@blamejs/pki 0.4.11 → 0.4.13

package/CHANGELOG.md

@@ -4,6 +4,45 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.4.13 — 2026-08-10
+
+A KEM shared secret and the key it derives are now wiped as soon as they stop being needed -- on the failing path as well as the succeeding one, which is the path an attacker chooses.
+
+### Added
+
+- A KEM shared secret and the key-encryption key derived from it are wiped as soon as they stop being needed, satisfying NIST SP 800-227 RS5 / sec. 4.2 and RFC 9629 sec. 7. The wipe runs in a finally, so a decryption that FAILS clears the same buffers a successful one does -- a wipe on the success path alone would preserve the secret in exactly the case an attacker can force. Only buffers this library allocated are cleared; a caller's key material, certificate, and the returned plaintext are never written to, and the plaintext remains usable after the wipe.
+- This is best-effort and is documented as such rather than overstated. The runtime copies a shared secret into places no code can reach -- the decapsulation result on its way out, and again when it is imported as key material -- and may relocate a buffer's backing store. Wiping the copies the library holds shortens the window in which a secret is readable; it does not mean a secret never persists in memory.
+- pki.oid.kemParams resolves an ML-KEM parameter set to its FIPS 203 Table 3 sizes, by dotted OID or by registered name.
+
+### Changed
+
+- The ML-KEM ciphertext-length check FIPS 203 sec. 7.3 requires of a decapsulating party is now performed by the crypto engine, so a caller reaching decapsulateBits directly is covered rather than only the CMS path that happens to call it today. It reports webcrypto/bad-kem-ciphertext, naming the parameter set and both lengths, where the failure was previously indistinguishable from any other decapsulation fault; a ciphertext whose length is valid for a DIFFERENT parameter set is refused as such rather than treated as merely short. The check is on length ONLY: a correct-length ciphertext that has been tampered with still resolves to a pseudo-random shared secret, because turning that into an error would give an attacker a decryption oracle. No engine detail reaches a CMS caller: a structurally valid message whose decryption fails for any secret-dependent reason still reports the single uniform cms/decrypt-failed verdict. A message whose ML-KEM ciphertext length does not match the parameter set the message itself declares is a separate case and always was -- including a length that would be valid for a different set -- because the strict parser rejects it up front and names it: the mismatch is a structural fault, decidable from the message alone, with nothing about it depending on a key.
+- The ML-KEM parameter sizes resolve from one registry instead of three separate tables in three modules. The encapsulation-key lengths were already duplicated verbatim in two of them, and each new consumer meant another copy that could drift; a parameter set is a property of the algorithm identifier, so it now lives beside the registry that resolves one. Behaviour is unchanged.
+
+### Fixed
+
+- The roadmap attributed two rules to NIST SP 800-227 that it does not state: implicit rejection and re-encapsulation are FIPS 203's, reached through SP 800-227's requirement to comply with the KEM's own standard, and SP 800-227 sec. 4.3 explicitly permits a shared secret to be used directly, truncated, or split into segments -- the unconditional key-derivation requirement comes from RFC 9629 sec. 5. The entry now states what each document requires.
+
+## v0.4.12 — 2026-08-09
+
+A CMS message can no longer declare one content cipher and be opened with another: the declared algorithm's mode is now bound to the container that carries it, so an EnvelopedData naming an authenticated cipher is refused rather than opened, unauthenticated, under a result that reported it as authenticated.
+
+### Added
+
+- pki.lint reports the RFC 5280 sec. 4.2.1.4 rules for a certificate policy's user notice, at the strength the specification states each one: encoding a notice as VisibleString or BMPString is an error, since conforming CAs must not; a notice past 200 characters, an empty one, and one containing control characters are warnings; a UTF8String notice that is not in Unicode normalization form C is a notice. The length is measured in characters, so a conforming notice whose accented or emoji characters occupy more storage than 200 units is not reported, and a value whose contents do not decode under its own declared string type is not measured at all -- though the encoding rule, which the ASN.1 tag alone answers, still reports it. The rules live in the linter and not the decoder deliberately: the same section directs certificate users to handle an over-long notice gracefully, so a verifier that refused one would reject certificates that exist and are otherwise valid.
+- The two ends of the SIZE (1..200) bound are separate findings rather than one, because the section treats them differently: it directs certificate users to handle a notice ABOVE 200 characters gracefully and says nothing of the sort about an empty one, so suppressing the first must not silently suppress the second. Both cover a notice reference's organization as well as the explicit text, since the bound belongs to the DisplayText type rather than to one of the two fields that use it.
+
+### Changed
+
+- pki.inspect renders a certificate policy's user notice as text. A user notice is a constructed value, so it previously fell to the hexadecimal fallback and an operator could not read the notice the qualifier exists to display; its explicit text and its notice reference now render, the reference carrying its organization together with the notice numbers that identify which notice is meant.
+- pki.inspect renders an authority-information-access location given as a directory name. It previously printed a bare form tag, hiding the responder or issuer identity the entry exists to convey, while the same name form already printed as a distinguished name elsewhere in the report.
+- The producing entry points state their error contract completely. pki.x509.sign, pki.csr.sign, pki.crl.sign and pki.attrcert.sign accept raw DER for a name, a pre-encoded extension, or a public key; a structural fault in those bytes raises the format's own error, while a malformed leaf inside them raises the codec's, which the parsing entry points already documented and these did not.
+
+### Fixed
+
+- A CMS content cipher is now bound to the container that declares it. An EnvelopedData must name a CBC cipher and an AuthEnvelopedData an AEAD one, checked before the content-encryption key is used; a mismatch is refused as an unsupported algorithm naming both the cipher and the container. Previously only the cipher's key length was resolved, and because AES-CBC and AES-GCM share key lengths, an EnvelopedData whose algorithm identifier had been changed to the same-size AES-GCM identifier decrypted successfully as unauthenticated CBC while reporting the AEAD algorithm in its result -- so a caller inspecting contentEncryptionAlgorithm to establish that the content was authenticated was answered from a field the decryption had not honoured. The reverse pairing was refused only incidentally, by a later dereference of parameters the AEAD path expects, rather than by a stated rule.
+- The password-recipient inner cipher is resolved through the same identifier-keyed table. It previously required a CBC mode by matching the algorithm identifier's display name, which pki.oid.register can rebind, so a caller that had registered a name over a built-in one could change which ciphers that check admitted.
+
 ## v0.4.11 — 2026-08-09
 
 A WebAuthn attestation can now be bound to the roots the authenticator's own model actually registered, by reading a FIDO Metadata Service BLOB that is verified and chained to a root you supply before any of its contents are parsed.

