@blamejs/pki 0.5.0 → 0.5.2

package/lib/path-validate.js

@@ -41,6 +41,7 @@ var ocsp = require("./schema-ocsp");
 var ocspVerify = require("./ocsp-verify");
 var crlVerify = require("./crl-verify");
 var cmpVerify = require("./cmp-verify");
+var cmsVerify = require("./cms-verify");
 var cmpSession = require("./cmp-session");
 var guard = require("./guard-all");
 var constants = require("./constants");
@@ -1187,40 +1188,9 @@ async function validate(path, opts) {
   // opts.requiredEku -- the key purposes the TARGET certificate must be good
   // for, each a registered OID name or a dotted OID string. Resolved (and
   // typo-checked) here at the entry point.
-  var requiredEku = null;
-  if (opts.requiredEku !== undefined) {
-    if (!Array.isArray(opts.requiredEku) || opts.requiredEku.length === 0) {
-      throw E("path/bad-input", "validate: opts.requiredEku must be a non-empty array of key-purpose OID names or dotted OID strings");
-    }
-    requiredEku = opts.requiredEku.map(function (p) {
-      if (typeof p !== "string" || p.length === 0) throw E("path/bad-input", "validate: opts.requiredEku entries must be non-empty strings");
-      // A dotted-form attempt (leads with a digit) must be a canonical OID -- a
-      // loose regex accepted a leading-zero / out-of-bounds key that would never
-      // match the canonical EKU the target advertises; anything else is a name.
-      if (/^[0-9]/.test(p)) return guard.identifier.assertCanonicalOid(p, E, "path/bad-input", "validate: opts.requiredEku entry " + JSON.stringify(p));
-      var dotted = oid.byName(p);
-      if (typeof dotted !== "string") throw E("path/bad-input", "validate: opts.requiredEku entry " + JSON.stringify(p) + " is not a registered OID name");
-      return dotted;
-    });
-  }
-  // opts.checkPurpose -- the single key purpose the ANCHOR's NSS trust metadata
-  // (distrustAfter / purposes) is consulted for. Independent of requiredEku
-  // (which gates the leaf's own EKU extension): this selects the per-purpose
-  // key in the trust-anchor constraint contract. A purpose OID name (or a
-  // canonical dotted OID normalized to its name); a bad value throws here.
-  var checkPurpose = null;
-  if (opts.checkPurpose !== undefined) {
-    if (typeof opts.checkPurpose !== "string" || opts.checkPurpose.length === 0) {
-      throw E("path/bad-input", "validate: opts.checkPurpose must be a key-purpose OID name or dotted OID string");
-    }
-    if (/^[0-9]/.test(opts.checkPurpose)) {
-      var cpDotted = guard.identifier.assertCanonicalOid(opts.checkPurpose, E, "path/bad-input", "validate: opts.checkPurpose");
-      checkPurpose = oid.name(cpDotted) || cpDotted;   // normalize a dotted purpose OID to its name for the anchor map
-    } else {
-      if (typeof oid.byName(opts.checkPurpose) !== "string") throw E("path/bad-input", "validate: opts.checkPurpose " + JSON.stringify(opts.checkPurpose) + " is not a registered OID name");
-      checkPurpose = opts.checkPurpose;
-    }
-  }
+  var purposeOpts = resolvePurposeOpts(opts);
+  var requiredEku = purposeOpts.requiredEku;
+  var checkPurpose = purposeOpts.checkPurpose;
 
   var state = initialize(certs, opts, seeds);
   state._n = n;
@@ -1385,9 +1355,8 @@ async function validate(path, opts) {
       // NaN time) would make `notBefore > it` NaN-false and SILENTLY drop the distrust
       // restriction -- the NaN-Date fail-open. Validate a present date fail-closed
       // before the comparison; an absent (undefined/null) date is no restriction.
-      var distrustDate = (checkPurpose && ta.distrustAfter) ? ta.distrustAfter[checkPurpose] : null;
+      var distrustDate = assertAnchorConstraints(ta, checkPurpose);
       if (distrustDate != null) {
-        distrustDate = guard.time.assertValid(distrustDate, E, "path/bad-input", "trustAnchor.distrustAfter." + checkPurpose);
         // STRICTLY > : a leaf whose notBefore == the distrust date stays trusted
         // (Mozilla certverifier isDistrustedCertificateChain: endEntityNotBefore
         // <= distrustAfterTime -> not distrusted; the end-of-day ...235959Z
@@ -2211,6 +2180,16 @@ var ocspCore = ocspVerify.makeOcspVerify({
 cmpVerify.setEngine({ verifyWithSpki: _verifyWithSpki, build: build, validate: validate });
 // pki.cmp.session validates the ISSUED leaf certificate (its signature + chain) through the same engine.
 cmpSession.setEngine({ build: build, validate: validate, toAnchor: toAnchor, coerceCert: coerceCert });
+// pki.cms.verify chains a SignedData's signer certificate to the anchors the CALLER named, so its
+// `trusted` is decided by this one path engine rather than a second, weaker walk of its own.
+// `toAnchor` so cms.verify can validate the caller's anchors ONCE at entry, before any signer is
+// walked -- otherwise a message whose signers all failed would never reach a build call and a
+// malformed anchor would pass unnoticed.
+// `resolvePurposeOpts` so cms.verify can reject a malformed requiredEku / checkPurpose at ITS entry
+// point, through the SAME definition the walk uses -- a message whose signers all failed never
+// reaches a build call, and a caller's configuration must not be judged by the message's quality.
+cmsVerify.setEngine({ build: build, validate: validate, toAnchor: toAnchor,
+  resolvePurposeOpts: resolvePurposeOpts, assertAnchorConstraints: assertAnchorConstraints });
 
