@blamejs/pki 0.2.4 → 0.2.6

package/CHANGELOG.md

@@ -4,6 +4,39 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.2.6 — 2026-07-13
+
+WebAuthn attestation verification covers Ed448 and the RFC 9864 fully-specified COSE algorithms, and hardens credential-key conformance.
+
+### Added
+
+- pki.webauthn now verifies the RFC 9864 fully-specified COSE algorithm identifiers a WebAuthn relying party may receive: ESP256 (-9), ESP384 (-51), ESP512 (-52), Ed25519 (-19), and Ed448 (-53). Ed448 (-53) is the only WebAuthn path to Ed448, so an Ed448 credential now verifies rather than erroring as an unsupported algorithm.
+- The verifier is now checked against the official W3C WebAuthn Level 3 test-vector suite -- every published vector across ES256 / ES384 / ES512 / RS256 / Ed25519 / Ed448 and the packed / self / tpm / apple / fido-u2f / none formats -- as an independent cross-implementation oracle.
+
+### Changed
+
+- A WebAuthn credential key with COSE alg -8 (EdDSA) now requires curve Ed25519 (crv 6), matching the WebAuthn algorithm-identifier profile; an -8 key claiming Ed448 (crv 7) is rejected -- Ed448 is carried under the fully-specified identifier -53 instead.
+- An EC2 credential key must use the uncompressed point form; the compressed sign-bit y encoding is rejected for WebAuthn credential keys.
+
+### Fixed
+
+- The WebAuthn credential public-key point is now validated on its curve, so an off-curve or identity EC/Edwards point fails closed at decode rather than being carried into a later verify step.
+- An ECDSA attestation signature is now enforced as a minimally-encoded DER ECDSA-Sig-Value (X.690): a non-minimal, negative, zero, or over-size r/s coordinate is rejected as malformed instead of being stripped and accepted.
+
+## v0.2.5 — 2026-07-12
+
+WebAuthn / passkey attestation verification joins the toolkit as pki.webauthn.
+
+### Added
+
+- pki.webauthn.parseAttestationObject(bytes) structurally decodes a WebAuthn attestation object (the CBOR { fmt, attStmt, authData }) and its authenticatorData over the strict pki.cbor codec, returning the format id, the decoded rpIdHash / flags / signCount, the attested credential data (aaguid, credentialId, and the decoded COSE credentialPublicKey), and the raw authenticatorData bytes a signature covers. Malformed input throws webauthn/bad-attestation-object. W3C WebAuthn Level 3.
+- pki.webauthn.verify(attestationObject, clientDataHash, opts) verifies a WebAuthn attestation statement -- packed, tpm, android-key, apple, fido-u2f, or none -- checking the attestation signature over authenticatorData || clientDataHash and each format's structural bindings (the x5c leaf key, the apple nonce, the tpm certInfo Name / extraData over the pubArea, the android KeyDescription, the fido-u2f verificationData), binding each attestation certificate key to the credential public key, and enforcing each format's certificate requirements (a packed leaf's Authenticator Attestation subject and non-CA basic constraints, a tpm AIK's empty subject and non-CA constraints). It resolves the attestation type and trust path or throws a typed webauthn/* error; a signature that does not verify is a webauthn/verify-failed verdict, never a silent pass. The error taxonomy gains WebauthnError (webauthn/*). W3C WebAuthn Level 3, RFC 9052.
+- The OID registry gains the FIDO id-fido-gen-ce-aaguid, Android key-attestation, Apple anonymous-attestation, and TCG TPM (AIK key purpose, tpmManufacturer / tpmModel / tpmVersion) arcs that WebAuthn attestation certificates carry.
+
+### Changed
+
+- The bounded big-endian byte cursor under pki.ct's TLS-vector decoding is extracted to a shared engine primitive so the packed big-endian TPM structures in pki.webauthn read through the same bounds-before-slice cursor -- one definition of the length-checked read, carrying each caller's typed error domain.
+
 ## v0.2.4 — 2026-07-12
 
 Human-readable certificate inspection joins the toolkit as pki.inspect.

