@blamejs/pki 0.2.28 → 0.2.29

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.2.29 — 2026-07-16
+
+Certificate Transparency log-list signature verification arrives as pki.ct.verifyLogListSignature: verify the detached signature published alongside the CT log list against a caller-pinned signer key, completing the offline log-list trust chain.
+
+### Added
+
+- pki.ct.verifyLogListSignature(json, signature, publicKey) verifies the detached signature over the Certificate Transparency log list (log_list.sig over log_list.json). The message is the raw json bytes, verified byte-for-byte with no canonicalization; publicKey is the caller-pinned signer SubjectPublicKeyInfo (there is no embedded key). The scheme is RSASSA-PKCS1-v1.5 with SHA-256 (an EC P-256 arm is accepted for future-proofing). It resolves true or false (a cryptographic verdict) and throws a typed CtError on a forgeable or unsupported key (an RSA exponent below 3, a sub-2048-bit RSA key, an unsupported key type or curve, a non-conformant ECDSA DER signature). Its verdict is cross-checked against OpenSSL's dgst -verify. Paired with pki.ct.parseLogList, this completes the offline CT log-list trust chain.
+
 ## v0.2.28 — 2026-07-16
 
 The Certificate Transparency log-list trust surface arrives as pki.ct.parseLogList and pki.ct.verifySctWithLogList: resolve a trusted CT log's key from an SCT's log id and verify it in one step, ingesting the CT log-list JSON into state- and temporal-interval-constrained trusted logs.