 /**
  * @primitive  pki.path.ocspChecker
@@ -2440,6 +2419,63 @@ function coerceCert(input) {
 // tuple. The algorithm is the SPKI KEY-algorithm OID (the sec. 6.1.4(f)
 // parameter-inheritance value), mirroring trust.js _mkAnchor -- NOT the
 // signature OID. The anchor is an input to validate, never one of the path certs.
+// The two key-purpose options, resolved and typo-checked. Extracted so a CALLER can validate them
+// at ITS entry point rather than only when a path is actually walked: a format verb that skips the
+// walk -- pki.cms.verify does when no signer verified -- would otherwise accept a malformed
+// purpose in silence, making configuration validity depend on the message. One definition, so the
+// answer cannot drift between the caller's early check and the walk's own.
+//
+// `requiredEku` gates the TARGET certificate's own EKU extension; `checkPurpose` selects which
+// per-purpose key the ANCHOR's NSS trust metadata (purposes / distrustAfter) is consulted under.
+// They are independent, and each is a registered OID name or a canonical dotted OID.
+// An anchor's CONSTRAINT metadata for one purpose, validated fail-closed and returned normalized.
+// A PRESENT-but-malformed distrustAfter (an Invalid Date: instanceof Date yet a NaN time) would
+// make `notBefore > it` NaN-false and SILENTLY drop the distrust restriction -- the NaN-Date
+// fail-open. Absent metadata is no restriction and returns null.
+//
+// Separate from resolvePurposeOpts because it validates the ANCHOR rather than the options, and
+// exposed for the same reason: a caller that may never reach the walk -- pki.cms.verify when no
+// signer verified -- has to be able to reject a malformed anchor at ITS entry point, through this
+// same definition, so configuration validity never depends on the message.
+function assertAnchorConstraints(ta, checkPurpose) {
+  var d = (checkPurpose && ta && ta.distrustAfter) ? ta.distrustAfter[checkPurpose] : null;
+  if (d == null) return null;
+  return guard.time.assertValid(d, E, "path/bad-input", "trustAnchor.distrustAfter." + checkPurpose);
+}
+
+function resolvePurposeOpts(opts) {
+  var requiredEku = null;
+  if (opts.requiredEku !== undefined) {
+    if (!Array.isArray(opts.requiredEku) || opts.requiredEku.length === 0) {
+      throw E("path/bad-input", "validate: opts.requiredEku must be a non-empty array of key-purpose OID names or dotted OID strings");
+    }
+    requiredEku = opts.requiredEku.map(function (p) {
+      if (typeof p !== "string" || p.length === 0) throw E("path/bad-input", "validate: opts.requiredEku entries must be non-empty strings");
+      // A dotted-form attempt (leads with a digit) must be a canonical OID -- a
+      // loose regex accepted a leading-zero / out-of-bounds key that would never
+      // match the canonical EKU the target advertises; anything else is a name.
+      if (/^[0-9]/.test(p)) return guard.identifier.assertCanonicalOid(p, E, "path/bad-input", "validate: opts.requiredEku entry " + JSON.stringify(p));
+      var dotted = oid.byName(p);
+      if (typeof dotted !== "string") throw E("path/bad-input", "validate: opts.requiredEku entry " + JSON.stringify(p) + " is not a registered OID name");
+      return dotted;
+    });
+  }
+  var checkPurpose = null;
+  if (opts.checkPurpose !== undefined) {
+    if (typeof opts.checkPurpose !== "string" || opts.checkPurpose.length === 0) {
+      throw E("path/bad-input", "validate: opts.checkPurpose must be a key-purpose OID name or dotted OID string");
+    }
+    if (/^[0-9]/.test(opts.checkPurpose)) {
+      var cpDotted = guard.identifier.assertCanonicalOid(opts.checkPurpose, E, "path/bad-input", "validate: opts.checkPurpose");
+      checkPurpose = oid.name(cpDotted) || cpDotted;   // normalize a dotted purpose OID to its name for the anchor map
+    } else {
+      if (typeof oid.byName(opts.checkPurpose) !== "string") throw E("path/bad-input", "validate: opts.checkPurpose " + JSON.stringify(opts.checkPurpose) + " is not a registered OID name");
+      checkPurpose = opts.checkPurpose;
+    }
+  }
+  return { requiredEku: requiredEku, checkPurpose: checkPurpose };
+}
+
 function toAnchor(entry) {
   if (entry && typeof entry === "object" && !Buffer.isBuffer(entry) && entry.name && entry.publicKey && entry.algorithm) {
     // A ready anchor tuple: validate the shape build + validate consume -- name.rdns

package/lib/sigstore.js

@@ -516,14 +516,54 @@ function _fulcioExtValue(ext, leafArc) {
   return asn1.read.string(asn1.decode(ext.value));
 }
 