package/README.md

@@ -228,8 +228,9 @@ is callable today; nothing below is a stub.
 | `pki.hpke` | Hybrid Public Key Encryption (RFC 9180) — the encrypt-to-a-public-key primitive behind TLS ECH, MLS, and OHTTP. `setupS`/`setupR` establish a sender/recipient context (KEM encapsulation + HKDF key schedule); the context's `seal`/`open` AEAD-encrypt with a sequence-counter nonce and `export` derives further secrets; `seal`/`open` are single-shot wrappers. DHKEM (P-256, P-521, X25519, X448) × HKDF-SHA256/SHA512 × AES-GCM/ChaCha20Poly1305/export-only × all four modes, proven against the RFC 9180 Appendix A vectors. DHKEM(P-384) and HKDF-SHA384 are RFC-registered but Appendix A ships no vector for them, so they fail closed until an authoritative KAT exists. Pure composition over `node:crypto`; ML-KEM / X-Wing are a registry data-row extension pending stable drafts — `suites`, `setupS`, `setupR`, `seal`, `open` |
 | `pki.sigstore` | Offline verifier for a Sigstore bundle — the exact artifact `npm publish --provenance` produces and the registry serves. `verifyBundle` composes five fail-closed legs against caller-pinned trust (Fulcio CA roots + Rekor log keys, never trusted from the bundle): the DSSE signature over its PAE preimage under the Fulcio leaf key; the ephemeral Fulcio certificate chain, validated as of the Rekor log time; the RFC 9162 inclusion proof folded to a Rekor-signed tree root; the log entry bound to this exact signature; and the in-toto SLSA subject digest the caller confirms against the published artifact. Zero runtime deps — reuses the X.509 parser, RFC 5280 path validator, and Merkle verifier; the net-new codecs are the DSSE PAE byte-builder and a fail-closed JSON reader. `pae`, `parseBundle`, `verifyBundle` |
 | `pki.inspect` | Human-readable certificate inspection — the pure-JS equivalent of `openssl x509 -text`. `certificate(pem | der | parsed)` renders a familiar OpenSSL-style report: version, serial, signature algorithm, issuer/subject distinguished names, validity, public-key details (curve or modulus size + the raw point/modulus), every decoded extension with its critical flag, and the signature. Built over the strict parser and the two-way OID registry, so it names extension and algorithm OIDs an OpenSSL build shows only as raw bytes. No OpenSSL dependency; the format is stable and OpenSSL-familiar rather than pinned to one OpenSSL version; a malformed extension falls back to a hex dump rather than throwing — `certificate` |
+| `pki.webauthn` | WebAuthn / passkey attestation verification — offline trust evaluation of a W3C WebAuthn (Level 3) attestation. `parseAttestationObject(bytes)` decodes the CBOR attestation object + authenticatorData + COSE credential key over the strict `pki.cbor` codec; `verify(attestationObject, clientDataHash, opts)` checks the attestation-statement signature and each format's structural bindings for **packed / tpm / android-key / apple / fido-u2f / none** — the x5c leaf key, the apple nonce, the tpm `certInfo` Name/`extraData` over the `pubArea`, the android `KeyDescription`, the fido-u2f `verificationData` — binding the credential public key to each attestation (via the signed authenticatorData for packed/fido-u2f, or a cert/`pubArea`-key equality check for android-key/apple/tpm) and enforcing each leaf's certificate requirements. The credential-key check covers the full WebAuthn COSE algorithm set — ES256/384/512, RS256/384/512, PS256, EdDSA (Ed25519), and the RFC 9864 fully-specified identifiers **ESP256/384/512, Ed25519, and Ed448** — validating the public-key point on its curve, rejecting the compressed EC point form, and enforcing a minimally-encoded DER ECDSA signature. A verifier, not a ceremony client; fail-closed with typed `webauthn/*` errors. Chaining the returned trust path to a pinned root (and aaguid→root via FIDO MDS) is the caller's step through `pki.path.validate` — `parseAttestationObject`, `verify` |
 | `pki.C` / `pki.constants` | Version-stable constants — functional scale helpers (`C.TIME.*`, `C.BYTES.*`), codec `LIMITS`, `version` |
-| `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError` / `TspError` / `AttrCertError` / `CrmfError` / `Pkcs12Error` / `CmpError` / `PathError` / `CtError` / `JoseError` / `AcmeError`, each carrying a stable `code` in `domain/reason` form |
+| `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError` / `TspError` / `AttrCertError` / `CrmfError` / `Pkcs12Error` / `CmpError` / `PathError` / `CtError` / `JoseError` / `AcmeError` / `WebauthnError`, each carrying a stable `code` in `domain/reason` form |
 | `pki` CLI | `pki version`, `pki oid <dotted\|name>`, `pki parse <cert>` |
 
 ### CLI
@@ -324,7 +325,8 @@ modules reached by explicit call rather than DER routing: `pki.path` (RFC 5280
 path validation), `pki.trust` (trust anchors), `pki.ct` (Certificate Transparency
 SCTs), `pki.hpke` (RFC 9180), `pki.shbs` (HSS/LMS stateful hash signatures),
 `pki.merkle` (RFC 9162 transparency proofs), `pki.sigstore` (offline npm-provenance
-verification), and the `jose` / `acme` / `est` enrollment surfaces. Each composes
+verification), `pki.webauthn` (WebAuthn / passkey attestation verification), and the
+`jose` / `acme` / `est` enrollment surfaces. Each composes
 the shared structure, foundation, and crypto layers directly. Alongside the schema
 engine, the fail-closed **guard family** (`guard-*`) centralizes each CVE-class
 defense — detached-buffer re-view, resource caps, constant-time compares,

package/index.js

@@ -45,6 +45,7 @@ var jose       = require("./lib/jose");
 var acme       = require("./lib/acme");
 var trust      = require("./lib/trust");
 var inspect    = require("./lib/inspect");
+var webauthn   = require("./lib/webauthn");
 
 module.exports = {
   version:   constants.version,
@@ -116,6 +117,14 @@ module.exports = {
   // OID registry, naming extension/algorithm OIDs OpenSSL shows only as raw bytes.
   // Pure, no OpenSSL dependency; best-effort (a bad extension falls back to hex).
   inspect:   inspect,
+  // `webauthn` verifies a W3C WebAuthn / passkey attestation -- pki.webauthn.verify
+  // checks the attestation-statement signature + each format's structural bindings
+  // (packed / tpm / android-key / apple / fido-u2f / none) and surfaces the x5c chain
+  // for the caller to anchor to a pinned root via pki.path.validate; it does not
+  // itself chain to a trust anchor. parseAttestationObject structurally decodes the
+  // attestation object + authenticatorData + COSE key over the strict pki.cbor codec.
+  // A verifier, not a ceremony client; fail-closed.
+  webauthn:  webauthn,
   // A ready W3C Crypto instance (globalThis.crypto shape) with the classes for
   // constructing more attached under the same namespace (pki.webcrypto.CryptoKey,
   // .SubtleCrypto, .Crypto, .WebCryptoError). PQC-first, classical-capable, zero-dep.

