@blamejs/pki 0.2.5 → 0.2.6

package/lib/webauthn.js

@@ -29,7 +29,8 @@ var pkix = require("./schema-pkix");
 var oid = require("./oid");
 var webcrypto = require("./webcrypto");
 var constants = require("./constants");
-var ByteReader = require("./byte-reader");
+var validator = require("./validator-all");
+var edwardsPoint = require("./edwards-point");
 var nodeCrypto = require("crypto");
 
 var WebauthnError = frameworkError.WebauthnError;
@@ -61,15 +62,13 @@ function _ucmp(a, b) {
 // A decoded node is a primitive universal INTEGER (so `.content` is a real buffer,
 // not null as it is for a constructed node).
 function _isInteger(node) { return !!node && !node.constructed && node.tagClass === "universal" && node.tagNumber === asn1.TAGS.INTEGER; }
-// The minimal unsigned big-endian encoding of a non-negative integer (no sign octet,
-// no leading zeros) -- for an unsigned compare against a COSE fixed-width field.
-function _uintBytes(n) {
-  var hex = n.toString(16); if (hex.length % 2) hex = "0" + hex;
-  var b = Buffer.from(hex, "hex"); var i = 0; while (i < b.length - 1 && b[i] === 0) i++; return b.subarray(i);
-}
-// COSE signature algorithm -> the node hash name of its signature scheme (the digest
-// the TPM extraData / apple nonce is taken under).
-var COSE_ALG_HASH = { "-7": "sha256", "-257": "sha256", "-37": "sha256", "-35": "sha384", "-258": "sha384", "-36": "sha512", "-259": "sha512", "-65535": "sha1" };
+// alg -> the digest a TPM attestation's certInfo.extraData is taken under (the ONLY
+// consumer). Every ECDSA/RSA algorithm a TPM AIK may sign with -- including the RFC 9864
+// fully-specified ECDSA ids (ESP256/384/512) -- MUST appear here, or the TPM extraData
+// step rejects the attestation before the signature is evaluated. EdDSA (-8/-19/-53) is
+// absent by design: a TPM 2.0 AIK never signs with EdDSA, so such an attestation is
+// correctly refused.
+var COSE_ALG_HASH = { "-7": "sha256", "-9": "sha256", "-257": "sha256", "-37": "sha256", "-35": "sha384", "-51": "sha384", "-258": "sha384", "-36": "sha512", "-52": "sha512", "-259": "sha512", "-65535": "sha1" };
 function _coseAlgHash(alg, E) {
   var h = COSE_ALG_HASH[String(alg)];
   if (!h) throw E("webauthn/unsupported-algorithm", "no hash mapping for COSE algorithm " + alg);
@@ -89,15 +88,6 @@ function _mapGet(node, key) {
   }
   return null;
 }
-// An integer-keyed entry (COSE_Key labels are ints), by its signed value.
-function _mapGetInt(node, key) {
-  if (!node || node.majorType !== 5 || !node.children) return null;
-  for (var i = 0; i < node.children.length; i++) {
-    var k = node.children[i][0];
-    if ((k.majorType === 0 || k.majorType === 1) && cbor.read.int(k) === BigInt(key)) return node.children[i][1];
-  }
-  return null;
-}
 
 // ---- authenticatorData bounded reader (WebAuthn sec. 6.1) --------------------
 
@@ -134,7 +124,7 @@ function _parseAuthData(buf, E) {
     try { keyNode = cbor.decode(buf.subarray(off), { allowTrailing: true }); }
     catch (e) { throw E("webauthn/bad-cose-key", "the credential public key is not well-formed CBOR", e); }
     out.credentialPublicKeyBytes = buf.subarray(off, off + keyNode.bytes.length);
-    out.credentialPublicKey = _decodeCoseKey(keyNode, E);
+    out.credentialPublicKey = _decodeCoseKey(keyNode);
     off += keyNode.bytes.length;
   }
   if (out.flags.ed) {
@@ -157,71 +147,10 @@ function _parseAuthData(buf, E) {
 
 // ---- COSE_Key decode (WebAuthn sec. 6.5.1, RFC 9052 sec. 7) ------------------
 
