ka.hash.name !== imp.hash)) throw _err("cms/bad-input", "the signer CryptoKey hash (" + (ka.hash && ka.hash.name) + ") does not match the signing digest (" + imp.hash + ")");
-  if (imp.namedCurve && ka.namedCurve !== imp.namedCurve) throw _err("cms/bad-input", "the signer CryptoKey curve (" + ka.namedCurve + ") does not match the certificate curve (" + imp.namedCurve + ")");
-}
-// Import the signer private key: a CryptoKey passed through, or a PKCS#8 DER Buffer / PEM string.
-function _importKey(key, imp) {
-  if (key && typeof key === "object" && !Buffer.isBuffer(key) && !(key instanceof Uint8Array) && key.type === "private") {
-    _assertKeyMatchesScheme(key, imp);
-    return Promise.resolve(key);
-  }
-  var der;
-  if (Buffer.isBuffer(key)) der = key;
-  else if (key instanceof Uint8Array) der = Buffer.from(key);
-  else if (typeof key === "string") { try { der = pkcs8.pemDecode(key); } catch (e) { throw _err("cms/bad-input", "the signer PEM private key could not be decoded", e); } }
-  else throw _err("cms/bad-input", "a signer key must be a CryptoKey, a PKCS#8 DER Buffer, or a PKCS#8 PEM string");
-  return subtle.importKey("pkcs8", der, imp, false, ["sign"]);
-}
 
 // Build one SignerInfo (RFC 5652 sec. 5.3) and sign it. Resolves the SignerInfo (as a build
 // node) plus its digestAlgorithm AlgorithmIdentifier and the signer certificate DER (for the
@@ -247,7 +70,7 @@ function _buildSignerInfo(signer, content, eContentType, opts) {
   var so = signer || {};
   var certDer = _normCertDer(so.cert);
   var cert = x509.parse(certDer);
-  var scheme = _scheme(cert, so, opts.signedAttributes === false);
+  var scheme = signScheme.resolveSignScheme(cert, so, opts.signedAttributes === false, _signE);
   var useSki = opts.sid === "ski";
   var sid = useSki
     ? b.contextPrimitive(0, _skiValue(cert))                                       // [0] IMPLICIT SubjectKeyIdentifier
@@ -282,7 +105,7 @@ function _buildSignerInfo(signer, content, eContentType, opts) {
     return { setOf: setOf, wire: wire };
   }).then(function (toSign) {
     var signedBytes = toSign.setOf ? toSign.setOf : toSign;   // SET-OF form for signing (sec. 5.4)
-    return _signScheme(scheme, so, signedBytes).then(function (sig) {
+    return signScheme.signOverTbs(scheme, so.key, signedBytes, _signE).then(function (sig) {
       var fields = [b.integer(BigInt(version)), sid, scheme.digestAlgId];
       if (toSign.wire) fields.push(toSign.wire);              // [0] IMPLICIT signedAttrs
       fields.push(scheme.sigAlgId, b.octetString(sig));
@@ -291,38 +114,7 @@ function _buildSignerInfo(signer, content, eContentType, opts) {
   });
 }
 
-// Sign the sec. 5.4 preimage under the resolved scheme -> the raw signature bytes for the
-// SignerInfo signature OCTET STRING. The classical path imports the single signer key and signs
-// (re-encoding ECDSA to canonical DER); the composite path signs BOTH component keys over the
-// domain-separated M' and returns mldsaSig || tradSig (composite-sig.js owns the construction).
-function _signScheme(scheme, so, signedBytes) {
-  if (scheme.composite) {
-    return compositeSig.compositeSign(scheme.composite, _normCompositeKeys(so.key, scheme.composite), signedBytes).then(function (sig) { return Buffer.from(sig); });
-  }
-  return _importKey(so.key, scheme.imp).then(function (priv) {
-    return subtle.sign(scheme.sign, priv, signedBytes).then(function (sigRaw) {
-      var sig = Buffer.from(sigRaw);
-      if (scheme.ecdsaDer) sig = validator.sig.rawToEcdsaDer(sig, scheme.coordLen);
-      return sig;
-    });
-  });
-}
 
-// A composite signer key is the two component private keys { mldsa, trad } as PKCS#8 (Node has no
-// single composite key type; the CMS draft is silent on key import). A missing/wrong-typed
-// component fails closed at config time -- never a partial single-component signature.