package/lib/acme.js

@@ -85,7 +85,8 @@ function _isUrl(v) {
   var u;
   // A parse failure IS the "not a URL" verdict for this boolean predicate -- there
   // is no PkiError here to thread a cause into, so the error is intentionally ignored.
-  try { u = new URL(v); } catch (_e) { return false; }
+  try { u = new URL(v); }
+  catch (_e) { return false; }
   return (u.protocol === "http:" || u.protocol === "https:") && u.hostname.length > 0;
 }
 // A URI string with any RFC 3986 scheme (mailto:, tel:, http(s):, ...). An account

package/lib/byte-reader.js

@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * @internal
+ * lib/byte-reader.js -- a bounded big-endian byte cursor: the shared ENCODING-layer
+ * primitive under the toolkit's non-ASN.1 length-prefixed wire formats (TLS-vector
+ * SCTs in pki.ct, the packed big-endian TPM2B_* / authenticatorData structures in
+ * pki.webauthn). Every read is length-checked against a hard [pos, end) window
+ * BEFORE a byte is taken, so a lying inner length can overrun only the current
+ * sub-reader's `end`, never the parent buffer -- bounds-before-slice is structural,
+ * not a per-call discipline. It carries the CALLER's typed ErrorClass so every wire
+ * format keeps its own `domain/reason` fault code, exactly as the guard family does.
+ *
+ * This is an engine primitive, not a format: a new fixed-width or length-prefixed
+ * wire field is a method here (with its own bounds check), never a hand-rolled
+ * offset walk in a format module.
+ */
+
+// A bounded cursor over `buf[start, end)`, faulting through the caller's ErrorClass
+// `E` (constructed `new E(code, message)`). `defaultCode` is the fault code used
+// when a read is not given its own.
+function ByteReader(buf, start, end, E, defaultCode) {
+  if (!Buffer.isBuffer(buf)) throw new TypeError("ByteReader: buf must be a Buffer");
+  this.buf = buf;
+  this.pos = start | 0;
+  this.end = end == null ? buf.length : (end | 0);
+  this.E = E;
+  this.defaultCode = defaultCode || "byte-reader/truncated";
+}
+ByteReader.prototype._need = function (n, code) {
+  if (this.pos + n > this.end) {
+    throw new this.E(code || this.defaultCode, "need " + n + " byte(s), only " + (this.end - this.pos) + " remain");
+  }
+};
+ByteReader.prototype.u8 = function (code) { this._need(1, code); return this.buf[this.pos++]; };
+ByteReader.prototype.u16 = function (code) { this._need(2, code); var v = this.buf.readUInt16BE(this.pos); this.pos += 2; return v; };
+ByteReader.prototype.u24 = function (code) {
+  this._need(3, code);
+  var v = (this.buf[this.pos] << 16) | (this.buf[this.pos + 1] << 8) | this.buf[this.pos + 2];
+  this.pos += 3; return v >>> 0;
+};
+ByteReader.prototype.u32 = function (code) { this._need(4, code); var v = this.buf.readUInt32BE(this.pos); this.pos += 4; return v; };
+ByteReader.prototype.u64 = function (code) { this._need(8, code); var v = this.buf.readBigUInt64BE(this.pos); this.pos += 8; return v; };
+// A fixed-width opaque slice (zero-copy view into the backing buffer).
+ByteReader.prototype.fixed = function (n, code) {
+  this._need(n, code);
+  var s = this.buf.subarray(this.pos, this.pos + n); this.pos += n; return s;
+};
+// opaque<min..max> -- a length-prefixed vector (lenWidth-byte big-endian prefix:
+// 2 or 3). The length prefix itself is a plain read (a truncation there is the
+// default code); only a LYING length whose body overruns the bound carries `code`.
+ByteReader.prototype.vector = function (lenWidth, min, max, code) {
+  var len = lenWidth === 3 ? this.u24() : this.u16();
+  if (len < min) throw new this.E(code, "vector length " + len + " below minimum " + min);
+  if (max != null && len > max) throw new this.E(code, "vector length " + len + " above maximum " + max);
+  this._need(len, code);
+  var s = this.buf.subarray(this.pos, this.pos + len); this.pos += len; return s;
+};
+// A bounded child cursor over the next `len` bytes, sharing the same ErrorClass.
+ByteReader.prototype.subReader = function (len, code) {
+  this._need(len, code);
+  var r = new ByteReader(this.buf, this.pos, this.pos + len, this.E, this.defaultCode); this.pos += len; return r;
+};
+ByteReader.prototype.remaining = function () { return this.end - this.pos; };
+ByteReader.prototype.atEnd = function () { return this.pos === this.end; };
+
+module.exports = ByteReader;

package/lib/ct.js

@@ -42,6 +42,7 @@ var asn1 = require("./asn1-der.js");
 var constants = require("./constants.js");
 var frameworkError = require("./framework-error.js");
 var guard = require("./guard-all.js");
+var ByteReader = require("./byte-reader.js");
 
 var CtError = frameworkError.CtError;
 var C = constants;
@@ -64,44 +65,11 @@ var SCT_MIN_BODY = 47;
 var LOGID_BYTES = 32;
 var MAX_SAFE = 9007199254740991n;   // 2^53 - 1; above this a Number loses precision
 