-// COSE EC2 curve (label -1) -> the fixed field-element byte length its x/y carry,
-// and the named-curve OID a certificate on that curve declares.
-var EC2_CRV_LEN = { 1: 32, 2: 48, 3: 66 };   // P-256 / P-384 / P-521
-var EC2_CRV_OID = { 1: "prime256v1", 2: "secp384r1", 3: "secp521r1" };
-// COSE OKP curve (label -1) -> its RFC 8410 named-key OID + fixed public-key length.
-// Ed25519 (crv 6, 32-byte) and Ed448 (crv 7, 57-byte) both sign under COSE alg -8.
-var OKP_CRV = { 6: { oid: "Ed25519", len: 32 }, 7: { oid: "Ed448", len: 57 } };
-// The WebAuthn credential-key profile: a COSE signature algorithm (label 3) pins the
-// key type (label 1) and, for EC2, the curve -- so an EC2 key claiming EdDSA, or an
-// OKP key claiming ES256, is a profile violation (WebAuthn sec. 6.5.1, RFC 9052).
-var ALG_PROFILE = {
-  "-7": { kty: 2, crv: 1 }, "-35": { kty: 2, crv: 2 }, "-36": { kty: 2, crv: 3 },
-  "-8": { kty: 1 },
-  "-257": { kty: 3 }, "-258": { kty: 3 }, "-259": { kty: 3 }, "-37": { kty: 3 }, "-65535": { kty: 3 },
-};
-
-// kty 1 / alg 3; EC2 (kty 2): crv -1, x -2, y -3; OKP (kty 1): crv -1, x -2;
-// RSA (kty 3): n -1, e -2. Surface the raw coordinate/modulus buffers.
-function _decodeCoseKey(node, E) {
-  if (!node || node.majorType !== 5) throw E("webauthn/bad-cose-key", "a COSE_Key must be a CBOR map (RFC 9052 sec. 7)");
-  // Every parameter read maps a wrong-type cbor/* fault to the webauthn domain -- a
-  // wrong-typed COSE label (x as an integer, kty as a string) is bad-cose-key input,
-  // not a leaked codec error.
-  function ib(label) { var n = _mapGetInt(node, label); if (!n) return null; try { return cbor.read.byteString(n); } catch (e) { throw E("webauthn/bad-cose-key", "COSE_Key parameter " + label + " must be a byte string", e); } }
-  function ii(label) { var n = _mapGetInt(node, label); if (!n) return null; try { return cbor.read.int(n); } catch (e) { throw E("webauthn/bad-cose-key", "COSE_Key parameter " + label + " must be an integer", e); } }
-  var ktyN = _mapGetInt(node, 1), algN = _mapGetInt(node, 3);
-  if (!ktyN) throw E("webauthn/bad-cose-key", "a COSE_Key is missing the kty (label 1) parameter");
-  // The credential public key MUST declare its algorithm (label 3): a relying party
-  // needs it to verify the later assertion signature (WebAuthn sec. 6.5.1, COSE sec. 7).
-  if (!algN) throw E("webauthn/bad-cose-key", "a COSE_Key is missing the alg (label 3) parameter");
-  var kty, algv;
-  try { kty = cbor.read.int(ktyN); algv = cbor.read.int(algN); }
-  catch (e) { throw E("webauthn/bad-cose-key", "COSE_Key kty (label 1) and alg (label 3) must be integers", e); }
-  var key = { kty: Number(kty), alg: Number(algv) };
-  // A credential key MUST carry every parameter its key type requires; an incomplete
-  // key (or an unknown kty) is rejected at decode rather than surfaced with null
-  // material a later binding check would have to defend against.
-  if (kty === 2n) {
-    key.crv = ii(-1) != null ? Number(ii(-1)) : null; key.x = ib(-2); key.y = ib(-3);
-    if (key.crv == null || !key.x || !key.y) throw E("webauthn/bad-cose-key", "an EC2 COSE_Key must carry crv (-1), x (-2), and y (-3)");
-    var el = EC2_CRV_LEN[key.crv];
-    if (!el || key.x.length !== el || key.y.length !== el) throw E("webauthn/bad-cose-key", "an EC2 COSE_Key x/y length is inconsistent with its curve");
-  } else if (kty === 1n) {
-    key.crv = ii(-1) != null ? Number(ii(-1)) : null; key.x = ib(-2);
-    var okp = OKP_CRV[key.crv];
-    if (!okp || !key.x || key.x.length !== okp.len) throw E("webauthn/bad-cose-key", "an OKP COSE_Key must be Ed25519 (crv 6) or Ed448 (crv 7) with a matching-length x (-2)");
-  } else if (kty === 3n) {
-    key.n = ib(-1); key.e = ib(-2);
-    if (!key.n || !key.n.length || !key.e || !key.e.length) throw E("webauthn/bad-cose-key", "an RSA COSE_Key must carry n (-1) and e (-2)");
-  } else {
-    throw E("webauthn/bad-cose-key", "unsupported COSE_Key kty " + Number(kty));
-  }
-  // A WebAuthn credential key is the CANONICAL CTAP2 COSE_Key for its type -- exactly
-  // its defined parameters, nothing more: EC2 = { 1, 3, -1, -2, -3 } (5), OKP/RSA = 4.
-  // Extra parameters are rejected (a padded key is a canonicalization ambiguity).
-  var expectedParams = kty === 2n ? 5 : 4;
-  if (node.children.length !== expectedParams) throw E("webauthn/bad-cose-key", "the COSE_Key carries parameters beyond the canonical set for its key type (WebAuthn sec. 6.5.1)");
-  // Enforce the alg <-> kty/crv profile: the declared algorithm must match the key
-  // type (and, for EC2, the curve) it is used with.
-  var prof = ALG_PROFILE[String(key.alg)];
-  if (!prof) throw E("webauthn/bad-cose-key", "unsupported credential key algorithm " + key.alg);
-  if (prof.kty !== key.kty) throw E("webauthn/bad-cose-key", "credential key algorithm " + key.alg + " is inconsistent with key type " + key.kty);
-  if (prof.crv != null && prof.crv !== key.crv) throw E("webauthn/bad-cose-key", "credential key algorithm " + key.alg + " requires a different curve");
-  return key;
-}
+// The complete COSE credential-key conformance rule set (kty/alg/crv/length/canonical/
+// profile/on-curve) lives in validator-cose, composed here so every credential key
+// routes through the one home -- never a per-format re-derivation of a partial subset.
+function _decodeCoseKey(node) { return validator.cose.credentialKey(node, WebauthnError, "webauthn/bad-cose-key"); }
 
 // ---- signature verification bridge ------------------------------------------
 
@@ -233,6 +162,15 @@ var COSE_ALG = {
   "-35":  { imp: { name: "ECDSA", namedCurve: "P-384" }, verify: { name: "ECDSA", hash: "SHA-384" }, ecdsa: 48 },
   "-36":  { imp: { name: "ECDSA", namedCurve: "P-521" }, verify: { name: "ECDSA", hash: "SHA-512" }, ecdsa: 66 },
   "-8":   { imp: { name: "Ed25519" }, verify: { name: "Ed25519" }, ecdsa: 0 },
+  // RFC 9864 fully-specified ids. WebAuthn recommends against them for credential creation,
+  // but a verifier MUST evaluate an assertion signed under one. ESP256/384/512 are the
+  // curve-pinned ECDSA twins of ES256/384/512; Ed25519(-19)/Ed448(-53) are fully-specified
+  // EdDSA (Ed448 is the ONLY WebAuthn path to Ed448 -- -8 is Ed25519 only).
+  "-9":   { imp: { name: "ECDSA", namedCurve: "P-256" }, verify: { name: "ECDSA", hash: "SHA-256" }, ecdsa: 32 },
+  "-51":  { imp: { name: "ECDSA", namedCurve: "P-384" }, verify: { name: "ECDSA", hash: "SHA-384" }, ecdsa: 48 },
+  "-52":  { imp: { name: "ECDSA", namedCurve: "P-521" }, verify: { name: "ECDSA", hash: "SHA-512" }, ecdsa: 66 },
+  "-19":  { imp: { name: "Ed25519" }, verify: { name: "Ed25519" }, ecdsa: 0 },
+  "-53":  { imp: { name: "Ed448" }, verify: { name: "Ed448" }, ecdsa: 0 },
   "-257": { imp: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, verify: { name: "RSASSA-PKCS1-v1_5" }, ecdsa: 0 },
   "-258": { imp: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-384" }, verify: { name: "RSASSA-PKCS1-v1_5" }, ecdsa: 0 },
   "-259": { imp: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-512" }, verify: { name: "RSASSA-PKCS1-v1_5" }, ecdsa: 0 },
@@ -244,33 +182,10 @@ var COSE_ALG = {
   "-65535": { imp: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-1" }, verify: { name: "RSASSA-PKCS1-v1_5" }, ecdsa: 0 },
 };
 