package/README.md

@@ -232,7 +232,7 @@ is callable today; nothing below is a stub.
 | `pki.crl` | RFC 5280 §5 certificate revocation list issuance — `sign(spec, issuer, opts)` builds and signs a `CertificateList`: a `spec` of `thisUpdate` / `nextUpdate`, an optional `crlNumber`, a `revoked` array (each entry a `serialNumber` + `revocationDate` with an optional `reason` or `invalidityDate`), and an optional `extensions` object (authority key identifier, issuing distribution point, delta-CRL indicator, freshest CRL, authority information access) or an array of pre-encoded Extension DER; an `issuer` of `{ cert, key }` or `{ name, publicKey, key }`. The signature algorithm is resolved from the issuer key, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch. The version is derived from the extension set (v2 when any CRL or entry extension is present, else v1), the outer `signatureAlgorithm` matches `tbsCertList.signature`, an empty revocation list omits the field rather than emitting an empty SEQUENCE, `reasonCode` is an ENUMERATED and `invalidityDate` is always GeneralizedTime, per-extension criticality is fixed by the RFC, and the produced signature is verified under the issuer key before return. `verify(crl, issuer)` checks a CRL signature through the one path-validation signature engine (algorithm-confusion and EdDSA low-order gates included), and `isRevoked(crl, serialNumber)` looks a serial up in the revocation list. Returns DER, or a PEM `X509 CRL` with `opts.pem`; malformed input throws a typed `CrlError`. Parsing stays at `pki.schema.crl.parse` — `sign` / `verify` / `isRevoked` |
 | `pki.key` | RFC 5958 / RFC 8018 key-material lifecycle — `encrypt(privateKey, password, opts)` wraps a PKCS#8 private key (DER, PEM, or an extractable `CryptoKey`) into an `EncryptedPrivateKeyInfo` under PBES2 (PBKDF2 + AES-CBC-Pad): `opts` selects the `cipher` (`aes-256-cbc` default, `aes-192-cbc`, `aes-128-cbc`), the `prf` (`hmacWithSHA256` default, SHA-384/512, SHA-1), the `iterations` (default 600000), and the `salt`; the plaintext is validated as PKCS#8 before encryption, a default `prf` and `keyLength` are omitted so the parameters are byte-exact with OpenSSL, and the output is re-parsed before return. `decrypt(encrypted, password, opts)` recovers the inner `PrivateKeyInfo` (re-validated through `pki.schema.pkcs8.parse`) — only PBES2/PBKDF2/AES-CBC is accepted (PBES1, PBMAC1, scrypt refused), the salt and iteration count are bounded before any derivation (`opts.maxIterations` lowers the cap), a malformed parameter set or wrong-length IV is a distinct typed error, and — because a MAC-less PBES2-CBC decrypt must not be a padding oracle (RFC 8018 §8) — a wrong password and a valid-pad-but-not-a-key both surface the one uniform `key/decrypt-failed`. `export(key, opts)` / `import(input, opts)` move a private key as PKCS#8 or a public key as SubjectPublicKeyInfo -- the key may come from the platform's WebCrypto or from a separately-installed copy of this toolkit, and is exported through whichever holds its material (a non-extractable key, or one whose implementation keeps its material out of reach, is refused with that as the reason) -- delegating the encoding to WebCrypto so RSA carries an explicit NULL, EC a named curve, and Ed25519/Ed448/X25519/X448 omit parameters (an ambiguous RSA/EC import requires `opts.algorithm`). `generate(algorithm, opts)` produces a key pair over RSA, ECDSA/ECDH, the Edwards/Montgomery curves, and the FIPS post-quantum ML-DSA / ML-KEM, and `publicFromPrivate(privateKey)` derives the public key. Returns DER or PEM; fail-closed with typed `KeyError`. Parsing stays at `pki.schema.pkcs8.parse` — `encrypt` / `decrypt` / `export` / `import` / `generate` / `publicFromPrivate` |
 | `pki.pkcs12` | RFC 7292 / RFC 9579 PKCS#12 (.p12/.pfx) issuance — `build(spec, opts)` assembles a password-integrity store. `spec` is the OpenSSL-style `{ key, cert, ca?, friendlyName?, localKeyId? }` or the full `{ safeContents: [...] }`, where each element is a plaintext or PBES2-encrypted `SafeContents` of key / shroudedKey / cert / crl / secret / nested `safeContents` bags. Keys and certs are validated before wrapping; `friendlyName` (BMPString) and `localKeyId` attributes are single-value. The store is protected by a classic Appendix B HMAC (default, max interop) or an RFC 9579 PBMAC1 (`opts.mac.algorithm`), over SHA-256/384/512, with the shrouded keys and cert safes encrypted under RFC 8018 PBES2 (AES-128/192/256-CBC). Every password is encoded the PKCS#12 way — BMPString+NULL for the classic MAC, UTF-8 for the PBES2 bags and PBMAC1 (what OpenSSL and NSS consume) — so a file it emits opens in OpenSSL and NSS, cross-checked bidirectionally. The MAC is computed over the exact AuthenticatedSafe byte range, a DEFAULT-1 `MacData.iterations` is rejected up front, and the store is re-parsed before return. `verifyMac(pfx, password, opts)` recomputes a store's classic or PBMAC1 MAC over `macedBytes` and constant-time-compares it, throwing on a MAC-less or public-key-integrity store. **Public-key integrity** (`opts.integrity.mode: "public-key"`) wraps the AuthenticatedSafe in a CMS SignedData instead of a MAC — a signature from any `pki.cms.sign` signer (RSA / ECDSA / EdDSA / ML-DSA / SLH-DSA / composite), no MacData (RFC 7292 §4); privacy stays independent, so the `password` still PBES2-encrypts the bags. **Public-key privacy** — per-safe `recipients` (or the `opts.recipientCerts` convenience) wraps a SafeContents as a CMS EnvelopedData (AES-CBC, `id-envelopedData` — never GCM) encrypting it to recipient public keys through the shipped `pki.cms.encrypt` recipient model, restricted to certificate recipients (RSA-OAEP / ECDH / X25519 / X448 / ML-KEM — a password or KEK recipient, which `open` could not reopen, is rejected); all four integrity × privacy combinations are permitted (RFC 7292 §3.1). **Legacy-PBE read** — `open` decrypts the RFC 7292 Appendix C 3DES and RC2 bags an `openssl pkcs12 -legacy` / NSS store uses (RC2 via an in-tree RFC 2268 cipher), so an older store opens; the legacy RC4 schemes are refused. Returns DER or a PEM `PKCS12`; fail-closed with typed `Pkcs12Error`. `open(pfx, password, opts)` reads a store back: it verifies the MAC **first** (a wrong password is the MAC verdict, not a decrypt error), then PBES2-decrypts every privacy safe and shrouded key bag and returns `{ integrityMode, macVerified, signers, keys, certs, crls, secrets }` — keys as re-validated PKCS#8 DER, certs/CRLs/secrets as raw DER, all with `friendlyName`/`localKeyId`, nested safes recursively. A MAC-less store is refused unless `opts.allowUnauthenticated`; a **public-key-integrity store is verified through its CMS SignedData signature first** (`pkcs12/signature-invalid` on failure, the signer surfaced in `signers` but never trust-chained — the caller's `pki.path.validate` step); a legacy-PBE (App. C) store's 3DES / RC2 bags are decrypted (RC4 refused); an `id-envelopedData` (public-key privacy) safe is decrypted with `opts.recipientKey` after the integrity gate (`pkcs12/no-recipient-key` if absent, every recipient-side fault the uniform `pkcs12/decrypt-failed`); a post-integrity decrypt failure is the uniform `pkcs12/decrypt-failed`, and `opts.keys: 'crypto'` imports each key to a `CryptoKey`; it reads what OpenSSL and NSS produce. Parsing stays at `pki.schema.pkcs12.parse` — `build` / `verifyMac` / `open` |
-| `pki.cms` | RFC 5652 §5 CMS SignedData signing + signature verification — `sign(content, signers, opts)` produces a SignedData (attached or detached, one or many signers, RSA / RSASSA-PSS / ECDSA / EdDSA, the post-quantum ML-DSA-44/65/87 (RFC 9882) and SLH-DSA (all twelve FIPS 205 sets, RFC 9814), and composite ML-DSA (pairing ML-DSA with a traditional RSA / ECDSA / EdDSA — accepted only when **both** components verify — draft-ietf-lamps-cms-composite-sigs)); it builds the signed attributes (content-type, message-digest, signing-time) as canonical DER, signs the exact §5.4 preimage, and emits a DER `Buffer` or PEM. `verify(input, opts)` parses a SignedData over the strict `pki.schema.cms` codec, locates each SignerInfo's signer certificate by its issuerAndSerialNumber or subjectKeyIdentifier, and checks the signature over the exact §5.4 preimage: when signed attributes are present it confirms the message-digest attribute equals the content digest and verifies over the DER re-encoding of the SignedAttributes (the on-wire `[0]` tag replaced by a universal SET OF), otherwise directly over the content. It returns a per-signer verdict with the matched signer certificate; it does not chain that certificate to a trust anchor — that is the caller's step through `pki.path.validate`. **Countersignatures** (RFC 5652 §11.4): `countersign(cms, signers, opts)` adds a countersignature — a `SignerInfo` over the countersigned SignerInfo's signature value, any signer algorithm, nestable, the primary bytes preserved so it still verifies — attached as the id-countersignature unsigned attribute; `verify` returns each countersignature's verdict under `signers[i].countersignatures` and every unsigned attribute (an RFC 3161 timestamp token attachable via `sign`'s `unsignedAttributes`) under `signers[i].unsignedAttrs`, surfaced unauthenticated. **Content encryption** (RFC 5652/5083/5084/9629): `encrypt(content, recipients, opts)` produces an EnvelopedData, AuthEnvelopedData (AES-GCM, the authenticated default), or EncryptedData — recipients auto-dispatch off the certificate key to key-transport (RSAES-OAEP; v1.5 never emitted), key-agreement (ephemeral-static ECDH over P-256/384/521 with the X9.63 KDF, and X25519/X448 with HKDF), symmetric key-wrap, password (PBKDF2 + RFC 3211 PWRI-KEK), or the post-quantum ML-KEM KEMRecipientInfo (RFC 9629/9936) — one fresh content key wrapped for every recipient. `decrypt(input, keyMaterial, opts)` recovers the content through the matching arm and returns it with an `authenticated` flag; every secret-dependent failure collapses to one uniform `cms/decrypt-failed` verdict (Bleichenbacher / EFAIL / password-oracle freedom), and PKCS#1 v1.5 is decrypt-only under the RFC 3218 implicit-rejection countermeasure. **AuthenticatedData** (RFC 5652 §9): `authenticate(content, recipients, opts)` produces an `id-ct-authData` — cleartext content plus an HMAC-SHA-256/384/512 MAC (authenticated but not encrypted), the fresh MAC key wrapped for every recipient through the same RecipientInfo model as `encrypt`; the MAC covers the authenticated attributes (content-type + message-digest) re-tagged to the EXPLICIT SET OF (§9.2), or the content octets directly. `decrypt` recovers the MAC key, recomputes the MAC and independently the message-digest (§9.3), and releases the content only after both pass, with every secret-dependent failure collapsing to the uniform `cms/decrypt-failed`. **Compression** (RFC 3274): `compress(content, opts)` / `decompress(input, opts)` produce and consume a CompressedData (ZLIB, version 0, id-alg-zlibCompress); decompress bounds the uncompressed output at 16 MiB and stops before it is materialized, so a decompression bomb fails closed as `cms/decompress-too-large` — a size transform with no integrity/confidentiality (RFC 8551 §2.4.5). Fail-closed with typed `cms/*` errors — `sign`, `verify`, `countersign`, `encrypt`, `authenticate`, `decrypt`, `compress`, `decompress` |
+| `pki.cms` | RFC 5652 §5 CMS SignedData signing + signature verification — `sign(content, signers, opts)` produces a SignedData (attached or detached, one or many signers, RSA / RSASSA-PSS / ECDSA / EdDSA, the post-quantum ML-DSA-44/65/87 (RFC 9882) and SLH-DSA (all twelve FIPS 205 sets, RFC 9814), and composite ML-DSA (pairing ML-DSA with a traditional RSA / ECDSA / EdDSA — accepted only when **both** components verify — draft-ietf-lamps-cms-composite-sigs)); it builds the signed attributes (content-type, message-digest, signing-time) as canonical DER, signs the exact §5.4 preimage, and emits a DER `Buffer` or PEM. `verify(input, opts)` parses a SignedData over the strict `pki.schema.cms` codec, locates each SignerInfo's signer certificate by its issuerAndSerialNumber or subjectKeyIdentifier, and checks the signature over the exact §5.4 preimage: when signed attributes are present it confirms the message-digest attribute equals the content digest and verifies over the DER re-encoding of the SignedAttributes (the on-wire `[0]` tag replaced by a universal SET OF), otherwise directly over the content. It returns a per-signer verdict with the matched signer certificate; it does not chain that certificate to a trust anchor — that is the caller's step through `pki.path.validate`. **Countersignatures** (RFC 5652 §11.4): `countersign(cms, signers, opts)` adds a countersignature — a `SignerInfo` over the countersigned SignerInfo's signature value, any signer algorithm, nestable, the primary bytes preserved so it still verifies — attached as the id-countersignature unsigned attribute; `verify` returns each countersignature's verdict under `signers[i].countersignatures` and every unsigned attribute (an RFC 3161 timestamp token attachable via `sign`'s `unsignedAttributes`) under `signers[i].unsignedAttrs`, surfaced unauthenticated. **Content encryption** (RFC 5652/5083/5084/9629): `encrypt(content, recipients, opts)` produces an EnvelopedData, AuthEnvelopedData (AES-GCM, the authenticated default), or EncryptedData — recipients auto-dispatch off the certificate key to key-transport (RSAES-OAEP; v1.5 never emitted), key-agreement (ephemeral-static ECDH over P-256/384/521 with the X9.63 KDF, and X25519/X448 with HKDF), symmetric key-wrap, password (PBKDF2 + RFC 3211 PWRI-KEK), or the post-quantum ML-KEM KEMRecipientInfo (RFC 9629/9936) — one fresh content key wrapped for every recipient. `decrypt(input, keyMaterial, opts)` recovers the content through the matching arm and returns it with an `authenticated` flag; every secret-dependent failure collapses to one uniform `cms/decrypt-failed` verdict (Bleichenbacher / EFAIL / password-oracle freedom), and PKCS#1 v1.5 is decrypt-only under the RFC 3218 implicit-rejection countermeasure. A KEM shared secret and its derived key-encryption key are wiped once used, on the failing path as well as the succeeding one (best-effort; NIST SP 800-227, RFC 9629 sec. 7). **AuthenticatedData** (RFC 5652 §9): `authenticate(content, recipients, opts)` produces an `id-ct-authData` — cleartext content plus an HMAC-SHA-256/384/512 MAC (authenticated but not encrypted), the fresh MAC key wrapped for every recipient through the same RecipientInfo model as `encrypt`; the MAC covers the authenticated attributes (content-type + message-digest) re-tagged to the EXPLICIT SET OF (§9.2), or the content octets directly. `decrypt` recovers the MAC key, recomputes the MAC and independently the message-digest (§9.3), and releases the content only after both pass, with every secret-dependent failure collapsing to the uniform `cms/decrypt-failed`. **Compression** (RFC 3274): `compress(content, opts)` / `decompress(input, opts)` produce and consume a CompressedData (ZLIB, version 0, id-alg-zlibCompress); decompress bounds the uncompressed output at 16 MiB and stops before it is materialized, so a decompression bomb fails closed as `cms/decompress-too-large` — a size transform with no integrity/confidentiality (RFC 8551 §2.4.5). Fail-closed with typed `cms/*` errors — `sign`, `verify`, `countersign`, `encrypt`, `authenticate`, `decrypt`, `compress`, `decompress` |