-// ---- TlsReader -- the one net-new primitive (an ENCODING layer, not a schema
-// combinator): a bounded big-endian TLS-vector cursor with a hard [pos, end).
-// A lying inner length can overrun only the current sub-reader's `end`, never
-// the parent buffer, so bounds-before-slice is structural.
-function TlsReader(buf, start, end) { this.buf = buf; this.pos = start; this.end = end; }
-TlsReader.prototype._need = function (n, code) {
-  if (this.pos + n > this.end) {
-    throw new CtError(code || "ct/truncated", "need " + n + " byte(s), only " + (this.end - this.pos) + " remain");
-  }
-};
-TlsReader.prototype.u8 = function (code) { this._need(1, code); return this.buf[this.pos++]; };
-TlsReader.prototype.u16 = function (code) { this._need(2, code); var v = this.buf.readUInt16BE(this.pos); this.pos += 2; return v; };
-TlsReader.prototype.u24 = function (code) {
-  this._need(3, code);
-  var v = (this.buf[this.pos] << 16) | (this.buf[this.pos + 1] << 8) | this.buf[this.pos + 2];
-  this.pos += 3; return v;
-};
-TlsReader.prototype.u64 = function (code) { this._need(8, code); var v = this.buf.readBigUInt64BE(this.pos); this.pos += 8; return v; };
-TlsReader.prototype.fixed = function (n, code) {
-  this._need(n, code);
-  var s = this.buf.subarray(this.pos, this.pos + n); this.pos += n; return s;
-};
-// opaque<min..max> -- a length-prefixed vector (lenWidth-byte big-endian prefix).
-// The length prefix itself is a plain read (a truncation there is ct/truncated);
-// only a LYING length whose body overruns the bound carries the field's own code.
-TlsReader.prototype.vector = function (lenWidth, min, max, code) {
-  var len = lenWidth === 3 ? this.u24() : this.u16();
-  if (len < min) throw new CtError(code, "vector length " + len + " below minimum " + min);
-  if (max != null && len > max) throw new CtError(code, "vector length " + len + " above maximum " + max);
-  this._need(len, code);
-  var s = this.buf.subarray(this.pos, this.pos + len); this.pos += len; return s;
-};
-TlsReader.prototype.subReader = function (len, code) {
-  this._need(len, code);
-  var r = new TlsReader(this.buf, this.pos, this.pos + len); this.pos += len; return r;
-};
-TlsReader.prototype.remaining = function () { return this.end - this.pos; };
-TlsReader.prototype.atEnd = function () { return this.pos === this.end; };
+// ---- TlsReader -- the RFC 6962 TLS-vector cursor, the shared bounded big-endian
+// ByteReader engine primitive bound to the ct/* fault domain. A lying inner length
+// can overrun only the current sub-reader's `end`, never the parent buffer, so
+// bounds-before-slice is structural (see lib/byte-reader.js).
+function TlsReader(buf, start, end) { return new ByteReader(buf, start, end, CtError, "ct/truncated"); }
 
 // Peel the RFC 6962 sec. 3.3 inner DER OCTET STRING (the certificate/OCSP layer
 // already peeled the outer extnValue OCTET STRING). Rides the strict codec, so

