@blamejs/pki 0.2.5 → 0.2.6

package/CHANGELOG.md

@@ -4,6 +4,25 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.2.6 — 2026-07-13
+
+WebAuthn attestation verification covers Ed448 and the RFC 9864 fully-specified COSE algorithms, and hardens credential-key conformance.
+
+### Added
+
+- pki.webauthn now verifies the RFC 9864 fully-specified COSE algorithm identifiers a WebAuthn relying party may receive: ESP256 (-9), ESP384 (-51), ESP512 (-52), Ed25519 (-19), and Ed448 (-53). Ed448 (-53) is the only WebAuthn path to Ed448, so an Ed448 credential now verifies rather than erroring as an unsupported algorithm.
+- The verifier is now checked against the official W3C WebAuthn Level 3 test-vector suite -- every published vector across ES256 / ES384 / ES512 / RS256 / Ed25519 / Ed448 and the packed / self / tpm / apple / fido-u2f / none formats -- as an independent cross-implementation oracle.
+
+### Changed
+
+- A WebAuthn credential key with COSE alg -8 (EdDSA) now requires curve Ed25519 (crv 6), matching the WebAuthn algorithm-identifier profile; an -8 key claiming Ed448 (crv 7) is rejected -- Ed448 is carried under the fully-specified identifier -53 instead.
+- An EC2 credential key must use the uncompressed point form; the compressed sign-bit y encoding is rejected for WebAuthn credential keys.
+
+### Fixed
+
+- The WebAuthn credential public-key point is now validated on its curve, so an off-curve or identity EC/Edwards point fails closed at decode rather than being carried into a later verify step.
+- An ECDSA attestation signature is now enforced as a minimally-encoded DER ECDSA-Sig-Value (X.690): a non-minimal, negative, zero, or over-size r/s coordinate is rejected as malformed instead of being stripped and accepted.
+
 ## v0.2.5 — 2026-07-12
 
 WebAuthn / passkey attestation verification joins the toolkit as pki.webauthn.

package/README.md

@@ -228,7 +228,7 @@ is callable today; nothing below is a stub.
 | `pki.hpke` | Hybrid Public Key Encryption (RFC 9180) — the encrypt-to-a-public-key primitive behind TLS ECH, MLS, and OHTTP. `setupS`/`setupR` establish a sender/recipient context (KEM encapsulation + HKDF key schedule); the context's `seal`/`open` AEAD-encrypt with a sequence-counter nonce and `export` derives further secrets; `seal`/`open` are single-shot wrappers. DHKEM (P-256, P-521, X25519, X448) × HKDF-SHA256/SHA512 × AES-GCM/ChaCha20Poly1305/export-only × all four modes, proven against the RFC 9180 Appendix A vectors. DHKEM(P-384) and HKDF-SHA384 are RFC-registered but Appendix A ships no vector for them, so they fail closed until an authoritative KAT exists. Pure composition over `node:crypto`; ML-KEM / X-Wing are a registry data-row extension pending stable drafts — `suites`, `setupS`, `setupR`, `seal`, `open` |
 | `pki.sigstore` | Offline verifier for a Sigstore bundle — the exact artifact `npm publish --provenance` produces and the registry serves. `verifyBundle` composes five fail-closed legs against caller-pinned trust (Fulcio CA roots + Rekor log keys, never trusted from the bundle): the DSSE signature over its PAE preimage under the Fulcio leaf key; the ephemeral Fulcio certificate chain, validated as of the Rekor log time; the RFC 9162 inclusion proof folded to a Rekor-signed tree root; the log entry bound to this exact signature; and the in-toto SLSA subject digest the caller confirms against the published artifact. Zero runtime deps — reuses the X.509 parser, RFC 5280 path validator, and Merkle verifier; the net-new codecs are the DSSE PAE byte-builder and a fail-closed JSON reader. `pae`, `parseBundle`, `verifyBundle` |
 | `pki.inspect` | Human-readable certificate inspection — the pure-JS equivalent of `openssl x509 -text`. `certificate(pem | der | parsed)` renders a familiar OpenSSL-style report: version, serial, signature algorithm, issuer/subject distinguished names, validity, public-key details (curve or modulus size + the raw point/modulus), every decoded extension with its critical flag, and the signature. Built over the strict parser and the two-way OID registry, so it names extension and algorithm OIDs an OpenSSL build shows only as raw bytes. No OpenSSL dependency; the format is stable and OpenSSL-familiar rather than pinned to one OpenSSL version; a malformed extension falls back to a hex dump rather than throwing — `certificate` |
-| `pki.webauthn` | WebAuthn / passkey attestation verification — offline trust evaluation of a W3C WebAuthn (Level 3) attestation. `parseAttestationObject(bytes)` decodes the CBOR attestation object + authenticatorData + COSE credential key over the strict `pki.cbor` codec; `verify(attestationObject, clientDataHash, opts)` checks the attestation-statement signature and each format's structural bindings for **packed / tpm / android-key / apple / fido-u2f / none** — the x5c leaf key, the apple nonce, the tpm `certInfo` Name/`extraData` over the `pubArea`, the android `KeyDescription`, the fido-u2f `verificationData` — binding the credential public key to each attestation (via the signed authenticatorData for packed/fido-u2f, or a cert/`pubArea`-key equality check for android-key/apple/tpm) and enforcing each leaf's certificate requirements. A verifier, not a ceremony client; fail-closed with typed `webauthn/*` errors. Chaining the returned trust path to a pinned root (and aaguid→root via FIDO MDS) is the caller's step through `pki.path.validate` — `parseAttestationObject`, `verify` |
+| `pki.webauthn` | WebAuthn / passkey attestation verification — offline trust evaluation of a W3C WebAuthn (Level 3) attestation. `parseAttestationObject(bytes)` decodes the CBOR attestation object + authenticatorData + COSE credential key over the strict `pki.cbor` codec; `verify(attestationObject, clientDataHash, opts)` checks the attestation-statement signature and each format's structural bindings for **packed / tpm / android-key / apple / fido-u2f / none** — the x5c leaf key, the apple nonce, the tpm `certInfo` Name/`extraData` over the `pubArea`, the android `KeyDescription`, the fido-u2f `verificationData` — binding the credential public key to each attestation (via the signed authenticatorData for packed/fido-u2f, or a cert/`pubArea`-key equality check for android-key/apple/tpm) and enforcing each leaf's certificate requirements. The credential-key check covers the full WebAuthn COSE algorithm set — ES256/384/512, RS256/384/512, PS256, EdDSA (Ed25519), and the RFC 9864 fully-specified identifiers **ESP256/384/512, Ed25519, and Ed448** — validating the public-key point on its curve, rejecting the compressed EC point form, and enforcing a minimally-encoded DER ECDSA signature. A verifier, not a ceremony client; fail-closed with typed `webauthn/*` errors. Chaining the returned trust path to a pinned root (and aaguid→root via FIDO MDS) is the caller's step through `pki.path.validate` — `parseAttestationObject`, `verify` |
 | `pki.C` / `pki.constants` | Version-stable constants — functional scale helpers (`C.TIME.*`, `C.BYTES.*`), codec `LIMITS`, `version` |
 | `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError` / `TspError` / `AttrCertError` / `CrmfError` / `Pkcs12Error` / `CmpError` / `PathError` / `CtError` / `JoseError` / `AcmeError` / `WebauthnError`, each carrying a stable `code` in `domain/reason` form |
 | `pki` CLI | `pki version`, `pki oid <dotted\|name>`, `pki parse <cert>` |