-// DER ECDSA-Sig-Value SEQUENCE { r INTEGER, s INTEGER } -> raw r||s, each left-
-// padded to `coordLen` (the ieee-p1363 form WebCrypto verify expects).
-function _derEcdsaToRaw(der, coordLen, E) {
-  var node;
-  try { node = asn1.decode(der); } catch (e) { throw E("webauthn/bad-signature", "ECDSA signature is not a DER SEQUENCE", e); }
-  if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length !== 2) {
-    throw E("webauthn/bad-signature", "ECDSA signature must be a DER SEQUENCE { r, s }");
-  }
-  function coord(c) {
-    // r and s MUST be primitive universal INTEGERs; a constructed child has a null
-    // content buffer, so assert the shape before touching `.content` (else a crafted
-    // SEQUENCE { SEQUENCE {}, SEQUENCE {} } would raw-throw instead of failing typed).
-    if (c.constructed || c.tagClass !== "universal" || c.tagNumber !== asn1.TAGS.INTEGER) {
-      throw E("webauthn/bad-signature", "ECDSA signature r/s must be a primitive INTEGER");
-    }
-    var b = c.content;
-    // r and s MUST be positive: an empty INTEGER, or a DER-negative one (top bit of
-    // the first content octet set, with no leading 0x00 sign octet), is not a valid
-    // ECDSA signature coordinate.
-    if (!b.length || (b[0] & 0x80)) throw E("webauthn/bad-signature", "ECDSA signature r/s must be a positive integer");
-    while (b.length > 1 && b[0] === 0x00) b = b.subarray(1);   // strip the DER sign octet
-    if (b.length === 1 && b[0] === 0x00) throw E("webauthn/bad-signature", "ECDSA signature r/s must be a positive integer");   // reject zero
-    if (b.length > coordLen) throw E("webauthn/bad-signature", "ECDSA signature coordinate exceeds the curve field size");
-    var out = Buffer.alloc(coordLen); b.copy(out, coordLen - b.length); return out;
-  }
-  return Buffer.concat([coord(node.children[0]), coord(node.children[1])]);
-}
+// DER ECDSA-Sig-Value { r, s } -> raw r||s (the ieee-p1363 form WebCrypto verify expects).
+// validator-sig owns the complete strict-DER conformance (primitive, minimal, positive,
+// bounded r/s), composed here.
+function _derEcdsaToRaw(der, coordLen) { return validator.sig.ecdsaSigToRaw(der, coordLen, WebauthnError, "webauthn/bad-signature"); }
 
 // Verify `sig` over `message` with the SPKI public key `spkiBytes` under COSE `alg`.
 // A wrong signature resolves `false` from subtle.verify without throwing (a false
@@ -283,7 +198,12 @@ function _verifySig(alg, sig, spkiBytes, message, E) {
   // COSE alg -8 (EdDSA) covers Ed25519 and Ed448; the WebCrypto name follows the
   // signing key's own SPKI algorithm OID, not the (curve-agnostic) alg id.
   if (alg === -8) { var nm = _edName(spkiBytes, E); imp = { name: nm }; ver = { name: nm }; }
-  var s = d.ecdsa ? _derEcdsaToRaw(sig, d.ecdsa, E) : sig;
+  // node/OpenSSL imports any Ed25519/Ed448 SPKI without validating the point, and a
+  // low-order (e.g. all-zeroes) key verifies a trivial signature -- so validate the OKP
+  // point before verify. This covers EVERY key that signs a WebAuthn statement: the x5c
+  // attestation-certificate key (packed/tpm/apple) AND the self-attestation credential key.
+  if (imp.name === "Ed25519" || imp.name === "Ed448") _requireValidEdPoint(spkiBytes, imp.name, E);
+  var s = d.ecdsa ? _derEcdsaToRaw(sig, d.ecdsa) : sig;
   return subtle.importKey("spki", spkiBytes, imp, false, ["verify"])
     .then(function (key) { return subtle.verify(ver, key, s, message); })
     .catch(function (e) { throw _err("webauthn/verify-error", "the attestation signature could not be evaluated", e); });
@@ -300,35 +220,24 @@ function _edName(spkiBytes, E) {
   if (!nm) throw E("webauthn/unsupported-algorithm", "unsupported EdDSA curve OID " + algOid);
   return nm;
 }
-
-// COSE EC2 / RSA credential key -> a self-contained SPKI the WebCrypto import
-// consumes, so a credential public key and a certificate key verify by one path.
-function _coseKeyToSpki(key, E) {
-  if (key.kty === 2 && key.x && key.y) {
-    var curveOid = key.crv === 1 ? "prime256v1" : key.crv === 2 ? "secp384r1" : key.crv === 3 ? "secp521r1" : null;
-    if (!curveOid) throw E("webauthn/bad-cose-key", "unsupported EC2 curve " + key.crv);
-    var b = asn1.build;
-    return b.sequence([
-      b.sequence([b.oid(oid.byName("ecPublicKey")), b.oid(oid.byName(curveOid))]),
-      b.bitString(Buffer.concat([Buffer.from([0x04]), key.x, key.y])),
-    ]);
-  }
-  if (key.kty === 3 && key.n && key.n.length && key.e && key.e.length) {
-    var bb = asn1.build;
-    return bb.sequence([
-      bb.sequence([bb.oid(oid.byName("rsaEncryption")), bb.nullValue()]),
-      bb.bitString(bb.sequence([bb.integer(BigInt("0x" + key.n.toString("hex"))), bb.integer(BigInt("0x" + key.e.toString("hex")))])),
-    ]);
-  }
-  if (key.kty === 1 && OKP_CRV[key.crv] && key.x && key.x.length === OKP_CRV[key.crv].len) {
-    // OKP Ed25519 / Ed448: the SPKI is AlgorithmIdentifier { id-Ed* } (no parameters)
-    // over the raw public key -- RFC 8410.
-    var eb = asn1.build;
-    return eb.sequence([eb.sequence([eb.oid(oid.byName(OKP_CRV[key.crv].oid))]), eb.bitString(key.x)]);
+// The raw Edwards point an OKP SPKI carries (its BIT STRING body, past the unused-bits
+// octet) MUST be a valid, full-order point -- reject an off-curve or low-order key before it
+// verifies a signature (WebCrypto import does not check it). Curve from the WebCrypto name.
+function _requireValidEdPoint(spkiBytes, name, E) {
+  var content;
+  try { content = asn1.decode(spkiBytes).children[1].content; }
+  catch (e) { throw E("webauthn/bad-signature", "the EdDSA public key is not a well-formed SPKI", e); }
+  var point = content && content.length ? content.subarray(1) : Buffer.alloc(0);
+  if (!edwardsPoint.validate(point, name === "Ed25519" ? 6 : 7)) {
+    throw E("webauthn/bad-signature", "the EdDSA public key is not a valid, full-order Edwards point");
   }
-  throw E("webauthn/bad-cose-key", "cannot build an SPKI for this COSE key type");
 }
 
