@blamejs/pki 0.3.21 → 0.3.23

package/lib/rc2.js

@@ -0,0 +1,130 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. RC2 is exposed only through the legacy-PBE bag decryption of
+// pki.pkcs12.open (RFC 7292 App. C), never as a general cipher; RC2 is a broken 64-bit block cipher (RC2-40
+// is export-crippled) kept solely to READ old `openssl pkcs12 -legacy` / NSS stores.
+//
+// rc2 -- a from-scratch RFC 2268 RC2-CBC. OpenSSL 3.x moved RC2 to the legacy provider (not loaded by Node),
+// so node:crypto cannot decrypt these bags; this in-tree primitive fills that single gap (Hard rule #1: own
+// code, no npm hop -- MANIFEST stays empty; a lib primitive like webcrypto.js, not a lib/vendor/ bundle). The
+// RFC 2268 sec. 5 known-answer vectors pin the cipher; the `openssl -legacy` store is the end-to-end KAT.
+
+// RFC 2268 sec. 2: PITABLE, a fixed 256-byte permutation of the digits of pi used by the key schedule.
+var PITABLE = [
+  0xd9, 0x78, 0xf9, 0xc4, 0x19, 0xdd, 0xb5, 0xed, 0x28, 0xe9, 0xfd, 0x79, 0x4a, 0xa0, 0xd8, 0x9d,
+  0xc6, 0x7e, 0x37, 0x83, 0x2b, 0x76, 0x53, 0x8e, 0x62, 0x4c, 0x64, 0x88, 0x44, 0x8b, 0xfb, 0xa2,
+  0x17, 0x9a, 0x59, 0xf5, 0x87, 0xb3, 0x4f, 0x13, 0x61, 0x45, 0x6d, 0x8d, 0x09, 0x81, 0x7d, 0x32,
+  0xbd, 0x8f, 0x40, 0xeb, 0x86, 0xb7, 0x7b, 0x0b, 0xf0, 0x95, 0x21, 0x22, 0x5c, 0x6b, 0x4e, 0x82,
+  0x54, 0xd6, 0x65, 0x93, 0xce, 0x60, 0xb2, 0x1c, 0x73, 0x56, 0xc0, 0x14, 0xa7, 0x8c, 0xf1, 0xdc,
+  0x12, 0x75, 0xca, 0x1f, 0x3b, 0xbe, 0xe4, 0xd1, 0x42, 0x3d, 0xd4, 0x30, 0xa3, 0x3c, 0xb6, 0x26,
+  0x6f, 0xbf, 0x0e, 0xda, 0x46, 0x69, 0x07, 0x57, 0x27, 0xf2, 0x1d, 0x9b, 0xbc, 0x94, 0x43, 0x03,
+  0xf8, 0x11, 0xc7, 0xf6, 0x90, 0xef, 0x3e, 0xe7, 0x06, 0xc3, 0xd5, 0x2f, 0xc8, 0x66, 0x1e, 0xd7,
+  0x08, 0xe8, 0xea, 0xde, 0x80, 0x52, 0xee, 0xf7, 0x84, 0xaa, 0x72, 0xac, 0x35, 0x4d, 0x6a, 0x2a,
+  0x96, 0x1a, 0xd2, 0x71, 0x5a, 0x15, 0x49, 0x74, 0x4b, 0x9f, 0xd0, 0x5e, 0x04, 0x18, 0xa4, 0xec,
+  0xc2, 0xe0, 0x41, 0x6e, 0x0f, 0x51, 0xcb, 0xcc, 0x24, 0x91, 0xaf, 0x50, 0xa1, 0xf4, 0x70, 0x39,
+  0x99, 0x7c, 0x3a, 0x85, 0x23, 0xb8, 0xb4, 0x7a, 0xfc, 0x02, 0x36, 0x5b, 0x25, 0x55, 0x97, 0x31,
+  0x2d, 0x5d, 0xfa, 0x98, 0xe3, 0x8a, 0x92, 0xae, 0x05, 0xdf, 0x29, 0x10, 0x67, 0x6c, 0xba, 0xc9,
+  0xd3, 0x00, 0xe6, 0xcf, 0xe1, 0x9e, 0xa8, 0x2c, 0x63, 0x16, 0x01, 0x3f, 0x58, 0xe2, 0x89, 0xa9,
+  0x0d, 0x38, 0x34, 0x1b, 0xab, 0x33, 0xff, 0xb0, 0xbb, 0x48, 0x0c, 0x5f, 0xb9, 0xb1, 0xcd, 0x2e,
+  0xc5, 0xf3, 0xdb, 0x47, 0xe5, 0xa5, 0x9c, 0x77, 0x0a, 0xa6, 0x20, 0x68, 0xfe, 0x7f, 0xc1, 0xad,
+];
+
+// RFC 2268 sec. 2: expand `key` (1..128 bytes) to the 64 16-bit words K[0..63], reducing to `effectiveBits`.
+function _expandKey(key, effectiveBits) {
+  var T = key.length, L = new Array(128);
+  for (var i = 0; i < T; i++) L[i] = key[i];
+  for (i = T; i < 128; i++) L[i] = PITABLE[(L[i - 1] + L[i - T]) & 0xff];
+  var T8 = (effectiveBits + 7) >>> 3;
+  var TM = 0xff >>> ((8 - (effectiveBits & 7)) & 7);   // 255 mod 2^(8 + effectiveBits - 8*T8)
+  L[128 - T8] = PITABLE[L[128 - T8] & TM];
+  for (i = 127 - T8; i >= 0; i--) L[i] = PITABLE[L[i + 1] ^ L[i + T8]];
+  var K = new Array(64);
+  for (i = 0; i < 64; i++) K[i] = L[2 * i] + (L[2 * i + 1] << 8);
+  return K;
+}
+
+function _rotl16(x, n) { return ((x << n) | (x >>> (16 - n))) & 0xffff; }
+function _rotr16(x, n) { return ((x >>> n) | (x << (16 - n))) & 0xffff; }
+var SHIFT = [1, 2, 3, 5];
+
+// RFC 2268 sec. 3: encrypt one 8-byte block (little-endian 16-bit words) in place-ish, returning 8 bytes.
