@blamejs/pki 0.2.4 → 0.2.6

package/lib/validator-cose.js

@@ -0,0 +1,176 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The documented surface is the
+// verifiers whose credential-key handling composes this validator (pki.webauthn).
+//
+// validator-cose -- the SINGLE home for "is this a conformant WebAuthn credential
+// COSE_Key" (RFC 9052 sec. 7 structure + RFC 9053 EC2/OKP/RSA key parameters + the
+// CTAP2 canonical-CBOR profile WebAuthn sec. 6.5.1 imposes). Sibling to the guard
+// family: where a guard owns a CVE-class fail-closed defence once, a validator owns a
+// decoded TYPE's COMPLETE conformance rule set once, so a format module composes the
+// family rather than re-deriving a partial subset inline (the drift that leaks MUSTs
+// out one review round at a time). Enforced by the validator-shape-reinlined
+// codebase-patterns detector: a lib function that re-inlines COSE-key validation fires.
+//
+// Interface mirrors the guard family: (subject, E, code) where E is the caller's typed
+// error CONSTRUCTOR and code its domain code, so every boundary keeps its own
+// domain/reason (a future COSE consumer passes its own E + code).
+//
+// Rule set (gap-checked verbatim against RFC 9052 sec. 7 + RFC 9053 sec. 2/6 +
+// WebAuthn sec. 6.5.1 + the IANA COSE Key Type / Key Type Parameters registries):
+//   - kty (label 1) REQUIRED; value an integer (CTAP2 canonical -- a tstr kty/alg is
+//     rejected as non-canonical for the WebAuthn profile).
+//   - alg (label 3) REQUIRED (the RP needs it to verify the later assertion).
+//   - EC2 (kty 2): crv (-1), x (-2), y (-3) all present; x/y length == the curve field
+//     size. OKP (kty 1): crv (-1) == Ed25519(6)/Ed448(7), x (-2) length == the key size.
+//     RSA (kty 3): n (-1), e (-2) present + non-empty.
+//   - CANONICAL: EXACTLY the type's parameters, nothing more (EC2 = 5, OKP/RSA = 4) --
+//     rejects a padded key / a private "d" component / kid / key_ops (WebAuthn 6.5.1
+//     CTAP2 canonical, stricter than open COSE `* label => values`).
+//   - PROFILE: alg <-> kty (and, for EC2, alg <-> crv) consistent; -8 (EdDSA) is Ed25519
+//     ONLY; the RFC 9864 fully-specified ids (-9/-51/-52/-19/-53) are accepted.
+//   - COMPRESSED: an EC2 credential key MUST use the uncompressed point form (y is a full
+//     coordinate byte string, never a CBOR bool sign bit) -- WebAuthn sec. alg identifier.
+//   - ON-CURVE: the public key point MUST be valid for its curve. For EC2 the SPKI is
+//     imported via node:crypto so OpenSSL validates the point (an off-curve or identity
+//     point fails to parse). For OKP, OpenSSL does NOT validate the Edwards point on
+//     import (an all-zeroes key parses, and even verifies a trivial signature), so the
+//     point is checked explicitly via edwards-point (RFC 8032 decode + cofactor low-order
+//     rejection) -- an off-curve, non-canonical, or low-order OKP key fails closed.
+
+var cbor = require("./cbor-det");
+var asn1 = require("./asn1-der");
+var oid = require("./oid");
+var edwardsPoint = require("./edwards-point");
+var nodeCrypto = require("crypto");
+
+// COSE EC2 curve (label -1) -> the fixed field-element byte length x/y carry, and the
+// named-curve OID a certificate on that curve declares.
+var EC2_CRV_LEN = { 1: 32, 2: 48, 3: 66 };   // P-256 / P-384 / P-521
+var EC2_CRV_OID = { 1: "prime256v1", 2: "secp384r1", 3: "secp521r1" };
+// COSE OKP curve (label -1) -> its RFC 8410 named-key OID + fixed public-key length.