+// A validated COSE credential key -> a self-contained SPKI the WebCrypto import
+// consumes, so a credential public key and a certificate key verify by one path.
+// validator-cose owns the encoding (EC2 / RSA / OKP), composed here.
+function _coseKeyToSpki(key) { return validator.cose.toSpki(key, WebauthnError, "webauthn/bad-cose-key"); }
+
 // The attestation-certificate subject public key MUST equal the credential public
 // key that authenticatorData carries (WebAuthn 8.4/8.8 item 30). Compare the raw
 // key material unsigned: an EC2 uncompressed point's X/Y vs the COSE x/y; an RSA
@@ -352,7 +261,7 @@ function _certPubKeyEqualsCose(cert, cose, E) {
   if (cose.kty === 2) {
     // The certificate's declared EC curve MUST equal the credential key's curve --
     // a curve substitution is a different key even if the coordinate bytes line up.
-    var wantCurve = EC2_CRV_OID[cose.crv];
+    var wantCurve = validator.cose.EC2_CRV_OID[cose.crv];
     if (!wantCurve) throw E("webauthn/key-mismatch", "unsupported credential EC curve " + cose.crv);
     if (_certEcCurveOid(cert, E) !== oid.byName(wantCurve)) throw E("webauthn/key-mismatch", "the attestation certificate EC curve does not equal the credential key curve");
     if (raw.length < 1 || raw[0] !== 0x04) throw E("webauthn/key-mismatch", "the attestation certificate key is not an uncompressed EC point");
@@ -382,71 +291,13 @@ function _certPubKeyEqualsCose(cert, cose, E) {
   throw E("webauthn/key-mismatch", "unsupported credential key type for the certificate comparison");
 }
 