-function _normCompositeKeys(key, comp) {
-  if (!key || typeof key !== "object" || Buffer.isBuffer(key) || key instanceof Uint8Array || key.mldsa == null || key.trad == null) {
-    throw _err("cms/bad-input", "a composite " + comp.name + " signer key must be { mldsa: <PKCS#8>, trad: <PKCS#8> }");
-  }
-  return { mldsa: _normPkcs8(key.mldsa, "the composite ML-DSA component key"), trad: _normPkcs8(key.trad, "the composite traditional component key") };
-}
-function _normPkcs8(k, label) {
-  if (Buffer.isBuffer(k)) return k;
-  if (k instanceof Uint8Array) return Buffer.from(k);
-  if (typeof k === "string") { try { return pkcs8.pemDecode(k); } catch (e) { throw _err("cms/bad-input", label + " PEM could not be decoded", e); } }
-  throw _err("cms/bad-input", label + " must be a PKCS#8 DER Buffer, Uint8Array, or PEM string");
-}
 
 // A signing-time Time value: UTCTime before 2050, GeneralizedTime from 2050 (RFC 5652 sec. 11.3 /
 // RFC 5280 sec. 4.1.2.5). A caller Date overrides; false omits the attribute (handled above).
@@ -415,7 +207,4 @@ function _toBuf(v, what) {
 //   * `_assertKeyMatchesScheme`'s `!ka.hash` guard -- an `imp.hash` is set only for an RSA
 //     scheme, which requires `ka.name` to already equal the RSA name (else the earlier name
 //     check throws); an RSA CryptoKey always carries a `hash`, so `!ka.hash` never fires.
-// MLDSA_SUITABLE_DIGEST is shared with cms-verify (which requires this module) so the per-
-// parameter-set digest-strength policy has ONE home -- a digest accepted on sign is exactly the
-// set accepted on verify, and neither side can drift from the other (RFC 9882 sec. 3.3).
-module.exports = { sign: sign, MLDSA_SUITABLE_DIGEST: MLDSA_SUITABLE_DIGEST, SLHDSA_BY_OID: SLHDSA_BY_OID };
+module.exports = { sign: sign };

package/lib/cms-verify.js

@@ -35,8 +35,11 @@ var webcrypto = require("./webcrypto");
 var subtle = webcrypto.webcrypto.subtle;
 var edwardsPoint = require("./edwards-point");
 var cmsSign = require("./cms-sign");
-var MLDSA_SUITABLE_DIGEST = cmsSign.MLDSA_SUITABLE_DIGEST;   // shared sign/verify digest-strength policy (RFC 9882 sec. 3.3)
-var SLHDSA_BY_OID = cmsSign.SLHDSA_BY_OID;                   // shared SLH-DSA set -> { wc, digest } (RFC 9814 sec. 4 pinned digest)
+var cmsEncrypt = require("./cms-encrypt");
+var cmsDecrypt = require("./cms-decrypt");
+var signScheme = require("./sign-scheme");
+var MLDSA_SUITABLE_DIGEST = signScheme.MLDSA_SUITABLE_DIGEST;   // shared sign/verify digest-strength policy (RFC 9882 sec. 3.3)
+var SLHDSA_BY_OID = signScheme.SLHDSA_BY_OID;                   // shared SLH-DSA set -> { wc, digest } (RFC 9814 sec. 4 pinned digest)
 var validator = require("./validator-all");
 var compositeSig = require("./composite-sig");
 var guard = require("./guard-all");
@@ -587,4 +590,64 @@ function _addCert(out, der) {
  */
 var sign = cmsSign.sign;
 
-module.exports = { verify: verify, sign: sign };
+/**
+ * @primitive pki.cms.encrypt
+ * @signature pki.cms.encrypt(content, recipients, opts?) -> Promise<Buffer | string>
+ * @since 0.2.23
+ * @status experimental
+ * @spec RFC 5652, RFC 5083, RFC 5084, RFC 3560, RFC 5753, RFC 8418, RFC 9629, RFC 9936, RFC 3211, RFC 8018
+ * @related pki.cms.decrypt, pki.schema.cms.parse
+ *
+ * Encrypt content as a CMS EnvelopedData (CBC content), AuthEnvelopedData (AEAD content -- the
+ * default), or EncryptedData. `recipients` is an ARRAY of recipient descriptors for the enveloped
+ * family, each wrapping the SAME fresh content-encryption key: `{ cert }` auto-dispatches off the
+ * recipient certificate's public-key algorithm -- RSA yields a ktri with RSAES-OAEP-SHA256 (PKCS#1
+ * v1.5 is NEVER emitted); EC P-256/384/521 a kari with ephemeral-static ECDH and the X9.63 KDF;
+ * X25519/X448 a kari per RFC 8418 (HKDF); ML-KEM-512/768/1024 an ori/KEMRecipientInfo per RFC
+ * 9629 + 9936. `{ password }` yields a pwri (PBKDF2 + RFC 3211 PWRI-KEK); `{ kek, kekId }` a kekri
+ * (AES key wrap). For EncryptedData (no RecipientInfos), pass a single non-array `{ cek }` or
+ * `{ password }` descriptor. The default AES-256-GCM content encryption produces an
+ * authenticated AuthEnvelopedData; a CBC choice produces an unauthenticated EnvelopedData.