package/README.md

@@ -225,7 +225,7 @@ is callable today; nothing below is a stub.
 | `pki.smime` | RFC 8551 S/MIME message assembly, verification, encryption, and compression over the CMS layer — `sign(content, signers, opts)` wraps a MIME entity as a signed S/MIME message in either form: `multipart/signed` (clear-signed — the content stays readable in any MUA, a detached CMS SignedData rides alongside as `application/pkcs7-signature` with a matching `micalg`) or `application/pkcs7-mime; smime-type=signed-data` (opaque — the whole entity is a base64 CMS SignedData). The signed bytes are the entity's RFC 8551 §3.1.1 canonical form (CRLF line endings); `verify(message, opts)` unwraps both forms and recomputes over the same canonicalizer, so a transport that re-wraps line endings still verifies and a tampered part fails. `encrypt(content, recipients, opts)` envelopes a MIME entity as an opaque `application/pkcs7-mime` message and `decrypt(message, keyMaterial, opts)` opens one — `smime-type=authEnveloped-data` (AES-GCM, confidentiality and integrity, the default) or `smime-type=enveloped-data` (AES-CBC, confidentiality only, so `decrypt` reports `authenticated: false`, the §3.3 no-integrity caveat); the `smime-type` is derived from the CMS body, not the header, and decryption is fail-closed and oracle-free. The crypto is entirely `pki.cms.sign` / `verify` / `encrypt` / `decrypt` — any RSA / RSASSA-PSS / ECDSA / EdDSA / ML-DSA / SLH-DSA signer and any RSA-OAEP / ECDH / X25519 / X448 / AES-KW / PBKDF2 / ML-KEM recipient carries through (algorithm-agnostic). Like `cms.verify`, `verify` returns the per-signer cryptographic verdict plus the recovered content; chaining a signer to a trust anchor is the caller's `pki.path.validate` step. `compress(content, opts)` / `decompress(message, opts)` add the opaque `application/pkcs7-mime; smime-type=compressed-data; name=smime.p7z` frame (RFC 8551 §3.6, RFC 3274) — a size transform with no integrity/confidentiality (§2.4.5), decompress bounded against a bomb; the recovered content, which may itself be signed or enveloped, is returned for the caller to re-verify. Bidirectionally interoperable with `openssl smime` / `openssl cms`. Fail-closed with typed `smime/*` errors — `sign`, `verify`, `encrypt`, `decrypt`, `compress`, `decompress` |
 | `pki.tsp` | RFC 3161 Time-Stamp Protocol — `sign(messageImprint, tsa, opts)` produces a TimeStampToken: a CMS SignedData (over `pki.cms.sign`) whose content is a `TSTInfo` carrying the timestamped message imprint, the TSA policy, a serial number, and `genTime` (with optional accuracy / nonce / ordering), plus the RFC 3161 §2.4.2 signing-certificate attribute binding the token to the TSA certificate (SHA-2 imprints, any `pki.cms.sign` TSA key). `request` / `parseRequest` build and parse the TimeStampReq a client sends (imprint, requested policy, nonce, certReq), `response` / `parseResponse` the TimeStampResp a TSA returns — a granted status wrapping a token, or a rejection with PKIStatus and failure info, the §2.4.2 status↔token coupling enforced in both directions. `verify(token, data, opts)` verifies a token fail-closed: the CMS signature over the exact signed bytes, the message imprint recomputed from the data, the TSTInfo content type, the ESSCertID(V2) binding to the TSA certificate, the §2.3 critical timeStamping-only extendedKeyUsage, the request nonce when used, and — with a trust anchor supplied — full certification-path validation of the TSA certificate at the token's `genTime`, returning `{ valid, genTime, serialNumber, tstInfo, … }` — `sign`, `request`, `parseRequest`, `response`, `parseResponse`, `verify` |
 | `pki.ocsp` | RFC 6960 Online Certificate Status Protocol — the responder and relying-party surface. `buildRequest(query, opts)` builds an OCSPRequest for one or more `{ cert, issuer }` pairs (CertID hashed under SHA-1 by default per the RFC 5019 lightweight profile, or SHA-2; optional RFC 9654 nonce, optional requestor signature). `sign(responseData, responder, opts)` produces a signed BasicOCSPResponse over the exact `ResponseData` DER — the issuing CA directly or a delegated responder, any `pki.cms.sign` key including the post-quantum ML-DSA / SLH-DSA sets, with `good` / `revoked` (reason + time) / `unknown` per-certificate status, and `buildErrorResponse(status)` the unsigned §2.3 error (`tryLater` / `unauthorized` / …). `verify(response, opts)` verifies a response fail-closed against the same hardened gates `pki.path.ocspChecker` runs: the CertID binding, responder authorization (the issuing CA or a CA-issued delegate bearing id-kp-OCSPSigning **and** id-pkix-ocsp-nocheck, passing the full out-of-path certificate gates), the signature over `tbsResponseDataBytes`, currency (`thisUpdate`/`nextUpdate`), and the request-nonce echo — returning `{ status: "good" / "revoked" / "unknown", … }`, never a silent accept. Transport-free — `buildRequest`, `sign`, `buildErrorResponse`, `verify` |