+function _encBlock(K, b, off) {
+  var R = [b[off] | (b[off + 1] << 8), b[off + 2] | (b[off + 3] << 8), b[off + 4] | (b[off + 5] << 8), b[off + 6] | (b[off + 7] << 8)];
+  var j = 0, i;
+  function mix() {
+    for (var k = 0; k < 4; k++) {
+      R[k] = (R[k] + K[j] + (R[(k + 3) & 3] & R[(k + 2) & 3]) + (~R[(k + 3) & 3] & R[(k + 1) & 3])) & 0xffff;
+      j++;
+      R[k] = _rotl16(R[k], SHIFT[k]);
+    }
+  }
+  function mash() { for (var k = 0; k < 4; k++) R[k] = (R[k] + K[R[(k + 3) & 3] & 63]) & 0xffff; }
+  for (i = 0; i < 5; i++) mix();
+  mash();
+  for (i = 0; i < 6; i++) mix();
+  mash();
+  for (i = 0; i < 5; i++) mix();
+  return R;
+}
+
+// RFC 2268 sec. 3 inverse: decrypt one 8-byte block.
+function _decBlock(K, b, off) {
+  var R = [b[off] | (b[off + 1] << 8), b[off + 2] | (b[off + 3] << 8), b[off + 4] | (b[off + 5] << 8), b[off + 6] | (b[off + 7] << 8)];
+  var j = 63, i;
+  function rMix() {
+    for (var k = 3; k >= 0; k--) {
+      R[k] = _rotr16(R[k], SHIFT[k]);
+      R[k] = (R[k] - K[j] - (R[(k + 3) & 3] & R[(k + 2) & 3]) - (~R[(k + 3) & 3] & R[(k + 1) & 3])) & 0xffff;
+      j--;
+    }
+  }
+  function rMash() { for (var k = 3; k >= 0; k--) R[k] = (R[k] - K[R[(k + 3) & 3] & 63]) & 0xffff; }
+  for (i = 0; i < 5; i++) rMix();
+  rMash();
+  for (i = 0; i < 6; i++) rMix();
+  rMash();
+  for (i = 0; i < 5; i++) rMix();
+  return R;
+}
+
+function _wordsToBytes(R) {
+  return Buffer.from([R[0] & 0xff, (R[0] >>> 8) & 0xff, R[1] & 0xff, (R[1] >>> 8) & 0xff, R[2] & 0xff, (R[2] >>> 8) & 0xff, R[3] & 0xff, (R[3] >>> 8) & 0xff]);
+}
+
+// ECB block encrypt/decrypt (used by the KAT; CBC wraps them).
+function encryptBlock(key, effectiveBits, block) { return _wordsToBytes(_encBlock(_expandKey(key, effectiveBits), block, 0)); }
+function decryptBlock(key, effectiveBits, block) { return _wordsToBytes(_decBlock(_expandKey(key, effectiveBits), block, 0)); }
+
+// RC2-CBC decrypt with PKCS#7 unpadding. `E`/`code` are the caller's typed-error factory + code; a structural
+// fault (bad length, invalid pad) throws E(code) so the caller can collapse it to its uniform decrypt verdict.
+function cbcDecrypt(key, effectiveBits, iv, ct, E, code) {
+  if (ct.length === 0 || ct.length % 8 !== 0) throw E(code, "RC2-CBC ciphertext length must be a non-zero multiple of 8");
+  var K = _expandKey(key, effectiveBits), out = Buffer.alloc(ct.length), prev = iv;
+  for (var off = 0; off < ct.length; off += 8) {
+    var dec = _wordsToBytes(_decBlock(K, ct, off));
+    for (var i = 0; i < 8; i++) out[off + i] = dec[i] ^ prev[i];
+    prev = ct.subarray(off, off + 8);
+  }
+  var pad = out[out.length - 1];
+  if (pad < 1 || pad > 8 || pad > out.length) throw E(code, "RC2-CBC invalid PKCS#7 padding");
+  for (i = 0; i < pad; i++) if (out[out.length - 1 - i] !== pad) throw E(code, "RC2-CBC invalid PKCS#7 padding");
+  return out.subarray(0, out.length - pad);
+}
+
+// RC2-CBC encrypt with PKCS#7 padding (for the round-trip KAT; pkcs12.open only decrypts).
+function cbcEncrypt(key, effectiveBits, iv, pt) {
+  var padLen = 8 - (pt.length % 8), padded = Buffer.concat([pt, Buffer.alloc(padLen, padLen)]);
+  var K = _expandKey(key, effectiveBits), out = Buffer.alloc(padded.length), prev = iv;
+  for (var off = 0; off < padded.length; off += 8) {
+    var x = Buffer.alloc(8);
+    for (var i = 0; i < 8; i++) x[i] = padded[off + i] ^ prev[i];
+    var enc = _wordsToBytes(_encBlock(K, x, 0));
+    enc.copy(out, off);
+    prev = enc;
+  }
+  return out;
+}
+
+module.exports = { encryptBlock: encryptBlock, decryptBlock: decryptBlock, cbcDecrypt: cbcDecrypt, cbcEncrypt: cbcEncrypt };

package/lib/smime.js

@@ -62,15 +62,273 @@ var MICALG = { sha1: "sha-1", sha224: "sha-224", sha256: "sha-256", sha384: "sha
 function _entityBytes(content, opts) {
   var raw = guard.bytes.view(content, SmimeError, "smime/bad-input", "content");
   if (opts.entity) return mime.canonicalize(raw, SmimeError, "smime/bad-mime");
-  var ct = opts.contentType || "text/plain; charset=utf-8";
   // Declare the honest Content-Transfer-Encoding: "7bit" requires every byte <= 127 (RFC 2045); a body
   // with any 8-bit byte is "8bit". Declaring 7bit for 8-bit content is a false claim a transport could act on.
   var cte = _is7bit(raw) ? "7bit" : "8bit";
-  var head = Buffer.from("Content-Type: " + ct + "\r\nContent-Transfer-Encoding: " + cte + "\r\n\r\n", "latin1");
-  return mime.canonicalize(Buffer.concat([head, raw]), SmimeError, "smime/bad-mime");
+  // Build through the guarded serializer so a CRLF / NUL in opts.contentType cannot inject a header field.