package/lib/acme.js

@@ -85,7 +85,8 @@ function _isUrl(v) {
   var u;
   // A parse failure IS the "not a URL" verdict for this boolean predicate -- there
   // is no PkiError here to thread a cause into, so the error is intentionally ignored.
-  try { u = new URL(v); } catch (_e) { return false; }
+  try { u = new URL(v); }
+  catch (_e) { return false; }
   return (u.protocol === "http:" || u.protocol === "https:") && u.hostname.length > 0;
 }
 // A URI string with any RFC 3986 scheme (mailto:, tel:, http(s):, ...). An account

package/lib/edwards-point.js

@@ -0,0 +1,91 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. Composed by validator-cose to validate an
+// OKP (Ed25519 / Ed448) credential public-key point.
+//
+// edwards-point -- point validation for the Edwards curves EdDSA uses. node:crypto imports
+// an RFC 8410 OKP SubjectPublicKeyInfo WITHOUT checking the point is a valid, full-order
+// Edwards point (an all-zeroes Ed25519/Ed448 key parses, and an all-zeroes key with an
+// all-zeroes signature even verifies TRUE -- a trivial forgery), so an OKP credential key
+// needs an explicit check. This decodes the compressed point per RFC 8032 sec. 5.1.3
+// (Ed25519) / sec. 5.2.3 (Ed448) -- which fails closed on an off-curve or non-canonical
+// encoding -- and rejects a low-order point via the cofactor check [8]P == identity (an
+// all-zeroes key is a low-order point ON the curve, so the decode alone does not catch it).
+// A conformant authenticator never emits a low-order credential key.
+//
+// Pure BigInt modular arithmetic (constant-time is not a goal here: the input is a public
+// key, and the verdict is a public validity bit, not a secret).
+
+// ---- field parameters ------------------------------------------------------
+var P25519 = (1n << 255n) - 19n;
+// d = -121665 / 121666 (mod p); sqrt(-1) = 2^((p-1)/4) (mod p).
+var D25519 = _mul(P25519 - 121665n, _inv(121666n, P25519), P25519);
+var SQRTM1 = _pow(2n, (P25519 - 1n) / 4n, P25519);
+var P448 = (1n << 448n) - (1n << 224n) - 1n;
+var D448 = P448 - 39081n;   // d = -39081 (mod p)
+
+var CURVE = {
+  6: { p: P25519, d: D25519, a: P25519 - 1n, len: 32, signBit: 255n },   // Ed25519, a = -1
+  7: { p: P448, d: D448, a: 1n, len: 57, signBit: 455n },                // Ed448, a = 1
+};
+
+function _mul(x, y, p) { return (x % p) * (y % p) % p; }
+function _pow(b, e, p) { var r = 1n; b %= p; while (e > 0n) { if (e & 1n) r = r * b % p; b = b * b % p; e >>= 1n; } return r; }
+function _inv(a, p) { return _pow(((a % p) + p) % p, p - 2n, p); }   // Fermat inverse (p prime)
+// A fixed 32/57-byte little-endian public key -> BigInt in one shot (big-endian hex of the
+// reversed bytes), never a per-byte shift-accumulate (the quadratic-BigInt antipattern).
+function _leToBig(buf) { return BigInt("0x" + Buffer.from(buf).reverse().toString("hex")); }
+
+// Decode a compressed Edwards point (RFC 8032) -> { x, y } or null (off-curve / non-canonical).
+function _decode(raw, c) {
+  var num = _leToBig(raw);
+  var sign = (num >> c.signBit) & 1n;
+  var y = num & ((1n << c.signBit) - 1n);
+  if (y >= c.p) return null;   // non-canonical y
+  var p = c.p, y2 = y * y % p, x;
+  var u = ((y2 - 1n) % p + p) % p;
+  if (c.a === 1n) {
+    // Ed448: v = d*y^2 - 1; x = u^3 v (u^5 v^3)^((p-3)/4); require v*x^2 == u.
+    var v = ((c.d * y2 % p - 1n) % p + p) % p;
+    x = _mul(_mul(_pow(u, 3n, p), v, p), _pow(_mul(_pow(u, 5n, p), _pow(v, 3n, p), p), (p - 3n) / 4n, p), p);
+    if (_mul(v, x * x % p, p) !== u) return null;
+  } else {
+    // Ed25519: v = d*y^2 + 1; x = u v^3 (u v^7)^((p-5)/8); v*x^2 == u, or == -u then x *= sqrt(-1).
+    var v25 = (c.d * y2 % p + 1n) % p;
+    x = _mul(_mul(u, _pow(v25, 3n, p), p), _pow(_mul(u, _pow(v25, 7n, p), p), (p - 5n) / 8n, p), p);
+    var vxx = _mul(v25, x * x % p, p);
+    if (vxx === u) { /* x is a root */ }
+    else if (vxx === (p - u) % p) { x = x * SQRTM1 % p; }
+    else return null;
+  }
+  if (x === 0n && sign === 1n) return null;
+  if ((x & 1n) !== sign) x = (p - x) % p;
+  return { x: x, y: y };
+}
+
+// Affine doubling on a*x^2 + y^2 = 1 + d*x^2*y^2: x3 = 2xy/(a x^2 + y^2),
+// y3 = (y^2 - a x^2)/(2 - a x^2 - y^2).
+function _double(P, c) {
+  var p = c.p, x2 = P.x * P.x % p, y2 = P.y * P.y % p, ax2 = c.a * x2 % p;
+  var nx = 2n * P.x % p * P.y % p, dx = (ax2 + y2) % p;
+  var ny = ((y2 - ax2) % p + p) % p, dy = ((2n - ax2 - y2) % p + 2n * p) % p;
+  return { x: _mul(nx, _inv(dx, p), p), y: _mul(ny, _inv(dy, p), p) };
+}
+
+// validate(raw, crv) -> true iff `raw` is a canonical, on-curve, full-order Edwards point for
+// the OKP curve (6 = Ed25519, 7 = Ed448). Off-curve, non-canonical, wrong-length, and
+// low-order (cofactor) points all return false.
+function validate(raw, crv) {
+  var c = CURVE[crv];
+  if (!c || !Buffer.isBuffer(raw) || raw.length !== c.len) return false;
+  var pt = _decode(raw, c);
+  if (!pt) return false;
+  // Low-order iff [8]P is the identity (0, 1). One double per cofactor bit (8 = 2^3).
+  var q = _double(_double(_double(pt, c), c), c);
+  if (q.x === 0n && q.y === 1n) return false;
+  return true;
+}
+
+module.exports = { validate: validate };