+var OKP_CRV = { 6: { oid: "Ed25519", len: 32 }, 7: { oid: "Ed448", len: 57 } };
+// alg (label 3) -> the key type (and, for EC2, curve) it pins. WebAuthn (sec. alg
+// identifier) adds guarantees over the open COSE registry: an ECDSA alg fixes its curve,
+// -8 (EdDSA) is Ed25519 ONLY, and the RFC 9864 fully-specified ids (-9 ESP256, -51 ESP384,
+// -52 ESP512, -19 Ed25519, -53 Ed448) each pin key type + curve. A verifier accepts the
+// fully-specified ids even though WebAuthn recommends against them for credential creation.
+var ALG_PROFILE = {
+  "-7": { kty: 2, crv: 1 }, "-35": { kty: 2, crv: 2 }, "-36": { kty: 2, crv: 3 },
+  "-9": { kty: 2, crv: 1 }, "-51": { kty: 2, crv: 2 }, "-52": { kty: 2, crv: 3 },
+  "-8": { kty: 1, crv: 6 }, "-19": { kty: 1, crv: 6 }, "-53": { kty: 1, crv: 7 },
+  "-257": { kty: 3 }, "-258": { kty: 3 }, "-259": { kty: 3 }, "-37": { kty: 3 }, "-65535": { kty: 3 },
+};
+
+// The value node of an integer-labelled COSE_Key parameter (labels are ints), or null.
+function _mapGetInt(node, key) {
+  if (!node || node.majorType !== 5 || !node.children) return null;
+  for (var i = 0; i < node.children.length; i++) {
+    var k = node.children[i][0];
+    if ((k.majorType === 0 || k.majorType === 1) && cbor.read.int(k) === BigInt(key)) return node.children[i][1];
+  }
+  return null;
+}
+
+// credentialKey(node, E, code) -> the decoded + validated credential public key
+// { kty, alg, crv?, x?, y?, n?, e? }, or throws new E(code, ...). The complete COSE_Key
+// conformance gate for a WebAuthn credential key; a format module MUST route a credential
+// key through here, never re-inline the kty/alg/crv/length/canonical/profile/on-curve
+// checks.
+// @enforced-by validator-shape-reinlined
+// @validator-shape kty\s*===\s*2n
+// @validator-shape EC2_CRV_LEN|ALG_PROFILE
+function credentialKey(node, E, code) {
+  function bad(msg, cause) { return new E(code, msg, cause); }
+  if (!node || node.majorType !== 5) throw bad("a COSE_Key must be a CBOR map (RFC 9052 sec. 7)");
+  // Every parameter read maps a wrong-type cbor/* fault to the caller's domain -- a
+  // wrong-typed COSE label (x as an integer, kty as a string) is bad input, not a leak.
+  function ib(label) { var n = _mapGetInt(node, label); if (!n) return null; try { return cbor.read.byteString(n); } catch (e) { throw bad("COSE_Key parameter " + label + " must be a byte string", e); } }
+  function ii(label) { var n = _mapGetInt(node, label); if (!n) return null; try { return cbor.read.int(n); } catch (e) { throw bad("COSE_Key parameter " + label + " must be an integer", e); } }
+  var ktyN = _mapGetInt(node, 1), algN = _mapGetInt(node, 3);
+  if (!ktyN) throw bad("a COSE_Key is missing the kty (label 1) parameter");
+  if (!algN) throw bad("a COSE_Key is missing the alg (label 3) parameter");
+  var kty, algv;
+  try { kty = cbor.read.int(ktyN); algv = cbor.read.int(algN); }
+  catch (e) { throw bad("COSE_Key kty (label 1) and alg (label 3) must be integers", e); }
+  var key = { kty: Number(kty), alg: Number(algv) };
+  if (kty === 2n) {
+    key.crv = ii(-1) != null ? Number(ii(-1)) : null;
+    // WebAuthn EC2 credential keys MUST use the uncompressed point form: y (-3) is the full
+    // y-coordinate byte string, never a CBOR bool sign bit (WebAuthn sec. alg identifier).