-| `pki.ct` | RFC 6962 Certificate Transparency SCTs — `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries in the SCT extension (a TLS-presentation-language payload inside the §3.3 double DER wrap) into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature; `reconstructSignedData` rebuilds the exact `digitally-signed` preimage; `verifySct` verifies an SCT signature against a log's public key by reconstructing the signed data, routing an ECDSA signature through the strict DER-conformance gate, and verifying through the crypto engine — resolving true or false, and throwing a typed error on a structural fault. The producing side: `encodeSctList` builds the extension value byte-for-byte (the exact inverse of `parseSctList`) and `signSct` performs a log's signing step (rebuilding the same signed-data preimage the verifier hashes and signing it with the log's ECDSA-P-256 / RSA key). The trust surface: `parseLogList` ingests the CT log-list JSON into constraint-carrying trusted logs — recomputing each log's id as SHA-256 of its key and refusing a disagreeing id (a swapped key, §3.2), decoding the state + temporal-interval constraints — and `verifySctWithLogList` resolves the log key from an SCT's log id, enforces the state (usable/qualified/readonly trusted; retired only before retirement; pending/rejected refused) and the temporal-interval window, then delegates the signature check to `verifySct`. Structure decoded, crypto fail-closed — `parseSctList`, `reconstructSignedData`, `verifySct`, `encodeSctList`, `signSct`, `parseLogList`, `verifySctWithLogList` |
+| `pki.ct` | RFC 6962 Certificate Transparency SCTs — `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries in the SCT extension (a TLS-presentation-language payload inside the §3.3 double DER wrap) into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature; `reconstructSignedData` rebuilds the exact `digitally-signed` preimage; `verifySct` verifies an SCT signature against a log's public key by reconstructing the signed data, routing an ECDSA signature through the strict DER-conformance gate, and verifying through the crypto engine — resolving true or false, and throwing a typed error on a structural fault. The producing side: `encodeSctList` builds the extension value byte-for-byte (the exact inverse of `parseSctList`) and `signSct` performs a log's signing step (rebuilding the same signed-data preimage the verifier hashes and signing it with the log's ECDSA-P-256 / RSA key). The trust surface: `parseLogList` ingests the CT log-list JSON into constraint-carrying trusted logs — recomputing each log's id as SHA-256 of its key and refusing a disagreeing id (a swapped key, §3.2), decoding the state + temporal-interval constraints — and `verifySctWithLogList` resolves the log key from an SCT's log id, enforces the state (usable/qualified/readonly trusted; retired only before retirement; pending/rejected refused) and the temporal-interval window, then delegates the signature check to `verifySct`. `verifyLogListSignature(json, signature, publicKey)` verifies the detached `log_list.sig` over the raw log-list bytes against a caller-pinned signer key (RSASSA-PKCS1-v1.5/SHA-256, EC P-256 arm; forgeable-key defenses fail closed) — cross-checked against `openssl dgst`, completing the offline log-list trust chain. Structure decoded, crypto fail-closed — `parseSctList`, `reconstructSignedData`, `verifySct`, `encodeSctList`, `signSct`, `parseLogList`, `verifySctWithLogList`, `verifyLogListSignature` |
 | `pki.merkle` | RFC 6962 / RFC 9162 Merkle-tree proof verification — `leafHash` / `nodeHash` / `emptyRootHash` build the domain-separated (0x00 leaf / 0x01 node) SHA-256 tree hashes; `verifyInclusion` folds an audit proof back to a root and `verifyConsistency` reconstructs both the old and new root (the append-only guarantee), each constant-time-compared to a trusted checkpoint root. Fail-closed on bad geometry, sync hashing, transport-free — `leafHash`, `nodeHash`, `emptyRootHash`, `verifyInclusion`, `verifyConsistency` |
 | `pki.trust` | Mozilla / CCADB trust-store ingestion — `parseCertdata` reads the NSS `certdata.txt` object stream and `parseCcadbCsv` the CCADB CSV export into one identical constraint-carrying anchor shape: the per-purpose trust bits (only `CKT_NSS_TRUSTED_DELEGATOR` grants) and the per-purpose distrust-after dates the bare root list omits. Certificate and trust objects pair by byte-exact issuer + serial (never adjacency) and are cross-checked against the parsed DER, so metadata can never attach to the wrong root; `anchor()` hands an entry to `pki.path.validate({ trustAnchor, checkPurpose })`. Offline, fail-closed, bounded — `parseCertdata`, `parseCcadbCsv`, `anchor` |
 | `pki.shbs` | Stateful hash-based signature **verification** — HSS/LMS (RFC 8554), carried in X.509 by RFC 9802 and CMS by RFC 9708, profiled by NIST SP 800-208 (CNSA 2.0 firmware signing). `verify` checks an HSS signature (every level must pass) and `verifyLms` a single-tree LMS, over the raw public-key / signature blobs the parsers already surface. Pure public-input SHA-256 / SHAKE256 hashing, a data-driven typecode registry, bounds-before-slice reads; a malformed blob throws a typed `ShbsError`, a well-formed-but-wrong signature returns `false`. **Verify only by design** — stateful signing needs atomic one-time-key state that belongs in an HSM — `verify`, `verifyLms` |