+// The fields an identity policy may constrain. Named once so the check, the refusal of an
+// unknown key, and the report of what ran cannot drift apart.
+var IDENTITY_FIELDS = ["san", "issuer", "sourceRepositoryURI"];
+// The guard tests membership with hasOwnProperty, so the permitted set is a lookup object --
+// an array would treat "0"/"1" as the known keys and reject every real field name.
+var IDENTITY_KEYS = { san: 1, issuer: 1, sourceRepositoryURI: 1 };
+
+// Returns WHICH fields were actually compared. A bundle verifies its own signature and log
+// inclusion whoever signed it -- Fulcio issues to anyone who completes an OIDC flow -- so
+// `verified: true` without an identity policy says the artifact was signed and logged, not that
+// a trusted party signed it. The caller cannot tell those apart from a bare boolean.
 function _checkIdentity(id, policy) {
-  if (!policy) return;
+  var ran = { san: false, issuer: false, sourceRepositoryURI: false };
+  if (policy === undefined || policy === null) return ran;
+  if (typeof policy !== "object" || Array.isArray(policy)) {
+    throw _err("sigstore/bad-input", "opts.identity must be an object naming the identity fields to pin (" + IDENTITY_FIELDS.join(", ") + ")");
+  }
+  // An unknown key is refused, not ignored: cosign spells this `certificateIdentity`, and a
+  // swallowed spelling checks nothing under a name the operator believes pins the signer.
+  // The guard rejects through a (code, message) FACTORY. Handing it the error CLASS raises
+  // "class constructor cannot be invoked without new" -- a raw, untyped throw escaping a public
+  // verb, on the branch a valid-input test never takes.
+  guard.identifier.assertKnownKeys(policy, IDENTITY_KEYS, _err, "sigstore/bad-input", "opts.identity has an unknown key ");
+  // A policy that constrains NOTHING is a configuration mistake, and the most dangerous input on
+  // this surface: every guard below is falsy, so it accepts every signer while reading as though
+  // an identity policy is in force. Refused at the boundary rather than answered.
+  var asked = IDENTITY_FIELDS.filter(function (f) { return policy[f] !== undefined; });
+  if (!asked.length) {
+    throw _err("sigstore/bad-input", "opts.identity constrains nothing -- name at least one of " + IDENTITY_FIELDS.join(", ") + ", or omit it to state that the signer is not being checked");
+  }
+  // A named field must carry a value that can actually be compared. The comparisons below are
+  // truthiness-guarded, so an empty string or a null would be skipped while the field had been
+  // named -- reporting a signer check that never ran, which is the exact confusion this report
+  // exists to remove. Deciding "asked" and deciding "compared" must be the SAME test, so a value
+  // that cannot be compared is refused here rather than quietly becoming "not asked".
+  asked.forEach(function (f) {
+    if (typeof policy[f] !== "string" || policy[f] === "") {
+      throw _err("sigstore/bad-input", "opts.identity." + f + " must be a non-empty string -- a value that cannot be compared would leave the signer unchecked under a policy that names it");
+    }
+    ran[f] = true;
+  });
   var sanValue = id.san && id.san.value;
   if (policy.san && sanValue !== policy.san) throw _err("sigstore/identity-mismatch", "the certificate SAN " + JSON.stringify(sanValue) + " does not match the expected identity");
   // The OIDC issuer is carried by the current Issuer V2 (.1.8) or, on older certs,
   // only by the deprecated raw-string issuer (.1.1); match against either.
   if (policy.issuer && policy.issuer !== id.extensions.issuer && policy.issuer !== id.extensions.issuerLegacy) throw _err("sigstore/identity-mismatch", "the certificate OIDC issuer does not match the expected issuer");
   if (policy.sourceRepositoryURI && id.extensions.sourceRepositoryURI !== policy.sourceRepositoryURI) throw _err("sigstore/identity-mismatch", "the certificate source-repository URI does not match");
+  return ran;
 }
 
 // ---- in-toto Statement leg ---------------------------------------------------
@@ -561,14 +601,23 @@ function _statement(payload, payloadType, expectedPredicate) {
  * the log entry bound to this exact signature; and the in-toto SLSA statement.
  * Any leg failing throws a typed `sigstore/*` error. On success returns
  * `{ verified: true, payload, statement, subjects, predicateType, predicate,
- * identity, integratedTime }` -- `payload` is the RAW verified envelope bytes
- * (never a re-serialization), and the caller confirms a `subjects[].digest`
- * matches the published artifact.
+ * identity, identityChecked, integratedTime }` -- `payload` is the RAW verified
+ * envelope bytes (never a re-serialization), and the caller confirms a
+ * `subjects[].digest` matches the published artifact.
+ *
+ * `verified: true` says the artifact was signed and logged -- not that a party you
+ * trust signed it. Fulcio issues a certificate to anyone who completes an OIDC
+ * flow, so WHO signed is decided only by `opts.identity`, and `identityChecked`
+ * reports which of its fields were compared (`{ san, issuer, sourceRepositoryURI }`,
+ * each a boolean). An `identity` naming none of them is refused rather than
+ * satisfied, since it would accept every signer while reading as a policy; so is an
+ * unrecognized field name, which would otherwise pin nothing under a spelling the
+ * operator believes constrains the signer.
  *
  * @opts
  *   fulcioRoots:   Array,      // the Fulcio CA anchors: a DER Buffer or { der, validFor } each
  *   rekorKeys:     Array,      // [{ keyId, spki, validFor? }] the Rekor log public keys
- *   identity:      object,     // optional policy: { san, issuer, sourceRepositoryURI }
+ *   identity:      object,     // optional policy: { san, issuer, sourceRepositoryURI }; at least one required when present
  *   predicateType: string,     // optional: require this in-toto predicateType (e.g. the SLSA URI)
  *   time:          Date,       // optional check-date override (default: the Rekor integratedTime)
  *
@@ -616,7 +665,7 @@ async function verifyBundle(bundle, opts) {
   var checkTime = (opts.time instanceof Date) ? opts.time.getTime() : C.TIME.seconds(integratedTime);
   await _verifyChain(leaf, _chainDers(vm), fulcioRoots, checkTime);
   var identity = _identity(leaf);
-  _checkIdentity(identity, opts.identity);
+  var identityChecked = _checkIdentity(identity, opts.identity);
 
   // Leg 4 -- the in-toto SLSA statement + subject binding (with an optional
   // caller-pinned predicateType).
@@ -630,6 +679,9 @@ async function verifyBundle(bundle, opts) {
     predicateType: st.predicateType,
     predicate: st.predicate,
     identity: identity,
+    // Which identity fields were actually compared. `verified` says the artifact was signed and
+    // logged; only these say a signer the caller named was the one who signed it.
+    identityChecked: identityChecked,
     integratedTime: integratedTime,
   };
 }