+    var yNode = _mapGetInt(node, -3);
+    if (yNode && yNode.majorType === 7) throw bad("an EC2 credential key must use the uncompressed point form (a compressed y sign-bit is not permitted for WebAuthn)");
+    key.x = ib(-2); key.y = ib(-3);
+    if (key.crv == null || !key.x || !key.y) throw bad("an EC2 COSE_Key must carry crv (-1), x (-2), and y (-3)");
+    var el = EC2_CRV_LEN[key.crv];
+    if (!el || key.x.length !== el || key.y.length !== el) throw bad("an EC2 COSE_Key x/y length is inconsistent with its curve");
+  } else if (kty === 1n) {
+    key.crv = ii(-1) != null ? Number(ii(-1)) : null; key.x = ib(-2);
+    var okp = OKP_CRV[key.crv];
+    if (!okp || !key.x || key.x.length !== okp.len) throw bad("an OKP COSE_Key must be Ed25519 (crv 6) or Ed448 (crv 7) with a matching-length x (-2)");
+  } else if (kty === 3n) {
+    key.n = ib(-1); key.e = ib(-2);
+    if (!key.n || !key.n.length || !key.e || !key.e.length) throw bad("an RSA COSE_Key must carry n (-1) and e (-2)");
+  } else {
+    throw bad("unsupported COSE_Key kty " + Number(kty));
+  }
+  // CANONICAL CTAP2 COSE_Key: exactly the type's parameters, nothing more.
+  var expectedParams = kty === 2n ? 5 : 4;
+  if (node.children.length !== expectedParams) throw bad("the COSE_Key carries parameters beyond the canonical set for its key type (WebAuthn sec. 6.5.1)");
+  // PROFILE: the declared alg must match the key type (and, for EC2, the curve).
+  var prof = ALG_PROFILE[String(key.alg)];
+  if (!prof) throw bad("unsupported credential key algorithm " + key.alg);
+  if (prof.kty !== key.kty) throw bad("credential key algorithm " + key.alg + " is inconsistent with key type " + key.kty);
+  if (prof.crv != null && prof.crv !== key.crv) throw bad("credential key algorithm " + key.alg + " requires a different curve");
+  // ON-CURVE: import the SPKI so OpenSSL validates the EC point on its curve. An off-curve
+  // x/y or the identity point fails to parse here.
+  try { nodeCrypto.createPublicKey({ key: toSpki(key, E, code), format: "der", type: "spki" }); }
+  catch (e) { throw bad("the credential public key point is not valid for its curve", e); }
+  // OpenSSL does NOT validate an OKP (Ed25519/Ed448) point on import -- an all-zeroes key
+  // parses, and even verifies a trivial signature -- so an OKP point needs an explicit
+  // on-curve + full-order (non-low-order) check (RFC 8032 decode + the cofactor check).
+  if (kty === 1n && !edwardsPoint.validate(key.x, key.crv)) throw bad("the OKP credential public key is not a valid, full-order Edwards point");
+  return key;
+}
+
+// toSpki(key, E, code) -> a self-contained SubjectPublicKeyInfo DER for a validated COSE
+// key, so a credential key and a certificate key import/compare by one path.
+// @enforced-by behavioral -- an SPKI encoding of a validated COSE key has no rename-proof
+// code shape distinct from the ecPublicKey/rsaEncryption OID-name tokens that legitimately
+// recur in the oid registry + inspect renderer; its consumers route through
+// validatorCose.toSpki and credentialKey calls it on the on-curve path, so the webauthn
+// KAT round-trip (a real SPKI imports + verifies) is the behavioral guard.