package/lib/cms-verify.js

@@ -253,7 +253,9 @@ function _verifySignature(scheme, hashName, sigBytes, spki, signedBytes, curveOi
   if (scheme.kind === "ec") {
     var ec = EC_CURVE[curveOid];
     if (!ec) throw _err("cms/unsupported-algorithm", "the signer key is on an unsupported EC curve");
-    var raw = validator.sig.ecdsaSigToRaw(sigBytes, ec.coordLen, CmsError, "cms/bad-signature");
+    // The ORDER-AWARE gate: r,s in [1, n-1] per FIPS 186-5 sec. 6.4.2 (rejecting an out-of-range r/s >= the
+    // curve order n, not only the r=s=0 forgery) -- a verifier that knows the curve MUST use it.
+    var raw = validator.sig.ecdsaDerToP1363(sigBytes, ec.curve, CmsError, "cms/bad-signature");
     return subtle.importKey("spki", spki, { name: "ECDSA", namedCurve: ec.curve }, false, ["verify"])
       .then(function (k) { return subtle.verify({ name: "ECDSA", hash: hashName }, k, raw, signedBytes); });
   }

package/lib/ct.js

@@ -396,9 +396,10 @@ async function verifySct(entry, sct, logPublicKey) {
     if (!ec) throw new CtError("ct/unsupported-algorithm", "unsupported SCT log EC curve (RFC 6962 sec. 2.1.4 mandates NIST P-256)");
     imp = { name: "ECDSA", namedCurve: ec.curve };
     ver = { name: "ECDSA", hash: hashName };
-    // The SCT signature is a DER ECDSA-Sig-Value; route it through the strict conformance
-    // gate (primitive, minimal, positive, bounded r/s) before converting to raw r||s.
-    sig = validator.sig.ecdsaSigToRaw(sig, ec.coordLen, CtError, "ct/bad-signature");
+    // The SCT signature is a DER ECDSA-Sig-Value; route it through the ORDER-AWARE conformance gate
+    // (primitive, minimal, and r,s in [1, n-1] per FIPS 186-5 sec. 6.4.2 -- rejecting an out-of-range
+    // r/s >= the curve order n, not only the r=s=0 shape) before converting to raw r||s.
+    sig = validator.sig.ecdsaDerToP1363(sig, ec.curve, CtError, "ct/bad-signature");
   } else if (sigInfo.signatureName === "rsa") {
     if (alg.algOid !== oid.byName("rsaEncryption")) throw new CtError("ct/bad-input", "the SCT declares an RSA signature but the log key is not an RSA key");
     if (!(alg.rsaBits >= 2048)) throw new CtError("ct/unsupported-algorithm", "the SCT log RSA key is below the RFC 6962 sec. 2.1.4 minimum of 2048 bits");
@@ -622,6 +623,7 @@ function _parseTemporalInterval(ti) {
   if (typeof ti !== "object") throw _ctErr("ct/bad-log-list", "a CT log temporal_interval must be an object");
   var start = rfc3339.parse(ti.start_inclusive, _ctErr, "ct/bad-date", "temporal_interval.start_inclusive");
   var end = rfc3339.parse(ti.end_exclusive, _ctErr, "ct/bad-date", "temporal_interval.end_exclusive");
+  // allow:nan-date-comparison-unguarded -- start/end are rfc3339.parse results, guaranteed non-NaN (rfc3339.isValid rejects a NaN date).
   if (start.getTime() >= end.getTime()) throw _ctErr("ct/bad-log-list", "a CT log temporal_interval start_inclusive must be strictly before end_exclusive");
   return { startInclusive: start, endExclusive: end };
 }
@@ -787,6 +789,63 @@ async function verifySctWithLogList(entry, sct, logList, opts) {
   return verifySct(entry, sct, log.key);   // the shipped crypto verdict (re-checks the logId binding)
 }
 