+  return mime.buildEntity([{ name: "Content-Type", value: opts.contentType || "text/plain; charset=utf-8" }, { name: "Content-Transfer-Encoding", value: cte }], raw, SmimeError, "smime/bad-header");
 }
 function _is7bit(buf) { for (var i = 0; i < buf.length; i++) if (buf[i] > 0x7f) return false; return true; }
 
+// ---- RFC 9788 header protection (an opts.protectHeaders-gated MIME transform over the shipped CMS path) ----
+// The protected header fields are inlined on the Cryptographic Payload root (its Content-Type gains an `hp`
+// parameter: "clear" for signed-only, "cipher" for encrypted); the outer display headers are copied as-is
+// (signed) or passed through a Header Confidentiality Policy (encrypted). The CMS crypto is UNCHANGED.
+
+// Is this (lowercased) header field name Structural? RFC 9787 sec. 1.1.1 defines a Structural Header Field as
+// MIME-Version OR any field whose name begins with "Content-" (Content-Type / -Transfer-Encoding /
+// -Disposition / -ID / -Description / -Language / -Location / ...). These describe the specific MIME part --
+// the library sets them -- so they are never protected as Non-Structural fields (rejected at the producer) nor
+// surfaced in the authenticated protectedHeaders set on verify. The prefix rule is the RFC definition itself,
+// so it matches EVERY Content-* field (not just an enumerated subset) and is not a prototype-key lookup (a
+// field named "constructor" / "toString" is simply not Structural).
+function _isStructural(lname) {
+  return lname === "mime-version" || lname.indexOf("content-") === 0;
+}
+
+// Normalize opts.headers (an object { Name: value } or an array [{ name, value }]) to an ordered list. A
+// malformed shape is a config-time smime/bad-input (the value's byte integrity is guarded at emission).
+function _hpHeaderList(headers) {
+  if (headers == null) return [];
+  var out = [];
+  if (Array.isArray(headers)) {
+    headers.forEach(function (h) {
+      if (!h || typeof h !== "object") throw _err("smime/bad-input", "each opts.headers entry must be { name, value }");
+      // Read name + value ONCE each -- an accessor / Proxy could return a different value on a second read, so
+      // the snapshot (not the live property) is what both the signed inner header and the outer display copy use.
+      var name = h.name, v = h.value;
+      if (typeof name !== "string") throw _err("smime/bad-input", "each opts.headers entry must be { name, value }");
+      out.push({ name: name, value: v == null ? "" : String(v) });
+    });
+  } else if (typeof headers === "object") {
+    Object.keys(headers).forEach(function (k) { var v = headers[k]; out.push({ name: k, value: v == null ? "" : String(v) }); });
+  } else {
+    throw _err("smime/bad-input", "opts.headers must be an object or an array of { name, value }");
+  }
+  // Only Non-Structural fields are protected (RFC 9787): a Structural header (Content-Type, MIME-Version, ...)
+  // describes the MIME structure -- the library sets it -- so a caller passing one would duplicate it on the
+  // payload root. And a REPEATED field name is rejected here at the PRODUCER: a repeated protected field is an
+  // unsupported shape (verify fails closed on the ambiguity), so the library never emits a message it cannot
+  // re-consume. Reject both rather than emit a malformed / self-inconsistent entity.
+  var seen = Object.create(null);
+  out.forEach(function (h) {
+    var ln = h.name.toLowerCase();
+    if (_isStructural(ln)) throw _err("smime/bad-input", "opts.headers must not include the Structural header " + JSON.stringify(h.name) + " (RFC 9787); only Non-Structural fields (Subject / From / To / ...) are protected");
+    // HP-Outer is a reserved field the library emits itself (RFC 9788 sec. 2.2) to document outer-header
+    // confidentiality; a caller-supplied one would be mistaken for that machinery, so reject it.
+    if (ln === "hp-outer") throw _err("smime/bad-input", "opts.headers must not include the reserved HP-Outer field (RFC 9788 sec. 2.2); the library emits it");
+    if (seen[ln]) throw _err("smime/bad-input", "opts.headers must not repeat a protected field name (" + JSON.stringify(h.name) + "); a repeated protected field is not supported");
+    seen[ln] = 1;
+  });
+  return out;
+}
+
+// The Header Confidentiality Policy for an OUTER header of an encrypted-HP message. hcp_baseline (RFC 9788
+// sec. 3.2.1, the default) obscures Subject to "[...]" and REMOVES Comments / Keywords (null);
+// hcp_no_confidentiality leaves every field visible (opt-in only). This is the sec. 3.2.1 pseudocode
+// VERBATIM: Bcc is intentionally NOT stripped -- RFC 9788 sec. 11.4 explains that removing Bcc during
+// encryption can break deliverability to a Bcc'd recipient, so the choice is left to the caller (omit Bcc
+// from opts.headers to keep it out of the plaintext outer headers).
+function _applyHcp(name, value, hcp) {
+  if (hcp === "hcp_no_confidentiality") return value;
+  var ln = name.toLowerCase();
+  if (ln === "subject") return "[...]";
+  if (ln === "comments" || ln === "keywords") return null;
+  return value;
+}
+
+// The outer display header list: for "clear" (signed) the fields are copied verbatim; for "cipher"
+// (encrypted) each passes through the HCP -- a null result removes the field (it lives only in the ciphertext).
+function _outerHeaderList(list, mode, hcp) {
+  var policy = hcp == null ? "hcp_baseline" : hcp;
+  if (policy !== "hcp_baseline" && policy !== "hcp_no_confidentiality") throw _err("smime/bad-input", "unknown opts.hcp policy " + JSON.stringify(hcp) + " (only \"hcp_baseline\" or \"hcp_no_confidentiality\")");
+  var out = [];
+  list.forEach(function (h) {
+    if (mode === "cipher") {
+      var v = _applyHcp(h.name, h.value, policy);
+      if (v !== null) out.push({ name: h.name, value: v });
+    } else {
+      out.push({ name: h.name, value: h.value });
+    }
+  });
+  return out;
+}
+
+// Build the inner Cryptographic Payload for a header-protected message: the caller's body wrapped with its
+// Content-Type (gaining ; hp="<mode>") + Content-Transfer-Encoding + the protected fields inlined, canonical.
+// hpList is the ONE normalized snapshot of opts.headers (see the caller) -- the SAME list feeds the signed/
+// encrypted inner header set here and the outer display copy, so an accessor / Proxy cannot make them diverge.
+// outerList is the HCP-processed outer set (_outerHeaderList) -- for a cipher payload it also drives the
+// HP-Outer records embedded here.