package/lib/edwards-point.js

@@ -0,0 +1,91 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. Composed by validator-cose to validate an
+// OKP (Ed25519 / Ed448) credential public-key point.
+//
+// edwards-point -- point validation for the Edwards curves EdDSA uses. node:crypto imports
+// an RFC 8410 OKP SubjectPublicKeyInfo WITHOUT checking the point is a valid, full-order
+// Edwards point (an all-zeroes Ed25519/Ed448 key parses, and an all-zeroes key with an
+// all-zeroes signature even verifies TRUE -- a trivial forgery), so an OKP credential key
+// needs an explicit check. This decodes the compressed point per RFC 8032 sec. 5.1.3
+// (Ed25519) / sec. 5.2.3 (Ed448) -- which fails closed on an off-curve or non-canonical
+// encoding -- and rejects a low-order point via the cofactor check [8]P == identity (an
+// all-zeroes key is a low-order point ON the curve, so the decode alone does not catch it).
+// A conformant authenticator never emits a low-order credential key.
+//
+// Pure BigInt modular arithmetic (constant-time is not a goal here: the input is a public
+// key, and the verdict is a public validity bit, not a secret).
+
+// ---- field parameters ------------------------------------------------------
+var P25519 = (1n << 255n) - 19n;
+// d = -121665 / 121666 (mod p); sqrt(-1) = 2^((p-1)/4) (mod p).
+var D25519 = _mul(P25519 - 121665n, _inv(121666n, P25519), P25519);
+var SQRTM1 = _pow(2n, (P25519 - 1n) / 4n, P25519);
+var P448 = (1n << 448n) - (1n << 224n) - 1n;
+var D448 = P448 - 39081n;   // d = -39081 (mod p)
+
+var CURVE = {
+  6: { p: P25519, d: D25519, a: P25519 - 1n, len: 32, signBit: 255n },   // Ed25519, a = -1
+  7: { p: P448, d: D448, a: 1n, len: 57, signBit: 455n },                // Ed448, a = 1
+};
+
+function _mul(x, y, p) { return (x % p) * (y % p) % p; }
+function _pow(b, e, p) { var r = 1n; b %= p; while (e > 0n) { if (e & 1n) r = r * b % p; b = b * b % p; e >>= 1n; } return r; }
+function _inv(a, p) { return _pow(((a % p) + p) % p, p - 2n, p); }   // Fermat inverse (p prime)
+// A fixed 32/57-byte little-endian public key -> BigInt in one shot (big-endian hex of the
+// reversed bytes), never a per-byte shift-accumulate (the quadratic-BigInt antipattern).
+function _leToBig(buf) { return BigInt("0x" + Buffer.from(buf).reverse().toString("hex")); }
+
+// Decode a compressed Edwards point (RFC 8032) -> { x, y } or null (off-curve / non-canonical).
+function _decode(raw, c) {
+  var num = _leToBig(raw);
+  var sign = (num >> c.signBit) & 1n;
+  var y = num & ((1n << c.signBit) - 1n);
+  if (y >= c.p) return null;   // non-canonical y
+  var p = c.p, y2 = y * y % p, x;
+  var u = ((y2 - 1n) % p + p) % p;
+  if (c.a === 1n) {
+    // Ed448: v = d*y^2 - 1; x = u^3 v (u^5 v^3)^((p-3)/4); require v*x^2 == u.
+    var v = ((c.d * y2 % p - 1n) % p + p) % p;
+    x = _mul(_mul(_pow(u, 3n, p), v, p), _pow(_mul(_pow(u, 5n, p), _pow(v, 3n, p), p), (p - 3n) / 4n, p), p);
+    if (_mul(v, x * x % p, p) !== u) return null;
+  } else {
+    // Ed25519: v = d*y^2 + 1; x = u v^3 (u v^7)^((p-5)/8); v*x^2 == u, or == -u then x *= sqrt(-1).
+    var v25 = (c.d * y2 % p + 1n) % p;
+    x = _mul(_mul(u, _pow(v25, 3n, p), p), _pow(_mul(u, _pow(v25, 7n, p), p), (p - 5n) / 8n, p), p);
+    var vxx = _mul(v25, x * x % p, p);
+    if (vxx === u) { /* x is a root */ }
+    else if (vxx === (p - u) % p) { x = x * SQRTM1 % p; }
+    else return null;
+  }
+  if (x === 0n && sign === 1n) return null;
+  if ((x & 1n) !== sign) x = (p - x) % p;
+  return { x: x, y: y };
+}
+
+// Affine doubling on a*x^2 + y^2 = 1 + d*x^2*y^2: x3 = 2xy/(a x^2 + y^2),
+// y3 = (y^2 - a x^2)/(2 - a x^2 - y^2).
+function _double(P, c) {
+  var p = c.p, x2 = P.x * P.x % p, y2 = P.y * P.y % p, ax2 = c.a * x2 % p;
+  var nx = 2n * P.x % p * P.y % p, dx = (ax2 + y2) % p;
+  var ny = ((y2 - ax2) % p + p) % p, dy = ((2n - ax2 - y2) % p + 2n * p) % p;
+  return { x: _mul(nx, _inv(dx, p), p), y: _mul(ny, _inv(dy, p), p) };
+}
+
+// validate(raw, crv) -> true iff `raw` is a canonical, on-curve, full-order Edwards point for
+// the OKP curve (6 = Ed25519, 7 = Ed448). Off-curve, non-canonical, wrong-length, and
+// low-order (cofactor) points all return false.
+function validate(raw, crv) {
+  var c = CURVE[crv];
+  if (!c || !Buffer.isBuffer(raw) || raw.length !== c.len) return false;
+  var pt = _decode(raw, c);
+  if (!pt) return false;
+  // Low-order iff [8]P is the identity (0, 1). One double per cofactor bit (8 = 2^3).
+  var q = _double(_double(_double(pt, c), c), c);
+  if (q.x === 0n && q.y === 1n) return false;
+  return true;
+}
+
+module.exports = { validate: validate };

package/lib/framework-error.js

@@ -298,6 +298,11 @@ var SigstoreError = defineClass("SigstoreError", { withCause: true });
 // whose label does not decode. Rendering itself is best-effort and never throws on
 // a malformed field -- an undecodable extension falls back to a hex dump.
 var InspectError = defineClass("InspectError", { withCause: true });
+// WebauthnError -- a malformed or unverifiable WebAuthn attestation (pki.webauthn):
+// a non-well-formed attestation object / COSE key, an authenticatorData that fails
+// its bounded layout, an attestation-statement signature that does not verify, or a
+// trust path that does not reach the caller's anchor. Fail-closed, typed reason.
+var WebauthnError = defineClass("WebauthnError", { withCause: true });
 
 module.exports = {
   PkiError:         PkiError,
@@ -325,6 +330,7 @@ module.exports = {
   HpkeError:        HpkeError,
   SigstoreError:    SigstoreError,
   InspectError:     InspectError,
+  WebauthnError:    WebauthnError,
   MerkleError:      MerkleError,
   SmimeError:       SmimeError,
   CsrattrsError:    CsrattrsError,