package/lib/inspect.js

@@ -121,7 +121,8 @@ function _keyBlock(spki, pad) {
 
   if (algName === "ecPublicKey" || algName === "id-ecPublicKey") {
     var curveName = null;
-    try { curveName = oid.name(asn1.read.oid(asn1.decode(spki.algorithm.parameters))); } catch (_e) { /* unknown curve */ }
+    try { curveName = oid.name(asn1.read.oid(asn1.decode(spki.algorithm.parameters))); }
+    catch (_e) { /* unknown curve */ }
     var bits = CURVE_BITS[curveName] || (pub ? ((pub.length - 1) / 2) * 8 : 0);
     out.push(inner + "Public-Key: (" + bits + " bit)");
     if (pub) { out.push(inner + "pub:"); out.push(_hexColon(pub, { wrap: 16, indent: (pad.length + 8) })); }
@@ -211,6 +212,8 @@ function _gnRaw(buf) {
     if (t === 1 || t === 2 || t === 6) return GN_KIND[t] + ":" + _clean(node.content.toString("latin1"));
     if (t === 7) return "IP Address:" + _ipString(node.content);
     return _hexColon(buf, {});   // dirName / otherName / registeredID -> best-effort hex
+    // allow:swallow-unverified drop-silent display fallback (tier-3): fullName GNs reach here as
+    // schema-validated TLVs so asn1.decode cannot throw -- an unreachable defensive best-effort hex render.
   } catch (_e) { return _hexColon(buf, {}); }
 }
 
@@ -262,7 +265,12 @@ var EXT_RENDERERS = {
     return inner + Object.keys(KU_LABEL).filter(function (k) { return decoded[k]; }).map(function (k) { return KU_LABEL[k]; }).join(", ");
   },
   extKeyUsage: function (decoded, inner) {
-    return inner + decoded.map(function (o) { var n = null; try { n = oid.name(o); } catch (_e) { /* unregistered EKU OID */ } return EKU_LABEL[n] || n || o; }).join(", ");
+    return inner + decoded.map(function (o) {
+      var n = null;
+      try { n = oid.name(o); }
+      catch (_e) { /* unregistered EKU OID */ }
+      return EKU_LABEL[n] || n || o;
+    }).join(", ");
   },
   basicConstraints: function (decoded, inner) {
     var s = "CA:" + (decoded.cA ? "TRUE" : "FALSE");
@@ -282,7 +290,9 @@ var EXT_RENDERERS = {
       try {
         (asn1.decode(p.qualifiersBytes).children || []).forEach(function (pqi) {
           var qid = asn1.read.oid(pqi.children[0]), q = pqi.children[1];
-          var label = null; try { label = oid.name(qid); } catch (_e) { /* unregistered qualifier */ }
+          var label = null;
+          try { label = oid.name(qid); }
+          catch (_e) { /* unregistered qualifier */ }
           var val = (q && !q.constructed && Buffer.isBuffer(q.content) && _printable(q.content))
             ? _clean(q.content.toString("latin1"))
             : _hexColon(q && Buffer.isBuffer(q.bytes) ? q.bytes : Buffer.alloc(0), {});