 | `pki.smime` | RFC 8551 S/MIME message assembly, verification, encryption, and compression over the CMS layer — `sign(content, signers, opts)` wraps a MIME entity as a signed S/MIME message in either form: `multipart/signed` (clear-signed — the content stays readable in any MUA, a detached CMS SignedData rides alongside as `application/pkcs7-signature` with a matching `micalg`) or `application/pkcs7-mime; smime-type=signed-data` (opaque — the whole entity is a base64 CMS SignedData). The signed bytes are the entity's RFC 8551 §3.1.1 canonical form (CRLF line endings); `verify(message, opts)` unwraps both forms and recomputes over the same canonicalizer, so a transport that re-wraps line endings still verifies and a tampered part fails. `encrypt(content, recipients, opts)` envelopes a MIME entity as an opaque `application/pkcs7-mime` message and `decrypt(message, keyMaterial, opts)` opens one — `smime-type=authEnveloped-data` (AES-GCM, confidentiality and integrity, the default) or `smime-type=enveloped-data` (AES-CBC, confidentiality only, so `decrypt` reports `authenticated: false`, the §3.3 no-integrity caveat); the `smime-type` is derived from the CMS body, not the header, and decryption is fail-closed and oracle-free. The crypto is entirely `pki.cms.sign` / `verify` / `encrypt` / `decrypt` — any RSA / RSASSA-PSS / ECDSA / EdDSA / ML-DSA / SLH-DSA signer and any RSA-OAEP / ECDH / X25519 / X448 / AES-KW / PBKDF2 / ML-KEM recipient carries through (algorithm-agnostic). Like `cms.verify`, `verify` returns the per-signer cryptographic verdict plus the recovered content; chaining a signer to a trust anchor is the caller's `pki.path.validate` step. `compress(content, opts)` / `decompress(message, opts)` add the opaque `application/pkcs7-mime; smime-type=compressed-data; name=smime.p7z` frame (RFC 8551 §3.6, RFC 3274) — a size transform with no integrity/confidentiality (§2.4.5), decompress bounded against a bomb; the recovered content, which may itself be signed or enveloped, is returned for the caller to re-verify. **Header protection** (RFC 9788): `sign` / `encrypt` gain `opts.protectHeaders` — the caller's `opts.headers` are inlined on the Cryptographic Payload root (its Content-Type gains `hp="clear"` signed / `hp="cipher"` encrypted) so the CMS signature/encryption covers them, defeating a transport that rewrites or reads Subject/From/… `verify` / `decrypt` surface the AUTHENTICATED inner set as `protectedHeaders` + `headerProtection { present, mode, fromMismatch, confidential, legacy }` (a tampered outer header cannot alter it; `fromMismatch` flags an outer From that disagrees). Encryption applies a Header Confidentiality Policy — the default `hcp_baseline` obscures the outer Subject to `[...]` and removes Comments/Keywords, so the real values live only in the ciphertext; `decrypt` recovers them. Every emitted header routes through a fail-closed injection guard (a CR/LF/NUL value or a non-ftext name is rejected), and a malformed/contradictory `hp` wrap fails closed (`smime/bad-header-protection`), never a silent downgrade; the CMS crypto is unchanged. Inbound **legacy** RFC 8551 header protection is recognized opt-in: `verify` / `decrypt` with `opts.legacyHeaderProtection` detect a legacy `message/rfc822`-wrapped payload (the RFC 9788 §4.10.1 four-condition identification) and surface the inner message's headers under `headerProtection.legacy = { headers, mode, fromMismatch, confidential }` (`headers` an ordered `[{ name, value }]` array that retains legally-repeated fields like `Received`) — never in `protectedHeaders` and never setting `present: true`. Because a legacy message is structurally indistinguishable from an ordinary forwarded `message/rfc822`, this is an explicit heuristic (§4.10.2, "no strong end-to-end guarantees"): a caller keying trust off `present`/`protectedHeaders` is never misled, and only one that explicitly reads `headerProtection.legacy.headers` (cross-checking `legacy.fromMismatch`) consumes it. Off by default; a nested crypto layer, an inner `hp=`, a non-`message/rfc822` payload, or a duplicate Content-Type reports `legacy: null`. Bidirectionally interoperable with `openssl smime` / `openssl cms`. Fail-closed with typed `smime/*` errors — `sign`, `verify`, `encrypt`, `decrypt`, `compress`, `decompress` |
 | `pki.tsp` | RFC 3161 Time-Stamp Protocol — `sign(messageImprint, tsa, opts)` produces a TimeStampToken: a CMS SignedData (over `pki.cms.sign`) whose content is a `TSTInfo` carrying the timestamped message imprint, the TSA policy, a serial number, and `genTime` (with optional accuracy / nonce / ordering), plus the RFC 3161 §2.4.2 signing-certificate attribute binding the token to the TSA certificate (SHA-2 imprints, any `pki.cms.sign` TSA key). `request` / `parseRequest` build and parse the TimeStampReq a client sends (imprint, requested policy, nonce, certReq), `response` / `parseResponse` the TimeStampResp a TSA returns — a granted status wrapping a token, or a rejection with PKIStatus and failure info, the §2.4.2 status↔token coupling enforced in both directions. `verify(token, data, opts)` verifies a token fail-closed: the CMS signature over the exact signed bytes, the message imprint recomputed from the data, the TSTInfo content type, the ESSCertID(V2) binding to the TSA certificate, the §2.3 critical timeStamping-only extendedKeyUsage, the request nonce when used, and — with a trust anchor supplied — full certification-path validation of the TSA certificate at the token's `genTime`, returning `{ valid, genTime, serialNumber, tstInfo, … }` — `sign`, `request`, `parseRequest`, `response`, `parseResponse`, `verify` |
 | `pki.ocsp` | RFC 6960 Online Certificate Status Protocol — the responder and relying-party surface. `buildRequest(query, opts)` builds an OCSPRequest for one or more `{ cert, issuer }` pairs (CertID hashed under SHA-1 by default per the RFC 5019 lightweight profile, or SHA-2; optional RFC 9654 nonce, optional requestor signature). `sign(responseData, responder, opts)` produces a signed BasicOCSPResponse over the exact `ResponseData` DER — the issuing CA directly or a delegated responder, any `pki.cms.sign` key including the post-quantum ML-DSA / SLH-DSA sets, with `good` / `revoked` (reason + time) / `unknown` per-certificate status, and `buildErrorResponse(status)` the unsigned §2.3 error (`tryLater` / `unauthorized` / …). `verify(response, opts)` verifies a response fail-closed against the same hardened gates `pki.path.ocspChecker` runs: the CertID binding, responder authorization (the issuing CA or a CA-issued delegate bearing id-kp-OCSPSigning **and** id-pkix-ocsp-nocheck, passing the full out-of-path certificate gates), the signature over `tbsResponseDataBytes`, currency (`thisUpdate`/`nextUpdate`), and the request-nonce echo — returning `{ status: "good" / "revoked" / "unknown", … }`, never a silent accept. Transport-free — `buildRequest`, `sign`, `buildErrorResponse`, `verify` |
@@ -243,9 +243,9 @@ is callable today; nothing below is a stub.
 | `pki.shbs` | Stateful hash-based signature **verification** — HSS/LMS (RFC 8554), carried in X.509 by RFC 9802 and CMS by RFC 9708, profiled by NIST SP 800-208 (CNSA 2.0 firmware signing). `verify` checks an HSS signature (every level must pass) and `verifyLms` a single-tree LMS, over the raw public-key / signature blobs the parsers already surface. Pure public-input SHA-256 / SHAKE256 hashing, a data-driven typecode registry, bounds-before-slice reads; a malformed blob throws a typed `ShbsError`, a well-formed-but-wrong signature returns `false`. **Verify only by design** — stateful signing needs atomic one-time-key state that belongs in an HSM — `verify`, `verifyLms` |
 | `pki.hpke` | Hybrid Public Key Encryption (RFC 9180) — the encrypt-to-a-public-key primitive behind TLS ECH, MLS, and OHTTP. `setupS`/`setupR` establish a sender/recipient context (KEM encapsulation + HKDF key schedule); the context's `seal`/`open` AEAD-encrypt with a sequence-counter nonce and `export` derives further secrets; `seal`/`open` are single-shot wrappers. DHKEM (P-256, P-521, X25519, X448) × HKDF-SHA256/SHA512 × AES-GCM/ChaCha20Poly1305/export-only × all four modes, proven against the RFC 9180 Appendix A vectors. DHKEM(P-384) and HKDF-SHA384 are RFC-registered but Appendix A ships no vector for them, so they fail closed until an authoritative KAT exists. Pure composition over `node:crypto`; ML-KEM / X-Wing are a registry data-row extension pending stable drafts — `suites`, `setupS`, `setupR`, `seal`, `open` |
 | `pki.sigstore` | Offline verifier for a Sigstore bundle — the exact artifact `npm publish --provenance` produces and the registry serves. `verifyBundle` composes five fail-closed legs against caller-pinned trust (Fulcio CA roots + Rekor log keys, never trusted from the bundle): the DSSE signature over its PAE preimage under the Fulcio leaf key; the ephemeral Fulcio certificate chain, validated as of the Rekor log time; the RFC 9162 inclusion proof folded to a Rekor-signed tree root; the log entry bound to this exact signature; and the in-toto SLSA subject digest the caller confirms against the published artifact. Zero runtime deps — reuses the X.509 parser, RFC 5280 path validator, and Merkle verifier; the net-new codecs are the DSSE PAE byte-builder and a fail-closed JSON reader. `pae`, `parseBundle`, `verifyBundle` |
-| `pki.inspect` | Human-readable inspection — the pure-JS equivalent of `openssl x509/crl/req/cms -text`. `certificate(pem \| der \| parsed)` renders a familiar OpenSSL-style report: version, serial, signature algorithm, issuer/subject distinguished names, validity, public-key details (curve or modulus size + the raw point/modulus), every decoded extension with its critical flag, and the signature. `crl` / `csr` / `cms` render the non-certificate formats the same way — a CRL like `openssl crl -text` (issuer, Last/Next Update, CRL extensions, each revoked entry with its serial, revocation date, and named reason), a CSR like `openssl req -text` (subject, key, requested extensions and attributes), and a CMS message like `openssl cms -cmsout -print` (a SignedData's content type, digest algorithms, embedded certificates, and each SignerInfo with its signer identifier, algorithms, attributes, and signature; a non-SignedData ContentInfo gets a stable summary) — and `any(input)` detects the format and routes to the right report. Built over the strict parsers and the two-way OID registry, reusing one set of field renderers, so it names extension/algorithm OIDs an OpenSSL build shows only as raw bytes and never drifts. No OpenSSL dependency; the format is stable and OpenSSL-familiar rather than pinned to one OpenSSL version; a malformed part falls back to a hex dump rather than throwing — `certificate`, `crl`, `csr`, `cms`, `any` |
+| `pki.inspect` | Human-readable inspection — the pure-JS equivalent of `openssl x509/crl/req/cms -text`. `certificate(pem \| der \| parsed)` renders a familiar OpenSSL-style report: version, serial, signature algorithm, issuer/subject distinguished names, validity, public-key details (curve or modulus size + the raw point/modulus), every decoded extension with its critical flag, and the signature. `crl` / `csr` / `cms` render the non-certificate formats the same way — a CRL like `openssl crl -text` (issuer, Last/Next Update, CRL extensions, each revoked entry with its serial, revocation date, and named reason), a CSR like `openssl req -text` (subject, key, requested extensions and attributes), and a CMS message like `openssl cms -cmsout -print` (a SignedData's content type, digest algorithms, embedded certificates, and each SignerInfo with its signer identifier, algorithms, attributes, and signature; a non-SignedData ContentInfo gets a stable summary) — and `any(input)` detects the format and routes to the right report. Built over the strict parsers and the two-way OID registry, reusing one set of field renderers, so it names extension/algorithm OIDs an OpenSSL build shows only as raw bytes and never drifts. No OpenSSL dependency; the format is stable and OpenSSL-familiar rather than pinned to one OpenSSL version; a certificate policy's user notice renders as text (its explicit text, and a notice reference with the notice numbers that identify it) rather than hex, and a malformed part falls back to a hex dump rather than throwing — `certificate`, `crl`, `csr`, `cms`, `any` |
 | `pki.webauthn` | WebAuthn / passkey attestation verification — offline trust evaluation of a W3C WebAuthn (Level 3) attestation. `parseAttestationObject(bytes)` decodes the CBOR attestation object + authenticatorData + COSE credential key over the strict `pki.cbor` codec; `verify(attestationObject, clientDataHash, opts)` checks the attestation-statement signature and each format's structural bindings for **packed / tpm / android-key / apple / fido-u2f / none** — the x5c leaf key, the apple nonce, the tpm `certInfo` Name/`extraData` over the `pubArea`, the android `KeyDescription`, the fido-u2f `verificationData` — binding the credential public key to each attestation (via the signed authenticatorData for packed/fido-u2f, or a cert/`pubArea`-key equality check for android-key/apple/tpm) and enforcing each leaf's certificate requirements. The credential-key check covers the full WebAuthn COSE algorithm set — ES256/384/512, RS256/384/512, PS256, EdDSA (Ed25519), and the RFC 9864 fully-specified identifiers **ESP256/384/512, Ed25519, and Ed448** — validating the public-key point on its curve, rejecting the compressed EC point form, and enforcing a minimally-encoded DER ECDSA signature. A verifier, not a ceremony client; fail-closed with typed `webauthn/*` errors. `verifyMetadataBlob(blob, opts)` reads a **FIDO Metadata Service (MDS v3)** BLOB — the signed catalogue of registered authenticator models — verifying its JWS and chaining its signer to an operator-supplied FIDO root **before** the payload is parsed, with sequence-number rollback and `nextUpdate` freshness checks; passing the result as `opts.metadata` to `verify` resolves the authenticator's registered attestation roots from its identifier and requires the trust path to fully validate to one of them, refusing an unlisted or revoked model. Both of the catalogue's key spaces are covered — an aaguid, and the attestation-certificate key identifiers a U2F authenticator is listed under instead. No FIDO root is bundled and there is no trust-on-first-use; retrieving the BLOB is out of scope — `parseAttestationObject`, `verify`, `verifyMetadataBlob`, `metadataFor`, `metadataAnchors` |
-| `pki.lint` | Certificate linting — the zlint / pkilint of JavaScript. `certificate(pem \| der \| parsed, opts)` walks a parsed certificate and emits graded, advisory findings — each with a stable id, a severity (`fatal` > `error` > `warn` > `notice`), a source, a spec-clause citation, and a message — against the RFC 5280 profile plus a representative CA/Browser Forum TLS BR subset (serial sign/size, validity ordering + the SC081v3 reducing validity schedule, keyCertSign coherence, extension criticality — basicConstraints/nameConstraints/policyConstraints/inhibitAnyPolicy must be critical and keyUsage should be, nameConstraints CA-scope, unknown critical extensions, empty-subject SAN, SKI/AKI presence including the end-entity subjectKeyIdentifier, SAN required + CN-in-SAN, dNSName syntax, serverAuth EKU, weak keys). Unlike every other entry the DATA path never throws: hostile bytes return a `fatal` `lint/unparseable` finding (with the strict parser's code) so a whole directory lints without a try/catch; only config-time misuse throws a typed `LintError`. `certificate`, `rules`, `profiles` |
+| `pki.lint` | Certificate linting — the zlint / pkilint of JavaScript. `certificate(pem \| der \| parsed, opts)` walks a parsed certificate and emits graded, advisory findings — each with a stable id, a severity (`fatal` > `error` > `warn` > `notice`), a source, a spec-clause citation, and a message — against the RFC 5280 profile plus a representative CA/Browser Forum TLS BR subset (serial sign/size, validity ordering + the SC081v3 reducing validity schedule, keyCertSign coherence, extension criticality — basicConstraints/nameConstraints/policyConstraints/inhibitAnyPolicy must be critical and keyUsage should be, nameConstraints CA-scope, unknown critical extensions, empty-subject SAN, SKI/AKI presence including the end-entity subjectKeyIdentifier, SAN required + CN-in-SAN, dNSName syntax, serverAuth EKU, weak keys, and the sec. 4.2.1.4 certificate-policy user-notice rules — a VisibleString/BMPString explicitText, a notice past 200 characters, an empty notice, control characters, and a non-NFC UTF8String notice, each at the strength the clause states). Unlike every other entry the DATA path never throws: hostile bytes return a `fatal` `lint/unparseable` finding (with the strict parser's code) so a whole directory lints without a try/catch; only config-time misuse throws a typed `LintError`. `certificate`, `rules`, `profiles` |
 | `pki.C` / `pki.constants` | Version-stable constants — functional scale helpers (`C.TIME.*`, `C.BYTES.*`), codec `LIMITS`, `version` |
 | `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError` / `TspError` / `AttrCertError` / `CrmfError` / `Pkcs12Error` / `CmpError` / `PathError` / `CtError` / `JoseError` / `AcmeError` / `WebauthnError` / `LintError`, each carrying a stable `code` in `domain/reason` form |
 | `pki` CLI | `pki version`, `pki oid <dotted\|name>`, `pki parse <cert>`, `pki inspect <cert>`, `pki lint <cert>`, `pki convert <file> --to der\|pem`, `pki verify <cert>... --anchor <cert>`, `pki sign <file> --cert <c> --key <k>` |