package/lib/smime.js

@@ -567,7 +567,7 @@ function _capped(msg) {
 
 /**
  * @primitive  pki.smime.verify
- * @signature  pki.smime.verify(message, opts?) -> Promise<{ valid, signers, form, content, micalg, protectedHeaders, headerProtection }>
+ * @signature  pki.smime.verify(message, opts?) -> Promise<{ valid, trusted, signers, form, content, micalg, protectedHeaders, headerProtection }>
  * @since      0.2.25
  * @status     stable
  * @spec       RFC 8551, RFC 5652, RFC 9788
@@ -577,9 +577,19 @@ function _capped(msg) {
  * `application/pkcs7-mime; smime-type=signed-data`. For `multipart/signed` the detached CMS signature
  * is recomputed over the first part's RFC 8551 sec. 3.1.1 canonical form (the SAME canonicalizer the
  * signer used); for `application/pkcs7-mime` the base64 body is the attached CMS SignedData. Returns
- * `pki.cms.verify`'s `{ valid, signers }` verdict PLUS `form`, the recovered `content` (the signed MIME
- * entity bytes), and the `micalg`. Like `cms.verify`, this returns the cryptographic verdict only --
- * chaining a signer certificate to a trust anchor is the caller's `pki.path.validate` step. A `micalg`
+ * `pki.cms.verify`'s `{ valid, trusted, signers }` verdict PLUS `form`, the recovered `content` (the
+ * signed MIME entity bytes), and the `micalg`.
+ *
+ * `valid` and `trusted` are separate claims, exactly as in `cms.verify`: a SignedData carries its own
+ * certificates, so `valid` says the signature is sound under one of them and nothing about who signed.
+ * Name the roots you accept in `opts.trustAnchors` and `trusted` says every signer chained to one --
+ * validated for EMAIL, at both ends of the chain. The signer certificate must carry the
+ * `emailProtection` key purpose (RFC 8551 sec. 4.4.4), because a certificate restricted to `serverAuth`
+ * chains to its root perfectly well and is still the wrong key to have signed a message; and the anchor's
+ * own trust metadata must permit that purpose, because a root distributed with NSS trust bits can be
+ * marked untrusted for email while remaining a good TLS root. Override either with `opts.requiredEku`
+ * and `opts.checkPurpose`. Supply no anchors and `trusted` is `false` -- there was nothing to chain to.
+ * A `micalg`
  * that disagrees with the actual digest is advisory unless `opts.strictMicalg` (then `smime/micalg-mismatch`).
  * If the message is header-protected (RFC 9788), `protectedHeaders` is the AUTHENTICATED inner header set (a
  * tampered outer header cannot alter it) and `headerProtection` is `{ present, mode, fromMismatch, confidential, legacy }`
@@ -596,6 +606,11 @@ function _capped(msg) {
  * `protectedHeaders` cannot mistake the opt-in heuristic for authenticated headers.
  *
  * @opts certs        extra signer certificates (DER `Buffer`s) to match, forwarded to `cms.verify`.
+ * @opts trustAnchors the roots you accept, forwarded to `cms.verify`; supplying them is what makes
+ *                    `trusted` answerable. Certificate DER or anchor tuples.
+ * @opts time         the instant the signer's chain is judged at (default now). Only read with `trustAnchors`.
+ * @opts requiredEku  key purposes the SIGNER certificate must carry. Defaults to `["emailProtection"]`.
+ * @opts checkPurpose the purpose the ANCHOR's own trust metadata must permit. Defaults to `"emailProtection"`.
  * @opts strictMicalg reject a `multipart/signed` whose `micalg` disagrees with the SignerInfo digest.
  * @opts legacyHeaderProtection  opt in to detecting a LEGACY RFC 8551 header-protected message (RFC 9788 sec. 4.10): a Cryptographic Payload that is a bare `message/rfc822` wrap with no `hp=` parameter. When set, a precisely-identified legacy message surfaces the inner message's headers under `headerProtection.legacy = { headers, mode, fromMismatch, confidential }` -- `headers` an ordered `[{ name, value }]` array (retaining legally-repeated fields such as `Received`), the mode inferred from the envelope (`clear` here) -- NOT under `protectedHeaders`, and `present` stays `false`. Consuming `headerProtection.legacy.headers` is an explicit choice: a legacy message is structurally indistinguishable from an ordinary forwarded `message/rfc822`, so this is a heuristic (RFC 9788 sec. 4.10.2: "not based on any strong end-to-end guarantees") -- cross-check `legacy.fromMismatch`. Anything not precisely identified (a nested crypto layer, an `hp=` on the inner message, a non-`message/rfc822` payload, a duplicate of a singleton field, or a duplicate Content-Type) reports `legacy: null`. Off by default. The signed-and-encrypted form (RFC 9788 Appendix C.3.17) is a documented gap (`legacy: null` at `decrypt`; surfaces as `clear` only via the caller's re-`verify` step) -- the non-recursive layered API exposes no single seam holding both the inner signature verdict and the outer header section.
  * @example
@@ -611,8 +626,28 @@ async function verify(message, opts) {
   opts = opts || {};
   var ent = mime.parse(message, SmimeError, "smime/bad-mime");
   var ct = ent.contentType;
+  // Forwarded, not re-decided here. This verb documents itself as pki.cms.verify's verdict plus the
+  // MIME surface, so the trust seam that verb offers has to reach it: building the options from
+  // scratch and passing only `certs` would leave a caller naming trust anchors with no way to have
+  // them applied, and a `trusted` that read false for want of ever being asked.
   var vOpts = {};
   if (opts.certs) vOpts.certs = opts.certs;
+  if (opts.trustAnchors != null) {
+    vOpts.trustAnchors = opts.trustAnchors;
+    // Trusted FOR THIS PURPOSE. A chain alone does not make a signer right for email: a
+    // certificate restricted to serverAuth chains to its root perfectly well and is still the
+    // wrong key to have signed a message. RFC 8551 sec. 4.4.4 names emailProtection as the purpose
+    // an S/MIME signer's certificate must carry, so this verb asks for it rather than accepting the
+    // purpose-neutral answer. A caller who means something else says so with `requiredEku`.
+    vOpts.requiredEku = opts.requiredEku != null ? opts.requiredEku : ["emailProtection"];
+    // Both ends of the chain. The EKU above constrains the LEAF; this selects the anchor's own
+    // trust metadata, which pki.path consults only when a purpose is named. A root distributed
+    // with NSS trust bits can be marked untrusted for email while remaining a good TLS root, so
+    // asking only the leaf would let a root explicitly distrusted for email still answer
+    // "trusted" for an email message.
+    vOpts.checkPurpose = opts.checkPurpose != null ? opts.checkPurpose : "emailProtection";
+  }
+  if (opts.time !== undefined) vOpts.time = opts.time;
   if (_isPkcs7(ct.type, "mime")) {
     if (ct.params["smime-type"] && ct.params["smime-type"] !== "signed-data") throw _err("smime/unsupported-type", "unsupported smime-type " + JSON.stringify(ct.params["smime-type"]) + " (only signed-data)");
     var p7m = _decodeCms(ent);
@@ -620,7 +655,7 @@ async function verify(message, opts) {
     var inner;
     try { inner = _toBuf(schemaCms.parse(p7m).encapContentInfo.eContent); }
     catch (e) { throw _err("smime/bad-mime", "the pkcs7-mime SignedData has no encapsulated content", e); }
-    return Object.assign({ valid: res.valid, signers: res.signers, form: "pkcs7-mime", content: inner, micalg: null }, _hpSurface(inner, ent, "clear", res.valid, opts.legacyHeaderProtection === true));
+    return Object.assign({ valid: res.valid, trusted: res.trusted, signers: res.signers, form: "pkcs7-mime", content: inner, micalg: null }, _hpSurface(inner, ent, "clear", res.valid, opts.legacyHeaderProtection === true));
   }
   if (ct.type === "multipart/signed") {
     if (ct.params.protocol && !_isPkcs7(ct.params.protocol, "signature")) throw _err("smime/bad-multipart", "multipart/signed protocol must be application/pkcs7-signature");
@@ -647,7 +682,7 @@ async function verify(message, opts) {
     if (opts.strictMicalg && micalg && _micalgSet(micalg) !== (_micalgOf(p7s) || "")) {
       throw _err("smime/micalg-mismatch", "the multipart/signed micalg " + JSON.stringify(micalg) + " disagrees with the SignerInfo digests");
     }
-    return Object.assign({ valid: res2.valid, signers: res2.signers, form: "multipart/signed", content: parts[0], micalg: micalg }, _hpSurface(parts[0], ent, "clear", res2.valid, opts.legacyHeaderProtection === true));
+    return Object.assign({ valid: res2.valid, trusted: res2.trusted, signers: res2.signers, form: "multipart/signed", content: parts[0], micalg: micalg }, _hpSurface(parts[0], ent, "clear", res2.valid, opts.legacyHeaderProtection === true));
   }
   throw _err("smime/unsupported-type", "not a signed S/MIME message (Content-Type " + JSON.stringify(ct.type) + ")");
 }

