@blamejs/pki 0.2.29 → 0.2.31

package/lib/smime.js

@@ -168,7 +168,7 @@ async function sign(content, signers, opts) {
 // Coverage residual: the throw only fires on a >16 MiB assembled message -- a real cap, exercised by no
 // unit vector (driving it would sign 16 MiB).
 function _capped(msg) {
-  if (msg.length > C.LIMITS.MIME_MAX_BYTES) throw _err("smime/too-large", "the assembled S/MIME message (" + msg.length + " bytes) exceeds the " + C.LIMITS.MIME_MAX_BYTES + "-byte cap that verify enforces");
+  guard.limits.byteCap(msg, C.LIMITS.MIME_MAX_BYTES, _err, "smime/too-large", "the assembled S/MIME message");
   return msg;
 }
 

package/lib/tsp-sign.js

@@ -119,9 +119,7 @@ function sign(messageImprint, tsa, opts) {
   var imprint = b.sequence([_hashAlgId(mi.hashAlgorithm), b.octetString(Buffer.from(mi.hashedMessage))]);
   // genTime defaults to now; a supplied value MUST be a valid Date (never a silently-ignored
   // non-Date or an Invalid Date that would encode a garbage GeneralizedTime).
-  if (opts.genTime != null && (!(opts.genTime instanceof Date) || isNaN(opts.genTime.getTime()))) {
-    throw _err("tsp/bad-input", "genTime must be a valid Date");
-  }
+  if (opts.genTime != null) guard.time.assertValid(opts.genTime, _err, "tsp/bad-input", "genTime");
   var genTime = opts.genTime instanceof Date ? opts.genTime : new Date();
   var fields = [b.integer(1n), _policy(opts.policy), imprint, b.integer(BigInt(opts.serialNumber)), b.generalizedTime(genTime)];
   if (opts.accuracy) fields.push(_accuracy(opts.accuracy));

package/lib/validator-all.js

@@ -15,8 +15,9 @@
 //                                     -- the COMPLETE WebAuthn credential COSE_Key rule
 //                                        set (RFC 9052/9053 + WebAuthn sec. 6.5.1 +
 //                                        CTAP2 canonical + on-curve), one home
-//   validator.sig.ecdsaSigToRaw       -- the COMPLETE DER ECDSA-Sig-Value conformance
-//                                        (RFC 3279 + X.690 strict-DER) + raw r||s conversion
+//   validator.sig.ecdsaDerToP1363     -- the COMPLETE order-aware DER ECDSA-Sig-Value
+//                                        conformance (RFC 3279 + X.690 strict-DER +
+//                                        FIPS 186-5 [1,n-1], CVE-2022-21449) + raw r||s
 //   validator.attcert.packedCert / .aikCert / .aaguidExt / .requireV3 / .assertNotCa
 //                                     -- the WebAuthn attestation-certificate profile
 //                                        (sec. 8.2.1 packed, sec. 8.3.1 TPM AIK), one home

package/lib/validator-sig.js

@@ -25,42 +25,13 @@
 
 var asn1 = require("./asn1-der");
 