package/lib/path-validate.js

@@ -1460,8 +1460,10 @@ function crlIssuerNamesIssuer(cRLIssuer, issuerRdns) {
   for (var i = 0; i < cRLIssuer.names.length; i++) {
     var n = cRLIssuer.names[i];
     if (n.tagNumber !== 4 || !n.value || !n.value.rdns) continue;
+    // dnEqual throws only on a control-byte / malformed cRLIssuer DN; returning false excludes
+    // that DP from the correspondence (a malformed indirect-CRL issuer name never corresponds).
     try { if (dnEqual(n.value.rdns, issuerRdns)) return true; }
-    catch (_e) { return false; }
+    catch (_e) { return false; }   // allow:swallow-unverified fail-closed predicate: error -> no match -> DP excluded (restrictive)
   }
   return false;
 }

package/lib/validator-all.js

@@ -0,0 +1,47 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. This is lib composition only; the
+// documented surface is the primitives whose type handling composes these validators.
+//
+// validator-all -- the validator-family orchestrator (schema-all's role for the
+// validator family, guard-all's role for the guards). It assembles the per-type
+// conformance validators into one namespaced surface every format module composes,
+// so a format depends on the family rather than re-deriving a decoded type's rule set
+// inline (the drift that leaks a spec MUST out one review round at a time):
+//
+//   validator.cose.credentialKey / .toSpki
+//                                     -- the COMPLETE WebAuthn credential COSE_Key rule
+//                                        set (RFC 9052/9053 + WebAuthn sec. 6.5.1 +
+//                                        CTAP2 canonical + on-curve), one home
+//   validator.sig.ecdsaSigToRaw       -- the COMPLETE DER ECDSA-Sig-Value conformance
+//                                        (RFC 3279 + X.690 strict-DER) + raw r||s conversion
+//   validator.attcert.packedCert / .aikCert / .aaguidExt / .requireV3 / .assertNotCa
+//                                     -- the WebAuthn attestation-certificate profile
+//                                        (sec. 8.2.1 packed, sec. 8.3.1 TPM AIK), one home
+//   validator.keydesc.androidKeyDescription
+//                                     -- the Android Key Attestation KeyDescription
+//                                        (AOSP schema + WebAuthn sec. 8.4.1), one home
+//   validator.tpm.parsePubArea / .parseCertInfo / .pubKeyEqualsCose
+//                                     -- the TPM 2.0 pubArea/certInfo structure conformance
+//                                        + key binding (WebAuthn sec. 8.3 + TCG Part 2), one home
+//
+// Each validator is enforced by the validator-reinlined codebase-patterns detector: a
+// lib function that re-inlines a type's characteristic validation shape (declared on the
+// validator via @validator-shape) is flagged, so a new format module cannot re-derive a
+// partial subset and reintroduce the drift the validator exists to prevent.
+
+var cose = require("./validator-cose");
+var sig = require("./validator-sig");
+var attcert = require("./validator-attcert");
+var keydesc = require("./validator-keydesc");
+var tpm = require("./validator-tpm");
+
+module.exports = {
+  cose: cose,
+  sig: sig,
+  attcert: attcert,
+  keydesc: keydesc,
+  tpm: tpm,
+};