package/lib/tsp-sign.js

@@ -604,9 +604,19 @@ function _buildTsaChains(leaf, pool) {
  *   res.valid;     // boolean; pass opts.trustAnchor to also chain the TSA cert to a root
  *   res.genTime;   // Date, read from the verified eContent
  */
+// Every option pki.tsp.verify reads. Adding one here is the only way to make it accepted.
+var _VERIFY_OPTS = { certs: 1, trustAnchor: 1, nonce: 1, reqPolicy: 1, revocationChecker: 1 };
+
 async function verify(token, data, opts) {
   opts = opts || {};
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("tsp/bad-input", "pki.tsp.verify options must be an object");
+  // An unrecognized option is refused rather than ignored. This verb spells its anchor option
+  // SINGULAR -- `trustAnchor`, an anchor tuple -- while pki.cms.verify and pki.cmp.verify spell it
+  // `trustAnchors` and take certificate DER. A caller carrying the plural spelling here would
+  // otherwise get no anchoring and no error: the TSA certificate unchained, `valid: true`, and
+  // nothing to notice it by. Naming the difference at the boundary is the only place it is cheap.
+  guard.identifier.assertKnownKeys(opts, _VERIFY_OPTS, _err, "tsp/bad-input",
+    "pki.tsp.verify has an unknown option (note the anchor option here is `trustAnchor`, singular, an anchor tuple -- not the `trustAnchors` certificate list pki.cms.verify takes) ");
   if (opts.certs != null && (!Array.isArray(opts.certs) || !opts.certs.every(function (c) { return Buffer.isBuffer(c) || c instanceof Uint8Array; }))) {
     throw _err("tsp/bad-input", "pki.tsp.verify opts.certs must be an array of DER certificate Buffers");   // a bad element is a caller error, never silently dropped
   }

package/lib/validator-cose.js

@@ -61,7 +61,12 @@ var ALG_PROFILE = {
   "-7": { kty: 2, crv: 1 }, "-35": { kty: 2, crv: 2 }, "-36": { kty: 2, crv: 3 },
   "-9": { kty: 2, crv: 1 }, "-51": { kty: 2, crv: 2 }, "-52": { kty: 2, crv: 3 },
   "-8": { kty: 1, crv: 6 }, "-19": { kty: 1, crv: 6 }, "-53": { kty: 1, crv: 7 },
-  "-257": { kty: 3 }, "-258": { kty: 3 }, "-259": { kty: 3 }, "-37": { kty: 3 }, "-65535": { kty: 3 },
+  // RSASSA-PSS at all three strengths. PS256 alone left PS384/PS512 refused at PARSE time on a key
+  // that is perfectly well-formed -- the same bytes accepted under -37 -- so the refusal blamed the
+  // key rather than the algorithm, and a relying party migrating credential rows written by another
+  // implementation could not tell which of its stored keys this verifier would decline, or why.
+  "-257": { kty: 3 }, "-258": { kty: 3 }, "-259": { kty: 3 },
+  "-37": { kty: 3 }, "-38": { kty: 3 }, "-39": { kty: 3 }, "-65535": { kty: 3 },
 };
 