+function _protectedInnerEntity(content, opts, mode, hpList, outerList) {
+  // Header protection inlines the protected fields on the payload ROOT it builds, so a caller-supplied
+  // complete entity (opts.entity) is an unsupported combination -- reject it rather than silently bury the
+  // caller's entity (its own Content-Type + headers) beneath a new default text/plain wrapper.
+  if (opts.entity) throw _err("smime/bad-input", "opts.entity is not supported with protectHeaders -- pass raw content + opts.contentType");
+  var raw = guard.bytes.view(content, SmimeError, "smime/bad-input", "content");
+  // Header protection sets the hp parameter itself; a caller hp in opts.contentType (with OR without a value)
+  // would emit two hp attributes (Content-Type: ...; hp; hp="clear"), an unconsumable non-interoperable
+  // message -- reject it here (hasParam catches a bare "hp" that paramCount would miss).
+  if (opts.contentType != null && mime.hasParam(String(opts.contentType), "hp")) throw _err("smime/bad-input", "opts.contentType must not set the hp parameter -- header protection sets it (hp=" + JSON.stringify(mode) + ")");
+  var ct = (opts.contentType || "text/plain; charset=utf-8") + "; hp=\"" + mode + "\"";
+  var fields = [{ name: "Content-Type", value: ct }, { name: "Content-Transfer-Encoding", value: _is7bit(raw) ? "7bit" : "8bit" }];
+  hpList.forEach(function (h) { fields.push(h); });
+  // RFC 9788 sec. 2.2 / sec. 5.2.1 step 5.v: an ENCRYPTED header-protected payload documents inside the
+  // ciphertext, as HP-Outer records, every Non-Structural field it deliberately left visible in the outer
+  // (unprotected) header section -- "HP-Outer: <name>: <outer-value>". A field the HCP removed has NO HP-Outer
+  // record; its absence authenticates that it was made confidential by removal. Signed-only (clear) payloads
+  // carry no HP-Outer (sec. 2.2: "not relevant for signed-only messages").
+  if (mode === "cipher") {
+    outerList.forEach(function (h) { fields.push({ name: "HP-Outer", value: h.name + ": " + h.value }); });
+  }
+  return mime.buildEntity(fields, raw, SmimeError, "smime/bad-header");
+}
+
+// The outer header prefix (display copies + MIME-Version) that precedes the Cryptographic Envelope's
+// Content-Type in a header-protected message. Each field is guard-validated (no CR/LF/NUL injection). list is
+// the SAME HCP-processed outer set the inner entity's HP-Outer records were built from.
+function _outerPrefix(list) {
+  var s = "";
+  for (var i = 0; i < list.length; i++) {
+    guard.header.assertField(list[i].name, list[i].value, SmimeError, "smime/bad-header");
+    s += list[i].name + ": " + list[i].value + "\r\n";
+  }
+  return s + "MIME-Version: 1.0\r\n";
+}
+
+// Does the payload header region declare an hp Content-Type parameter? A cheap raw scan (unfold the header
+// block, then look for a Content-Type line carrying an hp= parameter) so a NON-HP payload is never parsed --
+// no swallow -- and only a payload that CLAIMS hp is validated (a malformed such payload then fails closed,
+// never a silent downgrade to unprotected).
+// Re-decode a header value that mime.parse latin1-decoded (byte-preserving) as UTF-8 (RFC 6532), so a
+// non-ASCII protected value round-trips intact -- a latin1 string maps 1:1 to bytes, recovering the emitted UTF-8.
+function _utf8Header(s) { return Buffer.from(s, "latin1").toString("utf8"); }
+
+function _declaresHp(content) {
+  // content is the CANONICAL entity bytes -- the caller (_hpSurface) runs mime.canonicalizeText ONCE so
+  // detection here and the subsequent mime.parse see the identical normalized form (bare CR / LF -> CRLF).
+  // Detecting hp on the canonical form -- the bytes the signature covers -- is what stops a fold/line-ending
+  // transport rewrite from stripping the hp signal from a still-valid signed message.
+  var s = content.toString("latin1");
+  var m = s.match(/\r\n\r\n/);
+  var head = (m ? s.slice(0, m.index) : s).replace(/\r\n[ \t]+/g, " ");
+  // Detect hp by composing mime.paramCount -- the SAME comment- + quoted-string-aware tokenizer the parser
+  // uses -- over each Content-Type field, so the probe never diverges from mime.parse: a leading-whitespace
+  // or before-colon field name is matched (the parser trims it), while an hp= inside a MIME comment or a
+  // quoted value is NOT a parameter (so an ordinary Content-Type cannot opt a message into HP processing). A
+  // real hp on ANY Content-Type line is detected; a duplicate Content-Type is rejected downstream.
+  var cts = head.match(/^[ \t]*content-type[ \t]*:[^\r\n]*/gim);
+  if (!cts) return false;
+  for (var i = 0; i < cts.length; i++) {
+    // hasParam (not paramCount): a payload that names the hp attribute WITHOUT a value ("...; hp") still
+    // CLAIMS header protection -- detect it so _hpSurface fails closed on the malformed declaration rather
+    // than silently downgrading it to unprotected.
+    if (mime.hasParam(cts[i].replace(/^[ \t]*content-type[ \t]*:/i, ""), "hp")) return true;
+  }
+  return false;
+}
+
+// Detect + surface RFC 9788 header protection on a recovered inner entity, FAIL-CLOSED. A payload that does
+// not declare hp surfaces protectedHeaders:null. A payload that DECLARES hp is validated: a malformed block,
+// an invalid hp value, or an hp mode that CONTRADICTS the cryptographic envelope (expectedMode "clear" for a
+// signed message, "cipher" for a decrypted one) throws smime/bad-header-protection -- never a silent
+// downgrade. Otherwise the inline Non-Structural fields ARE the authenticated set; a From that differs from
+// the untrusted OUTER From is flagged fromMismatch.
+function _hpSurface(content, outerEnt, expectedMode, authenticated) {
+  var none = { protectedHeaders: null, headerProtection: { present: false, mode: null, fromMismatch: false, confidential: [] } };
+  // Header protection is an AUTHENTICATED property: surface the inner headers as protected ONLY when the
+  // cryptographic verdict succeeded (a valid signature, or an authenticated-encryption decrypt). An invalid
+  // signature or an unauthenticated (AES-CBC, no integrity) decrypt yields attacker-influenced bytes -- they
+  // are never marked or exposed as protected (a caller must not treat protectedHeaders as a trust signal
+  // unless integrity held).