-// ecdsaSigToRaw(der, coordLen, E, code) -> the validated signature as raw r||s, each
-// coordinate left-padded to coordLen bytes, or throws new E(code, ...). The complete DER
-// ECDSA-Sig-Value conformance gate; a verifier MUST route an ECDSA signature through here,
-// never hand-decode the SEQUENCE and read r/s content raw (which skips minimality).
-// @enforced-by behavioral -- a DER ECDSA-Sig-Value decode has no rename-proof code shape
-// distinct from generic 2-child-SEQUENCE content access; the RED conformance vectors
-// (non-minimal / negative / zero / over-size r or s rejected) and the webauthn ECDSA KATs
-// are the guard.
-function ecdsaSigToRaw(der, coordLen, E, code) {
-  var node;
-  try { node = asn1.decode(der); } catch (e) { throw new E(code, "ECDSA signature is not a DER SEQUENCE", e); }
-  if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length !== 2) {
-    throw new E(code, "ECDSA signature must be a DER SEQUENCE { r, s }");
-  }
-  function coord(c, label) {
-    // The strict DER integer reader enforces PRIMITIVE + MINIMAL encoding (a constructed
-    // child, an empty INTEGER, or a redundant 0x00/0xFF sign octet all throw). The value
-    // is then range-checked: r and s MUST be positive (>= 1) and fit the curve field size.
-    var v;
-    try { v = asn1.read.integer(c); } catch (e) { throw new E(code, "ECDSA signature " + label + " is not a minimally-encoded DER INTEGER", e); }
-    if (v <= 0n) throw new E(code, "ECDSA signature " + label + " must be a positive integer");
-    var hex = v.toString(16); if (hex.length % 2) hex = "0" + hex;
-    var b = Buffer.from(hex, "hex");
-    if (b.length > coordLen) throw new E(code, "ECDSA signature " + label + " exceeds the curve field size");
-    var out = Buffer.alloc(coordLen); b.copy(out, coordLen - b.length); return out;
-  }
-  return Buffer.concat([coord(node.children[0], "r"), coord(node.children[1], "s")]);
-}
-
 // rawToEcdsaDer(raw, coordLen) -> the canonical DER ECDSA-Sig-Value SEQUENCE { r, s } for a raw
-// r||s signature (IEEE P1363, the WebCrypto sign() output). The inverse of ecdsaSigToRaw: a
+// r||s signature (IEEE P1363, the WebCrypto sign() output). The inverse of ecdsaDerToP1363: a
 // signer composes this so the emitted ECDSA signature is canonical DER (minimally-encoded
 // INTEGERs via the build layer), never a hand-built SEQUENCE that could re-introduce a
 // non-minimal encoding. A config-time TypeError guards a mis-sized raw signature at entry.
 // @enforced-by behavioral -- a DER ECDSA-Sig-Value BUILD has no rename-proof code shape distinct
-// from generic sequence([integer,integer]); the round-trip vectors (build -> ecdsaSigToRaw
+// from generic sequence([integer,integer]); the round-trip vectors (build -> ecdsaDerToP1363
 // identity) and the cms.sign ECDSA KATs are the guard.
 function rawToEcdsaDer(raw, coordLen) {
   if (!Buffer.isBuffer(raw) || typeof coordLen !== "number" || coordLen <= 0 || raw.length !== coordLen * 2) {
@@ -82,12 +53,15 @@ var CURVE_ORDER = {
 // ecdsaDerToP1363(der, curve, E, code) -> the DER ECDSA-Sig-Value converted to raw r||s (P1363),
 // each coordinate left-padded to the curve field width, rejecting r or s outside [1, n-1] against
 // the curve ORDER (CVE-2022-21449 "Psychic Signatures" -- the r/s = 0 case AND the >= n upper
-// bound). `curve` is a WebCrypto namedCurve (P-256/384/521). This is the ORDER-AWARE gate a
-// verifier that knows the curve order MUST use; it is STRICTER than ecdsaSigToRaw above, which
-// bounds r/s only by the field SIZE (>= 1, <= coordLen bytes) and does not know the order. A
-// signature whose r or s is >= n is rejected here but passes ecdsaSigToRaw -- do not conflate them.
-// @enforced-by behavioral -- the RED conformance vectors (r/s = 0, r/s >= n, non-minimal, over-size)
-// and the composite-signature + path-validation KATs are the guard.
+// bound). `curve` is a WebCrypto namedCurve (P-256/384/521). This is the SINGLE ECDSA-Sig-Value
+// conformance gate every curve-aware verifier routes through: it enforces the complete strict-DER
+// rule set (2-INTEGER SEQUENCE, minimal encoding) AND the order bound, so a verifier never
+// hand-decodes the SEQUENCE (skipping minimality) nor bounds r/s only by the field size (missing
+// the order). A non-minimal, negative, zero, over-size, or >= n coordinate fails closed.
+// @enforced-by behavioral -- a DER ECDSA-Sig-Value decode has no rename-proof code shape distinct
+// from generic 2-child-SEQUENCE content access; the RED conformance vectors (r/s = 0, r/s >= n,
+// non-minimal, negative, over-size) and the cms / ct / composite / path / webauthn ECDSA KATs are
+// the guard.
 function ecdsaDerToP1363(der, curve, E, code) {
   var width = CURVE_FIELD_BYTES[curve];
   var order = CURVE_ORDER[curve];
@@ -99,8 +73,8 @@ function ecdsaDerToP1363(der, curve, E, code) {
     throw new E(code, "ECDSA signature must be a SEQUENCE of exactly two INTEGERs");
   }
   // Wrap the strict DER integer reads (they enforce PRIMITIVE + MINIMAL encoding) so a non-minimal /
-  // constructed / empty INTEGER surfaces the CALLER's typed code, not a raw asn1/* -- the same behavior
-  // as ecdsaSigToRaw, so this gate is a strict superset (DER conformance + the order bound below).
+  // constructed / empty INTEGER surfaces the CALLER's typed code, not a raw asn1/* -- the complete DER
+  // conformance rule set, gated together with the order bound below.
   var r, s;
   try { r = asn1.read.integer(n.children[0]); } catch (e) { throw new E(code, "ECDSA signature r is not a minimally-encoded DER INTEGER", e); }
   try { s = asn1.read.integer(n.children[1]); } catch (e) { throw new E(code, "ECDSA signature s is not a minimally-encoded DER INTEGER", e); }
@@ -122,4 +96,4 @@ function ecdsaDerToP1363(der, curve, E, code) {
   return Buffer.concat([pad(r), pad(s)]);
 }
 