package/lib/attrcert-sign.js

@@ -428,7 +428,9 @@ function _buildExtensions(extSpec, aaSpki) {
  * attribute certificate is never self-signed. The signature algorithm is resolved from the AA key (RSA
  * PKCS#1 v1.5 or PSS, ECDSA, EdDSA, ML-DSA, SLH-DSA, or a composite arm), and the signature is verified
  * under the AA public key before the certificate is returned. Returns DER, or a PEM `ATTRIBUTE
- * CERTIFICATE` with `opts.pem`. Malformed input throws a typed `AttrCertError`. The AA certificate's own
+ * CERTIFICATE` with `opts.pem`. Malformed input throws a typed `AttrCertError`; where the spec carries
+ * raw DER -- a holder or issuer `Name` Buffer, a pre-encoded `Extension` -- a malformed leaf inside
+ * those bytes throws `Asn1Error`. The AA certificate's own
  * profile (RFC 5755 sec. 4.5) and validity are a verification-layer concern -- validate the AA
  * certificate with `pki.path.validate` before trusting the attribute certificate. Parsing is
  * `pki.schema.attrcert.parse`.

package/lib/cms-decrypt.js

@@ -36,6 +36,7 @@ function _err(code, message, cause) { return new CmsError(code, message, cause);
 function _fail() { return new CmsError("cms/decrypt-failed", "the CMS content could not be decrypted (uniform by design -- padding / integrity / key-unwrap failures are indistinguishable to defeat oracles)"); }
 
 var CONTENT_KEYBITS = pbes2.CONTENT_KEYBITS; // content-encryption OID -> key bits (the shared PBES2 table)
+var CONTENT_MODE = pbes2.CONTENT_MODE;       // the same rows' cipher mode ("cbc" | "gcm")
 
 // ---- entry -----------------------------------------------------------------
 async function decrypt(input, keyMaterial, opts) {
@@ -63,6 +64,13 @@ async function decryptEnvelopedData(parsed, keyMaterial, opts, contentTypeName)
   var recips = parsed.recipientInfos || [];
   var candidates = _selectCandidates(recips, keyMaterial, opts);   // stage 1 (typed, distinct)
   var eci = parsed.encryptedContentInfo;
+  // The content cipher's MODE is a structural property of the message -- readable from the algorithm
+  // identifier with no key material at all -- so it is decided HERE, before any recipient is tried.
+  // Deciding it per candidate would make a structural verdict depend on key acquisition succeeding
+  // first: several password or KEK recipients can match the same key material, so the distinct
+  // cms/unsupported-algorithm would be swallowed by the ambiguous-candidate loop below and the caller
+  // told their key was wrong, after repeating a PBKDF2 derivation for every candidate to learn it.
+  _assertContentCipherMode(eci, ct);
   // Password- and KEK-based recipients carry no rid, so several may match the same key material; try
   // each until one yields a CEK that opens the content. A single candidate propagates its exact
   // verdict; multiple ambiguous candidates collapse to the uniform verdict so nothing is leaked.
@@ -274,7 +282,9 @@ async function _pwriCek(ri, km, opts) {
   var inner = asn1.decode(kea.parameters);                 // inner AES-CBC AlgorithmIdentifier
   var innerOid = asn1.read.oid(inner.children[0]);
   var innerBits = CONTENT_KEYBITS[innerOid];
-  if (!innerBits || !/CBC/.test(oid.name(innerOid) || "")) throw _err("cms/unsupported-algorithm", "unsupported pwri inner cipher");
+  // The mode comes from the OID-keyed table, not from the OID's display NAME: pki.oid.register() can
+  // override a built-in name, and a name-matched mode check would then admit a non-CBC inner cipher.
+  if (!innerBits || CONTENT_MODE[innerOid] !== "cbc") throw _err("cms/unsupported-algorithm", "unsupported pwri inner cipher");
   var iv = asn1.read.octetString(inner.children[1]);
   var kek = nodeCrypto.pbkdf2Sync(pbes2.passwordBytes(km.password, _err, "cms"), pb.salt, pb.iterations, innerBits / 8, pb.prfNode);
   return _pwriUnwrap(kek, ri.encryptedKey, iv, innerBits);
@@ -298,10 +308,45 @@ async function _kemriCek(ri, km) {
   var wrapAlg = k.wrap;
   if (WRAP_KEK_LENGTHS[wrapAlg.oid] !== kekBytes) throw _fail(); // M29 re-check on the consumer path
   var priv = await subtle.importKey("pkcs8", _normKeyDer(km.key), { name: wcName }, false, ["decapsulateBits"]);
-  var ss = Buffer.from(await subtle.decapsulateBits({ name: wcName }, priv, kemct));
-  var ssKey = await subtle.importKey("raw", ss, { name: "HKDF" }, false, ["deriveBits"]);
-  var kek = Buffer.from(await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt: Buffer.alloc(0), info: _kemOtherInfo(wrapAlg.name, kekBytes, k.ukm || null) }, ssKey, kekBytes * 8));
-  return await _aesKwUnwrap(kek, k.encryptedKey);
+  var ss = null, kek = null, ssAb = null, kekAb = null;
+  try {
+    // The engine hands back an ArrayBuffer it allocated, and the Buffer below is a copy of it. Both
+    // hold the secret, so both are wiped: clearing only the copy this function made would leave the
+    // engine's return value readable, which is the same omission one level up.
+    ssAb = await subtle.decapsulateBits({ name: wcName }, priv, kemct);
+    ss = Buffer.from(ssAb);
+    var ssKey = await subtle.importKey("raw", ss, { name: "HKDF" }, false, ["deriveBits"]);
+    kekAb = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt: Buffer.alloc(0), info: _kemOtherInfo(wrapAlg.name, kekBytes, k.ukm || null) }, ssKey, kekBytes * 8);
+    kek = Buffer.from(kekAb);
+    return await _aesKwUnwrap(kek, k.encryptedKey);
+  } finally {
+    // NIST SP 800-227 RS5 / sec. 4.2 and RFC 9629 sec. 7: the shared secret and the KEK it derives
+    // are destroyed as soon as they stop being needed. In a `finally`, so an unwrap that FAILS --
+    // the common case under a wrong key or a tampered encryptedKey -- leaves nothing behind either;
+    // a wipe on the success path alone would keep the secret exactly when an attacker made it fail.
+    // Only buffers allocated here are wiped: km.key, the message bytes and the returned CEK are the
+    // caller's or the caller's to consume.
+    // A Uint8Array view aliases the ArrayBuffer's own bytes, so wiping the view wipes the buffer
+    // the engine returned -- no further copy is made in order to destroy one.
+    guard.secret.zeroizeAll([ss, kek, ssAb ? new Uint8Array(ssAb) : null, kekAb ? new Uint8Array(kekAb) : null],
+      CmsError, "cms/bad-input", "the KEM shared secret");
+  }
+}
+
+// The declared cipher MODE must match the container's authentication model: an AEAD cipher belongs in
+// AuthEnvelopedData and a plain CBC cipher in EnvelopedData (RFC 5083 sec. 2.1 / RFC 5084 sec. 3). Key
+// length alone does not separate them, so without this an EnvelopedData naming AES-GCM was opened as
+// unauthenticated CBC while the result still reported the AEAD algorithm -- telling the caller the
+// content was authenticated when nothing had authenticated it. The mirror case dereferenced AEAD
+// parameters the parser leaves null for a non-AEAD algorithm, faulting instead of failing closed.
+// An unresolvable OID is left to _openContent, which names it as the unsupported algorithm it is.
+function _assertContentCipherMode(eci, ct) {
+  var oidStr = eci.contentEncryptionAlgorithm.oid;
+  if (!CONTENT_MODE[oidStr]) return;
+  var wantMode = ct === "authEnvelopedData" ? "gcm" : "cbc";
+  if (CONTENT_MODE[oidStr] !== wantMode) {
+    throw _err("cms/unsupported-algorithm", "contentEncryptionAlgorithm " + oidStr + " is not a " + wantMode.toUpperCase() + " cipher, which " + ct + " requires (RFC 5083 sec. 2.1 / RFC 5084 sec. 3)");
+  }
 }
 
 // ---- stage 3: open the content (uniform failure) ---------------------------
@@ -384,7 +429,22 @@ async function _aesKwUnwrap(kek, wrapped) {
   // length, so an AuthenticatedData MAC key that is not 16/24/32 octets (e.g. a 64-octet HMAC-SHA-512
   // key from another implementation) is recovered instead of rejected before the MAC is even checked.
   var raw = await subtle.unwrapKey("raw", wrapped, kekKey, { name: "AES-KW" }, { name: "HMAC", hash: "SHA-256" }, true, ["sign"]);
-  return Buffer.from(await subtle.exportKey("raw", raw));
+  // exportKey allocates an ArrayBuffer holding the unwrapped key; the Buffer below is a copy of it,
+  // and the original would otherwise stay readable with nothing referencing it. That is a
+  // controllable allocation, not one of the runtime-internal copies the best-effort caveat covers.
+  // Only the intermediate is wiped -- the returned Buffer IS the key the caller must use to open
+  // the content, so wiping it here would destroy the result rather than protect it.
+  var rawAb = await subtle.exportKey("raw", raw);
+  try {
+    // An explicit COPY, not Buffer.from(arrayBuffer) -- that form returns a VIEW sharing the
+    // ArrayBuffer's memory, so wiping the intermediate below would zero the key being returned.
+    var view = new Uint8Array(rawAb);
+    var out = Buffer.alloc(view.length);
+    out.set(view);
+    return out;
+  } finally {
+    guard.secret.zeroize(new Uint8Array(rawAb), CmsError, "cms/bad-input", "the unwrapped content key");
+  }
 }
 function _eccSharedInfo(wrapName, ukm, kekBytes) {
   var kids = [b.sequence([b.oid(O(wrapName))])];

package/lib/cms-encrypt.js

@@ -275,15 +275,29 @@ async function _buildKemri(cek, cert, opts) {
   var pub = await subtle.importKey("spki", cert.subjectPublicKeyInfo.bytes, { name: wcName }, false, ["encapsulateBits"]);
   var kem = await subtle.encapsulateBits({ name: wcName }, pub);
   var ss = Buffer.from(kem.sharedKey), kemct = Buffer.from(kem.ciphertext);
-  var ssKey = await subtle.importKey("raw", ss, { name: "HKDF" }, false, ["deriveBits"]);
-  var kek = Buffer.from(await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt: Buffer.alloc(0), info: _kemOtherInfo(wrapName, kekBytes, ukm) }, ssKey, kekBytes * 8));
-  var encryptedKey = await _aesKwWrap(kek, cek);
-  var rid = _rid(cert, opts.keyIdentifier);
-  var kemriKids = [b.integer(0n), rid.node, _algId(oid.name(keyOid), "absent"), b.octetString(kemct), _algId("hkdfWithSha256", "absent"), b.integer(BigInt(kekBytes))];
-  if (ukm) kemriKids.push(b.explicit(0, b.octetString(ukm)));
-  kemriKids.push(_algId(wrapName, "absent"), b.octetString(encryptedKey));
-  var kemri = b.sequence(kemriKids);
-  return { tag: 4, node: b.sequence([b.oid(O("kem")), kemri]) };
+  var kek = null, kekAb = null;
+  try {
+    var ssKey = await subtle.importKey("raw", ss, { name: "HKDF" }, false, ["deriveBits"]);
+    kekAb = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt: Buffer.alloc(0), info: _kemOtherInfo(wrapName, kekBytes, ukm) }, ssKey, kekBytes * 8);
+    kek = Buffer.from(kekAb);
+    var encryptedKey = await _aesKwWrap(kek, cek);
+    var rid = _rid(cert, opts.keyIdentifier);
+    var kemriKids = [b.integer(0n), rid.node, _algId(oid.name(keyOid), "absent"), b.octetString(kemct), _algId("hkdfWithSha256", "absent"), b.integer(BigInt(kekBytes))];
+    if (ukm) kemriKids.push(b.explicit(0, b.octetString(ukm)));
+    kemriKids.push(_algId(wrapName, "absent"), b.octetString(encryptedKey));
+    var kemri = b.sequence(kemriKids);
+    return { tag: 4, node: b.sequence([b.oid(O("kem")), kemri]) };
+  } finally {
+    // RFC 9629 sec. 7 asks the SENDER to discard the shared secret and KEK once the recipient entry
+    // is built -- and to use a fresh secret per recipient, so this runs per call rather than once at
+    // the end of a multi-recipient message. In a `finally`, so a wrap or encoding failure does not
+    // leave them behind. The CEK is the caller's and is wiped by no one here; kemct is public.
+    // kem.sharedKey is the ArrayBuffer the engine returned and ss is this function's copy of it;
+    // both hold the secret, so both are cleared. A Uint8Array view aliases the buffer's bytes, so
+    // wiping the view wipes the buffer itself. kem.ciphertext is public and stays.
+    guard.secret.zeroizeAll([ss, kek, kem.sharedKey ? new Uint8Array(kem.sharedKey) : null, kekAb ? new Uint8Array(kekAb) : null],
+      CmsError, "cms/bad-input", "the KEM shared secret");
+  }
 }
 