+  if (!authenticated) return none;
+  // Detect + parse the CANONICAL entity -- the exact bytes the signature covers. A transport may rewrite a
+  // CRLF fold OR the header/body separator to bare CR/LF; canonicalize repairs them (so verification still
+  // succeeds), and BOTH the hp detection and the parse must run on the repaired bytes, or they diverge from
+  // the signed content -- stripping the signal, or false-rejecting a valid message as an unparseable block.
+  // The returned `content` stays the raw recovered bytes; only this HP inspection uses the canonical copy.
+  var canon = mime.canonicalizeText(content);
+  if (!_declaresHp(canon)) return none;
+  var inner = mime.parse(canon, SmimeError, "smime/bad-header-protection");   // a malformed HP block fails closed
+  // A duplicate Content-Type makes the hp declaration ambiguous (a parser reads params from the FIRST field,
+  // but an hp= may sit on a later one) -- a malformed wrap that fails closed, never a silent downgrade.
+  var ctCount = 0;
+  inner.headers.forEach(function (h) { if (h.lname === "content-type") ctCount++; });
+  if (ctCount > 1) throw _err("smime/bad-header-protection", "a header-protected payload must carry exactly one Content-Type field (found " + ctCount + ")");
+  // A duplicate hp attribute is ambiguous (mime.parse keeps the LAST value, but a recipient honoring the
+  // first would see a different mode) -- fail closed, like the duplicate Content-Type. Counted by attribute
+  // name (bare OR valued) so a bare+valued pair ("hp; hp=x") is caught too, and quote-/comment-aware (an hp=
+  // inside a quoted value or comment is not the hp parameter, so a message we emit is never self-rejected).
+  if (mime.paramNameCount(inner.contentType.value, "hp") > 1) throw _err("smime/bad-header-protection", "a header-protected payload declares the hp parameter more than once");
+  // _declaresHp composes the SAME comment/quoted-string-aware tokenizer (mime.paramCount) mime.parse uses, so
+  // reaching here means the single Content-Type carries a real hp parameter (a duplicate is rejected above) --
+  // hp is defined. A malformed value fails CLOSED at the mode checks below, never a silent downgrade.
+  // The hp keyword values clear / cipher are an enumerated Content-Type parameter -- per RFC 2045 sec. 5.1 a
+  // value of this kind is compared case-insensitively for its intended use, so a peer that emits hp="Clear"
+  // or hp=CIPHER is still recognized. (We always EMIT lowercase; we ACCEPT any case. The value is inside the
+  // signed/encrypted payload, so normalizing it enables no attack -- the mode-contradiction check still runs.)
+  // _declaresHp detected the hp attribute (hasParam); a bare "hp" with no value is a malformed HP declaration
+  // -- fail closed rather than silently downgrade (mime.parse skips a valueless parameter, so params.hp is
+  // undefined here only for that malformed case).
+  var raw = inner.contentType.params.hp;
+  if (raw === undefined) throw _err("smime/bad-header-protection", "a header-protected payload declares a bare hp parameter with no value (expected hp=\"clear\" or hp=\"cipher\")");
+  var hp = raw.toLowerCase();
+  if (hp !== "clear" && hp !== "cipher") throw _err("smime/bad-header-protection", "the header-protected payload declares an invalid hp value " + JSON.stringify(raw) + " (only clear / cipher)");
+  if (hp !== expectedMode) throw _err("smime/bad-header-protection", "the payload hp=" + JSON.stringify(hp) + " contradicts the cryptographic envelope (a " + (expectedMode === "cipher" ? "decrypted" : "signed") + " message requires hp=" + JSON.stringify(expectedMode) + ")");
+  // mime.parse decodes the header block as latin1 (byte-preserving), so a protected value emitted as UTF-8
+  // (RFC 6532, the guard permits it) is re-decoded latin1->UTF-8 here to round-trip intact. protectedHeaders
+  // surfaces the exact authenticated field body (rawValue: leading/trailing whitespace preserved), NOT a
+  // trimmed value that would diverge from the signed octets.
+  var protectedHeaders = Object.create(null), protectedRaw = Object.create(null), innerFrom = null, seen = Object.create(null), dup = null;
+  var refouter = [];   // RFC 9788 sec. 4.2.1: the HP-Outer records (name + the value the field had in the outer section)
+  inner.headers.forEach(function (h) {
+    if (_isStructural(h.lname)) return;
+    if (h.lname === "hp-outer") {
+      // RFC 9788 sec. 4.2.1 step 4.i: split the HP-Outer value on the FIRST colon into (name, outer-value)
+      // -> refouter. The value is kept BYTE-PRESERVING (latin1), never UTF-8-decoded, because the sec. 4.3.1
+      // confidentiality comparison must be octet-exact (a lossy decode maps distinct invalid octets 0x80/0x81
+      // to one replacement char, which would mis-classify an obscured field as exposed and drop it from the
+      // confidential set). HP-Outer is NEVER surfaced as a protected header nor counted toward the duplicate
+      // check (sec. 2.2: it "can appear multiple times"). A valueless HP-Outer (no inner colon) is ignored.
+      var ci = h.rawValue.indexOf(":");
+      if (ci >= 0) refouter.push({ name: h.rawValue.slice(0, ci).trim().toLowerCase(), value: h.rawValue.slice(ci + 1).trim() });
+      return;
+    }
+    if (seen[h.lname]) dup = h.name;
+    seen[h.lname] = 1;
+    protectedHeaders[h.name] = _utf8Header(h.rawValue);   // SURFACE the exact authenticated field body (RFC 6532 UTF-8)
+    protectedRaw[h.name] = h.rawValue;                    // ...but retain the BYTE-PRESERVING (latin1) body for the octet-exact confidentiality comparison
+    // ...and for the mismatch comparison: a lossy UTF-8 decode maps distinct invalid 8-bit sequences (0x80 vs
+    // 0x81) to the same replacement char, which would let an attacker alter the displayed From without
+    // tripping fromMismatch. Compare the raw octets instead.
+    if (h.lname === "from") innerFrom = h.value;
+  });
+  // A duplicate protected field is ambiguous (the last-wins overwrite hides an earlier value a different
+  // parser might select) -- fail closed rather than surface an ambiguous authenticated set.