+/**
+ * @primitive  pki.ct.verifyLogListSignature
+ * @signature  pki.ct.verifyLogListSignature(json, signature, publicKey) -> Promise<boolean>
+ * @since      0.2.29
+ * @status     experimental
+ * @spec       RFC 6962, RFC 8017
+ * @related    pki.ct.parseLogList, pki.ct.verifySct
+ *
+ * Verify the detached signature published alongside the Certificate Transparency log list (the
+ * `log_list.sig` over `log_list.json`). `json` is the RAW log-list bytes (a Buffer, or the fetched text
+ * as a string -- verified byte-for-byte, never re-serialized), `signature` is the detached signature, and
+ * `publicKey` is the caller-PINNED signer SubjectPublicKeyInfo (DER; there is no baked-in key). The scheme
+ * is RSASSA-PKCS1-v1.5 with SHA-256 over an RSA key (the deployed scheme; an EC P-256 / ECDSA-SHA-256 arm
+ * is accepted for future-proofing). Resolves `true` for a valid signature, `false` on a cryptographic
+ * mismatch (a verdict). Fail-closed forgery defenses throw before any verify: an RSA public exponent below
+ * 3 or even (`ct/bad-input`), a sub-2048-bit RSA key or an unsupported key type / curve
+ * (`ct/unsupported-algorithm`), a non-conformant ECDSA DER Sig-Value (`ct/bad-signature`); a structural
+ * evaluation failure is `ct/verify-error`. Offline: the caller fetches and pins; the toolkit only verifies.
+ *
+ * @example
+ *   var ok = await pki.ct.verifyLogListSignature(logListJsonBytes, logListSig, googleSignerSpki);
+ */
+async function verifyLogListSignature(json, signature, publicKey) {
+  var message = typeof json === "string" ? Buffer.from(json) : _toBuffer(json, "the CT log list JSON");
+  // Bound the signed message before the digest/verify (the same cap parseLogList enforces) so a hostile
+  // caller cannot force unbounded hashing work on an oversized input (CWE-400).
+  if (message.length > C.LIMITS.CT_LOG_LIST_MAX_BYTES) throw new CtError("ct/too-large", "the CT log list exceeds the " + C.LIMITS.CT_LOG_LIST_MAX_BYTES + "-byte cap");
+  var sig = _toBuffer(signature, "the CT log list signature");
+  var spki = _toBuffer(publicKey, "the CT log list signer public key (SPKI)");
+  var alg = _spkiAlg(spki);   // fail-closed: a non-SPKI key or a forgeable RSA e < 3 throws ct/bad-input
+  var imp, ver;
+  if (alg.algOid === oid.byName("rsaEncryption")) {
+    if (!(alg.rsaBits >= 2048)) throw new CtError("ct/unsupported-algorithm", "the CT log-list signer RSA key is below the 2048-bit minimum");
+    imp = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" };
+    ver = { name: "RSASSA-PKCS1-v1_5" };
+  } else if (alg.algOid === oid.byName("ecPublicKey")) {
+    var ec = CT_EC_CURVE[alg.curveOid];
+    if (!ec) throw new CtError("ct/unsupported-algorithm", "unsupported CT log-list signer EC curve (only NIST P-256)");
+    imp = { name: "ECDSA", namedCurve: ec.curve };
+    ver = { name: "ECDSA", hash: "SHA-256" };
+    // A DER ECDSA-Sig-Value: route through the ORDER-AWARE conformance gate (primitive, minimal, and
+    // r,s in [1, n-1] per FIPS 186-5 sec. 6.4.2 -- defeating the CVE-2022-21449 r=s=0 forgery AND an
+    // out-of-range r/s >= the curve order n) before the raw r||s conversion.
+    sig = validator.sig.ecdsaDerToP1363(sig, ec.curve, CtError, "ct/bad-signature");
+  } else {
+    throw new CtError("ct/unsupported-algorithm", "unsupported CT log-list signer key algorithm (only rsaEncryption / ecPublicKey P-256)");
+  }
+  // A wrong signature resolves false from subtle.verify (a verdict); a structural failure -- an
+  // unimportable key -- is re-thrown fail-closed.
+  try {
+    var key = await subtle.importKey("spki", spki, imp, false, ["verify"]);
+    return await subtle.verify(ver, key, sig, message);
+  } catch (e) {
+    throw new CtError("ct/verify-error", "the CT log-list signature could not be evaluated", e);
+  }
+}
+
 module.exports = {
   parseSctList: parseSctList,
   reconstructSignedData: reconstructSignedData,
@@ -795,6 +854,7 @@ module.exports = {
   signSct: signSct,
   parseLogList: parseLogList,
   verifySctWithLogList: verifySctWithLogList,
+  verifyLogListSignature: verifyLogListSignature,
   HASH_ALGORITHMS: HASH_ALGORITHMS,
   SIGNATURE_ALGORITHMS: SIGNATURE_ALGORITHMS,
 };