-module.exports = { ecdsaSigToRaw: ecdsaSigToRaw, rawToEcdsaDer: rawToEcdsaDer, ecdsaDerToP1363: ecdsaDerToP1363 };
+module.exports = { rawToEcdsaDer: rawToEcdsaDer, ecdsaDerToP1363: ecdsaDerToP1363 };

package/lib/webcrypto.js

@@ -1000,10 +1000,27 @@ Crypto.prototype.getRandomValues = function getRandomValues(typedArray) {
 
 Crypto.prototype.randomUUID = function randomUUID() { return nodeCrypto.randomUUID(); };
 
+// decompressEcPoint(sec1Compressed, nodeCurve) -> the uncompressed SEC1 point 0x04||X||Y for a
+// compressed 0x02/0x03||X input, computing Y on-curve via node's ECDH.convertKey. The crypto-engine
+// home for EC point de-compression (Hard rule #8: EC key material is webcrypto's domain). Fail-closed:
+// convertKey throws on an off-curve X or an unsupported curve, surfaced as the caller's typed error.
+// `nodeCurve` is the OpenSSL curve name (prime256v1 / secp384r1 / secp521r1). The C509-specific
+// 0xFE/0xFD marker -> 0x02/0x03 parity translation stays in the C509 layer (this takes a real SEC1 point).
+function decompressEcPoint(sec1Compressed, nodeCurve, E, code) {
+  var head = sec1Compressed[0];
+  if (head !== 0x02 && head !== 0x03) throw E(code, "EC point de-compression expects a compressed SEC1 point (0x02/0x03)");
+  try {
+    return nodeCrypto.ECDH.convertKey(sec1Compressed, nodeCurve, undefined, undefined, "uncompressed");
+  } catch (e) {
+    throw E(code, "EC point is not on curve " + nodeCurve + " (de-compression failed)", e);
+  }
+}
+
 module.exports = {
   webcrypto:     new Crypto(),
   Crypto:        Crypto,
   SubtleCrypto:  SubtleCrypto,
   CryptoKey:     CryptoKey,
   WebCryptoError: WebCryptoError,
+  decompressEcPoint: decompressEcPoint,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.2.29",
+  "version": "0.2.31",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:2699d42b-0d6d-4b83-a3b9-1e8816b4e49a",
+  "serialNumber": "urn:uuid:c89087a8-9dba-4496-9704-cd639f3c4038",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-16T15:08:05.156Z",
+    "timestamp": "2026-07-16T21:10:43.618Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.2.29",
+      "bom-ref": "@blamejs/pki@0.2.31",
       "type": "application",
       "name": "pki",
-      "version": "0.2.29",
+      "version": "0.2.31",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.2.29",
+      "purl": "pkg:npm/%40blamejs/pki@0.2.31",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.2.29",
+      "ref": "@blamejs/pki@0.2.31",
       "dependsOn": []
     }
   ]