+  if (dup) throw _err("smime/bad-header-protection", "a header-protected payload has a duplicate protected header field " + JSON.stringify(dup));
+  // RFC 9788 sec. 4.3.1: for an ENCRYPTED payload (hp="cipher"), a protected field is end-to-end confidential
+  // (encrypted-only) unless an HP-Outer record carries its EXACT name + value -- i.e. it was copied verbatim
+  // to the visible outer section. A field with no matching HP-Outer (removed, or obscured to a different outer
+  // value) was made confidential. This authenticated set lets a caller reply/forward without leaking it
+  // (sec. 6.1). Signed-only (clear) payloads carry no HP-Outer, so nothing is confidential.
+  var confidential = [];
+  if (hp === "cipher") {
+    Object.keys(protectedHeaders).forEach(function (name) {
+      var ln = name.toLowerCase(), val = protectedRaw[name].trim(), exposed = false;   // octet-exact (latin1), not lossy-decoded
+      for (var i = 0; i < refouter.length; i++) { if (refouter[i].name === ln && refouter[i].value === val) { exposed = true; break; } }
+      if (!exposed) confidential.push(name);
+    });
+  }
+  // Inspect EVERY outer From (outerEnt.header returns only the FIRST; an attacker may append a second, forged
+  // From that a MUA displays) -- a duplicate outer From, or any that disagrees with the protected From, is flagged.
+  var outerFroms = [];
+  outerEnt.headers.forEach(function (h) { if (h.lname === "from") outerFroms.push(h.value.trim()); });   // byte-preserving (latin1), compared octet-for-octet against the protected From
+  // A mismatch is ANYTHING but exactly one outer From equal to the protected one: a removed outer From (a
+  // transport/attacker strips it), a duplicate, or a differing value all flag tampering of the displayed sender.
+  var fromMismatch = innerFrom != null && (outerFroms.length !== 1 || outerFroms[0] !== innerFrom.trim());
+  return { protectedHeaders: protectedHeaders, headerProtection: { present: true, mode: hp, fromMismatch: fromMismatch, confidential: confidential } };
+}
+
 // Map smime opts to cms.sign opts (the S/MIME layer is algorithm-agnostic -- it forwards any signer).
 function _cmsSignOpts(opts, detached) {
   var o = { detached: detached };
@@ -132,29 +390,41 @@ function _base64Body(der) {
  *   - `"pkcs7-mime"` (opaque): one `application/pkcs7-mime; smime-type=signed-data` entity whose base64
  *     body is an ATTACHED CMS SignedData over the canonical entity.
  * The signed bytes are the entity's RFC 8551 sec. 3.1.1 canonical form (CRLF line endings); the SAME
- * canonicalizer runs on verify. Returns the assembled message bytes. Fail-closed with `SmimeError`.
+ * canonicalizer runs on verify. With `opts.protectHeaders`, the message is header-protected (RFC 9788): the
+ * caller's `opts.headers` are inlined on the Cryptographic Payload root -- its Content-Type gains `hp="clear"`
+ * -- so the signature covers them, and copied to the outer display headers; `verify` surfaces the
+ * authenticated inner set. Returns the assembled message bytes. Fail-closed with `SmimeError`.
  *
  * @opts form        `"multipart"` (default) or `"pkcs7-mime"`.
  * @opts entity      treat `content` as a complete MIME entity (default: wrap it as text/plain).
  * @opts contentType the wrapped entity's Content-Type (default `text/plain; charset=utf-8`).
  * @opts signingTime a `Date` for the CMS signing-time attribute, or false to omit it.
+ * @opts protectHeaders enable RFC 9788 header protection (`hp="clear"`) -- inline `opts.headers` on the signed payload + the outer display headers.
+ * @opts headers     the Non-Structural fields to protect + display: an object `{ Name: value }` or an array `[{ name, value }]` (Subject / From / To / Date / ...); used with `protectHeaders`.
  * @example
  *   var msg = await pki.smime.sign(Buffer.from("hello"), [{ cert: signerCertDer, key: signerKeyPkcs8 }]);
  */
 async function sign(content, signers, opts) {
   opts = opts || {};
-  var entity = _entityBytes(content, opts);
+  // RFC 9788 header protection (opts.protectHeaders): the inner Cryptographic Payload gains hp="clear" +
+  // the inlined protected fields, and the outer frame carries the display copies. Off by default => the
+  // shipped path, byte-for-byte.
+  var hp = opts.protectHeaders === true;
+  var hpList = hp ? _hpHeaderList(opts.headers) : null;   // ONE snapshot for both the signed inner + outer display copies
+  var outerList = hp ? _outerHeaderList(hpList, "clear", opts.hcp) : null;
+  var entity = hp ? _protectedInnerEntity(content, opts, "clear", hpList, outerList) : _entityBytes(content, opts);
+  var outer = hp ? _outerPrefix(outerList) : "";
   var form = opts.form || "multipart";
   if (form === "pkcs7-mime") {
     var p7m = await cms.sign(entity, signers, _cmsSignOpts(opts, false));
-    var head = Buffer.from("Content-Type: application/pkcs7-mime; smime-type=signed-data; name=smime.p7m\r\nContent-Transfer-Encoding: base64\r\nContent-Disposition: attachment; filename=smime.p7m\r\n\r\n", "latin1");
+    var head = Buffer.from(outer + "Content-Type: application/pkcs7-mime; smime-type=signed-data; name=smime.p7m\r\nContent-Transfer-Encoding: base64\r\nContent-Disposition: attachment; filename=smime.p7m\r\n\r\n", "utf8");
     return _capped(Buffer.concat([head, _base64Body(_toBuf(p7m)), mime.CRLF]));
   }
   if (form !== "multipart") throw _err("smime/bad-input", "form must be \"multipart\" or \"pkcs7-mime\"");
   var p7s = _toBuf(await cms.sign(entity, signers, _cmsSignOpts(opts, true)));
   var micalg = _micalgOf(p7s) || "sha-256";
   var boundary = _boundary();
-  var head2 = Buffer.from("Content-Type: multipart/signed; protocol=\"application/pkcs7-signature\"; micalg=" + micalg + "; boundary=\"" + boundary + "\"\r\n\r\n", "latin1");
+  var head2 = Buffer.from(outer + "Content-Type: multipart/signed; protocol=\"application/pkcs7-signature\"; micalg=" + micalg + "; boundary=\"" + boundary + "\"\r\n\r\n", "utf8");
   var sigPart = Buffer.concat([
     Buffer.from("Content-Type: application/pkcs7-signature; name=smime.p7s\r\nContent-Transfer-Encoding: base64\r\nContent-Disposition: attachment; filename=smime.p7s\r\n\r\n", "latin1"),
     _base64Body(p7s),
@@ -174,10 +444,10 @@ function _capped(msg) {
 
 /**
  * @primitive  pki.smime.verify
- * @signature  pki.smime.verify(message, opts?) -> Promise<{ valid, signers, form, content, micalg }>
+ * @signature  pki.smime.verify(message, opts?) -> Promise<{ valid, signers, form, content, micalg, protectedHeaders, headerProtection }>
  * @since      0.2.25
  * @status     experimental
- * @spec       RFC 8551, RFC 5652
+ * @spec       RFC 8551, RFC 5652, RFC 9788
  * @related    pki.smime.sign, pki.cms.verify, pki.path.validate
  *
  * Unwrap and verify a signed S/MIME message (RFC 8551), both `multipart/signed` and
@@ -188,6 +458,13 @@ function _capped(msg) {
  * entity bytes), and the `micalg`. Like `cms.verify`, this returns the cryptographic verdict only --
  * chaining a signer certificate to a trust anchor is the caller's `pki.path.validate` step. A `micalg`
  * that disagrees with the actual digest is advisory unless `opts.strictMicalg` (then `smime/micalg-mismatch`).