-// ---- TPM structure readers (WebAuthn 8.3; TCG TPM 2.0 Part 2) ----------------
-// Every field is unsigned big-endian, packed with no padding; every TPM2B_* is a
-// UINT16 size followed by exactly `size` bytes. The bare certInfo (TPMS_ATTEST) and
-// pubArea (TPMT_PUBLIC) carry NO outer TPM2B size prefix.
-var TPM_GENERATED_VALUE = 0xff544347;
-var TPM_ST_ATTEST_CERTIFY = 0x8017;
-var TPM_ALG = { RSA: 0x0001, SHA1: 0x0004, SHA256: 0x000b, SHA384: 0x000c, SHA512: 0x000d, NULL: 0x0010, ECC: 0x0023 };
-var TPM_ALG_HASH = {}; TPM_ALG_HASH[TPM_ALG.SHA1] = "sha1"; TPM_ALG_HASH[TPM_ALG.SHA256] = "sha256"; TPM_ALG_HASH[TPM_ALG.SHA384] = "sha384"; TPM_ALG_HASH[TPM_ALG.SHA512] = "sha512";
-// TPM_ECC_CURVE -> COSE crv (the codepoints differ; this is a mapping, not equality).
-var TPM_CURVE_TO_COSE = {}; TPM_CURVE_TO_COSE[0x0003] = 1; TPM_CURVE_TO_COSE[0x0004] = 2; TPM_CURVE_TO_COSE[0x0005] = 3;
-
-function _tpmReader(buf) { return new ByteReader(buf, 0, buf.length, WebauthnError, "webauthn/bad-tpm"); }
-
-// TPMT_PUBLIC (WebAuthn 8.3 item 17-20): decode type/nameAlg + the public key in
-// `unique`, walking past `parameters` per the algorithm union.
-function _parseTpmPubArea(buf) {
-  var r = _tpmReader(buf);
-  var type = r.u16(), nameAlg = r.u16();
-  r.u32();                       // objectAttributes (full policy validation deferred)
-  r.vector(2, 0, null);          // authPolicy TPM2B_DIGEST
-  var pub = { type: type, nameAlg: nameAlg, nameAlgBytes: buf.subarray(2, 4) };
-  if (type === TPM_ALG.RSA) {
-    _tpmSymDef(r);               // symmetric TPMT_SYM_DEF_OBJECT
-    _tpmScheme(r);               // scheme TPMT_RSA_SCHEME
-    r.u16();                     // keyBits
-    var exp = r.u32();           // exponent (0 => default 65537)
-    pub.exponent = exp === 0 ? 65537 : exp;
-    pub.rsa = r.vector(2, 0, null);   // unique TPM2B_PUBLIC_KEY_RSA (the modulus)
-  } else if (type === TPM_ALG.ECC) {
-    _tpmSymDef(r);               // symmetric
-    _tpmScheme(r);               // scheme TPMT_ECC_SCHEME
-    pub.curveId = r.u16();       // curveID TPMI_ECC_CURVE
-    _tpmScheme(r);               // kdf TPMT_KDF_SCHEME
-    pub.x = r.vector(2, 0, null);     // unique.ecc.x TPM2B_ECC_PARAMETER
-    pub.y = r.vector(2, 0, null);     // unique.ecc.y TPM2B_ECC_PARAMETER
-  } else {
-    throw _err("webauthn/bad-tpm", "unsupported TPMT_PUBLIC type 0x" + type.toString(16));
-  }
-  // TPMT_PUBLIC ends with `unique`; trailing bytes mean a malformed pubArea (and
-  // would perturb the TPM Name hash), so fail closed rather than silently ignore them.
-  if (!r.atEnd()) throw _err("webauthn/bad-tpm", "pubArea has trailing bytes after the unique field (WebAuthn 8.3)");
-  return pub;
-}
-// TPMT_SYM_DEF_OBJECT: algorithm UINT16; when not NULL, keyBits+mode follow. An
-// attestation (restricted signing) key is NULL, so the non-NULL arm is defensive.
-function _tpmSymDef(r) { if (r.u16() !== TPM_ALG.NULL) { r.u16(); r.u16(); } }
-// TPMT_*_SCHEME / TPMT_KDF_SCHEME: scheme UINT16; when not NULL, a TPMS_SCHEME_HASH
-// (a single UINT16 hashAlg) follows for the signing/kdf schemes in scope.
-function _tpmScheme(r) { if (r.u16() !== TPM_ALG.NULL) { r.u16(); } }
-
-// TPMS_ATTEST (WebAuthn 8.3 item 13-15): magic/type + extraData + attested.name.
-// The whole certInfo is walked -- through qualifiedName and to the end -- so a
-// certInfo with trailing bytes past the TPMS_CERTIFY_INFO union fails closed.
-function _parseTpmCertInfo(buf) {
-  var r = _tpmReader(buf);
-  var magic = r.u32(), type = r.u16();
-  r.vector(2, 0, null);          // qualifiedSigner TPM2B_NAME
-  var extraData = r.vector(2, 0, null);   // extraData TPM2B_DATA
-  r.u64(); r.u32(); r.u32(); r.u8();      // clockInfo TPMS_CLOCK_INFO (17 bytes)
-  r.u64();                       // firmwareVersion
-  var name = r.vector(2, 0, null);        // attested.name TPM2B_NAME (nameAlg||H)
-  r.vector(2, 0, null);          // attested.qualifiedName TPM2B_NAME
-  if (!r.atEnd()) throw _err("webauthn/bad-tpm", "certInfo has trailing bytes after the attested structure (WebAuthn 8.3)");
-  return { magic: magic, type: type, extraData: extraData, attestedName: name };
-}
+// ---- TPM structure conformance (WebAuthn 8.3; TCG TPM 2.0 Part 2) -------------
+// The TPMT_PUBLIC (pubArea) + TPMS_ATTEST (certInfo) decode + the pubArea-key binding
+// live in validator-tpm, composed here. A malformed structure is bad-tpm; a key that
+// does not equal the credential key is key-mismatch.
+function _parseTpmPubArea(buf) { return validator.tpm.parsePubArea(buf, WebauthnError, "webauthn/bad-tpm"); }
+function _parseTpmCertInfo(buf) { return validator.tpm.parseCertInfo(buf, WebauthnError, "webauthn/bad-tpm"); }
+function _tpmPubKeyEqualsCose(pub, cose) { validator.tpm.pubKeyEqualsCose(pub, cose, WebauthnError, "webauthn/key-mismatch", "webauthn/bad-tpm"); }
 
 // ---- extension helpers -------------------------------------------------------
 // `oidName` is a registered name (byName resolves it at call time); an unregistered
@@ -455,17 +306,6 @@ function _findExt(cert, oidName) {
   var target = oid.byName(oidName);
   return (cert.extensions || []).filter(function (e) { return e.oid === target; })[0] || null;
 }
-// AuthorizationList (Android key attestation) is a SEQUENCE of [tag] EXPLICIT
-// OPTIONAL fields with non-contiguous tag numbers; return the EXPLICIT-unwrapped
-// value node for a tag, or null when absent (a tolerant, skip-unknown scan).
-function _alGet(seqNode, tag) {
-  if (!seqNode || !seqNode.children) return null;
-  for (var i = 0; i < seqNode.children.length; i++) {
-    var c = seqNode.children[i];
-    if (c.tagClass === "context" && c.tagNumber === tag) return c.children && c.children[0] ? c.children[0] : c;
-  }
-  return null;
-}
 