package/lib/inspect.js

@@ -121,7 +121,8 @@ function _keyBlock(spki, pad) {
 
   if (algName === "ecPublicKey" || algName === "id-ecPublicKey") {
     var curveName = null;
-    try { curveName = oid.name(asn1.read.oid(asn1.decode(spki.algorithm.parameters))); } catch (_e) { /* unknown curve */ }
+    try { curveName = oid.name(asn1.read.oid(asn1.decode(spki.algorithm.parameters))); }
+    catch (_e) { /* unknown curve */ }
     var bits = CURVE_BITS[curveName] || (pub ? ((pub.length - 1) / 2) * 8 : 0);
     out.push(inner + "Public-Key: (" + bits + " bit)");
     if (pub) { out.push(inner + "pub:"); out.push(_hexColon(pub, { wrap: 16, indent: (pad.length + 8) })); }
@@ -211,6 +212,8 @@ function _gnRaw(buf) {
     if (t === 1 || t === 2 || t === 6) return GN_KIND[t] + ":" + _clean(node.content.toString("latin1"));
     if (t === 7) return "IP Address:" + _ipString(node.content);
     return _hexColon(buf, {});   // dirName / otherName / registeredID -> best-effort hex
+    // allow:swallow-unverified drop-silent display fallback (tier-3): fullName GNs reach here as
+    // schema-validated TLVs so asn1.decode cannot throw -- an unreachable defensive best-effort hex render.
   } catch (_e) { return _hexColon(buf, {}); }
 }
 
@@ -262,7 +265,12 @@ var EXT_RENDERERS = {
     return inner + Object.keys(KU_LABEL).filter(function (k) { return decoded[k]; }).map(function (k) { return KU_LABEL[k]; }).join(", ");
   },
   extKeyUsage: function (decoded, inner) {
-    return inner + decoded.map(function (o) { var n = null; try { n = oid.name(o); } catch (_e) { /* unregistered EKU OID */ } return EKU_LABEL[n] || n || o; }).join(", ");
+    return inner + decoded.map(function (o) {
+      var n = null;
+      try { n = oid.name(o); }
+      catch (_e) { /* unregistered EKU OID */ }
+      return EKU_LABEL[n] || n || o;
+    }).join(", ");
   },
   basicConstraints: function (decoded, inner) {
     var s = "CA:" + (decoded.cA ? "TRUE" : "FALSE");
@@ -282,7 +290,9 @@ var EXT_RENDERERS = {
       try {
         (asn1.decode(p.qualifiersBytes).children || []).forEach(function (pqi) {
           var qid = asn1.read.oid(pqi.children[0]), q = pqi.children[1];
-          var label = null; try { label = oid.name(qid); } catch (_e) { /* unregistered qualifier */ }
+          var label = null;
+          try { label = oid.name(qid); }
+          catch (_e) { /* unregistered qualifier */ }
           var val = (q && !q.constructed && Buffer.isBuffer(q.content) && _printable(q.content))
             ? _clean(q.content.toString("latin1"))
             : _hexColon(q && Buffer.isBuffer(q.bytes) ? q.bytes : Buffer.alloc(0), {});

package/lib/oid.js

@@ -300,6 +300,30 @@ var FAMILIES = {
 
   // Misc datatypes (RFC 4519 domainComponent).
   datatype: { base: [0, 9, 2342, 19200300, 100, 1], of: { domainComponent: 25 } },
+
+  // FIDO Alliance generated-credential certificate extensions (arc
+  // 1.3.6.1.4.1.45724.1.1). id-fido-gen-ce-aaguid carries the authenticator's
+  // AAGUID -- a WebAuthn packed-attestation leaf-cert extension (WebAuthn L3 8.2.1)
+  // whose OCTET STRING value MUST equal the attestedCredentialData aaguid.
+  fidoGenCe: { base: [1, 3, 6, 1, 4, 1, 45724, 1, 1], of: { idFidoGenCeAaguid: 4 } },
+
+  // Android Keystore key-attestation extension (arc 1.3.6.1.4.1.11129.2.1). The
+  // keyDescription extension carries the hardware-backed KeyDescription SEQUENCE a
+  // WebAuthn android-key attestation leaf cert asserts (WebAuthn L3 8.4.1).
+  androidKeystore: { base: [1, 3, 6, 1, 4, 1, 11129, 2, 1], of: { keyDescription: 17 } },
+
+  // Apple anonymous-attestation extension (arc 1.2.840.113635.100.8). The value in
+  // a WebAuthn apple attestation leaf cert embeds the SHA-256 nonce over
+  // authenticatorData || clientDataHash (WebAuthn L3 8.8).
+  appleAttest: { base: [1, 2, 840, 113635, 100, 8], of: { appleAnonymousAttestation: 2 } },
+
+  // TCG (Trusted Computing Group) TPM identifiers on the 2.23.133 arc. tcgKp
+  // (id-tcg-kp) names the AIK-certificate extended key purpose a WebAuthn tpm
+  // attestation leaf cert MUST carry; tcgAt (id-tcg-at) names the tpmManufacturer /
+  // tpmModel / tpmVersion directory attributes its subjectAltName MUST carry
+  // (WebAuthn L3 8.3.1).
+  tcgKp: { base: [2, 23, 133, 8], of: { tcgKpAikCertificate: 3 } },
+  tcgAt: { base: [2, 23, 133, 2], of: { tpmManufacturer: 1, tpmModel: 2, tpmVersion: 3 } },
 };
 
 var _byOid = new Map();