 // AES-KW wrap of the CEK under a raw KEK.

package/lib/crl-sign.js

@@ -478,7 +478,8 @@ function _sign(spec, issuer, opts) {
  * empty revocation list omits `revokedCertificates` rather than emitting an empty SEQUENCE (sec. 5.1.2.6);
  * `reasonCode` is an ENUMERATED and `invalidityDate` is always GeneralizedTime (sec. 5.3.1/5.3.2);
  * per-extension criticality is fixed by the RFC; and the produced signature is verified under the issuer
- * key before return. A violation throws a typed `CrlError`.
+ * key before return. A violation throws a typed `CrlError`; where the spec carries raw DER -- an issuer
+ * `Name` Buffer or a pre-encoded `Extension` -- a malformed leaf inside those bytes throws `Asn1Error`.
  *
  * @opts
  *   - `pem` (boolean) -- return a PEM `X509 CRL` string instead of DER.

package/lib/csr-sign.js

@@ -82,7 +82,9 @@ function _challengePassword(pw) {
  * to prove possession of the private half of `subjectPublicKey`, and that proof is verified before the
  * request is returned. The signature algorithm is resolved from the subject key (RSA PKCS#1 v1.5 or PSS,
  * ECDSA, EdDSA, ML-DSA, SLH-DSA, or a composite arm). Returns DER, or a PEM `CERTIFICATE REQUEST` with
- * `opts.pem`. Malformed input throws a typed `CsrError`. Certificate-request parsing is `pki.schema.csr.parse`.
+ * `opts.pem`. Malformed input throws a typed `CsrError`; where the spec carries raw DER -- a `Name`
+ * Buffer, a pre-encoded requested `Extension` or `Attribute` -- a malformed leaf inside those bytes
+ * throws `Asn1Error` instead. Certificate-request parsing is `pki.schema.csr.parse`.
  *
  * @opts
  *   - `pem` (boolean) -- return a PEM `CERTIFICATE REQUEST` string instead of DER.

package/lib/guard-all.js

@@ -59,6 +59,7 @@ var json   = require("./guard-json");
 var identifier = require("./guard-identifier");
 var header = require("./guard-header");
 var compress = require("./guard-compress");
+var secret = require("./guard-secret");
 
 module.exports = {
   bytes:  bytes,
@@ -73,4 +74,5 @@ module.exports = {
   identifier: identifier,
   header: header,
   compress: compress,
+  secret: secret,
 };

package/lib/guard-secret.js

@@ -0,0 +1,82 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The documented surface is the KEM
+// key-establishment paths that compose this guard (pki.cms.encrypt / decrypt).
+//
+// guard-secret -- wipe a secret buffer the TOOLKIT ALLOCATED at the moment it
+// stops being needed. NIST SP 800-227 RS5 / sec. 4.2 requires that a KEM shared
+// secret and every intermediate value be destroyed as soon as they are no longer
+// needed; RFC 9629 sec. 7 says the same of the KEK a KEMRecipientInfo derives.
+//
+// The defended class is secret lifetime, not secret disclosure: a shared secret
+// or KEK left readable in the heap widens the window in which a later memory
+// disclosure -- a core dump, a swapped page, a same-process read primitive --
+// yields key material for traffic that was already decrypted.
+//
+// SCOPE, stated honestly because the docstring is the only place a reader learns
+// it: this is BEST EFFORT. The runtime copies buffers into places no JS can
+// reach (node's decapsulate return is copied on the way out; importKey("raw")
+// copies into a KeyObject), and V8 may relocate a backing store, leaving the
+// original bytes behind. Wiping the copies the toolkit holds shortens the
+// window. It does not support a claim that a secret never persists in memory,
+// and no operator-facing text may imply that it does.
+//
+// OWNERSHIP IS THE CONTRACT. Only a buffer the toolkit allocated may be wiped --
+// never a caller's opts.key / opts.cert / opts.kek / opts.password, and never the
+// input DER. Silently destroying a caller's own memory is a worse defect than
+// leaving a secret readable, and it is the failure mode a zeroization patch
+// reaches for first, so the call sites pass only their own intermediates.
+
+var bytes = require("./guard-bytes");
+
+// zeroize(value, ErrorClass, code, label) -> the same object, cleared.
+//   value      : a Buffer / TypedArray the TOOLKIT allocated, or null / undefined
+//                (absent is a no-op so a `finally` needs no branch around it).
+//   ErrorClass : the caller's typed error CONSTRUCTOR, declared with
+//                `{ withCause: true }`. The guard family carries two currencies --
+//                most guards take a (code, message) factory and call it without
+//                `new`, while guard-bytes / guard-header take the class and
+//                construct it. This module's ONLY throw is the delegated re-view
+//                below, so it must pass what guard-bytes expects: the class, and
+//                one that accepts a cause, because guard-bytes threads the raw
+//                detach fault through as one. A plain class fails to construct at
+//                the single moment the caller needs a real error.
+//   code       : the frozen domain/reason code a detached buffer rejects under.
+//   label      : field phrase for the message.
+//
+// A detached ArrayBuffer cannot be written, and reaching one here means a caller
+// handed over memory that was transferred away -- a real fault, not something to
+// swallow, so it routes through the shared re-view guard and throws typed.
+//
+// The `.fill(0)` shape lives ONLY in this module: a wipe re-inlined anywhere in
+// lib/ -- including a module not yet written -- is flagged, so the safe
+// implementation is also the tripwire that stops the next consumer from rolling
+// its own partial one.
+// @enforced-by guard-shape-reinlined
+// @guard-shape \.fill\s*\(\s*0\s*[,)]
+function zeroize(value, ErrorClass, code, label) {
+  if (value === null || value === undefined) return value;
+  // Re-view through the shared bytes guard: it is the single place that decides
+  // what counts as a writable BufferSource and rejects a detached one typed.
+  var view = bytes.view(value, ErrorClass, code, label);
+  view.fill(0);
+  return value;
+}
+
+// zeroizeAll(list, ErrorClass, code, label) -- wipe every present member, tolerating
+// holes so a `finally` can name intermediates that may not have been reached.
+//
+// @enforced-by behavioral -- this is a loop over zeroize, which carries the family's only
+// rename-proof shape (the `.fill(0)` above). It introduces no shape of its own, so a lexical
+// detector here would anchor on a renameable symbol and go silently green (drift rule sec. 3).
+// The behavioural guards are guard-secret.test.js (holes tolerated, every member cleared) and the
+// CMS vectors that assert the shared secret and KEK are wiped on BOTH the success and failure paths.
+function zeroizeAll(list, ErrorClass, code, label) {
+  if (!list) return list;
+  for (var i = 0; i < list.length; i++) zeroize(list[i], ErrorClass, code, label);
+  return list;
+}
+
+module.exports = { zeroize: zeroize, zeroizeAll: zeroizeAll };

package/lib/inspect.js

@@ -46,6 +46,9 @@ function _err(code, message, cause) { return new InspectError(code, message, cau
 // caught by the renderer and fall back to a hex dump (inspection is best-effort).
 var NS = pkix.makeNS("inspect", InspectError, oid);
 var EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
+// Dispatch on the stable OID, not the display name: pki.oid.register() can override a built-in
+// name, which would silently skip the userNotice rendering and hex-dump the notice instead.
+var OID_UNOTICE = oid.byName("unotice");
 
 // ---- formatting helpers ------------------------------------------------------
 
@@ -196,14 +199,17 @@ function _ipString(buf) {
 // their structural separators are left as-is, matching OpenSSL (a GeneralName has no
 // RFC 4514-equivalent escaping profile, and escaping a legitimate comma in a URI
 // would misrepresent it).
+// The DN of a decoded directoryName GeneralName value. Shared so every renderer that meets this
+// form -- the SAN/AKI GeneralName path and the AIA/SIA accessLocation path, which carry different
+// decoded shapes -- prints the same DN rather than one of them falling back to a bare tag number.
+function _gnDn(value) {
+  return (value && Array.isArray(value.rdns)) ? _dnString(value) : ((value && value.dn) || "");
+}
 function _gn(g) {
   if (!g || typeof g !== "object") return "";
   var t = g.tagNumber;
   if (t === 7 && Buffer.isBuffer(g.value)) return "IP Address:" + _ipString(g.value);
-  if (t === 4) {
-    var dn = (g.value && Array.isArray(g.value.rdns)) ? _dnString(g.value) : ((g.value && g.value.dn) || "");
-    return "DirName:" + dn;
-  }
+  if (t === 4) return "DirName:" + _gnDn(g.value);
   if (t === 0) return "othername:" + (Buffer.isBuffer(g.bytes) ? _hexColon(g.bytes, {}) : "<unsupported>");
   var kind = GN_KIND[t] || ("tag" + t);
   var v = (typeof g.value === "string") ? _clean(g.value)
@@ -368,6 +374,30 @@ var EXT_RENDERERS = {
           var label = null;
           try { label = oid.name(qid); }
           catch (_e) { /* unregistered qualifier */ }
+          // A userNotice is a constructed SEQUENCE, so the printable-content test below can never
+          // read it and it would hex-dump -- leaving the operator unable to read the very text the
+          // qualifier exists to display. Render its DisplayText members through the shared pkix
+          // reader (the same one pki.lint measures), so both agree on what the notice says.
+          if (qid === OID_UNOTICE) {
+            // Render only when EVERY member decoded under its declared string type. A null text means
+            // the value did not, and showing the members that happened to decode would present a
+            // partial notice as a complete one -- so the whole qualifier falls through to the hex
+            // dump, where the operator sees the bytes the certificate actually holds.
+            // A null noticeNumbers means the reference did not fully decode, and is refused for the
+            // same reason as a null text: a partially decoded notice must not be shown as a whole one.
+            var texts = pkix.userNoticeTexts(q);
+            if (texts.length && texts.every(function (t) {
+              return t.text !== null && (t.field !== "organization" || t.noticeNumbers !== null);
+            })) {
+              texts.forEach(function (t) {
+                // A NoticeReference is identified by organization AND number, so the numbers ride with
+                // the organization -- printing the text alone would drop the key that names the notice.
+                var nums = (t.noticeNumbers && t.noticeNumbers.length) ? " #" + t.noticeNumbers.join(", ") : "";
+                lines.push(inner + "  " + (label || qid) + " " + t.field + ": " + _clean(t.text) + nums);
+              });
+              return;
+            }
+          }
           var val = (q && !q.constructed && Buffer.isBuffer(q.content) && _printable(q.content))
             ? _clean(q.content.toString("latin1"))
             : _hexColon(q && Buffer.isBuffer(q.bytes) ? q.bytes : Buffer.alloc(0), {});
@@ -397,6 +427,10 @@ var EXT_RENDERERS = {
       else if (loc.tag === 2) lv = "DNS:" + loc.value;
       else if (loc.tag === 1) lv = "email:" + loc.value;
       else if (loc.tag === 7) lv = "IP:" + _ipString(loc.value);
+      // A directoryName accessLocation carries a decoded Name, so print the DN. Without this it fell
+      // to the bracketed-tag fallback and rendered a bare "[4]", hiding the responder/issuer identity
+      // the entry exists to convey -- while the same form already printed as DirName elsewhere.
+      else if (loc.tag === 4) lv = "DirName:" + _gnDn(loc.value);
       else lv = typeof loc.value === "string" ? loc.value : "[" + loc.tag + "]";
       return inner + (LABEL[m] || m || ad.accessMethod) + " - " + lv;
     }).join("\n");

package/lib/lint.js

@@ -274,6 +274,58 @@ function _ecCurveName(spki) {
   } catch (_e) { return null; }   // explicit / invalid EC parameters are not an approved named curve
 }
 