+function toSpki(key, E, code) {
+  function bad(msg) { return new E(code, msg); }
+  if (key.kty === 2 && key.x && key.y) {
+    var curveOid = EC2_CRV_OID[key.crv];
+    if (!curveOid) throw bad("unsupported EC2 curve " + key.crv);
+    var b = asn1.build;
+    return b.sequence([
+      b.sequence([b.oid(oid.byName("ecPublicKey")), b.oid(oid.byName(curveOid))]),
+      b.bitString(Buffer.concat([Buffer.from([0x04]), key.x, key.y])),
+    ]);
+  }
+  if (key.kty === 3 && key.n && key.n.length && key.e && key.e.length) {
+    var bb = asn1.build;
+    return bb.sequence([
+      bb.sequence([bb.oid(oid.byName("rsaEncryption")), bb.nullValue()]),
+      bb.bitString(bb.sequence([bb.integer(BigInt("0x" + key.n.toString("hex"))), bb.integer(BigInt("0x" + key.e.toString("hex")))])),
+    ]);
+  }
+  if (key.kty === 1 && OKP_CRV[key.crv] && key.x && key.x.length === OKP_CRV[key.crv].len) {
+    var eb = asn1.build;
+    return eb.sequence([eb.sequence([eb.oid(oid.byName(OKP_CRV[key.crv].oid))]), eb.bitString(key.x)]);
+  }
+  throw bad("cannot build an SPKI for this COSE key type");
+}
+
+module.exports = {
+  credentialKey: credentialKey,
+  toSpki: toSpki,
+  EC2_CRV_LEN: EC2_CRV_LEN,
+  EC2_CRV_OID: EC2_CRV_OID,
+  OKP_CRV: OKP_CRV,
+};

package/lib/validator-keydesc.js

@@ -0,0 +1,89 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The documented surface is the verifier whose
+// android-key handling composes this validator (pki.webauthn).
+//
+// validator-keydesc -- the SINGLE home for the Android Key Attestation KeyDescription
+// conformance (the AOSP key-attestation schema + WebAuthn sec. 8.4.1 authorization-list
+// checks). Sibling to the guard family: a validator owns a decoded TYPE's COMPLETE
+// conformance rule set once, so the four 8.4.1 checks cannot lose a gate to drift.
+//
+// The caller supplies its parsed certificate + an extension-accessor `exts`
+// { find(cert, oidName) -> rawExt|null } + its typed error CONSTRUCTOR E with two codes: a
+// STRUCTURAL `code` (a malformed KeyDescription is bad input) and a semantic `failCode` (a
+// well-formed description that fails an 8.4.1 MUST is a failed verification).
+//
+// Rule set (gap-checked verbatim against WebAuthn sec. 8.4.1 + the AOSP KeyDescription
+// schema):
+//   - KeyDescription is a positional SEQUENCE; attestationChallenge (position 4) MUST equal
+//     clientDataHash.
+//   - allApplications (tag 600) MUST be absent from BOTH the softwareEnforced (position 6)
+//     and teeEnforced (position 7) AuthorizationLists (the key MUST be scoped to the RP).
+//   - origin (tag 702) MUST equal KM_ORIGIN_GENERATED (0): at least one list declares it,
+//     and every list that declares one says GENERATED (a mixed IMPORTED/GENERATED key is
+//     contradictory and rejected).
+//   - purpose (tag 1) MUST be EXACTLY { KM_PURPOSE_SIGN (2) } over the union of the lists.
+
+var asn1 = require("./asn1-der");
+
+// The EXPLICIT-unwrapped value node for a [tag] field of an AuthorizationList (a SEQUENCE
+// of context-tagged OPTIONAL fields with non-contiguous tag numbers), or null when absent.
+function _alGet(seqNode, tag) {
+  if (!seqNode || !seqNode.children) return null;
+  for (var i = 0; i < seqNode.children.length; i++) {
+    var c = seqNode.children[i];
+    if (c.tagClass === "context" && c.tagNumber === tag) return c.children && c.children[0] ? c.children[0] : c;
+  }
+  return null;
+}
+
+function _alInt(node, E, code) {
+  try { return asn1.read.integer(node); }
+  catch (e) { throw new E(code, "an android KeyDescription authorization value is not an INTEGER", e); }
+}
+
+function _purposeUnion(a, b, E, code) {
+  var out = [];
+  [a, b].forEach(function (list) {
+    var p = _alGet(list, 1);
+    if (p && p.children) p.children.forEach(function (c) { var v = _alInt(c, E, code); if (out.indexOf(v) === -1) out.push(v); });
+  });
+  return out;
+}
+
+// androidKeyDescription(cert, clientDataHash, exts, E, code, failCode) -- the complete
+// WebAuthn 8.4.1 KeyDescription gate. A verifier MUST route the android-key description
+// through here, never re-derive a partial subset of the four checks inline.