package/lib/path-validate.js

@@ -1460,8 +1460,10 @@ function crlIssuerNamesIssuer(cRLIssuer, issuerRdns) {
   for (var i = 0; i < cRLIssuer.names.length; i++) {
     var n = cRLIssuer.names[i];
     if (n.tagNumber !== 4 || !n.value || !n.value.rdns) continue;
+    // dnEqual throws only on a control-byte / malformed cRLIssuer DN; returning false excludes
+    // that DP from the correspondence (a malformed indirect-CRL issuer name never corresponds).
     try { if (dnEqual(n.value.rdns, issuerRdns)) return true; }
-    catch (_e) { return false; }
+    catch (_e) { return false; }   // allow:swallow-unverified fail-closed predicate: error -> no match -> DP excluded (restrictive)
   }
   return false;
 }

package/lib/validator-all.js

@@ -0,0 +1,47 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. This is lib composition only; the
+// documented surface is the primitives whose type handling composes these validators.
+//
+// validator-all -- the validator-family orchestrator (schema-all's role for the
+// validator family, guard-all's role for the guards). It assembles the per-type
+// conformance validators into one namespaced surface every format module composes,
+// so a format depends on the family rather than re-deriving a decoded type's rule set
+// inline (the drift that leaks a spec MUST out one review round at a time):
+//
+//   validator.cose.credentialKey / .toSpki
+//                                     -- the COMPLETE WebAuthn credential COSE_Key rule
+//                                        set (RFC 9052/9053 + WebAuthn sec. 6.5.1 +
+//                                        CTAP2 canonical + on-curve), one home
+//   validator.sig.ecdsaSigToRaw       -- the COMPLETE DER ECDSA-Sig-Value conformance
+//                                        (RFC 3279 + X.690 strict-DER) + raw r||s conversion
+//   validator.attcert.packedCert / .aikCert / .aaguidExt / .requireV3 / .assertNotCa
+//                                     -- the WebAuthn attestation-certificate profile
+//                                        (sec. 8.2.1 packed, sec. 8.3.1 TPM AIK), one home
+//   validator.keydesc.androidKeyDescription
+//                                     -- the Android Key Attestation KeyDescription
+//                                        (AOSP schema + WebAuthn sec. 8.4.1), one home
+//   validator.tpm.parsePubArea / .parseCertInfo / .pubKeyEqualsCose
+//                                     -- the TPM 2.0 pubArea/certInfo structure conformance
+//                                        + key binding (WebAuthn sec. 8.3 + TCG Part 2), one home
+//
+// Each validator is enforced by the validator-reinlined codebase-patterns detector: a
+// lib function that re-inlines a type's characteristic validation shape (declared on the
+// validator via @validator-shape) is flagged, so a new format module cannot re-derive a
+// partial subset and reintroduce the drift the validator exists to prevent.
+
+var cose = require("./validator-cose");
+var sig = require("./validator-sig");
+var attcert = require("./validator-attcert");
+var keydesc = require("./validator-keydesc");
+var tpm = require("./validator-tpm");
+
+module.exports = {
+  cose: cose,
+  sig: sig,
+  attcert: attcert,
+  keydesc: keydesc,
+  tpm: tpm,
+};