+// RFC 5280 marks several extensions MUST (error) or SHOULD (warn) be critical. The shape is
+// uniform: applies when the extension is present, fires when its raw `critical` flag is not
+// true. The rule reads `ctx.raw(name).critical` WITHOUT decoding the value -- criticality is
+// a structural property of the extension, independent of its contents.
+// ---- RFC 5280 4.2.1.4 userNotice DisplayText ----
+// certificatePolicies surfaces each policy's qualifiers as RAW bytes (an external verifier may hash
+// them), so the DisplayText values are read out of those bytes here. The UserNotice walk itself lives
+// in schema-pkix (pki.inspect renders the same values), so the two consumers cannot disagree about
+// which members are DisplayText or how a BMPString decodes.
+var OID_UNOTICE = oid.byName("unotice");
+var _T_BMP = asn1.TAGS.BMP_STRING, _T_VISIBLE = asn1.TAGS.VISIBLE_STRING, _T_UTF8 = asn1.TAGS.UTF8_STRING;
+// The C0 and C1 control ranges, tested by code point rather than a regex: the characters this rule is
+// ABOUT cannot appear in the source, and a regex holding them would be a control byte here.
+function _hasControlChar(str) {
+  for (var i = 0; i < str.length; i++) {
+    var c = str.charCodeAt(i);
+    if (c <= 0x1f || (c >= 0x7f && c <= 0x9f)) return true;
+  }
+  return false;
+}
+// Every DisplayText in the certificate's certificatePolicies. Both positions are collected --
+// explicitText AND NoticeReference.organization -- because the SIZE bound is on the DisplayText type,
+// so reporting only explicitText would leave its sibling unmeasured.
+// The two decodes below are fail-safe belts on the never-throw data path, not reachable paths: the
+// shared decoder ran pkix.assertPolicyQualifiers before surfacing qualifiersBytes, so the bytes are
+// already known to decode as a SEQUENCE whose every element is a two-member PolicyQualifierInfo led
+// by a readable OID. An undecodable extension never reaches here at all -- it is the separate
+// extension-undecodable finding.
+function _policyDisplayTexts(ctx) {
+  var d = ctx.decode("certificatePolicies");
+  if (!d || !Array.isArray(d.value)) return [];
+  var out = [];
+  d.value.forEach(function (pi) {
+    if (!pi.qualifiersBytes || !pi.qualifiersBytes.length) return;
+    var quals;
+    // allow:swallow-unverified re-decoding bytes that already decoded under assertPolicyQualifiers cannot throw
+    try { quals = asn1.decode(pi.qualifiersBytes).children; } catch (_e) { return; }
+    (quals || []).forEach(function (pq) {
+      var qid;
+      // allow:swallow-unverified assertPolicyQualifiers already read this OID, so re-reading it cannot throw
+      try { qid = asn1.read.oid(pq.children[0]); } catch (_e2) { return; }
+      if (qid !== OID_UNOTICE) return;
+      // Entries whose contents did not decode arrive with a null `text` and keep their tag: the rules
+      // below that read the text skip them, while the encoding rule -- which the ASN.1 tag alone
+      // answers -- still sees them.
+      out = out.concat(pkix.userNoticeTexts(pq.children[1]));
+    });
+  });
+  return out;
+}
+function _hasPolicyDisplayText(cert, ctx) { return _policyDisplayTexts(ctx).length > 0; }
+
 // RFC 5280 marks several extensions MUST (error) or SHOULD (warn) be critical. The shape is
 // uniform: applies when the extension is present, fires when its raw `critical` flag is not
 // true. The rule reads `ctx.raw(name).critical` WITHOUT decoding the value -- criticality is
@@ -413,6 +465,65 @@ var RFC5280_RULES = [
     appliesTo: function (cert, ctx) { var bc = ctx.decode("basicConstraints"); return !(bc && bc.value && bc.value.cA === true); },
     check: function (cert, ctx) { return ctx.raw("subjectKeyIdentifier") ? null : true; },
   },
+  // 4.2.1.4 governs the userNotice qualifier's DisplayText with one MUST NOT and three SHOULD-level
+  // rules. None of them can live in the decoder: the section closes by directing certificate users to
+  // "gracefully handle explicitText with more than 200 characters", so a verifier that rejected these
+  // would refuse certificates that are in the wild and otherwise valid. Reporting them is exactly what
+  // a linter is for, so each rule carries the severity its normative word does.
+  {
+    // DisplayText is SIZE (1..200) -- both ends -- but the two ends get SEPARATE ids rather than one
+    // length rule, because the section treats them differently: it tells certificate users to handle a
+    // notice ABOVE 200 gracefully, and says nothing of the sort about an empty one. An operator acting
+    // on that advice suppresses the over-long finding; folding both into a single id would silently
+    // suppress the empty case along with it, which has no such carve-out.
+    id: "lint/rfc5280/explicit-text-too-long", severity: "warn", source: "rfc5280", citation: "RFC 5280 4.2.1.4",
+    message: "a userNotice DisplayText should not exceed 200 characters",
+    appliesTo: _hasPolicyDisplayText,
+    check: function (cert, ctx) {
+      var over = _policyDisplayTexts(ctx).filter(function (d) { return d.text !== null && d.chars > pkix.DISPLAY_TEXT_MAX; });
+      return over.length ? { context: { count: over.length, longest: Math.max.apply(null, over.map(function (d) { return d.chars; })) } } : null;
+    },
+  },
+  {
+    id: "lint/rfc5280/explicit-text-empty", severity: "warn", source: "rfc5280", citation: "RFC 5280 4.2.1.4",
+    message: "a userNotice DisplayText must not be empty (SIZE (1..200))",
+    appliesTo: _hasPolicyDisplayText,
+    check: function (cert, ctx) {
+      var empty = _policyDisplayTexts(ctx).filter(function (d) { return d.text !== null && d.chars < 1; });
+      return empty.length ? { context: { count: empty.length } } : null;
+    },
+  },
+  {
+    id: "lint/rfc5280/explicit-text-bad-encoding", severity: "error", source: "rfc5280", citation: "RFC 5280 4.2.1.4",
+    message: "conforming CAs must not encode explicitText as VisibleString or BMPString",
+    appliesTo: _hasPolicyDisplayText,
+    check: function (cert, ctx) {
+      var bad = _policyDisplayTexts(ctx).filter(function (d) { return d.field === "explicitText" && (d.tagNumber === _T_VISIBLE || d.tagNumber === _T_BMP); });
+      return bad.length ? { context: { count: bad.length, encoding: bad[0].tagNumber === _T_BMP ? "BMPString" : "VisibleString" } } : null;
+    },
+  },
+  {
+    id: "lint/rfc5280/explicit-text-control-chars", severity: "warn", source: "rfc5280", citation: "RFC 5280 4.2.1.4",
+    message: "an explicitText should not include control characters (U+0000 to U+001F, U+007F to U+009F)",
+    appliesTo: _hasPolicyDisplayText,
+    check: function (cert, ctx) {
+      var bad = _policyDisplayTexts(ctx).filter(function (d) { return d.field === "explicitText" && d.text !== null && _hasControlChar(d.text); });
+      return bad.length ? { context: { count: bad.length } } : null;
+    },
+  },
+  {
+    id: "lint/rfc5280/explicit-text-not-nfc", severity: "notice", source: "rfc5280", citation: "RFC 5280 4.2.1.4",
+    message: "a UTF8String explicitText should be normalized to Unicode normalization form C (NFC)",
+    appliesTo: _hasPolicyDisplayText,
+    check: function (cert, ctx) {
+      // Only the utf8String arm carries the NFC recommendation; the other arms cannot express the
+      // combining sequences the rule is about.
+      var bad = _policyDisplayTexts(ctx).filter(function (d) {
+        return d.field === "explicitText" && d.text !== null && d.tagNumber === _T_UTF8 && d.text.normalize("NFC") !== d.text;
+      });
+      return bad.length ? { context: { count: bad.length } } : null;
+    },
+  },
 ];
 
 function _isTls(cert, ctx) { return ctx.isTlsServerCert; }
@@ -517,8 +628,10 @@ var CABF_TLS_RULES = [
 
 // RFC 9935 -- ML-KEM public keys in X.509 certificates. The OID is the sole authority for the
 // parameter set; the SPKI BIT STRING is the raw ek, exactly 384k+32 octets for that OID.
+// Encapsulation-key lengths come from the shared ML-KEM parameter registry (FIPS 203 Table 3),
+// keyed by NAME because an SPKI surfaces its algorithm by name on this path.
 var ML_KEM_EK_LEN = {};
-["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function (n, i) { ML_KEM_EK_LEN[n] = [800, 1184, 1568][i]; });
+["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function (n) { ML_KEM_EK_LEN[n] = oid.kemParams(n).ek; });
 function _isMlKem(cert) {
   var spki = cert.subjectPublicKeyInfo;
   return !!(spki && spki.algorithm && ML_KEM_EK_LEN[spki.algorithm.name] !== undefined);

package/lib/oid.js

@@ -693,11 +693,46 @@ function paramsMustBeAbsent(dotted) {
   return _PARAMS_ABSENT.has(dotted);
 }
 
+// ---- ML-KEM parameter sets (FIPS 203 Table 3) --------------------------------
+//
+// ONE row per parameter set, resolvable by dotted OID or by registered name, because the
+// consumers hold different currencies: the CMS codec and the decrypt path key by OID, the
+// linter keys by the SPKI algorithm's name. Before this table the same FIPS 203 constants
+// lived in three modules -- schema-cms's ciphertext lengths, webcrypto's {ek, dk}, and
+// lint's encapsulation-key lengths -- so a fourth consumer (a composite KEM, an HPKE row,
+// HQC by analogy) meant a fourth copy, and the ek values were already duplicated verbatim
+// in two of them. A parameter set is a property OF the algorithm identifier, so it lives
+// beside the registry that resolves one rather than in whichever module needed it first.
+//
+//   ek : encapsulation-key octets      dk : decapsulation-key octets
+//   ct : ciphertext octets             ss : shared-secret octets
+// A null-prototype table: a plain object would answer kemParams("toString") with a function
+// inherited from Object.prototype, so the documented fail-closed contract would hold for every
+// input EXCEPT the handful every object already carries -- exactly the ones an untrusted
+// identifier might be.
+var KEM_PARAMS = Object.create(null);
+[["id-ml-kem-512", 800, 1632, 768, 32],
+  ["id-ml-kem-768", 1184, 2400, 1088, 32],
+  ["id-ml-kem-1024", 1568, 3168, 1568, 32]].forEach(function (r) {
+  // FROZEN, because these rows are reachable from the public surface AND one of them now governs a
+  // security check: the engine reads .ct to enforce the FIPS 203 sec. 7.3 ciphertext length. A shared
+  // mutable row would let any code in the process rewrite that bound once, for every later call --
+  // a parameter set is a fact about the algorithm, not a setting an application may retune.
+  var row = Object.freeze({ ek: r[1], dk: r[2], ct: r[3], ss: r[4] });
+  KEM_PARAMS[byName(r[0])] = row;   // by dotted OID
+  KEM_PARAMS[r[0]] = row;           // and by registered name -- the same frozen row
+});
+Object.freeze(KEM_PARAMS);
+// kemParams(oidOrName) -> the row, or undefined for anything that is not an ML-KEM
+// parameter set. Undefined is the caller's signal to fail closed; it never guesses a size.
+function kemParams(oidOrName) { return KEM_PARAMS[oidOrName]; }
+
 module.exports = {
   name:           name,
   byName:         byName,
   has:            has,
   paramsMustBeAbsent: paramsMustBeAbsent,
+  kemParams:      kemParams,
   register:       register,
   registerFamily: registerFamily,
   all:            all,

package/lib/pbes2.js

@@ -26,8 +26,15 @@ var PRF_NODE_BY_NAME = { hmacWithSHA1: "sha1", hmacWithSHA256: "sha256", hmacWit
 var PRF_NODE_BY_OID = {}; Object.keys(PRF_NODE_BY_NAME).forEach(function (n) { PRF_NODE_BY_OID[O(n)] = PRF_NODE_BY_NAME[n]; });
 
 // content-encryption OID -> AES key bits (CBC + GCM). The PBES2 encryptionScheme + CMS content cipher table.
-var CONTENT_KEYBITS = {};
-[["aes128-CBC", 128], ["aes192-CBC", 192], ["aes256-CBC", 256], ["aes128-GCM", 128], ["aes192-GCM", 192], ["aes256-GCM", 256]].forEach(function (r) { CONTENT_KEYBITS[O(r[0])] = r[1]; });
+// CONTENT_MODE rides the SAME rows so a cipher can never be present for its key length but absent for its
+// mode: key length alone does not distinguish an AEAD cipher from a plain one, and a consumer that resolves
+// only the length would open content in the wrong mode whenever the two happen to share a key size.
+var CONTENT_KEYBITS = {}, CONTENT_MODE = {};
+[["aes128-CBC", 128, "cbc"], ["aes192-CBC", 192, "cbc"], ["aes256-CBC", 256, "cbc"],
+  ["aes128-GCM", 128, "gcm"], ["aes192-GCM", 192, "gcm"], ["aes256-GCM", 256, "gcm"]].forEach(function (r) {
+  CONTENT_KEYBITS[O(r[0])] = r[1];
+  CONTENT_MODE[O(r[0])] = r[2];
+});
 