package/lib/lint.js

@@ -156,6 +156,7 @@ function _makeCtx(cert, profile) {
 function _effective(rule, cert) {
   if (!rule.effectiveDate) return true;
   var nb = cert.validity && cert.validity.notBefore;
+  // allow:nan-date-comparison-unguarded -- nb is a codec-parsed cert notBefore (asn1 readTime rejects a NaN instant); effectiveDate is a Date literal.
   return (nb instanceof Date) && nb.getTime() >= rule.effectiveDate.getTime();
 }
 
@@ -296,6 +297,7 @@ var RFC5280_RULES = [
     message: "the certificate notBefore must not be later than notAfter",
     check: function (cert) {
       var v = cert.validity;
+      // allow:nan-date-comparison-unguarded -- notBefore/notAfter are codec-parsed cert dates (asn1 readTime rejects a NaN instant).
       return (v.notBefore instanceof Date && v.notAfter instanceof Date && v.notBefore.getTime() > v.notAfter.getTime()) ? true : null;
     },
   },
@@ -375,6 +377,7 @@ var VALIDITY_SCHEDULE = [
 var VALIDITY_SCHEDULE_START = VALIDITY_SCHEDULE[VALIDITY_SCHEDULE.length - 1].from;
 function _validityCeilingDays(notBefore) {
   for (var i = 0; i < VALIDITY_SCHEDULE.length; i++) {
+    // allow:nan-date-comparison-unguarded -- notBefore is a codec-parsed cert date (NaN-rejected); the schedule bounds are Date literals.
     if (notBefore.getTime() >= VALIDITY_SCHEDULE[i].from.getTime()) return VALIDITY_SCHEDULE[i].maxDays;
   }
   // Unreachable: the rule's effectiveDate (VALIDITY_SCHEDULE_START) reports NE for any cert

package/lib/ocsp-verify.js

@@ -206,6 +206,7 @@ function makeOcspVerify(deps) {
       if (st.type === "revoked") {
         // Present-time validation revokes regardless of a future revocationTime (skew/post-dating);
         // only explicit historical validation defers a strictly-future revocation (reports good).
+        // allow:nan-date-comparison-unguarded -- revocationTime is codec-parsed (NaN-rejected); a NaN check time makes this FAIL CLOSED (sawGood stays unset -> not treated good), and `time` is validated at the pki.ocsp.verify / path.verifyOcspResponse entry points.
         if (historical && st.revocationTime instanceof Date && st.revocationTime.getTime() > time.getTime()) { out.sawGood = true; }
         else if (!out.revoked) { out.revoked = { revocationReason: st.revocationReason || null, reason: "certificate reported revoked by an authorized OCSP responder" + (st.revocationReason ? " (" + st.revocationReason + ")" : "") }; }
       } else if (st.type === "good") { out.sawGood = true; }

package/lib/path-validate.js

@@ -1766,6 +1766,7 @@ function crlChecker(crls) {
           // validation (opts.historicalMode) -- validating as of a past instant,
           // e.g. a timestamped signature -- does an entry dated AFTER the
           // validation time not yet apply.
+          // allow:nan-date-comparison-unguarded -- revocationDate is codec-parsed (NaN-rejected); a NaN check time makes this FAIL CLOSED (the skip is not taken -> the entry is treated as revoked), and `time` is validated at the path.validate / crlChecker entry points.
           if (historical && entry.revocationDate instanceof Date && entry.revocationDate.getTime() > time.getTime()) continue;
           // Record the revocation but keep scanning: a delta removeFromCRL for the
           // same serial (in another CRL) overrides it (base/delta not merged).