+// @enforced-by behavioral -- the challenge / allApplications / origin / purpose checks are
+// WebAuthn 8.4.1 business rules with no rename-proof code shape; the RED vectors (challenge
+// mismatch, allApplications present, origin != GENERATED, purpose != SIGN, and the empty-
+// authorization-list spec vector) are the guard.
+function androidKeyDescription(cert, clientDataHash, exts, E, code, failCode) {
+  var ext = exts.find(cert, "keyDescription");
+  if (!ext) throw new E(code, "the android-key attestation certificate is missing the key-description extension (WebAuthn 8.4.1)");
+  var kd;
+  try { kd = asn1.decode(ext.value); } catch (e) { throw new E(code, "the android KeyDescription is not decodable", e); }
+  if (!kd.children || kd.children.length < 8) throw new E(code, "the android KeyDescription is not a positional 8-field SEQUENCE");
+  // (1) attestationChallenge (position 4) == clientDataHash.
+  var challenge;
+  try { challenge = asn1.read.octetString(kd.children[4]); } catch (e) { throw new E(code, "the android attestationChallenge is not an OCTET STRING", e); }
+  if (!challenge.equals(clientDataHash)) throw new E(failCode, "the android attestationChallenge does not equal clientDataHash");
+  var softwareEnforced = kd.children[6], hardwareEnforced = kd.children[7];
+  // (2) [600] allApplications MUST be ABSENT in both lists.
+  if (_alGet(softwareEnforced, 600) || _alGet(hardwareEnforced, 600)) throw new E(failCode, "android allApplications MUST be absent (WebAuthn 8.4.1)");
+  // (3) origin == KM_ORIGIN_GENERATED (0) over the union: at least one list declares it,
+  // and every list that declares one says GENERATED.
+  var origins = [_alGet(softwareEnforced, 702), _alGet(hardwareEnforced, 702)].filter(Boolean);
+  if (!origins.length || !origins.every(function (o) { return _alInt(o, E, code) === 0n; })) {
+    throw new E(failCode, "android key origin is not KM_ORIGIN_GENERATED in every authorization list that declares it (WebAuthn 8.4.1)");
+  }
+  // (4) purpose == exactly { KM_PURPOSE_SIGN (2) } over the union.
+  var purposes = _purposeUnion(softwareEnforced, hardwareEnforced, E, code);
+  if (purposes.length !== 1 || purposes[0] !== 2n) {
+    throw new E(failCode, "android key purpose is not exactly KM_PURPOSE_SIGN (WebAuthn 8.4.1)");
+  }
+}
+
+module.exports = { androidKeyDescription: androidKeyDescription };

package/lib/validator-sig.js

@@ -0,0 +1,57 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The documented surface is the verifiers
+// whose ECDSA signature handling composes this validator (pki.webauthn).
+//
+// validator-sig -- the SINGLE home for "is this a conformant DER ECDSA-Sig-Value", and
+// its conversion to the raw r||s (IEEE P1363) form a WebCrypto verify expects. Sibling to
+// the guard family: a validator owns a decoded TYPE's COMPLETE conformance rule set once,
+// so a format module composes it rather than hand-decoding a 2-INTEGER SEQUENCE into r/s
+// and forgetting a strict-DER check (the drift a validator exists to prevent).
+//
+// Interface mirrors the guard family: (subject, ..., E, code) where E is the caller's
+// typed error CONSTRUCTOR and code its domain code.
+//
+// Rule set (gap-checked verbatim against RFC 3279 sec. 2.2.3 + X.690 sec. 8.3 + SEC1):
+//   - ECDSA-Sig-Value ::= SEQUENCE { r INTEGER, s INTEGER } -- a universal SEQUENCE with
+//     EXACTLY two children.
+//   - r and s are each a PRIMITIVE, MINIMALLY-ENCODED (X.690 sec. 8.3.2 -- no redundant
+//     leading 0x00/0xFF), POSITIVE integer. Reading through the strict DER integer reader
+//     enforces the primitive + minimal-encoding rules; the value is then range-checked
+//     positive (r,s >= 1) and bounded by the curve field size. A non-minimal, zero,
+//     negative, or over-size coordinate fails closed -- never normalized-and-accepted.