 // ---- public: parseAttestationObject -----------------------------------------
 
@@ -548,50 +388,15 @@ function _readX5c(attStmt) {
     try { return x509.parse(der); } catch (e) { throw _err("webauthn/bad-att-stmt", "an x5c certificate is not a well-formed X.509 certificate", e); }
   });
 }
-// Every attestation leaf cert MUST be an X.509 v3 certificate (WebAuthn 8.2.1 /
-// 8.3.1 / 8.4). The chain to a trust anchor is the caller's to run through
-// pki.path.validate with a supplied root; a bare chain is surfaced in trustPath.
-function _requireV3(cert) {
-  if (cert.version !== 3) throw _err("webauthn/bad-att-cert", "an attestation certificate must be X.509 version 3");
-}
-// A packed / tpm attestation LEAF certificate MUST carry a basicConstraints
-// extension asserting cA=false (WebAuthn 8.2.1 / 8.3.1). Requiring the extension --
-// not merely rejecting a present cA=true -- is the gate that stops a genuine CA
-// certificate under the caller's pinned root, or a leaf that simply omits the
-// constraint, from being repurposed as an attestation leaf; RFC 5280 path validation
-// does not reject a CA-asserting or unconstrained leaf.
-function _assertNotCa(cert) {
-  var bc = _decodeExt(cert, "basicConstraints");
-  if (!bc) throw _err("webauthn/bad-att-cert", "an attestation leaf certificate MUST carry a basicConstraints extension (WebAuthn 8.2.1 / 8.3.1)");
-  if (bc.value && bc.value.cA === true) throw _err("webauthn/bad-att-cert", "an attestation leaf certificate MUST NOT be a CA (basicConstraints cA=true)");
-}
-// Packed attestation certificate requirements (WebAuthn 8.2.1): v3, non-CA, and the
-// subject set to C (country), O (organization), OU = "Authenticator Attestation",
-// and CN (a vendor string).
-function _checkPackedCert(cert) {
-  _requireV3(cert);
-  _assertNotCa(cert);
-  var have = {};
-  (cert.subject.rdns || []).forEach(function (rdn) { rdn.forEach(function (a) { have[a.type] = a.value; }); });
-  if (have[oid.byName("countryName")] == null || have[oid.byName("organizationName")] == null || have[oid.byName("commonName")] == null) {
-    throw _err("webauthn/bad-att-cert", "the packed attestation certificate subject MUST set C, O, OU, and CN (WebAuthn 8.2.1)");
-  }
-  if (have[oid.byName("organizationalUnitName")] !== "Authenticator Attestation") {
-    throw _err("webauthn/bad-att-cert", "the packed attestation certificate subject OU MUST be \"Authenticator Attestation\" (WebAuthn 8.2.1)");
-  }
-}
-var AAGUID_EXT_OID = oid.byName("idFidoGenCeAaguid");   // a registered name, resolved at load
-// The id-fido-gen-ce-aaguid extension value (when present) MUST equal the
-// attestedCredentialData aaguid, and it MUST NOT be critical (WebAuthn 8.2.1).
-function _checkAaguidExt(cert, aaguid) {
-  var ext = (cert.extensions || []).filter(function (e) { return e.oid === AAGUID_EXT_OID; })[0];
-  if (!ext) return;   // absence is tolerated; presence must match
-  if (ext.critical) throw _err("webauthn/bad-att-cert", "the id-fido-gen-ce-aaguid extension MUST NOT be critical (WebAuthn 8.2.1)");
-  var val;
-  try { val = asn1.read.octetString(asn1.decode(ext.value)); }
-  catch (e) { throw _err("webauthn/bad-att-cert", "the id-fido-gen-ce-aaguid extension value is not a valid OCTET STRING", e); }
-  if (!val.equals(aaguid)) throw _err("webauthn/aaguid-mismatch", "the id-fido-gen-ce-aaguid extension value does not equal the authenticatorData aaguid");
-}
+// The WebAuthn attestation-certificate profile checks (WebAuthn 8.2.1 packed / 8.3.1 TPM
+// AIK / the id-fido-gen-ce-aaguid extension) live in validator-attcert, composed here. The
+// extension-accessor object hands the validator this format's fail-closed extension
+// decoders so it stays decoupled from the webauthn error namespace.
+var _exts = { find: _findExt, decode: _decodeExt };
+function _requireV3(cert) { validator.attcert.requireV3(cert, WebauthnError, "webauthn/bad-att-cert"); }
+function _checkPackedCert(cert) { validator.attcert.packedCert(cert, _exts, WebauthnError, "webauthn/bad-att-cert"); }
+function _checkAikCert(cert) { validator.attcert.aikCert(cert, _exts, WebauthnError, "webauthn/bad-att-cert"); }
+function _checkAaguidExt(cert, aaguid) { validator.attcert.aaguidExt(cert, aaguid, _exts, WebauthnError, "webauthn/bad-att-cert", "webauthn/aaguid-mismatch"); }
 
 var VERIFIERS = {
   // packed (WebAuthn 8.2): the x5c arm (Basic/AttCA) or self-attestation.
@@ -612,7 +417,7 @@ var VERIFIERS = {
     // Self-attestation: the statement alg MUST equal the credential key's own alg
     // (WebAuthn 8.2), then sig verifies under the credential key itself.
     if (alg !== att.authData.credentialPublicKey.alg) throw _err("webauthn/bad-att-stmt", "the packed self-attestation alg does not match the credential public key algorithm (WebAuthn 8.2)");
-    var spki = _coseKeyToSpki(att.authData.credentialPublicKey, _err);
+    var spki = _coseKeyToSpki(att.authData.credentialPublicKey);
     return _verifySig(alg, sig, spki, message, _err).then(function (ok) {
       if (!ok) throw _err("webauthn/verify-failed", "the packed self-attestation signature does not verify under the credential key");
       return _result("packed", "Self", [], att);
@@ -630,8 +435,10 @@ var VERIFIERS = {
     var leaf = chain[0];
     var sig = _sigOf(att.attStmt);
     var key = att.authData.credentialPublicKey;
-    if (key.kty !== 2 || key.crv !== 1 || !key.x || !key.y || key.x.length !== 32 || key.y.length !== 32) {
-      throw _err("webauthn/bad-att-stmt", "fido-u2f requires an EC2 P-256 credential public key (WebAuthn 8.6)");
+    // WebAuthn 8.6: the fido-u2f credential public key MUST be alg -7 (ES256) on EC2 P-256 --
+    // the newer ESP256 (-9) id, though the same curve, is not a valid fido-u2f credential.
+    if (key.alg !== -7 || key.kty !== 2 || key.crv !== 1 || !key.x || !key.y || key.x.length !== 32 || key.y.length !== 32) {
+      throw _err("webauthn/bad-att-stmt", "fido-u2f requires an ES256 (-7) EC2 P-256 credential public key (WebAuthn 8.6)");
     }
     var publicKeyU2F = Buffer.concat([Buffer.from([0x04]), key.x, key.y]);
     var verificationData = Buffer.concat([Buffer.from([0x00]), att.authData.rpIdHash, clientDataHash, att.authData.credentialId, publicKeyU2F]);
@@ -682,21 +489,20 @@ var VERIFIERS = {
     var pubAreaBytes = _attRead(att.attStmt, "pubArea", cbor.read.byteString, "a byte string");
     var certInfoBytes = _attRead(att.attStmt, "certInfo", cbor.read.byteString, "a byte string");
     var chain = _readX5c(att.attStmt), aik = chain[0];
-    _requireV3(aik);
 
     var pub = _parseTpmPubArea(pubAreaBytes);
     _tpmPubKeyEqualsCose(pub, att.authData.credentialPublicKey);   // 8.3 item 22
 