+ * Malformed input throws a typed `CmsError`.
+ *
+ * @opts contentEncryptionAlgorithm `"aes-256-gcm"` (default, AuthEnvelopedData) / `"aes-128-gcm"` / `"aes-256-cbc"` / `"aes-128-cbc"` (EnvelopedData).
+ * @opts contentType   The encapsulated content type (an OID name). Default `data`.
+ * @opts oaepHash      The RSAES-OAEP hash for ktri recipients: `"sha256"` (default) / `"sha384"` / `"sha512"`.
+ * @opts keyIdentifier The recipient identifier form: `"issuerAndSerial"` (default) or `"subjectKeyIdentifier"`.
+ * @opts ukm           User keying material (a Buffer) for kari / kemri recipients.
+ * @opts authAttrs     Authenticated attributes (SET OF Attribute) for AuthEnvelopedData.
+ * @opts pem           Return a PEM string instead of a DER Buffer.
+ * @example
+ *   var env = await pki.cms.encrypt(Buffer.from("secret"), [{ cert: recipientCertDer }]);
+ */
+var encrypt = cmsEncrypt.encrypt;
+
+/**
+ * @primitive pki.cms.decrypt
+ * @signature pki.cms.decrypt(input, keyMaterial, opts?) -> Promise<{ content, contentType, contentTypeName, recipientType, recipientIndex, contentEncryptionAlgorithm, authenticated }>
+ * @since 0.2.23
+ * @status experimental
+ * @spec RFC 5652, RFC 5083, RFC 5084, RFC 3560, RFC 5753, RFC 8418, RFC 9629, RFC 9936, RFC 3211, RFC 8018, RFC 3218
+ * @related pki.cms.encrypt, pki.schema.cms.parse
+ *
+ * Decrypt a CMS EnvelopedData / AuthEnvelopedData / EncryptedData (DER Buffer or PEM). It selects
+ * the recipient the key material targets, acquires the content-encryption key through the matching
+ * arm (ktri OAEP or PKCS#1 v1.5 decrypt-only; kari ECDH / X25519 / X448; kekri; pwri; ori/ML-KEM),
+ * and decrypts + authenticates the content. `keyMaterial` is `{ key, cert }` (the recipient
+ * private key + its certificate, which drives recipient matching), `{ password }`, `{ kek, kekId? }`,
+ * or `{ cek }` (EncryptedData raw-key mode). Fail-closed and oracle-free: every secret-dependent
+ * failure -- a bad key-wrap, a padding fault, a GCM tag mismatch, a PWRI check-byte mismatch --
+ * collapses to the SINGLE uniform `cms/decrypt-failed` verdict (Bleichenbacher / EFAIL oracle
+ * freedom), and the PKCS#1 v1.5 arm applies the RFC 3218 implicit-rejection countermeasure so its
+ * failure is indistinguishable. `authenticated` is true only for AuthEnvelopedData; a CBC
+ * EnvelopedData surfaces `authenticated: false` (the EFAIL caveat in the verdict itself).
+ *
+ * @opts recipientIndex Explicitly select the recipient by index (overrides key-material matching).
+ * @opts maxIterations  Lower the PBKDF2 iteration cap (a DoS bound; downward only).