package/lib/validator-attcert.js

@@ -0,0 +1,110 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The documented surface is the verifier whose
+// attestation-certificate handling composes this validator (pki.webauthn).
+//
+// validator-attcert -- the SINGLE home for "does this X.509 leaf meet the WebAuthn
+// attestation-certificate profile" (WebAuthn sec. 8.2.1 packed, sec. 8.3.1 TPM AIK).
+// Sibling to the guard family: a validator owns a decoded TYPE's COMPLETE conformance rule
+// set once, so the packed and AIK profiles cannot drift apart or lose a gate (e.g. the v3
+// check that previously lived split out in the tpm verifier rather than in the profile).
+//
+// The caller supplies its parsed certificate + an extension-accessor object `exts`
+// { find(cert, oidName) -> rawExt|null, decode(cert, oidName) -> {critical, value}|null }
+// so this validator stays decoupled from any one format's extension-decoder namespace, and
+// its typed error CONSTRUCTOR E + domain code (a distinct mismatchCode for aaguidExt).
+//
+// Rule set (gap-checked verbatim against WebAuthn sec. 8.2.1 + sec. 8.3.1 + RFC 5280):
+//   - requireV3:  the leaf MUST be X.509 v3 (packed 8.2.1, AIK 8.3.1).
+//   - assertNotCa: the leaf MUST carry basicConstraints with cA=FALSE (present, not merely
+//     "not cA=true": a genuine CA or unconstrained leaf must not be repurposed as a leaf).
+//   - packedCert: v3 + non-CA + subject sets C, O, OU="Authenticator Attestation", CN.
+//   - aikCert:    v3 + non-CA + EMPTY subject + EKU contains tcg-kp-AIKCertificate + SAN
+//     directoryName carries tpmManufacturer/tpmModel/tpmVersion (TPMv2-EK-Profile 3.2.9).
+//   - aaguidExt:  the id-fido-gen-ce-aaguid extension, if present, MUST NOT be critical and
+//     MUST equal the authenticatorData aaguid (a 16-byte OCTET STRING inside the ext OCTET
+//     STRING). Absence is tolerated; presence must match.
+
+var oid = require("./oid");
+var asn1 = require("./asn1-der");
+
+// requireV3(cert, E, code) -- the leaf attestation certificate MUST be X.509 v3.
+// @enforced-by behavioral -- a version-field check has no rename-proof code shape; the RED
+// vector (a non-v3 attestation leaf rejected) is the guard.
+function requireV3(cert, E, code) {
+  if (cert.version !== 3) throw new E(code, "an attestation certificate must be X.509 version 3");
+}
+
+// assertNotCa(cert, exts, E, code) -- the leaf MUST carry basicConstraints with cA=FALSE.
+// @enforced-by behavioral -- a basicConstraints cA gate has no rename-proof code shape; the
+// RED vector (a CA-asserting or constraint-omitting attestation leaf rejected) is the guard.
+function assertNotCa(cert, exts, E, code) {
+  var bc = exts.decode(cert, "basicConstraints");
+  if (!bc) throw new E(code, "an attestation leaf certificate MUST carry a basicConstraints extension (WebAuthn 8.2.1 / 8.3.1)");
+  if (bc.value && bc.value.cA === true) throw new E(code, "an attestation leaf certificate MUST NOT be a CA (basicConstraints cA=true)");
+}
+
+// packedCert(cert, exts, E, code) -- the complete WebAuthn 8.2.1 packed attestation-cert
+// profile (v3 + non-CA + the four subject attributes).
+// @enforced-by behavioral -- the subject-attribute + OU-literal checks are WebAuthn 8.2.1
+// business rules with no rename-proof code shape; the RED vectors (missing C/O/CN, wrong OU,
+// CA=true, non-v3) are the guard.
+function packedCert(cert, exts, E, code) {
+  requireV3(cert, E, code);
+  assertNotCa(cert, exts, E, code);
+  var have = {};
+  (cert.subject.rdns || []).forEach(function (rdn) { rdn.forEach(function (a) { have[a.type] = a.value; }); });
+  if (have[oid.byName("countryName")] == null || have[oid.byName("organizationName")] == null || have[oid.byName("commonName")] == null) {
+    throw new E(code, "the packed attestation certificate subject MUST set C, O, OU, and CN (WebAuthn 8.2.1)");
+  }
+  if (have[oid.byName("organizationalUnitName")] !== "Authenticator Attestation") {
+    throw new E(code, "the packed attestation certificate subject OU MUST be \"Authenticator Attestation\" (WebAuthn 8.2.1)");
+  }
+}
+
+// aikCert(cert, exts, E, code) -- the complete WebAuthn 8.3.1 TPM AIK attestation-cert
+// profile (v3 + non-CA + empty subject + tcg-kp-AIKCertificate EKU + the tcg SAN attributes).
+// @enforced-by behavioral -- the empty-subject + EKU + SAN-attribute checks are WebAuthn
+// 8.3.1 business rules with no rename-proof code shape; the RED vectors are the guard.
+function aikCert(cert, exts, E, code) {
+  requireV3(cert, E, code);
+  assertNotCa(cert, exts, E, code);
+  if ((cert.subject.rdns || []).length !== 0) throw new E(code, "the tpm AIK certificate subject MUST be empty (WebAuthn 8.3.1)");
+  var eku = exts.decode(cert, "extKeyUsage");
+  if (!eku || !Array.isArray(eku.value) || eku.value.indexOf(oid.byName("tcgKpAikCertificate")) === -1) {
+    throw new E(code, "the tpm AIK certificate lacks the tcg-kp-AIKCertificate extended key purpose (WebAuthn 8.3.1)");
+  }
+  var san = exts.decode(cert, "subjectAltName");
+  var dirName = san && san.value && san.value.names && san.value.names.filter(function (n) { return n.tagNumber === 4; })[0];
+  var types = {};
+  if (dirName && dirName.value && dirName.value.rdns) {
+    dirName.value.rdns.forEach(function (rdn) { rdn.forEach(function (a) { types[a.type] = true; }); });
+  }
+  if (!types[oid.byName("tpmManufacturer")] || !types[oid.byName("tpmModel")] || !types[oid.byName("tpmVersion")]) {
+    throw new E(code, "the tpm AIK certificate subjectAltName lacks the required tcg attributes (WebAuthn 8.3.1)");
+  }
+}
+
+// aaguidExt(cert, aaguid, exts, E, code, mismatchCode) -- the id-fido-gen-ce-aaguid
+// extension, if present, MUST NOT be critical and MUST equal the authenticatorData aaguid.
+// @enforced-by behavioral -- an optional-extension equality check has no rename-proof code
+// shape; the RED vectors (a critical ext, a non-matching aaguid) are the guard.
+function aaguidExt(cert, aaguid, exts, E, code, mismatchCode) {
+  var ext = exts.find(cert, "idFidoGenCeAaguid");
+  if (!ext) return;   // absence is tolerated; presence must match
+  if (ext.critical) throw new E(code, "the id-fido-gen-ce-aaguid extension MUST NOT be critical (WebAuthn 8.2.1)");
+  var val;
+  try { val = asn1.read.octetString(asn1.decode(ext.value)); }
+  catch (e) { throw new E(code, "the id-fido-gen-ce-aaguid extension value is not a valid OCTET STRING", e); }
+  if (!val.equals(aaguid)) throw new E(mismatchCode, "the id-fido-gen-ce-aaguid extension value does not equal the authenticatorData aaguid");
+}
+
+module.exports = {
+  requireV3: requireV3,
+  assertNotCa: assertNotCa,
+  packedCert: packedCert,
+  aikCert: aikCert,
+  aaguidExt: aaguidExt,
+};