+
+var asn1 = require("./asn1-der");
+
+// ecdsaSigToRaw(der, coordLen, E, code) -> the validated signature as raw r||s, each
+// coordinate left-padded to coordLen bytes, or throws new E(code, ...). The complete DER
+// ECDSA-Sig-Value conformance gate; a verifier MUST route an ECDSA signature through here,
+// never hand-decode the SEQUENCE and read r/s content raw (which skips minimality).
+// @enforced-by behavioral -- a DER ECDSA-Sig-Value decode has no rename-proof code shape
+// distinct from generic 2-child-SEQUENCE content access; the RED conformance vectors
+// (non-minimal / negative / zero / over-size r or s rejected) and the webauthn ECDSA KATs
+// are the guard.
+function ecdsaSigToRaw(der, coordLen, E, code) {
+  var node;
+  try { node = asn1.decode(der); } catch (e) { throw new E(code, "ECDSA signature is not a DER SEQUENCE", e); }
+  if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length !== 2) {
+    throw new E(code, "ECDSA signature must be a DER SEQUENCE { r, s }");
+  }
+  function coord(c, label) {
+    // The strict DER integer reader enforces PRIMITIVE + MINIMAL encoding (a constructed
+    // child, an empty INTEGER, or a redundant 0x00/0xFF sign octet all throw). The value
+    // is then range-checked: r and s MUST be positive (>= 1) and fit the curve field size.
+    var v;
+    try { v = asn1.read.integer(c); } catch (e) { throw new E(code, "ECDSA signature " + label + " is not a minimally-encoded DER INTEGER", e); }
+    if (v <= 0n) throw new E(code, "ECDSA signature " + label + " must be a positive integer");
+    var hex = v.toString(16); if (hex.length % 2) hex = "0" + hex;
+    var b = Buffer.from(hex, "hex");
+    if (b.length > coordLen) throw new E(code, "ECDSA signature " + label + " exceeds the curve field size");
+    var out = Buffer.alloc(coordLen); b.copy(out, coordLen - b.length); return out;
+  }
+  return Buffer.concat([coord(node.children[0], "r"), coord(node.children[1], "s")]);
+}
+
+module.exports = { ecdsaSigToRaw: ecdsaSigToRaw };

package/lib/validator-tpm.js

@@ -0,0 +1,135 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The documented surface is the verifier whose
+// tpm handling composes this validator (pki.webauthn).
+//
+// validator-tpm -- the SINGLE home for the TPM 2.0 structure conformance a WebAuthn tpm
+// attestation carries: the TPMT_PUBLIC (pubArea) and TPMS_ATTEST (certInfo) decode, plus the
+// pubArea-key == credential-key binding (WebAuthn sec. 8.3 + TCG TPM 2.0 Part 2). Sibling to
+// the guard family: a validator owns a decoded TYPE's COMPLETE conformance rule set once, so
+// the strict TPM2B sizing / algorithm-union walking / trailing-byte rejection cannot drift.
+//
+// Every field is unsigned big-endian, packed with no padding; every TPM2B_* is a UINT16 size
+// followed by exactly `size` bytes. The bare certInfo and pubArea carry NO outer TPM2B size
+// prefix. The caller supplies its typed error CONSTRUCTOR E + a structural `code` (a
+// malformed structure is bad input) and, for the key binding, a `mismatchCode`.
+//
+// Rule set (gap-checked verbatim against WebAuthn sec. 8.3 + TCG TPM 2.0 Part 2 sec. 10.12 /
+// 12.2):
+//   - parsePubArea: decode type/nameAlg, walk parameters per the algorithm union, read the
+//     public key in `unique`; reject trailing bytes (they perturb the TPM Name hash).
+//   - parseCertInfo: magic == TPM_GENERATED_VALUE, type == TPM_ST_ATTEST_CERTIFY; read
+//     extraData + attested.name; reject trailing bytes past the attested structure.
+//   - pubKeyEqualsCose: the pubArea key (EC curve+x+y, or RSA modulus+exponent) equals the
+//     credential COSE key, compared as unsigned magnitudes (a TPM2B may differ from a COSE
+//     coordinate by a leading 0x00), the RSA exponent over its full UINT32 width.