+ * If the message is header-protected (RFC 9788), `protectedHeaders` is the AUTHENTICATED inner header set (a
+ * tampered outer header cannot alter it) and `headerProtection` is `{ present, mode, fromMismatch, confidential }`
+ * -- `fromMismatch` flags an outer From differing from the protected one; `confidential` lists the protected
+ * fields the composer kept end-to-end confidential (per the authenticated HP-Outer records, RFC 9788 sec. 4.3;
+ * only populated for an encrypted `hp="cipher"` payload). A non-protected message reports `protectedHeaders: null`.
+ * A payload whose declared `hp` is malformed, invalid, or contradicts the envelope fails closed
+ * (`smime/bad-header-protection`), never a silent downgrade.
  *
  * @opts certs        extra signer certificates (DER `Buffer`s) to match, forwarded to `cms.verify`.
  * @opts strictMicalg reject a `multipart/signed` whose `micalg` disagrees with the SignerInfo digest.
@@ -208,7 +485,7 @@ async function verify(message, opts) {
     var inner;
     try { inner = _toBuf(schemaCms.parse(p7m).encapContentInfo.eContent); }
     catch (e) { throw _err("smime/bad-mime", "the pkcs7-mime SignedData has no encapsulated content", e); }
-    return { valid: res.valid, signers: res.signers, form: "pkcs7-mime", content: inner, micalg: null };
+    return Object.assign({ valid: res.valid, signers: res.signers, form: "pkcs7-mime", content: inner, micalg: null }, _hpSurface(inner, ent, "clear", res.valid));
   }
   if (ct.type === "multipart/signed") {
     if (ct.params.protocol && !_isPkcs7(ct.params.protocol, "signature")) throw _err("smime/bad-multipart", "multipart/signed protocol must be application/pkcs7-signature");
@@ -235,7 +512,7 @@ async function verify(message, opts) {
     if (opts.strictMicalg && micalg && _micalgSet(micalg) !== (_micalgOf(p7s) || "")) {
       throw _err("smime/micalg-mismatch", "the multipart/signed micalg " + JSON.stringify(micalg) + " disagrees with the SignerInfo digests");
     }
-    return { valid: res2.valid, signers: res2.signers, form: "multipart/signed", content: parts[0], micalg: micalg };
+    return Object.assign({ valid: res2.valid, signers: res2.signers, form: "multipart/signed", content: parts[0], micalg: micalg }, _hpSurface(parts[0], ent, "clear", res2.valid));
   }
   throw _err("smime/unsupported-type", "not a signed S/MIME message (Content-Type " + JSON.stringify(ct.type) + ")");
 }
@@ -289,11 +566,18 @@ function _cmsEncryptOpts(opts) {
  * has ONE form -- opaque `application/pkcs7-mime` with the whole entity base64-encoded. The `smime-type`
  * is derived from the produced CMS: AES-GCM (the default) yields an AuthEnvelopedData with
  * `smime-type=authEnveloped-data` (confidentiality AND integrity); a CBC choice yields an EnvelopedData
- * with `smime-type=enveloped-data` (confidentiality only -- no integrity, RFC 8551 sec. 3.3). Returns the
- * assembled message bytes. Fail-closed with `SmimeError`.
+ * with `smime-type=enveloped-data` (confidentiality only -- no integrity, RFC 8551 sec. 3.3). With
+ * `opts.protectHeaders`, the message is header-protected (RFC 9788): the REAL `opts.headers` are inlined
+ * inside the ciphertext (the payload Content-Type gains `hp="cipher"`), and only the Header-Confidentiality-
+ * Policy-processed display copies appear outside -- the default `hcp_baseline` obscures Subject to `[...]`
+ * and removes Comments / Keywords, so those values live only in the ciphertext; `decrypt` recovers the real
+ * inner set. Returns the assembled message bytes. Fail-closed with `SmimeError`.
  *
  * @opts entity                     treat `content` as a complete MIME entity (default: wrap it as text/plain).
  * @opts contentType                the wrapped entity's MIME Content-Type (default `text/plain; charset=utf-8`).
+ * @opts protectHeaders             enable RFC 9788 header protection (`hp="cipher"`) -- inline `opts.headers` inside the ciphertext, emit HCP-processed outer copies, and embed the authenticated HP-Outer records (RFC 9788 sec. 2.2) documenting which fields were left visible outside.
+ * @opts headers                    the Non-Structural fields to protect (object `{ Name: value }` or array `[{ name, value }]`); the real values, hidden by the HCP.
+ * @opts hcp                        the Header Confidentiality Policy: `"hcp_baseline"` (default -- obscure Subject, remove Comments/Keywords) or `"hcp_no_confidentiality"` (leave all outer values visible). Per RFC 9788 sec. 3.2.1 / sec. 11.4, `hcp_baseline` deliberately does NOT strip `Bcc` (removing it can break deliverability to a Bcc'd recipient); to keep a blind recipient out of the plaintext outer headers, omit `Bcc` from `opts.headers`.