package/lib/validator-cose.js

@@ -0,0 +1,176 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The documented surface is the
+// verifiers whose credential-key handling composes this validator (pki.webauthn).
+//
+// validator-cose -- the SINGLE home for "is this a conformant WebAuthn credential
+// COSE_Key" (RFC 9052 sec. 7 structure + RFC 9053 EC2/OKP/RSA key parameters + the
+// CTAP2 canonical-CBOR profile WebAuthn sec. 6.5.1 imposes). Sibling to the guard
+// family: where a guard owns a CVE-class fail-closed defence once, a validator owns a
+// decoded TYPE's COMPLETE conformance rule set once, so a format module composes the
+// family rather than re-deriving a partial subset inline (the drift that leaks MUSTs
+// out one review round at a time). Enforced by the validator-shape-reinlined
+// codebase-patterns detector: a lib function that re-inlines COSE-key validation fires.
+//
+// Interface mirrors the guard family: (subject, E, code) where E is the caller's typed
+// error CONSTRUCTOR and code its domain code, so every boundary keeps its own
+// domain/reason (a future COSE consumer passes its own E + code).
+//
+// Rule set (gap-checked verbatim against RFC 9052 sec. 7 + RFC 9053 sec. 2/6 +
+// WebAuthn sec. 6.5.1 + the IANA COSE Key Type / Key Type Parameters registries):
+//   - kty (label 1) REQUIRED; value an integer (CTAP2 canonical -- a tstr kty/alg is
+//     rejected as non-canonical for the WebAuthn profile).
+//   - alg (label 3) REQUIRED (the RP needs it to verify the later assertion).
+//   - EC2 (kty 2): crv (-1), x (-2), y (-3) all present; x/y length == the curve field
+//     size. OKP (kty 1): crv (-1) == Ed25519(6)/Ed448(7), x (-2) length == the key size.
+//     RSA (kty 3): n (-1), e (-2) present + non-empty.
+//   - CANONICAL: EXACTLY the type's parameters, nothing more (EC2 = 5, OKP/RSA = 4) --
+//     rejects a padded key / a private "d" component / kid / key_ops (WebAuthn 6.5.1
+//     CTAP2 canonical, stricter than open COSE `* label => values`).
+//   - PROFILE: alg <-> kty (and, for EC2, alg <-> crv) consistent; -8 (EdDSA) is Ed25519
+//     ONLY; the RFC 9864 fully-specified ids (-9/-51/-52/-19/-53) are accepted.
+//   - COMPRESSED: an EC2 credential key MUST use the uncompressed point form (y is a full
+//     coordinate byte string, never a CBOR bool sign bit) -- WebAuthn sec. alg identifier.
+//   - ON-CURVE: the public key point MUST be valid for its curve. For EC2 the SPKI is
+//     imported via node:crypto so OpenSSL validates the point (an off-curve or identity
+//     point fails to parse). For OKP, OpenSSL does NOT validate the Edwards point on
+//     import (an all-zeroes key parses, and even verifies a trivial signature), so the
+//     point is checked explicitly via edwards-point (RFC 8032 decode + cofactor low-order
+//     rejection) -- an off-curve, non-canonical, or low-order OKP key fails closed.
+
+var cbor = require("./cbor-det");
+var asn1 = require("./asn1-der");
+var oid = require("./oid");
+var edwardsPoint = require("./edwards-point");
+var nodeCrypto = require("crypto");
+
+// COSE EC2 curve (label -1) -> the fixed field-element byte length x/y carry, and the
+// named-curve OID a certificate on that curve declares.
+var EC2_CRV_LEN = { 1: 32, 2: 48, 3: 66 };   // P-256 / P-384 / P-521
+var EC2_CRV_OID = { 1: "prime256v1", 2: "secp384r1", 3: "secp521r1" };
+// COSE OKP curve (label -1) -> its RFC 8410 named-key OID + fixed public-key length.
+var OKP_CRV = { 6: { oid: "Ed25519", len: 32 }, 7: { oid: "Ed448", len: 57 } };
+// alg (label 3) -> the key type (and, for EC2, curve) it pins. WebAuthn (sec. alg
+// identifier) adds guarantees over the open COSE registry: an ECDSA alg fixes its curve,
+// -8 (EdDSA) is Ed25519 ONLY, and the RFC 9864 fully-specified ids (-9 ESP256, -51 ESP384,
+// -52 ESP512, -19 Ed25519, -53 Ed448) each pin key type + curve. A verifier accepts the
+// fully-specified ids even though WebAuthn recommends against them for credential creation.
+var ALG_PROFILE = {
+  "-7": { kty: 2, crv: 1 }, "-35": { kty: 2, crv: 2 }, "-36": { kty: 2, crv: 3 },
+  "-9": { kty: 2, crv: 1 }, "-51": { kty: 2, crv: 2 }, "-52": { kty: 2, crv: 3 },
+  "-8": { kty: 1, crv: 6 }, "-19": { kty: 1, crv: 6 }, "-53": { kty: 1, crv: 7 },
+  "-257": { kty: 3 }, "-258": { kty: 3 }, "-259": { kty: 3 }, "-37": { kty: 3 }, "-65535": { kty: 3 },
+};
+
+// The value node of an integer-labelled COSE_Key parameter (labels are ints), or null.
+function _mapGetInt(node, key) {
+  if (!node || node.majorType !== 5 || !node.children) return null;
+  for (var i = 0; i < node.children.length; i++) {
+    var k = node.children[i][0];
+    if ((k.majorType === 0 || k.majorType === 1) && cbor.read.int(k) === BigInt(key)) return node.children[i][1];
+  }
+  return null;
+}
+
+// credentialKey(node, E, code) -> the decoded + validated credential public key
+// { kty, alg, crv?, x?, y?, n?, e? }, or throws new E(code, ...). The complete COSE_Key
+// conformance gate for a WebAuthn credential key; a format module MUST route a credential
+// key through here, never re-inline the kty/alg/crv/length/canonical/profile/on-curve
+// checks.
+// @enforced-by validator-shape-reinlined
+// @validator-shape kty\s*===\s*2n
+// @validator-shape EC2_CRV_LEN|ALG_PROFILE
+function credentialKey(node, E, code) {
+  function bad(msg, cause) { return new E(code, msg, cause); }
+  if (!node || node.majorType !== 5) throw bad("a COSE_Key must be a CBOR map (RFC 9052 sec. 7)");
+  // Every parameter read maps a wrong-type cbor/* fault to the caller's domain -- a