+
+var ByteReader = require("./byte-reader");
+
+var TPM_GENERATED_VALUE = 0xff544347;
+var TPM_ST_ATTEST_CERTIFY = 0x8017;
+var TPM_ALG = { RSA: 0x0001, SHA1: 0x0004, SHA256: 0x000b, SHA384: 0x000c, SHA512: 0x000d, NULL: 0x0010, ECC: 0x0023 };
+var TPM_ALG_HASH = {}; TPM_ALG_HASH[TPM_ALG.SHA1] = "sha1"; TPM_ALG_HASH[TPM_ALG.SHA256] = "sha256"; TPM_ALG_HASH[TPM_ALG.SHA384] = "sha384"; TPM_ALG_HASH[TPM_ALG.SHA512] = "sha512";
+// TPM_ECC_CURVE -> COSE crv (the codepoints differ; this is a mapping, not equality).
+var TPM_CURVE_TO_COSE = {}; TPM_CURVE_TO_COSE[0x0003] = 1; TPM_CURVE_TO_COSE[0x0004] = 2; TPM_CURVE_TO_COSE[0x0005] = 3;
+
+// Unsigned big-endian magnitude compare: strip leading zero octets, then byte-equal. TPM2B
+// buffers and COSE fixed-length coordinates can differ by a leading 0x00.
+function _ucmp(a, b) {
+  function strip(x) { var i = 0; while (i < x.length - 1 && x[i] === 0) i++; return x.subarray(i); }
+  return Buffer.compare(strip(a), strip(b)) === 0;
+}
+function _uintBytes(n) {
+  var hex = n.toString(16); if (hex.length % 2) hex = "0" + hex;
+  var b = Buffer.from(hex, "hex"); var i = 0; while (i < b.length - 1 && b[i] === 0) i++; return b.subarray(i);
+}
+// TPMT_SYM_DEF_OBJECT: algorithm UINT16; when not NULL, keyBits+mode follow. An attestation
+// (restricted signing) key is NULL, so the non-NULL arm is defensive.
+function _symDef(r) { if (r.u16() !== TPM_ALG.NULL) { r.u16(); r.u16(); } }
+// TPMT_*_SCHEME / TPMT_KDF_SCHEME: scheme UINT16; when not NULL, a TPMS_SCHEME_HASH (a single
+// UINT16 hashAlg) follows for the signing/kdf schemes in scope.
+function _scheme(r) { if (r.u16() !== TPM_ALG.NULL) { r.u16(); } }
+
+// parsePubArea(buf, E, code) -> the decoded TPMT_PUBLIC (WebAuthn 8.3 item 17-20).
+// @enforced-by behavioral -- a packed TPM structure decode has no rename-proof code shape;
+// the RED vectors (trailing bytes, an unsupported type, a truncated TPM2B) are the guard.
+function parsePubArea(buf, E, code) {
+  var r = new ByteReader(buf, 0, buf.length, E, code);
+  var type = r.u16(), nameAlg = r.u16();
+  r.u32();                       // objectAttributes (full policy validation deferred)
+  r.vector(2, 0, null);          // authPolicy TPM2B_DIGEST
+  var pub = { type: type, nameAlg: nameAlg, nameAlgBytes: buf.subarray(2, 4) };
+  if (type === TPM_ALG.RSA) {
+    _symDef(r);                  // symmetric TPMT_SYM_DEF_OBJECT
+    _scheme(r);                  // scheme TPMT_RSA_SCHEME
+    r.u16();                     // keyBits
+    var exp = r.u32();           // exponent (0 => default 65537)
+    pub.exponent = exp === 0 ? 65537 : exp;
+    pub.rsa = r.vector(2, 0, null);   // unique TPM2B_PUBLIC_KEY_RSA (the modulus)
+  } else if (type === TPM_ALG.ECC) {
+    _symDef(r);                  // symmetric
+    _scheme(r);                  // scheme TPMT_ECC_SCHEME
+    pub.curveId = r.u16();       // curveID TPMI_ECC_CURVE
+    _scheme(r);                  // kdf TPMT_KDF_SCHEME
+    pub.x = r.vector(2, 0, null);     // unique.ecc.x TPM2B_ECC_PARAMETER
+    pub.y = r.vector(2, 0, null);     // unique.ecc.y TPM2B_ECC_PARAMETER
+  } else {
+    throw new E(code, "unsupported TPMT_PUBLIC type 0x" + type.toString(16));
+  }
+  // TPMT_PUBLIC ends with `unique`; trailing bytes mean a malformed pubArea (and would
+  // perturb the TPM Name hash), so fail closed rather than silently ignore them.