+    // validator-tpm decodes certInfo AND validates magic == TPM_GENERATED_VALUE / type ==
+    // TPM_ST_ATTEST_CERTIFY, so the returned structure is already self-consistent.
     var certInfo = _parseTpmCertInfo(certInfoBytes);
-    if (certInfo.magic !== TPM_GENERATED_VALUE) throw _err("webauthn/bad-tpm", "certInfo magic is not TPM_GENERATED_VALUE (WebAuthn 8.3)");
-    if (certInfo.type !== TPM_ST_ATTEST_CERTIFY) throw _err("webauthn/bad-tpm", "certInfo type is not TPM_ST_ATTEST_CERTIFY (WebAuthn 8.3)");
 
     // extraData == hash_alg(authData || clientDataHash) (bare digest, no method id).
     var attToBeSigned = Buffer.concat([att.authDataBytes, clientDataHash]);
     if (!certInfo.extraData.equals(_sha(_coseAlgHash(alg, _err), attToBeSigned))) throw _err("webauthn/verify-failed", "certInfo extraData does not equal the hash of authData || clientDataHash");
 
     // attested.name == nameAlg || H_nameAlg(pubArea).
-    var nameHash = TPM_ALG_HASH[pub.nameAlg];
+    var nameHash = validator.tpm.TPM_ALG_HASH[pub.nameAlg];
     if (!nameHash) throw _err("webauthn/bad-tpm", "unsupported TPM nameAlg 0x" + pub.nameAlg.toString(16));
     var computedName = Buffer.concat([pub.nameAlgBytes, _sha(nameHash, pubAreaBytes)]);
     if (!certInfo.attestedName.equals(computedName)) throw _err("webauthn/verify-failed", "certInfo attested Name does not match the pubArea TPM Name");
@@ -736,27 +542,6 @@ function _result(fmt, attestationType, chain, att) {
   return { verified: true, fmt: fmt, attestationType: attestationType, trustPath: (chain || []).slice().reverse(), aaguid: att.authData.aaguid, credentialPublicKey: att.authData.credentialPublicKey };
 }
 
-// pubArea public key == credentialPublicKey (unsigned compare; WebAuthn 8.3 item 22).
-function _tpmPubKeyEqualsCose(pub, cose) {
-  if (pub.type === TPM_ALG.ECC) {
-    if (cose.kty !== 2 || TPM_CURVE_TO_COSE[pub.curveId] !== cose.crv || !_ucmp(pub.x, cose.x || Buffer.alloc(0)) || !_ucmp(pub.y, cose.y || Buffer.alloc(0))) {
-      throw _err("webauthn/key-mismatch", "the TPM pubArea EC key does not equal the credential public key");
-    }
-    return;
-  }
-  if (pub.type === TPM_ALG.RSA) {
-    // Compare the exponent as an unsigned integer over its FULL width (a UINT32 up to
-    // 0xFFFFFFFF); a fixed 3-byte re-encode would silently truncate an exponent
-    // > 0xFFFFFF and let a mismatched key pass (WebAuthn 8.3 item 22).
-    var e = _uintBytes(pub.exponent >>> 0);
-    if (cose.kty !== 3 || !_ucmp(pub.rsa, cose.n || Buffer.alloc(0)) || !_ucmp(e, cose.e || Buffer.alloc(0))) {
-      throw _err("webauthn/key-mismatch", "the TPM pubArea RSA key does not equal the credential public key");
-    }
-    return;
-  }
-  throw _err("webauthn/bad-tpm", "unsupported TPM pubArea key type");
-}
-
 // Decode the Apple extension AppleAnonymousAttestation ::= SEQUENCE { nonce [1]
 // EXPLICIT OCTET STRING } (WebAuthn 8.8 item 29) and return the 32-byte nonce.
 function _appleNonce(extValue) {
@@ -769,73 +554,13 @@ function _appleNonce(extValue) {
   try { return asn1.read.octetString(tagged.children[0]); } catch (e) { throw _err("webauthn/bad-att-cert", "the apple attestation nonce is not an OCTET STRING", e); }
 }
 