  * @opts contentEncryptionAlgorithm forwarded to cms.encrypt: `"aes-256-gcm"` (default) / `"aes-128-gcm"` / `"aes-256-cbc"` / `"aes-128-cbc"`.
  * @opts oaepHash                   forwarded: the RSAES-OAEP hash for ktri recipients.
  * @opts keyIdentifier              forwarded: `"issuerAndSerial"` (default) or `"subjectKeyIdentifier"`.
@@ -303,21 +587,30 @@ function _cmsEncryptOpts(opts) {
  */
 async function encrypt(content, recipients, opts) {
   opts = opts || {};
-  var entity = _entityBytes(content, opts);
+  // RFC 9788 header protection (opts.protectHeaders): the inner payload carries hp="cipher" + the REAL
+  // headers (inside the ciphertext); the outer frame carries only the Header-Confidentiality-Policy-processed
+  // display copies (hcp_baseline obscures Subject to [...], removes Comments/Keywords). Off => shipped path.
+  var hp = opts.protectHeaders === true;
+  var hpList = hp ? _hpHeaderList(opts.headers) : null;   // ONE snapshot for both the encrypted inner + outer display copies
+  var outerList = hp ? _outerHeaderList(hpList, "cipher", opts.hcp) : null;
+  var entity = hp ? _protectedInnerEntity(content, opts, "cipher", hpList, outerList) : _entityBytes(content, opts);
+  // Build the outer prefix (opts.headers + opts.hcp were validated when outerList was computed) BEFORE the
+  // expensive cms.encrypt, so a bad policy / header fails closed without doing the crypto.
+  var outer = hp ? Buffer.from(_outerPrefix(outerList), "utf8") : Buffer.alloc(0);
   // Normalize a single descriptor to an array so cms.encrypt always takes the ENVELOPED path (an array of
   // RecipientInfos), never bare EncryptedData -- which is not an S/MIME construct (no smime-type maps to it).
   var recips = Array.isArray(recipients) ? recipients : [recipients];
   var der = _toBuf(await cms.encrypt(entity, recips, _cmsEncryptOpts(opts)));
   var head = _pkcs7MimeHead(_envelopedTypeOf(der, "smime/bad-mime"), "smime.p7m");
-  return _capped(Buffer.concat([head, _base64Body(der), mime.CRLF]));
+  return _capped(Buffer.concat([outer, head, _base64Body(der), mime.CRLF]));
 }
 
 /**
  * @primitive  pki.smime.decrypt
- * @signature  pki.smime.decrypt(message, keyMaterial, opts?) -> Promise<{ content, smimeType, authenticated, recipientType, recipientIndex, contentEncryptionAlgorithm }>
+ * @signature  pki.smime.decrypt(message, keyMaterial, opts?) -> Promise<{ content, smimeType, authenticated, recipientType, recipientIndex, contentEncryptionAlgorithm, protectedHeaders, headerProtection }>
  * @since      0.2.26
  * @status     experimental
- * @spec       RFC 8551, RFC 5652, RFC 5083
+ * @spec       RFC 8551, RFC 5652, RFC 5083, RFC 9788
  * @related    pki.smime.encrypt, pki.cms.decrypt, pki.smime.verify
  *
  * Open an encrypted S/MIME message (RFC 8551 sec. 3.3 / sec. 3.4) -- an `application/pkcs7-mime` entity
@@ -329,7 +622,12 @@ async function encrypt(content, recipients, opts) {
  * oracle-free: every secret-dependent failure collapses to the uniform `cms/decrypt-failed` the CMS layer
  * emits (this layer only propagates it). A recovered `content` that is itself a signed S/MIME message is
  * returned as-is for the caller to feed back to `pki.smime.verify` (no auto-recursion). Accepts OpenSSL's
- * legacy `application/x-pkcs7-mime` and a missing `smime-type`.
+ * legacy `application/x-pkcs7-mime` and a missing `smime-type`. If the decrypted payload is header-protected
+ * (RFC 9788, `hp="cipher"`), `protectedHeaders` is the recovered REAL inner header set (the values the outer
+ * Header Confidentiality Policy hid) and `headerProtection` is `{ present, mode, fromMismatch, confidential }`,
+ * where `confidential` names the fields the composer kept end-to-end confidential (via the authenticated
+ * HP-Outer records, RFC 9788 sec. 4.3) -- so a caller can reply/forward without leaking them (sec. 6.1); a
+ * payload whose `hp` is malformed or contradicts the envelope fails closed (`smime/bad-header-protection`).
  *
  * @opts recipientIndex  forwarded to cms.decrypt: explicitly select the recipient by index.
  * @opts maxIterations   forwarded to cms.decrypt: lower the PBKDF2 iteration cap (downward only).
@@ -356,11 +654,11 @@ async function decrypt(message, keyMaterial, opts) {
   if (opts.recipientIndex !== undefined) cmsOpts.recipientIndex = opts.recipientIndex;
   if (opts.maxIterations !== undefined) cmsOpts.maxIterations = opts.maxIterations;
   var res = await cms.decrypt(der, keyMaterial, cmsOpts);
-  return {
+  return Object.assign({
     content: res.content, smimeType: smimeType, authenticated: res.authenticated,
     recipientType: res.recipientType, recipientIndex: res.recipientIndex,
     contentEncryptionAlgorithm: res.contentEncryptionAlgorithm,
-  };
+  }, _hpSurface(res.content, ent, "cipher", res.authenticated));
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.3.21",
+  "version": "0.3.23",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:b01f035a-7844-490a-a236-5c901a15cfa3",
+  "serialNumber": "urn:uuid:e6deeec3-0517-4316-9e40-caa107241321",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-26T07:13:35.044Z",
+    "timestamp": "2026-07-26T18:13:45.078Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.3.21",
+      "bom-ref": "@blamejs/pki@0.3.23",
       "type": "application",
       "name": "pki",
-      "version": "0.3.21",
+      "version": "0.3.23",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.3.21",
+      "purl": "pkg:npm/%40blamejs/pki@0.3.23",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.3.21",
+      "ref": "@blamejs/pki@0.3.23",
       "dependsOn": []
     }
   ]