package/lib/validator-attcert.js

@@ -0,0 +1,110 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The documented surface is the verifier whose
+// attestation-certificate handling composes this validator (pki.webauthn).
+//
+// validator-attcert -- the SINGLE home for "does this X.509 leaf meet the WebAuthn
+// attestation-certificate profile" (WebAuthn sec. 8.2.1 packed, sec. 8.3.1 TPM AIK).
+// Sibling to the guard family: a validator owns a decoded TYPE's COMPLETE conformance rule
+// set once, so the packed and AIK profiles cannot drift apart or lose a gate (e.g. the v3
+// check that previously lived split out in the tpm verifier rather than in the profile).
+//
+// The caller supplies its parsed certificate + an extension-accessor object `exts`
+// { find(cert, oidName) -> rawExt|null, decode(cert, oidName) -> {critical, value}|null }
+// so this validator stays decoupled from any one format's extension-decoder namespace, and
+// its typed error CONSTRUCTOR E + domain code (a distinct mismatchCode for aaguidExt).
+//
+// Rule set (gap-checked verbatim against WebAuthn sec. 8.2.1 + sec. 8.3.1 + RFC 5280):
+//   - requireV3:  the leaf MUST be X.509 v3 (packed 8.2.1, AIK 8.3.1).
+//   - assertNotCa: the leaf MUST carry basicConstraints with cA=FALSE (present, not merely
+//     "not cA=true": a genuine CA or unconstrained leaf must not be repurposed as a leaf).
+//   - packedCert: v3 + non-CA + subject sets C, O, OU="Authenticator Attestation", CN.
+//   - aikCert:    v3 + non-CA + EMPTY subject + EKU contains tcg-kp-AIKCertificate + SAN
+//     directoryName carries tpmManufacturer/tpmModel/tpmVersion (TPMv2-EK-Profile 3.2.9).
+//   - aaguidExt:  the id-fido-gen-ce-aaguid extension, if present, MUST NOT be critical and
+//     MUST equal the authenticatorData aaguid (a 16-byte OCTET STRING inside the ext OCTET
+//     STRING). Absence is tolerated; presence must match.
+
+var oid = require("./oid");
+var asn1 = require("./asn1-der");
+
+// requireV3(cert, E, code) -- the leaf attestation certificate MUST be X.509 v3.
+// @enforced-by behavioral -- a version-field check has no rename-proof code shape; the RED
+// vector (a non-v3 attestation leaf rejected) is the guard.
+function requireV3(cert, E, code) {
+  if (cert.version !== 3) throw new E(code, "an attestation certificate must be X.509 version 3");
+}
+
+// assertNotCa(cert, exts, E, code) -- the leaf MUST carry basicConstraints with cA=FALSE.
+// @enforced-by behavioral -- a basicConstraints cA gate has no rename-proof code shape; the
+// RED vector (a CA-asserting or constraint-omitting attestation leaf rejected) is the guard.
+function assertNotCa(cert, exts, E, code) {
+  var bc = exts.decode(cert, "basicConstraints");
+  if (!bc) throw new E(code, "an attestation leaf certificate MUST carry a basicConstraints extension (WebAuthn 8.2.1 / 8.3.1)");
+  if (bc.value && bc.value.cA === true) throw new E(code, "an attestation leaf certificate MUST NOT be a CA (basicConstraints cA=true)");
+}
+
+// packedCert(cert, exts, E, code) -- the complete WebAuthn 8.2.1 packed attestation-cert
+// profile (v3 + non-CA + the four subject attributes).
+// @enforced-by behavioral -- the subject-attribute + OU-literal checks are WebAuthn 8.2.1
+// business rules with no rename-proof code shape; the RED vectors (missing C/O/CN, wrong OU,
+// CA=true, non-v3) are the guard.
+function packedCert(cert, exts, E, code) {
+  requireV3(cert, E, code);
+  assertNotCa(cert, exts, E, code);
+  var have = {};
+  (cert.subject.rdns || []).forEach(function (rdn) { rdn.forEach(function (a) { have[a.type] = a.value; }); });
+  if (have[oid.byName("countryName")] == null || have[oid.byName("organizationName")] == null || have[oid.byName("commonName")] == null) {
+    throw new E(code, "the packed attestation certificate subject MUST set C, O, OU, and CN (WebAuthn 8.2.1)");
+  }
+  if (have[oid.byName("organizationalUnitName")] !== "Authenticator Attestation") {
+    throw new E(code, "the packed attestation certificate subject OU MUST be \"Authenticator Attestation\" (WebAuthn 8.2.1)");
+  }
+}
+
+// aikCert(cert, exts, E, code) -- the complete WebAuthn 8.3.1 TPM AIK attestation-cert
+// profile (v3 + non-CA + empty subject + tcg-kp-AIKCertificate EKU + the tcg SAN attributes).
+// @enforced-by behavioral -- the empty-subject + EKU + SAN-attribute checks are WebAuthn
+// 8.3.1 business rules with no rename-proof code shape; the RED vectors are the guard.
+function aikCert(cert, exts, E, code) {
+  requireV3(cert, E, code);
+  assertNotCa(cert, exts, E, code);
+  if ((cert.subject.rdns || []).length !== 0) throw new E(code, "the tpm AIK certificate subject MUST be empty (WebAuthn 8.3.1)");
+  var eku = exts.decode(cert, "extKeyUsage");
+  if (!eku || !Array.isArray(eku.value) || eku.value.indexOf(oid.byName("tcgKpAikCertificate")) === -1) {
+    throw new E(code, "the tpm AIK certificate lacks the tcg-kp-AIKCertificate extended key purpose (WebAuthn 8.3.1)");
+  }
+  var san = exts.decode(cert, "subjectAltName");
+  var dirName = san && san.value && san.value.names && san.value.names.filter(function (n) { return n.tagNumber === 4; })[0];
+  var types = {};
+  if (dirName && dirName.value && dirName.value.rdns) {
+    dirName.value.rdns.forEach(function (rdn) { rdn.forEach(function (a) { types[a.type] = true; }); });
+  }
+  if (!types[oid.byName("tpmManufacturer")] || !types[oid.byName("tpmModel")] || !types[oid.byName("tpmVersion")]) {
+    throw new E(code, "the tpm AIK certificate subjectAltName lacks the required tcg attributes (WebAuthn 8.3.1)");
+  }
+}
+
+// aaguidExt(cert, aaguid, exts, E, code, mismatchCode) -- the id-fido-gen-ce-aaguid
+// extension, if present, MUST NOT be critical and MUST equal the authenticatorData aaguid.
+// @enforced-by behavioral -- an optional-extension equality check has no rename-proof code
+// shape; the RED vectors (a critical ext, a non-matching aaguid) are the guard.
+function aaguidExt(cert, aaguid, exts, E, code, mismatchCode) {
+  var ext = exts.find(cert, "idFidoGenCeAaguid");
+  if (!ext) return;   // absence is tolerated; presence must match
+  if (ext.critical) throw new E(code, "the id-fido-gen-ce-aaguid extension MUST NOT be critical (WebAuthn 8.2.1)");
+  var val;
+  try { val = asn1.read.octetString(asn1.decode(ext.value)); }
+  catch (e) { throw new E(code, "the id-fido-gen-ce-aaguid extension value is not a valid OCTET STRING", e); }
+  if (!val.equals(aaguid)) throw new E(mismatchCode, "the id-fido-gen-ce-aaguid extension value does not equal the authenticatorData aaguid");
+}
+
+module.exports = {
+  requireV3: requireV3,
+  assertNotCa: assertNotCa,
+  packedCert: packedCert,
+  aikCert: aikCert,
+  aaguidExt: aaguidExt,
+};