+ * @example
+ *   var res = await pki.cms.decrypt(envDer, { key: recipientKeyPkcs8, cert: recipientCertDer });
+ *   res.content;   // the recovered plaintext Buffer
+ */
+var decrypt = cmsDecrypt.decrypt;
+
+module.exports = { verify: verify, sign: sign, encrypt: encrypt, decrypt: decrypt };

package/lib/constants.js

@@ -227,6 +227,12 @@ var LIMITS = {
   // enforced BEFORE parsing so a hostile document is refused up front.
   JSON_MAX_BYTES: BYTES.mib(1),
   JSON_MAX_DEPTH: 32,
+  // PBKDF2 iteration ceiling on the DECRYPT side (RFC 8018 pwri / PBES2). An attacker-supplied
+  // iterationCount is attacker-controlled work; a message above this is refused before any
+  // derivation (typed cms/iteration-limit), and a caller may cap it lower via opts.maxIterations.
+  // 10M clears the authoring default (600k) with generous headroom for high-security policies.
+  PBKDF2_MAX_ITERATIONS: 10000000,
+  PBKDF2_MAX_SALT: 1024,
   // ACME challenge token entropy floor (RFC 8555 sec. 8, errata 6950): >= 128
   // bits of base64url is >= 22 characters. A shorter token is refused before use.
   ACME_TOKEN_MIN_CHARS: 22,

package/lib/ocsp-verify.js

@@ -0,0 +1,226 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The documented surfaces are pki.path.ocspChecker
+// (revocation during path validation) and pki.ocsp.verify (standalone RFC 6960 sec. 3.2 client
+// acceptance), which BOTH compose this ONE verify core. There is deliberately no second, weaker
+// OCSP response-verification path: a standalone verify that re-derived the responder-authorization
+// gates would be the exact fail-open the out-of-path-signer-cert-full-validation discipline exists
+// to prevent.
+//
+// The core is a factory over an INJECTED `deps` seam so it has no back-edge into path-validate:
+// the signature engine (`verifyWithSpki`) and the RFC 5280 cert-profile gates
+// (`decodeExt`/`findExt`/`unrecognizedCriticalExtension`/`validateCriticalExtensionStructure`/
+// `compositeKeyUsageCheck`/`isNullOrAbsentParams`/`spliceSpkiParameters`/`dnEqual`) are supplied by
+// the caller that owns them; everything OCSP-specific (CertID hash binding, responder
+// authorization, currency, status) lives here.
+//
+// Rule set (gap-checked verbatim against RFC 6960 sec. 3.2 / 4.1.1 / 4.2.2.2 / 4.2.2.2.1):
+//   - authorizeResponder: the issuing CA directly (responderID identifies the issuer) OR a
+//     CA-issued delegate valid at `time` bearing id-kp-OCSPSigning (anyEKU / absent EKU do NOT
+//     authorize), keyUsage-permits-signing, no unknown/malformed critical extension, and
+//     id-pkix-ocsp-nocheck (a transport-free verify cannot otherwise confirm the responder is
+//     unrevoked); the delegate's own issuance signature is verified under the issuer key.
+//   - certIdMatches: serial + issuerNameHash + issuerKeyHash under the CertID's OWN hashAlgorithm
+//     (a serial-only match is a cross-CA substitution and is rejected).
+//   - currency: thisUpdate <= time and a bounded nextUpdate > time (a nextUpdate-less response is
+//     unusable per the lightweight profile).
+
+var asn1 = require("./asn1-der");
+var oid = require("./oid");
+var x509 = require("./schema-x509");
+var compositeSig = require("./composite-sig");
+var webcrypto = require("./webcrypto");
+var subtle = webcrypto.webcrypto.subtle;
+
+// CertID identity-hash algorithms (RFC 6960 sec. 4.1.1). SEPARATE from the signature HASH set
+// (which omits SHA-1, SHAttered): a CertID hash is an identity binding of an already-known issuer,
+// not a signature, so RFC 6960's default SHA-1 CertID MUST interoperate. A hash outside this set
+// cannot be reproduced -> no CertID match (fail closed).