+  // wrong-typed COSE label (x as an integer, kty as a string) is bad input, not a leak.
+  function ib(label) { var n = _mapGetInt(node, label); if (!n) return null; try { return cbor.read.byteString(n); } catch (e) { throw bad("COSE_Key parameter " + label + " must be a byte string", e); } }
+  function ii(label) { var n = _mapGetInt(node, label); if (!n) return null; try { return cbor.read.int(n); } catch (e) { throw bad("COSE_Key parameter " + label + " must be an integer", e); } }
+  var ktyN = _mapGetInt(node, 1), algN = _mapGetInt(node, 3);
+  if (!ktyN) throw bad("a COSE_Key is missing the kty (label 1) parameter");
+  if (!algN) throw bad("a COSE_Key is missing the alg (label 3) parameter");
+  var kty, algv;
+  try { kty = cbor.read.int(ktyN); algv = cbor.read.int(algN); }
+  catch (e) { throw bad("COSE_Key kty (label 1) and alg (label 3) must be integers", e); }
+  var key = { kty: Number(kty), alg: Number(algv) };
+  if (kty === 2n) {
+    key.crv = ii(-1) != null ? Number(ii(-1)) : null;
+    // WebAuthn EC2 credential keys MUST use the uncompressed point form: y (-3) is the full
+    // y-coordinate byte string, never a CBOR bool sign bit (WebAuthn sec. alg identifier).
+    var yNode = _mapGetInt(node, -3);
+    if (yNode && yNode.majorType === 7) throw bad("an EC2 credential key must use the uncompressed point form (a compressed y sign-bit is not permitted for WebAuthn)");
+    key.x = ib(-2); key.y = ib(-3);
+    if (key.crv == null || !key.x || !key.y) throw bad("an EC2 COSE_Key must carry crv (-1), x (-2), and y (-3)");
+    var el = EC2_CRV_LEN[key.crv];
+    if (!el || key.x.length !== el || key.y.length !== el) throw bad("an EC2 COSE_Key x/y length is inconsistent with its curve");
+  } else if (kty === 1n) {
+    key.crv = ii(-1) != null ? Number(ii(-1)) : null; key.x = ib(-2);
+    var okp = OKP_CRV[key.crv];
+    if (!okp || !key.x || key.x.length !== okp.len) throw bad("an OKP COSE_Key must be Ed25519 (crv 6) or Ed448 (crv 7) with a matching-length x (-2)");
+  } else if (kty === 3n) {
+    key.n = ib(-1); key.e = ib(-2);
+    if (!key.n || !key.n.length || !key.e || !key.e.length) throw bad("an RSA COSE_Key must carry n (-1) and e (-2)");
+  } else {
+    throw bad("unsupported COSE_Key kty " + Number(kty));
+  }
+  // CANONICAL CTAP2 COSE_Key: exactly the type's parameters, nothing more.
+  var expectedParams = kty === 2n ? 5 : 4;
+  if (node.children.length !== expectedParams) throw bad("the COSE_Key carries parameters beyond the canonical set for its key type (WebAuthn sec. 6.5.1)");
+  // PROFILE: the declared alg must match the key type (and, for EC2, the curve).
+  var prof = ALG_PROFILE[String(key.alg)];
+  if (!prof) throw bad("unsupported credential key algorithm " + key.alg);
+  if (prof.kty !== key.kty) throw bad("credential key algorithm " + key.alg + " is inconsistent with key type " + key.kty);
+  if (prof.crv != null && prof.crv !== key.crv) throw bad("credential key algorithm " + key.alg + " requires a different curve");
+  // ON-CURVE: import the SPKI so OpenSSL validates the EC point on its curve. An off-curve
+  // x/y or the identity point fails to parse here.
+  try { nodeCrypto.createPublicKey({ key: toSpki(key, E, code), format: "der", type: "spki" }); }
+  catch (e) { throw bad("the credential public key point is not valid for its curve", e); }
+  // OpenSSL does NOT validate an OKP (Ed25519/Ed448) point on import -- an all-zeroes key
+  // parses, and even verifies a trivial signature -- so an OKP point needs an explicit
+  // on-curve + full-order (non-low-order) check (RFC 8032 decode + the cofactor check).
+  if (kty === 1n && !edwardsPoint.validate(key.x, key.crv)) throw bad("the OKP credential public key is not a valid, full-order Edwards point");
+  return key;
+}
+
+// toSpki(key, E, code) -> a self-contained SubjectPublicKeyInfo DER for a validated COSE
+// key, so a credential key and a certificate key import/compare by one path.
+// @enforced-by behavioral -- an SPKI encoding of a validated COSE key has no rename-proof
+// code shape distinct from the ecPublicKey/rsaEncryption OID-name tokens that legitimately
+// recur in the oid registry + inspect renderer; its consumers route through
+// validatorCose.toSpki and credentialKey calls it on the on-curve path, so the webauthn
+// KAT round-trip (a real SPKI imports + verifies) is the behavioral guard.
+function toSpki(key, E, code) {
+  function bad(msg) { return new E(code, msg); }
+  if (key.kty === 2 && key.x && key.y) {
+    var curveOid = EC2_CRV_OID[key.crv];
+    if (!curveOid) throw bad("unsupported EC2 curve " + key.crv);
+    var b = asn1.build;
+    return b.sequence([
+      b.sequence([b.oid(oid.byName("ecPublicKey")), b.oid(oid.byName(curveOid))]),
+      b.bitString(Buffer.concat([Buffer.from([0x04]), key.x, key.y])),
+    ]);
+  }
+  if (key.kty === 3 && key.n && key.n.length && key.e && key.e.length) {
+    var bb = asn1.build;
+    return bb.sequence([
+      bb.sequence([bb.oid(oid.byName("rsaEncryption")), bb.nullValue()]),
+      bb.bitString(bb.sequence([bb.integer(BigInt("0x" + key.n.toString("hex"))), bb.integer(BigInt("0x" + key.e.toString("hex")))])),
+    ]);
+  }
+  if (key.kty === 1 && OKP_CRV[key.crv] && key.x && key.x.length === OKP_CRV[key.crv].len) {
+    var eb = asn1.build;
+    return eb.sequence([eb.sequence([eb.oid(oid.byName(OKP_CRV[key.crv].oid))]), eb.bitString(key.x)]);
+  }
+  throw bad("cannot build an SPKI for this COSE key type");
+}
+
+module.exports = {
+  credentialKey: credentialKey,
+  toSpki: toSpki,
+  EC2_CRV_LEN: EC2_CRV_LEN,
+  EC2_CRV_OID: EC2_CRV_OID,
+  OKP_CRV: OKP_CRV,
+};