 // credentialKey(node, E, code) -> the decoded + validated credential public key
@@ -72,7 +77,10 @@ var ALG_PROFILE = {
 // @enforced-by validator-shape-reinlined
 // @validator-shape kty\s*===\s*2n
 // @validator-shape EC2_CRV_LEN|ALG_PROFILE
-function credentialKey(node, E, code) {
+// `unsupportedCode` is OPTIONAL and names the code raised when the key is well-formed but its
+// algorithm is not one this verifier implements -- a different fact from a malformed key. Omit it
+// and that case keeps raising `code`, so an existing caller sees no change.
+function credentialKey(node, E, code, unsupportedCode) {
   function bad(msg, cause) { return new E(code, msg, cause); }
   if (!node || node.majorType !== 5) throw bad("a COSE_Key must be a CBOR map (RFC 9052 sec. 7)");
   // Every parameter read maps a wrong-type cbor/* fault to the caller's domain -- a
@@ -111,7 +119,12 @@ function credentialKey(node, E, code) {
   if (node.children.length !== expectedParams) throw bad("the COSE_Key carries parameters beyond the canonical set for its key type (WebAuthn sec. 6.5.1)");
   // PROFILE: the declared alg must match the key type (and, for EC2, the curve).
   var prof = ALG_PROFILE[String(key.alg)];
-  if (!prof) throw bad("unsupported credential key algorithm " + key.alg);
+  // An algorithm this verifier does not implement is NOT a malformed key. The key can be perfectly
+  // well-formed -- the same bytes may parse under a neighbouring algorithm id -- and a relying
+  // party migrating credential rows written elsewhere needs to tell "I cannot check this
+  // algorithm" from "these bytes are wrong", since only one of those is fixable by re-registering.
+  // Callers that do not distinguish the two pass one code and keep the previous behaviour.
+  if (!prof) throw new E(unsupportedCode || code, "unsupported credential key algorithm " + key.alg);
   if (prof.kty !== key.kty) throw bad("credential key algorithm " + key.alg + " is inconsistent with key type " + key.kty);
   if (prof.crv != null && prof.crv !== key.crv) throw bad("credential key algorithm " + key.alg + " requires a different curve");
   // ON-CURVE: import the SPKI so OpenSSL validates the EC point on its curve. An off-curve

package/lib/webauthn.js

@@ -73,7 +73,7 @@ function _isInteger(node) { return !!node && !node.constructed && node.tagClass
 // step rejects the attestation before the signature is evaluated. EdDSA (-8/-19/-53) is
 // absent by design: a TPM 2.0 AIK never signs with EdDSA, so such an attestation is
 // correctly refused.
-var COSE_ALG_HASH = { "-7": "sha256", "-9": "sha256", "-257": "sha256", "-37": "sha256", "-35": "sha384", "-51": "sha384", "-258": "sha384", "-36": "sha512", "-52": "sha512", "-259": "sha512", "-65535": "sha1" };
+var COSE_ALG_HASH = { "-7": "sha256", "-9": "sha256", "-257": "sha256", "-37": "sha256", "-35": "sha384", "-51": "sha384", "-258": "sha384", "-38": "sha384", "-36": "sha512", "-52": "sha512", "-259": "sha512", "-39": "sha512", "-65535": "sha1" };
 function _coseAlgHash(alg, E) {
   var h = COSE_ALG_HASH[String(alg)];
   if (!h) throw E("webauthn/unsupported-algorithm", "no hash mapping for COSE algorithm " + alg);
@@ -141,7 +141,54 @@ function _parseAuthData(buf, E) {
 // The complete COSE credential-key conformance rule set (kty/alg/crv/length/canonical/
 // profile/on-curve) lives in validator-cose, composed here so every credential key
 // routes through the one home -- never a per-format re-derivation of a partial subset.
-function _decodeCoseKey(node) { return validator.cose.credentialKey(node, WebauthnError, "webauthn/bad-cose-key"); }
+function _decodeCoseKey(node) {
+  return validator.cose.credentialKey(node, WebauthnError, "webauthn/bad-cose-key", "webauthn/unsupported-algorithm");
+}
+
+/**
+ * @primitive  pki.webauthn.parseCoseKey
+ * @signature  pki.webauthn.parseCoseKey(bytes) -> object
+ * @since      0.5.2
+ * @status     stable
+ * @spec       RFC 9052, W3C WebAuthn Level 3 sec. 6.5.1
+ * @related    pki.webauthn.verify, pki.webauthn.verifyAssertion
+ *
+ * Decode a bare COSE_Key -- the credential public key a relying party stored at
+ * registration -- back into the object `verifyAssertion` takes. `pki.webauthn.verify`
+ * returns that object, but the durable form is bytes: the object carries `Buffer`
+ * values, so a JSON round trip through a datastore yields
+ * `{"type":"Buffer","data":[...]}` rather than the object that went in, and existing
+ * credential stores already hold COSE bytes whoever wrote them. Without this the only
+ * routes into the decoder were `parseAttestationObject` and `parseAuthenticatorData`,
+ * both of which parse a CONTAINING structure -- so recovering a stored key meant
+ * fabricating an authenticatorData that never existed.
+ *
+ * The same validation the attestation path applies: the key type, the algorithm, the
+ * curve, and the coordinates are checked, and anything that is not a credential COSE
+ * key is refused with `webauthn/bad-cose-key`. `verifyAssertion` accepts either form
+ * for `credentialPublicKey`, so calling this first is a convenience rather than a step.
+ *
+ * @example
+ *   // requires: `attestationObject` / `clientDataHash` -- what a browser returns from a
+ *   // registration ceremony
+ *   var reg = await pki.webauthn.verify(attestationObject, clientDataHash, {});
+ *   var stored = reg.credentialPublicKeyBytes;   // the form a credential row holds
+ *   // ... at a login months later, read it back:
+ *   var key = pki.webauthn.parseCoseKey(stored);
+ *   key.alg;   // -> -7 for ES256
+ *   // verifyAssertion takes either form, so this parse is a convenience, not a step:
+ *   // pass `stored` straight as its credentialPublicKey.
+ */
+function parseCoseKey(bytes) {
+  var buf = _snapshotBytes(bytes, "the COSE key");
+  if (!Buffer.isBuffer(buf)) {
+    throw _err("webauthn/bad-input", "parseCoseKey takes the stored COSE key bytes (a Buffer, TypedArray or ArrayBuffer)");
+  }
+  var node;
+  try { node = cbor.decode(buf); }
+  catch (e) { throw _err("webauthn/bad-cose-key", "the stored credential key is not decodable CBOR", e); }
+  return _decodeCoseKey(node);
+}
 