+var OCSP_CERTID_HASHES = {};
+OCSP_CERTID_HASHES[oid.byName("sha1")] = "SHA-1";
+OCSP_CERTID_HASHES[oid.byName("sha256")] = "SHA-256";
+OCSP_CERTID_HASHES[oid.byName("sha384")] = "SHA-384";
+OCSP_CERTID_HASHES[oid.byName("sha512")] = "SHA-512";
+var OID_OCSP_SIGNING = oid.byName("ocspSigning");
+var OID_OCSP_NOCHECK = oid.byName("ocspNoCheck");
+var OID_EKU = oid.byName("extKeyUsage");
+var OID_KEY_USAGE = oid.byName("keyUsage");
+
+function ocspDigest(alg, buf) { return subtle.digest(alg, buf).then(function (h) { return Buffer.from(h); }); }
+
+// The subjectPublicKey BIT STRING VALUE (past the unused-bits octet) of an SPKI DER -- the exact
+// bytes an OCSP CertID issuerKeyHash / byKey KeyHash hash over (RFC 6960 sec. 4.1.1). Throws on a
+// malformed SPKI; the caller fails closed.
+function ocspKeyValue(spkiDer) {
+  return asn1.read.bitString(asn1.decode(spkiDer).children[1]).bytes;
+}
+
+// makeOcspVerify(deps) -> the bound OCSP verify core. deps = { verifyWithSpki, decodeExt, findExt,
+// unrecognizedCriticalExtension, validateCriticalExtensionStructure, compositeKeyUsageCheck,
+// isNullOrAbsentParams, spliceSpkiParameters, dnEqual } -- the signature engine + RFC 5280
+// cert-profile gates owned by the caller.
+function makeOcspVerify(deps) {
+  var verifyWithSpki = deps.verifyWithSpki;
+  var decodeExt = deps.decodeExt;
+  var findExt = deps.findExt;
+  var unrecognizedCriticalExtension = deps.unrecognizedCriticalExtension;
+  var validateCriticalExtensionStructure = deps.validateCriticalExtensionStructure;
+  var compositeKeyUsageCheck = deps.compositeKeyUsageCheck;
+  var isNullOrAbsentParams = deps.isNullOrAbsentParams;
+  var spliceSpkiParameters = deps.spliceSpkiParameters;
+  var dnEqual = deps.dnEqual;
+
+  // The delegate responder's importable SPKI, splicing the issuer's algorithm parameters in when
+  // the delegate key inherits them (an EC SPKI that omits the namedCurve, RFC 5280 sec. 4.1.2.7).
+  function ocspResponderSpki(rc, issuer) {
+    var keyAlg = rc.subjectPublicKeyInfo.algorithm;
+    if (!isNullOrAbsentParams(keyAlg.parameters)) return rc.subjectPublicKeyInfo.bytes;
+    var issuerOid, issuerParams;
+    // Coverage residual -- the catch is unreachable: this runs only after the delegate's signature
+    // verified under issuer.workingPublicKey, so that SPKI already imported and decodes cleanly.
+    try {
+      var alg = asn1.decode(issuer.workingPublicKey).children[0];
+      issuerOid = asn1.read.oid(alg.children[0]);
+      issuerParams = alg.children[1] ? alg.children[1].bytes : null;
+    } catch (_e) { return rc.subjectPublicKeyInfo.bytes; }
+    if (issuerOid === keyAlg.oid && !isNullOrAbsentParams(issuerParams)) {
+      return spliceSpkiParameters(rc.subjectPublicKeyInfo, keyAlg.oid, issuerParams);
+    }
+    return rc.subjectPublicKeyInfo.bytes;
+  }
+
+  // Returns true if `extList` carries any critical extension (this code processes no OCSP
+  // response/single extension semantics, so a critical one makes the response unusable).
+  function ocspHasCriticalExtension(extList) {
+    if (!extList) return false;
+    for (var i = 0; i < extList.length; i++) if (extList[i].critical) return true;
+    return false;
+  }
+
+  // A SingleResponse's CertID names the target cert IFF serial AND issuerNameHash + issuerKeyHash
+  // (under the CertID's OWN hashAlgorithm) match the issuer. `issuerNameCandidates` is every RFC
+  // 5280 sec. 7.1-equal byte encoding of the validated issuer DN to try.