-// The four Android KeyDescription checks (WebAuthn 8.4.1 item 28).
+// The complete Android Key Attestation KeyDescription conformance (AOSP schema + WebAuthn
+// 8.4.1) lives in validator-keydesc, composed here. A structural fault is bad-att-cert; a
+// well-formed description that fails an 8.4.1 MUST is verify-failed.
 function _checkAndroidKeyDescription(cert, clientDataHash) {
-  var ext = _findExt(cert, "keyDescription");
-  if (!ext) throw _err("webauthn/bad-att-cert", "the android-key attestation certificate is missing the key-description extension (WebAuthn 8.4.1)");
-  var kd;
-  try { kd = asn1.decode(ext.value); } catch (e) { throw _err("webauthn/bad-att-cert", "the android KeyDescription is not decodable", e); }
-  if (!kd.children || kd.children.length < 8) throw _err("webauthn/bad-att-cert", "the android KeyDescription is not a positional 8-field SEQUENCE");
-  // (1) attestationChallenge (position 4) == clientDataHash.
-  var challenge;
-  try { challenge = asn1.read.octetString(kd.children[4]); } catch (e) { throw _err("webauthn/bad-att-cert", "the android attestationChallenge is not an OCTET STRING", e); }
-  if (!challenge.equals(clientDataHash)) throw _err("webauthn/verify-failed", "the android attestationChallenge does not equal clientDataHash");
-  var softwareEnforced = kd.children[6], hardwareEnforced = kd.children[7];
-  // (2) [600] allApplications MUST be ABSENT in both lists.
-  if (_alGet(softwareEnforced, 600) || _alGet(hardwareEnforced, 600)) throw _err("webauthn/verify-failed", "android allApplications MUST be absent (WebAuthn 8.4.1)");
-  // (3)+(4) origin == KM_ORIGIN_GENERATED (0) and purpose == exactly {KM_PURPOSE_SIGN}
-  // (2), evaluated over the UNION of the teeEnforced and softwareEnforced lists --
-  // the WebAuthn 8.4.1 default (a teeEnforced-only policy is the caller's opt-in).
-  // Origin: at least one list MUST declare it, and EVERY list that declares one MUST
-  // say GENERATED -- a mixed teeEnforced=IMPORTED / softwareEnforced=GENERATED key is
-  // contradictory and rejected, not accepted on the strength of one list.
-  var origins = [_alGet(softwareEnforced, 702), _alGet(hardwareEnforced, 702)].filter(Boolean);
-  if (!origins.length || !origins.every(function (o) { return _alInt(o) === 0n; })) {
-    throw _err("webauthn/verify-failed", "android key origin is not KM_ORIGIN_GENERATED in every authorization list that declares it (WebAuthn 8.4.1)");
-  }
-  var purposes = _purposeUnion(softwareEnforced, hardwareEnforced);
-  if (purposes.length !== 1 || purposes[0] !== 2n) {
-    throw _err("webauthn/verify-failed", "android key purpose is not exactly KM_PURPOSE_SIGN (WebAuthn 8.4.1)");
-  }
-}
-// Read an android KeyDescription authorization INTEGER, mapping a wrong-type asn1/*
-// fault to the webauthn domain (a malformed authorization value is bad-att-cert input
-// to this layer, not a leaked codec error).
-function _alInt(node) {
-  try { return asn1.read.integer(node); }
-  catch (e) { throw _err("webauthn/bad-att-cert", "an android KeyDescription authorization value is not an INTEGER", e); }
-}
-// The union of the [1] purpose (SET OF INTEGER) values across both authorization
-// lists -- an attestation key MUST be usable for SIGN and nothing else.
-function _purposeUnion(a, b) {
-  var out = [];
-  [a, b].forEach(function (list) {
-    var p = _alGet(list, 1);
-    if (p && p.children) p.children.forEach(function (c) { var v = _alInt(c); if (out.indexOf(v) === -1) out.push(v); });
-  });
-  return out;
+  validator.keydesc.androidKeyDescription(cert, clientDataHash, _exts, WebauthnError, "webauthn/bad-att-cert", "webauthn/verify-failed");
 }
 
-// AIK-certificate requirements (WebAuthn 8.3.1): non-CA, an empty subject, the tcg
-// AIK-certificate EKU, and the tcg tpmManufacturer/tpmModel/tpmVersion subjectAltName
-// directory attributes.
-function _checkAikCert(cert) {
-  _assertNotCa(cert);
-  if ((cert.subject.rdns || []).length !== 0) throw _err("webauthn/bad-att-cert", "the tpm AIK certificate subject MUST be empty (WebAuthn 8.3.1)");
-  var eku = _decodeExt(cert, "extKeyUsage");
-  if (!eku || !Array.isArray(eku.value) || eku.value.indexOf(oid.byName("tcgKpAikCertificate")) === -1) {
-    throw _err("webauthn/bad-att-cert", "the tpm AIK certificate lacks the tcg-kp-AIKCertificate extended key purpose (WebAuthn 8.3.1)");
-  }
-  var san = _decodeExt(cert, "subjectAltName");
-  var dirName = san && san.value && san.value.names && san.value.names.filter(function (n) { return n.tagNumber === 4; })[0];
-  var types = {};
-  if (dirName && dirName.value && dirName.value.rdns) {
-    dirName.value.rdns.forEach(function (rdn) { rdn.forEach(function (a) { types[a.type] = true; }); });
-  }
-  if (!types[oid.byName("tpmManufacturer")] || !types[oid.byName("tpmModel")] || !types[oid.byName("tpmVersion")]) {
-    throw _err("webauthn/bad-att-cert", "the tpm AIK certificate subjectAltName lacks the required tcg attributes (WebAuthn 8.3.1)");
-  }
-}
 
 /**
  * @primitive pki.webauthn.verify

package/lib/webcrypto.js

@@ -658,7 +658,11 @@ function _algFromImport(name, alg, keyObject) {
 }
 
 function _curveFromKey(ko) {
-  try { var jwk = ko.export({ format: "jwk" }); for (var k in CURVE_NODE) { if (jwk.crv === k) return k; } } catch (_e) { /* best-effort */ }
+  try {
+    var jwk = ko.export({ format: "jwk" });
+    for (var k in CURVE_NODE) { if (jwk.crv === k) return k; }
+  }
+  catch (_e) { /* best-effort */ }
   return undefined;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",
@@ -66,6 +66,8 @@
     "fuzz": "npm ci --prefix fuzz && npx --prefix fuzz jazzer fuzz/asn1-der.fuzz.js -- -max_total_time=60",
     "gates": "node test/layer-0-primitives/codebase-patterns.test.js && node scripts/validate-source-comment-blocks.js && node scripts/check-api-snapshot.js",
     "coverage": "c8 --include=lib/** --include=index.js --reporter=text-summary --reporter=lcov node test/smoke.js",
+    "check:swallows": "node scripts/check-swallow-coverage.js",
+    "coverage:gated": "npm run coverage && npm run check:swallows",
     "prepack": "node scripts/check-pack-against-gitignore.js",
     "check:vendor-currency": "node scripts/check-vendor-currency.js"
   },