package/lib/validator-sig.js

@@ -98,8 +98,12 @@ function ecdsaDerToP1363(der, curve, E, code) {
   if (n.tagClass !== "universal" || n.tagNumber !== asn1.TAGS.SEQUENCE || !n.children || n.children.length !== 2) {
     throw new E(code, "ECDSA signature must be a SEQUENCE of exactly two INTEGERs");
   }
-  var r = asn1.read.integer(n.children[0]);
-  var s = asn1.read.integer(n.children[1]);
+  // Wrap the strict DER integer reads (they enforce PRIMITIVE + MINIMAL encoding) so a non-minimal /
+  // constructed / empty INTEGER surfaces the CALLER's typed code, not a raw asn1/* -- the same behavior
+  // as ecdsaSigToRaw, so this gate is a strict superset (DER conformance + the order bound below).
+  var r, s;
+  try { r = asn1.read.integer(n.children[0]); } catch (e) { throw new E(code, "ECDSA signature r is not a minimally-encoded DER INTEGER", e); }
+  try { s = asn1.read.integer(n.children[1]); } catch (e) { throw new E(code, "ECDSA signature s is not a minimally-encoded DER INTEGER", e); }
   if (r < 1n || s < 1n || r >= order || s >= order) {
     throw new E(code, "ECDSA signature component out of range [1, n-1] (CVE-2022-21449)");
   }

package/lib/webauthn.js

@@ -169,9 +169,9 @@ var COSE_ALG = {
 };
 
 // DER ECDSA-Sig-Value { r, s } -> raw r||s (the ieee-p1363 form WebCrypto verify expects).
-// validator-sig owns the complete strict-DER conformance (primitive, minimal, positive,
-// bounded r/s), composed here.
-function _derEcdsaToRaw(der, coordLen) { return validator.sig.ecdsaSigToRaw(der, coordLen, WebauthnError, "webauthn/bad-signature"); }
+// validator-sig owns the complete strict-DER conformance PLUS the FIPS 186-5 sec. 6.4.2 order bound
+// (r,s in [1, n-1] -- the order-aware gate a curve-aware verifier MUST use), composed here.
+function _derEcdsaToRaw(der, curve) { return validator.sig.ecdsaDerToP1363(der, curve, WebauthnError, "webauthn/bad-signature"); }
 
 // Verify `sig` over `message` with the SPKI public key `spkiBytes` under COSE `alg`.
 // A wrong signature resolves `false` from subtle.verify without throwing (a false
@@ -189,7 +189,7 @@ function _verifySig(alg, sig, spkiBytes, message, E) {
   // point before verify. This covers EVERY key that signs a WebAuthn statement: the x5c
   // attestation-certificate key (packed/tpm/apple) AND the self-attestation credential key.
   if (imp.name === "Ed25519" || imp.name === "Ed448") _requireValidEdPoint(spkiBytes, imp.name, E);
-  var s = d.ecdsa ? _derEcdsaToRaw(sig, d.ecdsa) : sig;
+  var s = d.ecdsa ? _derEcdsaToRaw(sig, d.imp.namedCurve) : sig;
   return subtle.importKey("spki", spkiBytes, imp, false, ["verify"])
     .then(function (key) { return subtle.verify(ver, key, s, message); })
     .catch(function (e) { throw _err("webauthn/verify-error", "the attestation signature could not be evaluated", e); });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.2.28",
+  "version": "0.2.29",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:517b8e6e-813e-4f65-9d63-651831e57f82",
+  "serialNumber": "urn:uuid:2699d42b-0d6d-4b83-a3b9-1e8816b4e49a",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-16T14:06:47.411Z",
+    "timestamp": "2026-07-16T15:08:05.156Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.2.28",
+      "bom-ref": "@blamejs/pki@0.2.29",
       "type": "application",
       "name": "pki",
-      "version": "0.2.28",
+      "version": "0.2.29",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.2.28",
+      "purl": "pkg:npm/%40blamejs/pki@0.2.29",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.2.28",
+      "ref": "@blamejs/pki@0.2.29",
       "dependsOn": []
     }
   ]