 // ---- signature verification bridge ------------------------------------------
 
@@ -165,7 +212,11 @@ var COSE_ALG = {
   "-257": { imp: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, verify: { name: "RSASSA-PKCS1-v1_5" }, ecdsa: 0 },
   "-258": { imp: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-384" }, verify: { name: "RSASSA-PKCS1-v1_5" }, ecdsa: 0 },
   "-259": { imp: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-512" }, verify: { name: "RSASSA-PKCS1-v1_5" }, ecdsa: 0 },
+  // RSASSA-PSS. The salt length is the hash length, the profile WebCrypto verifies and the one
+  // RFC 8230 sec. 2 fixes for the COSE PS* identifiers -- 32 / 48 / 64 bytes for SHA-256/384/512.
   "-37":  { imp: { name: "RSA-PSS", hash: "SHA-256" }, verify: { name: "RSA-PSS", saltLength: 32 }, ecdsa: 0 },
+  "-38":  { imp: { name: "RSA-PSS", hash: "SHA-384" }, verify: { name: "RSA-PSS", saltLength: 48 }, ecdsa: 0 },
+  "-39":  { imp: { name: "RSA-PSS", hash: "SHA-512" }, verify: { name: "RSA-PSS", saltLength: 64 }, ecdsa: 0 },
   // RS1 (RSASSA-PKCS1-v1_5 / SHA-1): a legacy COSE algorithm real Windows Hello TPM
   // authenticators emit in their attestation statement. VERIFY-only support -- the
   // toolkit never signs with SHA-1; it must still evaluate the attestations that
@@ -1139,6 +1190,11 @@ function _result(fmt, attestationType, chain, att) {
     aaguid: att.authData.aaguid,
     credentialId: att.authData.credentialId,
     credentialPublicKey: att.authData.credentialPublicKey,
+    // The same key in the form that SURVIVES STORAGE. The decoded object carries Buffers, so a JSON
+    // round trip through a datastore returns {"type":"Buffer","data":[...]} rather than what went
+    // in; the COSE bytes are what a credential row actually holds. Returning only the object left
+    // the caller re-parsing the attestation object to recover bytes this call had already isolated.
+    credentialPublicKeyBytes: att.authData.credentialPublicKeyBytes,
     signCount: att.authData.signCount,
     flags: att.authData.flags,
   };
@@ -1176,7 +1232,7 @@ function _checkAndroidKeyDescription(cert, clientDataHash) {
 
 /**
  * @primitive pki.webauthn.verify
- * @signature pki.webauthn.verify(attestationObject, clientDataHash, opts) -> Promise<{ attestationVerified, fmt, attestationType, trustPath, anchoredTo, anchoredElements, aaguid, credentialId, credentialPublicKey, signCount, flags, bindingChecked }>
+ * @signature pki.webauthn.verify(attestationObject, clientDataHash, opts) -> Promise<{ attestationVerified, fmt, attestationType, trustPath, anchoredTo, anchoredElements, aaguid, credentialId, credentialPublicKey, credentialPublicKeyBytes, signCount, flags, bindingChecked }>
  * @since 0.2.5
  * @status stable
  * @spec W3C WebAuthn Level 3 sec. 8 / sec. 7.1
@@ -1201,7 +1257,12 @@ function _checkAndroidKeyDescription(cert, clientDataHash) {
  * them against the state only the relying party has.
  *
  * The verdict also carries what a relying party must STORE to run a later login:
- * `credentialId`, `credentialPublicKey` and the initial `signCount`.
+ * `credentialId`, `credentialPublicKey` and the initial `signCount`. The credential key
+ * comes back in both forms: the decoded object, and `credentialPublicKeyBytes`, which is
+ * what a credential row should hold -- the object carries `Buffer` values, so a JSON round
+ * trip through a datastore returns `{"type":"Buffer","data":[...]}` rather than the object
+ * that went in. `pki.webauthn.parseCoseKey` reads those bytes back, and
+ * `verifyAssertion` accepts either form.
  *
  * @intro This verifies the attestation STATEMENT -- the signature and the format's
  *   structural bindings (the x5c leaf key == credential key, the apple nonce, the tpm
@@ -1937,7 +1998,15 @@ function _snapshotAssertion(input) {
       out[f] = guard.bytes.snapshotSource(out[f], WebauthnError, "webauthn/bad-input", f);
     }
   });
-  if (_isPlainObject(out.credentialPublicKey)) {
+  // The BYTES form first. A Buffer satisfies the plain-object test below, so leaving it to that
+  // branch copies its numeric indices into a `{0:.., 1:..}` object that is no longer a key at all
+  // -- the stored credential silently becoming something the SPKI builder cannot read. It is
+  // snapshotted here for the same reason the other byte inputs are: it is read after a yield.
+  if (Buffer.isBuffer(out.credentialPublicKey) || ArrayBuffer.isView(out.credentialPublicKey) ||
+      out.credentialPublicKey instanceof ArrayBuffer) {
+    out.credentialPublicKey = guard.bytes.snapshotSource(out.credentialPublicKey, WebauthnError,
+      "webauthn/bad-input", "credentialPublicKey");
+  } else if (_isPlainObject(out.credentialPublicKey)) {
     var key = {}, kk;
     for (kk in out.credentialPublicKey) {
       if (!Object.prototype.hasOwnProperty.call(out.credentialPublicKey, kk)) continue;
@@ -2000,9 +2069,16 @@ function verifyAssertion(input) {
       }
       clientDataHash = Buffer.from(input.clientDataHash);
     }
+    // Either form a relying party can be holding. `verify` hands back the parsed object, but the
+    // durable form is BYTES: the object carries Buffers, so a JSON round trip through a datastore
+    // returns {"type":"Buffer","data":[...]} rather than what went in, and every existing credential
+    // store already holds the COSE bytes. Accepting only the object made a caller fabricate an
+    // authenticatorData that never existed just to reach their own key.
     var coseKey = input.credentialPublicKey;
-    if (!_isPlainObject(coseKey)) {
-      throw _err("webauthn/bad-input", "credentialPublicKey must be the stored COSE key object");
+    if (Buffer.isBuffer(coseKey) || ArrayBuffer.isView(coseKey) || coseKey instanceof ArrayBuffer) {
+      coseKey = parseCoseKey(coseKey);
+    } else if (!_isPlainObject(coseKey)) {
+      throw _err("webauthn/bad-input", "credentialPublicKey must be the stored COSE key -- the object pki.webauthn.verify returned, or its COSE bytes");
     }
     var bindingChecked = _applyBindings(authData, coseKey, input);
     // The counter's SHAPE is a config-time question and is answered here; whether it
@@ -2057,6 +2133,7 @@ module.exports = {
   parseAttestationObject: parseAttestationObject,
   parseAuthenticatorData: parseAuthenticatorData,
   parseClientData: parseClientData,
+  parseCoseKey: parseCoseKey,
   verify: verify,
   verifyAssertion: verifyAssertion,
   verifyMetadataBlob: mds.verifyMetadataBlob,