package/lib/validator-keydesc.js

@@ -0,0 +1,89 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The documented surface is the verifier whose
+// android-key handling composes this validator (pki.webauthn).
+//
+// validator-keydesc -- the SINGLE home for the Android Key Attestation KeyDescription
+// conformance (the AOSP key-attestation schema + WebAuthn sec. 8.4.1 authorization-list
+// checks). Sibling to the guard family: a validator owns a decoded TYPE's COMPLETE
+// conformance rule set once, so the four 8.4.1 checks cannot lose a gate to drift.
+//
+// The caller supplies its parsed certificate + an extension-accessor `exts`
+// { find(cert, oidName) -> rawExt|null } + its typed error CONSTRUCTOR E with two codes: a
+// STRUCTURAL `code` (a malformed KeyDescription is bad input) and a semantic `failCode` (a
+// well-formed description that fails an 8.4.1 MUST is a failed verification).
+//
+// Rule set (gap-checked verbatim against WebAuthn sec. 8.4.1 + the AOSP KeyDescription
+// schema):
+//   - KeyDescription is a positional SEQUENCE; attestationChallenge (position 4) MUST equal
+//     clientDataHash.
+//   - allApplications (tag 600) MUST be absent from BOTH the softwareEnforced (position 6)
+//     and teeEnforced (position 7) AuthorizationLists (the key MUST be scoped to the RP).
+//   - origin (tag 702) MUST equal KM_ORIGIN_GENERATED (0): at least one list declares it,
+//     and every list that declares one says GENERATED (a mixed IMPORTED/GENERATED key is
+//     contradictory and rejected).
+//   - purpose (tag 1) MUST be EXACTLY { KM_PURPOSE_SIGN (2) } over the union of the lists.
+
+var asn1 = require("./asn1-der");
+
+// The EXPLICIT-unwrapped value node for a [tag] field of an AuthorizationList (a SEQUENCE
+// of context-tagged OPTIONAL fields with non-contiguous tag numbers), or null when absent.
+function _alGet(seqNode, tag) {
+  if (!seqNode || !seqNode.children) return null;
+  for (var i = 0; i < seqNode.children.length; i++) {
+    var c = seqNode.children[i];
+    if (c.tagClass === "context" && c.tagNumber === tag) return c.children && c.children[0] ? c.children[0] : c;
+  }
+  return null;
+}
+
+function _alInt(node, E, code) {
+  try { return asn1.read.integer(node); }
+  catch (e) { throw new E(code, "an android KeyDescription authorization value is not an INTEGER", e); }
+}
+
+function _purposeUnion(a, b, E, code) {
+  var out = [];
+  [a, b].forEach(function (list) {
+    var p = _alGet(list, 1);
+    if (p && p.children) p.children.forEach(function (c) { var v = _alInt(c, E, code); if (out.indexOf(v) === -1) out.push(v); });
+  });
+  return out;
+}
+
+// androidKeyDescription(cert, clientDataHash, exts, E, code, failCode) -- the complete
+// WebAuthn 8.4.1 KeyDescription gate. A verifier MUST route the android-key description
+// through here, never re-derive a partial subset of the four checks inline.
+// @enforced-by behavioral -- the challenge / allApplications / origin / purpose checks are
+// WebAuthn 8.4.1 business rules with no rename-proof code shape; the RED vectors (challenge
+// mismatch, allApplications present, origin != GENERATED, purpose != SIGN, and the empty-
+// authorization-list spec vector) are the guard.
+function androidKeyDescription(cert, clientDataHash, exts, E, code, failCode) {
+  var ext = exts.find(cert, "keyDescription");
+  if (!ext) throw new E(code, "the android-key attestation certificate is missing the key-description extension (WebAuthn 8.4.1)");
+  var kd;
+  try { kd = asn1.decode(ext.value); } catch (e) { throw new E(code, "the android KeyDescription is not decodable", e); }
+  if (!kd.children || kd.children.length < 8) throw new E(code, "the android KeyDescription is not a positional 8-field SEQUENCE");
+  // (1) attestationChallenge (position 4) == clientDataHash.
+  var challenge;
+  try { challenge = asn1.read.octetString(kd.children[4]); } catch (e) { throw new E(code, "the android attestationChallenge is not an OCTET STRING", e); }
+  if (!challenge.equals(clientDataHash)) throw new E(failCode, "the android attestationChallenge does not equal clientDataHash");
+  var softwareEnforced = kd.children[6], hardwareEnforced = kd.children[7];
+  // (2) [600] allApplications MUST be ABSENT in both lists.
+  if (_alGet(softwareEnforced, 600) || _alGet(hardwareEnforced, 600)) throw new E(failCode, "android allApplications MUST be absent (WebAuthn 8.4.1)");
+  // (3) origin == KM_ORIGIN_GENERATED (0) over the union: at least one list declares it,
+  // and every list that declares one says GENERATED.
+  var origins = [_alGet(softwareEnforced, 702), _alGet(hardwareEnforced, 702)].filter(Boolean);
+  if (!origins.length || !origins.every(function (o) { return _alInt(o, E, code) === 0n; })) {
+    throw new E(failCode, "android key origin is not KM_ORIGIN_GENERATED in every authorization list that declares it (WebAuthn 8.4.1)");
+  }
+  // (4) purpose == exactly { KM_PURPOSE_SIGN (2) } over the union.
+  var purposes = _purposeUnion(softwareEnforced, hardwareEnforced, E, code);
+  if (purposes.length !== 1 || purposes[0] !== 2n) {
+    throw new E(failCode, "android key purpose is not exactly KM_PURPOSE_SIGN (WebAuthn 8.4.1)");
+  }
+}
+
+module.exports = { androidKeyDescription: androidKeyDescription };