+  async function ocspCertIdMatches(certID, cert, issuerNameCandidates, issuerKeyBits) {
+    if (certID.serialNumberHex !== cert.serialNumberHex) return false;
+    var hashName = OCSP_CERTID_HASHES[certID.hashAlgorithm.oid];
+    if (!hashName) return false;
+    var keyHash = await ocspDigest(hashName, issuerKeyBits);
+    if (!certID.issuerKeyHash.equals(keyHash)) return false;
+    for (var i = 0; i < issuerNameCandidates.length; i++) {
+      if (certID.issuerNameHash.equals(await ocspDigest(hashName, issuerNameCandidates[i]))) return true;
+    }
+    return false;
+  }
+
+  // Resolve the signer of a BasicOCSPResponse to an AUTHORIZED responder SPKI DER, or null. Two
+  // models: the issuing CA directly, or a CA-delegated responder (RFC 6960 sec. 4.2.2.2). Fails
+  // closed at every branch.
+  async function ocspAuthorizeResponder(basicResponse, cert, issuer, issuerKeyBits, time) {
+    var rid = basicResponse.responderID;
+    var matchesIssuer = false;
+    try {
+      if (rid.byName) matchesIssuer = dnEqual(rid.byName.rdns, cert.issuer.rdns);
+      else if (rid.byKey) matchesIssuer = rid.byKey.equals(await ocspDigest("SHA-1", issuerKeyBits));
+    } catch (_e) { matchesIssuer = false; }
+    if (matchesIssuer) return issuer.workingPublicKey;
+
+    for (var i = 0; i < basicResponse.certs.length; i++) {
+      var rc;
+      try { rc = x509.parse(basicResponse.certs[i]); }
+      catch (_e) { continue; }
+      var identifies = false;
+      try {
+        if (rid.byName) identifies = dnEqual(rid.byName.rdns, rc.subject.rdns);
+        else if (rid.byKey) identifies = rid.byKey.equals(await ocspDigest("SHA-1", ocspKeyValue(rc.subjectPublicKeyInfo.bytes)));
+      } catch (_e) { identifies = false; }
+      if (!identifies) continue;
+      // The delegate MUST be issued directly by the CA that issued the target.
+      var issuedByCa;
+      try { issuedByCa = dnEqual(rc.issuer.rdns, cert.issuer.rdns); }
+      catch (_e) { continue; }
+      if (!issuedByCa) continue;
+      if (!isOctetAligned(rc.signatureValue)) continue;
+      if (!(await verifyWithSpki(rc.signatureAlgorithm, rc.signatureValue.bytes, issuer.workingPublicKey, rc.tbsBytes))) continue;
+      // The delegate cert MUST itself be valid at the validation instant.
+      if (time < rc.validity.notBefore || time > rc.validity.notAfter) continue;
+      // The delegate MUST assert id-kp-OCSPSigning; anyEKU / an absent EKU do not.
+      var eku;
+      try { eku = decodeExt(rc, OID_EKU); }
+      catch (_e) { continue; }
+      if (!eku || eku.value.indexOf(OID_OCSP_SIGNING) === -1) continue;
+      // A delegate asserting keyUsage MUST permit digitalSignature; an absent keyUsage is
+      // unrestricted, an unreadable one is not authoritative.
+      var ku;
+      try { ku = decodeExt(rc, OID_KEY_USAGE); }
+      catch (_e) { continue; }
+      if (ku && ku.value.digitalSignature !== true) continue;
+      // An unknown critical extension (or a recognized-but-malformed one) makes the delegate
+      // unusable, the same fail-closed rule the path validator applies.
+      if (unrecognizedCriticalExtension(rc, false)) continue;
+      if (validateCriticalExtensionStructure(rc)) continue;
+      // The delegate MUST carry id-pkix-ocsp-nocheck (RFC 6960 sec. 4.2.2.2.1): a transport-free
+      // checker cannot otherwise confirm the responder cert is unrevoked.
+      if (!findExt(rc, OID_OCSP_NOCHECK)) continue;
+      // A composite-keyed delegate gets the same composite keyUsage gate the path certs do.
+      if (compositeSig.COMPOSITE_ALGS[rc.subjectPublicKeyInfo.algorithm.oid] && !compositeKeyUsageCheck(rc).ok) continue;
+      return ocspResponderSpki(rc, issuer);
+    }
+    return null;
+  }
+
+  // A BIT STRING is octet-aligned iff its unused-bits count is 0 -- reused from the caller's
+  // guard so a non-octet-aligned responder signature is never verified.