 // A password is an octet string (RFC 8018 sec. 2): a string is UTF-8-encoded deterministically (correct for
 // non-ASCII, and byte-identical to OpenSSL), a Buffer/Uint8Array used verbatim.
@@ -211,6 +218,6 @@ module.exports = {
   prfNodeByName: prfNodeByName, prfNodeByOid: prfNodeByOid,
   pbkdf2ParamsSeq: pbkdf2ParamsSeq, pbes2AlgId: pbes2AlgId, parsePbkdf2Params: parsePbkdf2Params,
   requireChildren: requireChildren, seqChildren: seqChildren,
-  cbcEncrypt: cbcEncrypt, cbcDecrypt: cbcDecrypt, pbes2Encrypt: pbes2Encrypt, pbes2Decrypt: pbes2Decrypt, CONTENT_KEYBITS: CONTENT_KEYBITS,
+  cbcEncrypt: cbcEncrypt, cbcDecrypt: cbcDecrypt, pbes2Encrypt: pbes2Encrypt, pbes2Decrypt: pbes2Decrypt, CONTENT_KEYBITS: CONTENT_KEYBITS, CONTENT_MODE: CONTENT_MODE,
   pbmac1AlgId: pbmac1AlgId, pbmac1: pbmac1,
 };

package/lib/schema-c509.js

@@ -1031,7 +1031,11 @@ function _qualifierToDer(qidNode, qtextNode) {
   if (qtextNode.majorType !== 3) throw _err("c509/bad-extensions", "a policyQualifier value must be a CBOR text string");
   var text = cbor.read.textString(qtextNode);
   if (qi === 1) return b.sequence([b.oid(oid.byName("cps")), _ia5Universal(text, "a CPSuri")]);   // CPSuri ::= IA5String
-  // id-qt-unotice: UserNotice ::= SEQUENCE { explicitText utf8String } -- noticeRef omitted, DisplayText SIZE 1..200 floor.
+  // id-qt-unotice: UserNotice ::= SEQUENCE { explicitText utf8String } -- noticeRef omitted. Only the SIZE
+  // (1..200) FLOOR is enforced: an empty explicitText is a degenerate value no encoder can have produced,
+  // while RFC 5280 sec. 4.2.1.4 directs certificate users to gracefully handle a notice ABOVE 200
+  // characters, and draft-20 sec. 3.3's compact predicate is SIZE-silent -- so an over-long notice
+  // transcodes rather than being refused.
   if (text.length === 0) throw _err("c509/bad-extensions", "a UserNotice explicitText must be non-empty (DisplayText SIZE 1..200)");
   return b.sequence([b.oid(oid.byName("unotice")), b.sequence([b.utf8(text)])]);
 }

package/lib/schema-cms.js

@@ -106,10 +106,10 @@ WRAP_KEK_LENGTHS[oid.byName("aes256-wrap")] = 32;
 // ML-KEM OID -> the exact ciphertext (kemct) length in octets (FIPS 203). A
 // recognized ML-KEM kem carries a fixed-size ciphertext; any other length can
 // never decapsulate. (The params-absent rule rides the shared oid registry.)
+// Ciphertext lengths come from the shared ML-KEM parameter registry (FIPS 203 Table 3) rather
+// than a local copy, so this codec and the crypto engine cannot disagree about a parameter set.
 var KEM_CT_LENGTHS = {};
-KEM_CT_LENGTHS[oid.byName("id-ml-kem-512")] = 768;
-KEM_CT_LENGTHS[oid.byName("id-ml-kem-768")] = 1088;
-KEM_CT_LENGTHS[oid.byName("id-ml-kem-1024")] = 1568;
+["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function (n) { KEM_CT_LENGTHS[oid.byName(n)] = oid.kemParams(n).ct; });
 
 // Recognized AEAD content-encryption OIDs -> the AES-GCM/CCM parameter shape + the
 // legal ICVlen set (RFC 5084). An unrecognized content-encryption OID surfaces its

package/lib/schema-pkix.js

@@ -703,6 +703,108 @@ function assertPolicyQualifiers(qNode, fail) {
   });
 }
 
+// DisplayText ::= CHOICE { ia5String, visibleString, bmpString, utf8String } each SIZE (1..200)
+// -- RFC 5280 sec. 4.2.1.4. The bound is deliberately NOT enforced here, and that is a normative
+// requirement rather than a gap: the same section closes with "While the explicitText has a maximum
+// size of 200 characters, some non-conforming CAs exceed this limit. Therefore, certificate users
+// SHOULD gracefully handle explicitText with more than 200 characters." A decoder IS the certificate
+// user that note addresses, so refusing an over-long notice would violate a SHOULD and reject
+// certificates that are in the wild and otherwise valid. The bound belongs to the two layers that
+// can act on it: an issuer, which must not MINT one, and pki.lint, which reports it as an advisory.
+//
+// Measured in CHARACTERS, not octets: a conforming 200-character UTF8String notice can occupy 800
+// octets, so `.length` (UTF-16 units) or a byte count would misjudge a valid value. Exported so
+// every layer that reports the bound counts it identically instead of keeping its own copy.
+var DISPLAY_TEXT_MAX = 200;
+function displayTextChars(str) { return Array.from(str).length; }
+
+// @internal
+// userNoticeTexts(qualifier) -- the DisplayText values of a decoded UserNotice qualifier, as
+// [{ field, tagNumber, text, chars }] in encounter order. `field` is "explicitText" or
+// "organization" (the NoticeReference member), so a caller that must treat the two alike (the
+// SIZE bound applies to both) and one that must not (only explicitText carries the encoding and
+// normalization rules) can each select correctly.
+//
+// UserNotice ::= SEQUENCE { noticeRef NoticeReference OPTIONAL, explicitText DisplayText OPTIONAL }
+// NoticeReference ::= SEQUENCE { organization DisplayText, noticeNumbers SEQUENCE OF INTEGER }
+// Both members are OPTIONAL and distinguished by tag, so a leading SEQUENCE is the noticeRef and any
+// DisplayText member is the explicitText. Returns [] for a qualifier that is not a UserNotice --
+// this reads an already-decoded node for display and reporting, and is never a validity verdict.
+var _DISPLAY_TEXT_TAGS = null;
+function _isDisplayTextNode(n) {
+  if (!_DISPLAY_TEXT_TAGS) {
+    _DISPLAY_TEXT_TAGS = {};
+    _DISPLAY_TEXT_TAGS[_T.IA5_STRING] = 1; _DISPLAY_TEXT_TAGS[_T.VISIBLE_STRING] = 1;
+    _DISPLAY_TEXT_TAGS[_T.BMP_STRING] = 1; _DISPLAY_TEXT_TAGS[_T.UTF8_STRING] = 1;
+  }
+  return !!n && n.tagClass === "universal" && _DISPLAY_TEXT_TAGS[n.tagNumber] === 1;
+}
+// Decoded through the STRICT reader, which validates each arm against its own declared string type
+// (invalid UTF-8, a high bit in an IA5String, an odd-length or lone-surrogate BMPString all throw).
+// Reading the content bytes directly would repair the value instead: `toString("utf8")` substitutes
+// U+FFFD for invalid sequences and a hand-rolled UCS-2 loop drops a trailing odd octet, so a caller
+// would render or measure text the certificate does not contain. Returns null when the value does
+// not decode, so the caller can take its own fallback rather than trust a repair.
+// An undecodable value yields an entry whose `text` and `chars` are null but whose `field` and
+// `tagNumber` are still present. The two are separable facts: which ASN.1 string type was used is
+// established by the tag alone, so a rule about the ENCODING stays answerable even when the contents
+// do not decode, while every rule that reads the TEXT must skip the entry rather than analyze a
+// repair. Collapsing both into "not analyzable" would let a prohibited encoding escape its finding
+// by also being malformed inside.
+function _dtEntry(field, node) {
+  var text;
+  // allow:swallow-unverified an undecodable DisplayText keeps its tag and drops its text; the callers branch on text === null
+  try { text = asn1.read.string(node); } catch (_e) { text = null; }
+  return { field: field, tagNumber: node.tagNumber, text: text, chars: text === null ? null : displayTextChars(text) };
+}
+// A NoticeReference names its notice by ORGANIZATION **and** NUMBER -- the organization alone does not
+// identify which notice is meant, so a consumer that surfaced only the text would lose the lookup key.
+// Returns null when the numbers are absent, wrongly shaped, or contain a member that is not a readable
+// INTEGER: an incompletely decoded reference must NOT be presentable, because dropping the members that
+// failed would render a partial reference indistinguishable from a whole one -- the same defect as
+// omitting the numbers entirely, in a form that is harder to notice. Numbers are decimal strings.
+function _noticeNumbers(node) {
+  if (!node || node.tagClass !== "universal" || node.tagNumber !== _T.SEQUENCE || !node.children) return null;
+  var nums = [], ok = true;
+  node.children.forEach(function (n) {
+    // allow:swallow-unverified a non-INTEGER member makes the whole reference undecodable; the caller falls back rather than rendering part of it
+    try { nums.push(String(asn1.read.integer(n))); } catch (_e) { ok = false; }
+  });
+  return ok ? nums : null;
+}
+// Every DisplayText member is returned, including one whose contents did not decode -- that entry
+// carries its tag with a null `text`. A caller that RENDERS the notice must check that every entry
+// decoded before showing any of it (a partial notice is indistinguishable from a complete one); a
+// caller that only classifies the encoding can read the tags regardless.
+// The LAYOUT is validated before any member is read: UserNotice fixes the order (noticeRef first) and
+// the cardinality (each member at most once, nothing else present). Collecting every recognized member
+// and ignoring the rest would accept a duplicated explicitText, a reversed order, or an extra member,
+// and the caller -- which can only see whether the entries it got look complete -- would then present
+// a structurally invalid notice as a whole one. A malformed layout yields NO entries, so a renderer
+// falls back to hex and a reporter measures nothing.
+function userNoticeTexts(qualifier) {
+  if (!qualifier || qualifier.tagClass !== "universal" || qualifier.tagNumber !== _T.SEQUENCE || !qualifier.children) return [];
+  var kids = qualifier.children;
+  if (kids.length > 2) return [];
+  var i = 0, out = [];
+  // noticeRef [absent | first]: a SEQUENCE of { organization DisplayText, noticeNumbers }.
+  if (i < kids.length && kids[i].tagClass === "universal" && kids[i].tagNumber === _T.SEQUENCE) {
+    var nr = kids[i];
+    if (!nr.children || nr.children.length !== 2 || !_isDisplayTextNode(nr.children[0])) return [];
+    var org = _dtEntry("organization", nr.children[0]);
+    org.noticeNumbers = _noticeNumbers(nr.children[1]);
+    out.push(org);
+    i++;
+  }
+  // explicitText [absent | last]: a DisplayText. Anything else remaining is not a UserNotice member.
+  if (i < kids.length) {
+    if (!_isDisplayTextNode(kids[i])) return [];
+    out.push(_dtEntry("explicitText", kids[i]));
+    i++;
+  }
+  return i === kids.length ? out : [];
+}
+
 // Shared imperative decode helpers for the certExtensionDecoders + attrValueDecoders factories. Both
 // take the caller's ns, so the helpers close over ns.E / ns.oid; extracted once so the two factories
 // share one copy (a per-OID value-decoder body is the identical idiom to a per-OID extension body).
@@ -1468,6 +1570,9 @@ module.exports = {
   signedEnvelopeTbs: signedEnvelopeTbs,
   rootSequenceChildren: rootSequenceChildren,
   assertPolicyQualifiers: assertPolicyQualifiers,
+  DISPLAY_TEXT_MAX: DISPLAY_TEXT_MAX,
+  displayTextChars: displayTextChars,
+  userNoticeTexts: userNoticeTexts,
   signedEnvelope: signedEnvelope,
   attrValueToString: attrValueToString,
   attributeTypeAndValue: attributeTypeAndValue,

package/lib/webcrypto.js

@@ -608,8 +608,16 @@ async function _deriveBitsRaw(alg, key, length) {
   }
   if (name === "HKDF") {
     _requireDeriveLength(length, "HKDF");
-    var derived = nodeCrypto.hkdfSync(_hashNode(alg.hash, "HKDF"), _secretBytes(key), _toBuf(alg.salt, "HKDF salt"), _toBuf(alg.info || Buffer.alloc(0), "HKDF info"), length / 8);
-    return derived instanceof ArrayBuffer ? derived : _toArrayBuffer(Buffer.from(derived));
+    // _secretBytes EXPORTS the key material into a fresh Buffer this module owns -- for a KEM flow
+    // that Buffer is the shared secret itself. It is a controllable allocation, not one of the
+    // runtime-internal copies the best-effort caveat covers, so it is wiped once HKDF has consumed it.
+    var ikm = _secretBytes(key);
+    try {
+      var derived = nodeCrypto.hkdfSync(_hashNode(alg.hash, "HKDF"), ikm, _toBuf(alg.salt, "HKDF salt"), _toBuf(alg.info || Buffer.alloc(0), "HKDF info"), length / 8);
+      return derived instanceof ArrayBuffer ? derived : _toArrayBuffer(Buffer.from(derived));
+    } finally {
+      guard.secret.zeroize(ikm, WebCryptoError, "webcrypto/operation", "the HKDF input key material");
+    }
   }
   if (name === "PBKDF2") {
     _requireDeriveLength(length, "PBKDF2");
@@ -701,7 +709,18 @@ SubtleCrypto.prototype.encapsulateBits = async function encapsulateBits(algorith
   var r;
   try { r = nodeCrypto.encapsulate(encapsulationKey._handle); }
   catch (e) { throw new WebCryptoError("webcrypto/operation", "encapsulateBits: ML-KEM encapsulation failed", e); }
-  return { sharedKey: _toArrayBuffer(Buffer.from(r.sharedKey)), ciphertext: _toArrayBuffer(Buffer.from(r.ciphertext)) };
+  try {
+    // _toArrayBuffer copies via ArrayBuffer.slice, so the shared key is passed straight through --
+    // an intermediate Buffer.from would be another copy of the secret that nothing wipes. The
+    // ciphertext is public and needs no such care, but it is copied the same way for symmetry.
+    return { sharedKey: _toArrayBuffer(r.sharedKey), ciphertext: _toArrayBuffer(r.ciphertext) };
+  } finally {
+    // Encapsulation produces a shared secret exactly as decapsulation does, so it owes the same
+    // duty: the provider's buffer is wiped once the caller's copy exists (NIST SP 800-227 RS5 /
+    // sec. 4.2, RFC 9629 sec. 7). Wiping only the decapsulation side would make the guarantee a
+    // half-truth -- the sender holds the same secret the recipient does.
+    guard.secret.zeroize(r.sharedKey, WebCryptoError, "webcrypto/operation", "the KEM shared secret");
+  }
 };
 