package/lib/webcrypto.js

@@ -1097,7 +1097,17 @@ SubtleCrypto.prototype.importKey = async function importKey(format, keyData, alg
       var a2 = (name === "HMAC") ? { name: name, hash: _hashObj(alg.hash, "importKey jwk HMAC"), length: kbuf.length * 8 } : { name: name, length: kbuf.length * 8 };
       return new CryptoKey("secret", extractable, a2, usages, s2);
     }
-    var isPrivate = Object.prototype.hasOwnProperty.call(jwk, "d");
+    // The private half is named by the KEY TYPE, not by one spelling. EC and OKP carry it in `d`;
+    // an AKP JWK -- how ML-DSA, ML-KEM and SLH-DSA are represented -- carries it in `priv`.
+    // Testing `d` alone reads every PQC private JWK as public, so a re-import yields a public key
+    // that still announces `usages: ["sign"]` and forces `extractable` true whatever the caller
+    // asked, silently dropping the half that signs.
+    // `priv` is read ONLY for an AKP key, the type that defines it. RFC 7517 sec. 4 requires an
+    // unrecognized member to be ignored, so a member of that name on an EC or OKP JWK is an
+    // extension this implementation has no meaning for -- reading it as private material there
+    // would turn a valid public-key import into a failure.
+    var isPrivate = Object.prototype.hasOwnProperty.call(jwk, "d") ||
+      (jwk.kty === "AKP" && Object.prototype.hasOwnProperty.call(jwk, "priv"));
     var ko = _nodeKey(function () { return isPrivate ? nodeCrypto.createPrivateKey({ key: jwk, format: "jwk" }) : nodeCrypto.createPublicKey({ key: jwk, format: "jwk" }); }, "importKey jwk");
     return new CryptoKey(isPrivate ? "private" : "public", isPrivate ? extractable : true, _algFromImport(name, alg, ko), usages, ko);
   }
@@ -1187,6 +1197,17 @@ function _curveFromKey(ko) {
  * (either), or `raw` (symmetric, or an uncompressed EC / OKP public
  * point). Throws unless the key was created `extractable`.
  *
+ * `raw` is defined for public and secret keys only -- asking for it on a private
+ * key throws `webcrypto/not-supported` rather than answering with the public half.
+ * This matters through `wrapKey`, which forwards the caller's format here: wrapping
+ * a private key as `raw` would otherwise escrow the public key, and unwrapping it
+ * returns a handle announcing `usages: ["sign"]` that cannot sign, with the private
+ * key gone. Use `pkcs8` or `jwk` to serialize a private key.
+ *
+ * A private `jwk` round-trips as a private key for every algorithm, ML-DSA, ML-KEM
+ * and SLH-DSA included: those are `kty: "AKP"` and carry the private half in `priv`
+ * rather than the `d` an EC or OKP key uses.
+ *
  * @example
  *   var keyPair = await pki.webcrypto.subtle.generateKey({ name: "Ed25519" }, true, ["sign", "verify"]);
  *   var spki = await pki.webcrypto.subtle.exportKey("spki", keyPair.publicKey);
@@ -1206,7 +1227,19 @@ SubtleCrypto.prototype.exportKey = async function exportKey(format, key) {
   }
   if (format === "spki") return _toArrayBuffer(key._handle.export({ format: "der", type: "spki" }));
   if (format === "pkcs8") return _toArrayBuffer(key._handle.export({ format: "der", type: "pkcs8" }));
-  if (format === "raw") return _toArrayBuffer(_rawPublic(key));
+  if (format === "raw") {
+    // "raw" is defined for PUBLIC and secret keys; there is no raw private-key serialization for
+    // EC or OKP. Answering a private-key request with the public half hands back the opposite of
+    // what was asked for, with nothing to notice it by -- and `wrapKey` forwards the caller's
+    // format straight here, so a private key wrapped as "raw" escrows the PUBLIC key. Unwrapping
+    // that yields a handle announcing it can sign, which cannot, and the private key is gone.
+    if (key.type !== "public") {
+      throw new WebCryptoError("webcrypto/not-supported",
+        "exportKey: 'raw' is defined for public and secret keys only -- a " + key.type +
+        " key has no raw serialization; use 'pkcs8' or 'jwk'");
+    }
+    return _toArrayBuffer(_rawPublic(key));
+  }
   throw new WebCryptoError("webcrypto/not-supported", "exportKey: unsupported format " + JSON.stringify(format));
 };