+  function isOctetAligned(bitString) { return !!bitString && bitString.unusedBits === 0; }
+
+  // evaluateResponse(resp, cert, issuer, issuerKeyBits, issuerNameCandidates, time, historical) ->
+  // a granular per-response SUMMARY for ONE parsed OCSPResponse, aggregating over ALL of its
+  // matching SingleResponses (a revoked SingleResponse shadows a good one WITHIN the response, the
+  // same fail-closed law the multi-response aggregator applies). Never throws (fail-closed):
+  //   { applicable, responderAuthorized, signatureValid, matched, revoked:{reason,revocationReason}?,
+  //     sawGood, sawUnknownStatus, thisUpdate?, nextUpdate?, reason }
+  async function evaluateResponse(resp, cert, issuer, issuerKeyBits, issuerNameCandidates, time, historical) {
+    if (resp.responseStatus.code !== 0) return { applicable: false, matched: false, reason: "non-successful OCSP responseStatus (" + resp.responseStatus.code + ")" };
+    var br = resp.basicResponse;
+    // Coverage residual -- unreachable for a parsed response (schema-ocsp enforces the
+    // successful<->responseBytes biconditional); backstop for a hand-built object.
+    if (!br) return { applicable: false, matched: false, reason: "successful OCSP response carries no BasicOCSPResponse" };
+    var signerSpki = await ocspAuthorizeResponder(br, cert, issuer, issuerKeyBits, time);
+    if (!signerSpki) return { applicable: true, matched: false, responderAuthorized: false, reason: "no authorized OCSP responder signs this response (RFC 6960 sec. 4.2.2.2)" };
+    if (!(await verifyWithSpki(br.signatureAlgorithm, br.signature, signerSpki, br.tbsResponseDataBytes))) {
+      return { applicable: true, matched: false, responderAuthorized: true, signatureValid: false, reason: "the OCSP response signature does not verify over tbsResponseData" };
+    }
+    if (ocspHasCriticalExtension(br.responseExtensions)) {
+      return { applicable: true, matched: false, responderAuthorized: true, signatureValid: true, reason: "the OCSP response carries an unrecognized critical extension" };
+    }
+    var out = { applicable: true, matched: false, responderAuthorized: true, signatureValid: true, revoked: null, sawGood: false, sawUnknownStatus: false, reason: "no current SingleResponse names this certificate" };
+    for (var s = 0; s < br.responses.length; s++) {
+      var sr = br.responses[s];
+      if (!(await ocspCertIdMatches(sr.certID, cert, issuerNameCandidates, issuerKeyBits))) continue;
+      if (ocspHasCriticalExtension(sr.singleExtensions)) continue;
+      if (sr.thisUpdate > time) continue;
+      if (!sr.nextUpdate || sr.nextUpdate < time) continue;
+      out.matched = true; out.thisUpdate = sr.thisUpdate; out.nextUpdate = sr.nextUpdate;
+      var st = sr.certStatus;
+      if (st.type === "revoked") {
+        // Present-time validation revokes regardless of a future revocationTime (skew/post-dating);
+        // only explicit historical validation defers a strictly-future revocation (reports good).
+        if (historical && st.revocationTime instanceof Date && st.revocationTime.getTime() > time.getTime()) { out.sawGood = true; }
+        else if (!out.revoked) { out.revoked = { revocationReason: st.revocationReason || null, reason: "certificate reported revoked by an authorized OCSP responder" + (st.revocationReason ? " (" + st.revocationReason + ")" : "") }; }
+      } else if (st.type === "good") { out.sawGood = true; }
+      else { out.sawUnknownStatus = true; }
+    }
+    return out;
+  }
+
+  return {
+    evaluateResponse: evaluateResponse,
+    authorizeResponder: ocspAuthorizeResponder,
+    certIdMatches: ocspCertIdMatches,
+    hasCriticalExtension: ocspHasCriticalExtension,
+    responderSpki: ocspResponderSpki,
+  };
+}
+
+module.exports = { makeOcspVerify: makeOcspVerify, ocspKeyValue: ocspKeyValue, ocspDigest: ocspDigest, OCSP_CERTID_HASHES: OCSP_CERTID_HASHES };