 SubtleCrypto.prototype.decapsulateBits = async function decapsulateBits(algorithm, decapsulationKey, ciphertext) {
@@ -711,10 +730,39 @@ SubtleCrypto.prototype.decapsulateBits = async function decapsulateBits(algorith
   _requireAlgMatch(alg, decapsulationKey, "decapsulateBits");
   if (decapsulationKey.type !== "private") throw new WebCryptoError("webcrypto/invalid-access", "decapsulateBits requires a private (decapsulation) key, got " + JSON.stringify(decapsulationKey.type));
   var ct = _toBuf(ciphertext, "decapsulateBits ciphertext");
+  // FIPS 203 sec. 7.3 makes the ciphertext-length check the ONE per-execution input check a
+  // decapsulating party owes, so it belongs here, at the engine boundary, rather than only in the
+  // format module that happens to call this today: a direct caller -- or a future composite-KEM or
+  // HPKE consumer -- inherits nothing from a check that lives in cms-decrypt. A distinct code names
+  // the real reason, which "the operation failed" cannot.
+  //
+  // Length ONLY. A correct-length ciphertext that has been tampered with must still resolve to a
+  // pseudo-random shared secret (the Fujisaki-Okamoto implicit rejection of FIPS 203 sec. 6.3);
+  // turning that into a throw would hand an attacker a decryption oracle, and it is the property
+  // the CMS uniform verdict is built on.
+  // The registry is keyed by the registered OID name ("id-ml-kem-768"), which is the node
+  // algorithm name this module already maps ("ml-kem-768") under its id- prefix.
+  var kemRow = oid.kemParams("id-" + ML_KEM_NODE[alg.name]);
+  if (kemRow && ct.length !== kemRow.ct) {
+    throw new WebCryptoError("webcrypto/bad-kem-ciphertext",
+      "decapsulateBits: " + alg.name + " expects a " + kemRow.ct + "-octet ciphertext, got " + ct.length + " (FIPS 203 sec. 7.3)");
+  }
   var ss;
   try { ss = nodeCrypto.decapsulate(decapsulationKey._handle, ct); }
   catch (e) { throw new WebCryptoError("webcrypto/operation", "decapsulateBits: ML-KEM decapsulation failed (malformed or wrong-length ciphertext)", e); }
-  return _toArrayBuffer(Buffer.from(ss));
+  try {
+    // ss is already a Buffer, and _toArrayBuffer copies via ArrayBuffer.slice -- so it is passed
+    // straight through. An intermediate Buffer.from(ss) would be a THIRD copy of the secret that
+    // nothing wipes, which would give back most of what the wipe below is for.
+    return _toArrayBuffer(ss);
+  } finally {
+    // The shared secret is returned as a COPY, so the buffer the provider handed back would stay
+    // readable until collection -- and a caller wiping only what it receives would leave the
+    // original behind, which is the whole secret. Wiping here means the engine owns the lifetime of
+    // the buffer it allocated, and every caller (CMS today, a composite KEM or HPKE later) inherits
+    // it rather than each having to remember (NIST SP 800-227 RS5 / sec. 4.2).
+    guard.secret.zeroize(ss, WebCryptoError, "webcrypto/operation", "the KEM shared secret");
+  }
 };
 
 SubtleCrypto.prototype.wrapKey = async function wrapKey(format, key, wrappingKey, wrapAlgorithm) {
@@ -731,10 +779,16 @@ SubtleCrypto.prototype.wrapKey = async function wrapKey(format, key, wrappingKey
     if (bytes.length < 16 || bytes.length % 8 !== 0) {
       throw new WebCryptoError("webcrypto/operation", "wrapKey: AES-KW requires the serialized key be a multiple of 8 bytes (>= 16); got " + bytes.length + " -- format " + JSON.stringify(format) + " is not AES-KW-wrappable");
     }
+    // The mirror of unwrapKey below: in a KEM flow this export is the SENDER's copy of the same
+    // key-encryption key, so leaving it unwiped would keep a full copy of the KEK alive for the
+    // process lifetime and make the wipes the CMS layer performs pointless in the encrypt direction.
+    var wkBytes = null;
     try {
-      var c = nodeCrypto.createCipheriv("aes" + wrappingKey.algorithm.length + "-wrap", _secretBytes(wrappingKey), Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
+      wkBytes = _secretBytes(wrappingKey);
+      var c = nodeCrypto.createCipheriv("aes" + wrappingKey.algorithm.length + "-wrap", wkBytes, Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
       return _toArrayBuffer(Buffer.concat([c.update(bytes), c.final()]));
     } catch (e) { throw new WebCryptoError("webcrypto/operation", "wrapKey: AES-KW key wrap failed", e); }
+    finally { guard.secret.zeroize(wkBytes, WebCryptoError, "webcrypto/operation", "the AES-KW wrapping key"); }
   }
   // Delegate to a content-encryption algorithm (RSA-OAEP / AES-GCM).
   var wrapKeyClone = _cloneWithUsage(wrappingKey, "encrypt");
@@ -760,10 +814,19 @@ SubtleCrypto.prototype.unwrapKey = async function unwrapKey(format, wrappedKey,
     if (wrapped.length < 24 || wrapped.length % 8 !== 0) {
       throw new WebCryptoError("webcrypto/operation", "unwrapKey: AES-KW wrapped key must be a multiple of 8 bytes (>= 24); got " + wrapped.length);
     }
+    // The exported wrapping key is a Buffer this module owns; in a KEM flow it is the KEK derived
+    // from the shared secret, so it is wiped once the unwrap has consumed it -- on the failing path
+    // too, which is the one an attacker induces by tampering with the wrapped key.
+    // Declared outside so the finally can reach it, but EXPORTED INSIDE the try: a key whose handle
+    // cannot be exported must still surface the typed verdict this branch promises, not a raw node
+    // TypeError -- and a non-PkiError throw would also break the fuzz-harness contract.
+    var kwBytes = null;
     try {
-      var d = nodeCrypto.createDecipheriv("aes" + unwrappingKey.algorithm.length + "-wrap", _secretBytes(unwrappingKey), Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
+      kwBytes = _secretBytes(unwrappingKey);
+      var d = nodeCrypto.createDecipheriv("aes" + unwrappingKey.algorithm.length + "-wrap", kwBytes, Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
       bytes = Buffer.concat([d.update(wrapped), d.final()]);
     } catch (e) { throw new WebCryptoError("webcrypto/operation", "unwrapKey: AES-KW key unwrap failed (integrity or length)", e); }
+    finally { guard.secret.zeroize(kwBytes, WebCryptoError, "webcrypto/operation", "the AES-KW unwrapping key"); }
   } else {
     var unwrapKeyClone = _cloneWithUsage(unwrappingKey, "decrypt");
     bytes = Buffer.from(await this.decrypt(unwrapAlgorithm, unwrapKeyClone, wrappedKey));
@@ -783,7 +846,14 @@ SubtleCrypto.prototype.unwrapKey = async function unwrapKey(format, wrappedKey,
   } else {
     keyData = bytes;
   }
-  return this.importKey(format, keyData, unwrappedKeyAlgorithm, extractable, keyUsages);
+  try {
+    return await this.importKey(format, keyData, unwrappedKeyAlgorithm, extractable, keyUsages);
+  } finally {
+    // `bytes` is the UNWRAPPED key in plaintext -- a module-owned buffer, and the last plaintext
+    // copy this layer controls once importKey has taken its own. Clearing the caller-visible copy
+    // downstream while leaving this one live would make that wipe ceremonial.
+    guard.secret.zeroize(bytes, WebCryptoError, "webcrypto/operation", "the unwrapped key material");
+  }
 };
 
 function _cloneWithUsage(key, usage) {
@@ -819,10 +889,13 @@ function _nodeKey(fn, who) {
 // RFC 9935 sec. 6 ML-KEM-*-PrivateKey CHOICE: the inner sizes, keyed by the OID -- the OID is
 // the SOLE authority for the parameter set (never a length heuristic). ek = 384k+32, dk = the
 // FIPS 203 decapsulation key length.
+// {ek, dk} come from the shared ML-KEM parameter registry (FIPS 203 Table 3) -- the same rows the
+// CMS codec and the linter read, so a parameter set cannot mean one size here and another there.
 var ML_KEM_INNER = {};
-ML_KEM_INNER[oid.byName("id-ml-kem-512")] = { ek: 800, dk: 1632 };
-ML_KEM_INNER[oid.byName("id-ml-kem-768")] = { ek: 1184, dk: 2400 };
-ML_KEM_INNER[oid.byName("id-ml-kem-1024")] = { ek: 1568, dk: 3168 };
+["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function (n) {
+  var row = oid.kemParams(n);
+  ML_KEM_INNER[oid.byName(n)] = { ek: row.ek, dk: row.dk };
+});
 
 function _isOctet(node, size) {
   return node && node.tagClass === "universal" && node.tagNumber === asn1.TAGS.OCTET_STRING &&
@@ -1028,9 +1101,16 @@ SubtleCrypto.prototype.exportKey = async function exportKey(format, key) {
   if (!key.extractable) throw new WebCryptoError("webcrypto/invalid-access", "key is not extractable");
   if (format === "jwk") return key._handle.export({ format: "jwk" });
   if (key.type === "secret") {
+    // export() allocates a fresh Buffer holding the secret key, and _toArrayBuffer copies it via
+    // ArrayBuffer.slice -- so the export Buffer is a controllable allocation nothing references once
+    // the copy exists. Wiped in a `finally` so the unsupported-format throw below clears it too.
     var raw = key._handle.export();
-    if (format === "raw") return _toArrayBuffer(raw);
-    throw new WebCryptoError("webcrypto/not-supported", "exportKey: secret keys support 'raw' / 'jwk' only");
+    try {
+      if (format === "raw") return _toArrayBuffer(raw);
+      throw new WebCryptoError("webcrypto/not-supported", "exportKey: secret keys support 'raw' / 'jwk' only");
+    } finally {
+      guard.secret.zeroize(raw, WebCryptoError, "webcrypto/operation", "the exported secret key");
+    }
   }
   if (format === "spki") return _toArrayBuffer(key._handle.export({ format: "der", type: "spki" }));
   if (format === "pkcs8") return _toArrayBuffer(key._handle.export({ format: "der", type: "pkcs8" }));

package/lib/x509-sign.js

@@ -245,6 +245,9 @@ function _hasCriticalSan(extSpec) {
  * (positive, <= 20 octets), the validity UTCTime/GeneralizedTime cutover, the DER DEFAULT omissions
  * (v1 tag, `critical=FALSE`, `cA=FALSE`), and the CA cross-field rules (keyCertSign and
  * pathLenConstraint require cA=TRUE) are all enforced; a violation throws a typed `CertificateError`.
+ * Where the spec carries raw DER -- a `Name` Buffer, a pre-encoded `Extension`, an issuer `publicKey`
+ * SPKI -- a structural fault throws `CertificateError`, while a malformed leaf inside those bytes
+ * throws `Asn1Error`, the same two-error contract the parsers present.
  *
  * @opts
  *   - `pem` (boolean) -- return a PEM `CERTIFICATE` string instead of DER.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.4.11",
+  "version": "0.4.13",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:37941dc8-becd-4983-b264-d6897e595ed1",
+  "serialNumber": "urn:uuid:47691d4d-f958-4718-adb0-5a945e2dd23e",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-09T10:47:07.155Z",
+    "timestamp": "2026-08-10T06:22:53.264Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.4.11",
+      "bom-ref": "@blamejs/pki@0.4.13",
       "type": "application",
       "name": "pki",
-      "version": "0.4.11",
+      "version": "0.4.13",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.4.11",
+      "purl": "pkg:npm/%40blamejs/pki@0.4.13",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.4.11",
+      "ref": "@blamejs/pki@0.4.13",
       "dependsOn": []
     }
   ]