+  if (!r.atEnd()) throw new E(code, "pubArea has trailing bytes after the unique field (WebAuthn 8.3)");
+  return pub;
+}
+
+// parseCertInfo(buf, E, code) -> the decoded + magic/type-validated TPMS_ATTEST
+// { extraData, attestedName } (WebAuthn 8.3 item 13-15).
+// @enforced-by behavioral -- a packed TPM structure decode has no rename-proof code shape;
+// the RED vectors (wrong magic, wrong type, trailing bytes) are the guard.
+function parseCertInfo(buf, E, code) {
+  var r = new ByteReader(buf, 0, buf.length, E, code);
+  var magic = r.u32(), type = r.u16();
+  if (magic !== TPM_GENERATED_VALUE) throw new E(code, "certInfo magic is not TPM_GENERATED_VALUE (WebAuthn 8.3)");
+  if (type !== TPM_ST_ATTEST_CERTIFY) throw new E(code, "certInfo type is not TPM_ST_ATTEST_CERTIFY (WebAuthn 8.3)");
+  r.vector(2, 0, null);          // qualifiedSigner TPM2B_NAME
+  var extraData = r.vector(2, 0, null);   // extraData TPM2B_DATA
+  r.u64(); r.u32(); r.u32(); r.u8();      // clockInfo TPMS_CLOCK_INFO (17 bytes)
+  r.u64();                       // firmwareVersion
+  var name = r.vector(2, 0, null);        // attested.name TPM2B_NAME (nameAlg||H)
+  r.vector(2, 0, null);          // attested.qualifiedName TPM2B_NAME
+  if (!r.atEnd()) throw new E(code, "certInfo has trailing bytes after the attested structure (WebAuthn 8.3)");
+  return { extraData: extraData, attestedName: name };
+}
+
+// pubKeyEqualsCose(pub, cose, E, mismatchCode, code) -- the pubArea public key MUST equal the
+// credential COSE key (WebAuthn 8.3 item 22).
+// @enforced-by behavioral -- a decoded-key equality check has no rename-proof code shape; the
+// RED vectors (a mismatched EC curve/coordinate, a mismatched RSA modulus/exponent) are the guard.
+function pubKeyEqualsCose(pub, cose, E, mismatchCode, code) {
+  if (pub.type === TPM_ALG.ECC) {
+    if (cose.kty !== 2 || TPM_CURVE_TO_COSE[pub.curveId] !== cose.crv || !_ucmp(pub.x, cose.x || Buffer.alloc(0)) || !_ucmp(pub.y, cose.y || Buffer.alloc(0))) {
+      throw new E(mismatchCode, "the TPM pubArea EC key does not equal the credential public key");
+    }
+    return;
+  }
+  if (pub.type === TPM_ALG.RSA) {
+    // Compare the exponent as an unsigned integer over its FULL width (a UINT32 up to
+    // 0xFFFFFFFF); a fixed 3-byte re-encode would silently truncate an exponent > 0xFFFFFF
+    // and let a mismatched key pass (WebAuthn 8.3 item 22).
+    var e = _uintBytes(pub.exponent >>> 0);
+    if (cose.kty !== 3 || !_ucmp(pub.rsa, cose.n || Buffer.alloc(0)) || !_ucmp(e, cose.e || Buffer.alloc(0))) {
+      throw new E(mismatchCode, "the TPM pubArea RSA key does not equal the credential public key");
+    }
+    return;
+  }
+  throw new E(code, "unsupported TPM pubArea key type");
+}
+
+module.exports = {
+  parsePubArea: parsePubArea,
+  parseCertInfo: parseCertInfo,
+  pubKeyEqualsCose: pubKeyEqualsCose,
+  TPM_ALG_HASH: TPM_ALG_HASH,
+};