@blamejs/pki 0.5.1 → 0.5.3

package/lib/jose.js

@@ -566,8 +566,47 @@ async function thumbprint(jwk) {
   return b64uEncode(digest);
 }
 
+/**
+ * @primitive  pki.jose.sigAlgs
+ * @signature  pki.jose.sigAlgs() -> Array<{alg,kty,crv,hash,saltLength}>
+ * @since      0.5.3
+ * @status     stable
+ * @spec       RFC 7518 sec. 3, RFC 8037, RFC 9964
+ * @related    pki.jose.verify
+ *
+ * The JWS signature algorithms this toolkit verifies, one row per `alg`, each
+ * naming the JWK key type it requires (`kty`, plus the exact `crv` where the
+ * curve is fixed), the hash, and the RSASSA-PSS salt length where the algorithm
+ * is PSS. Rows describe key material in RFC 7517 / 7518 vocabulary only, so a
+ * caller can decide whether a key it holds can sign or verify a given `alg`
+ * without a table of its own.
+ *
+ * MAC algorithms are deliberately absent: `HS*` is not a signature algorithm and
+ * listing it beside `RS256` is how the HMAC key-confusion class starts. `none`
+ * does not exist here at all.
+ *
+ * Each call returns a fresh array of fresh rows -- the registry that drives
+ * verification is never handed out, so nothing a caller does to the result can
+ * widen what a signature check accepts.
+ *
+ * @example
+ *   var pss = pki.jose.sigAlgs().filter(function (r) { return r.saltLength; });
+ *   pss.map(function (r) { return r.alg; });   // -> ["PS256", "PS384", "PS512"]
+ */
+function sigAlgs() {
+  return Object.keys(SIG_ALGS).map(function (alg) {
+    var row = SIG_ALGS[alg];
+    var out = { alg: alg, kty: row.kty };
+    if (row.crv) out.crv = row.crv;
+    if (row.hash) out.hash = row.hash;
+    if (row.saltLength) out.saltLength = row.saltLength;
+    return out;
+  });
+}
+
 module.exports = {
   base64url: { encode: b64uEncode, decode: b64uDecode },
+  sigAlgs: sigAlgs,
   parseJson: parseJson,
   verify: verify,
   sign: sign,

package/lib/path-validate.js

@@ -41,6 +41,7 @@ var ocsp = require("./schema-ocsp");
 var ocspVerify = require("./ocsp-verify");
 var crlVerify = require("./crl-verify");
 var cmpVerify = require("./cmp-verify");
+var cmsVerify = require("./cms-verify");
 var cmpSession = require("./cmp-session");
 var guard = require("./guard-all");
 var constants = require("./constants");
@@ -1187,40 +1188,9 @@ async function validate(path, opts) {
   // opts.requiredEku -- the key purposes the TARGET certificate must be good
   // for, each a registered OID name or a dotted OID string. Resolved (and
   // typo-checked) here at the entry point.
-  var requiredEku = null;
-  if (opts.requiredEku !== undefined) {
-    if (!Array.isArray(opts.requiredEku) || opts.requiredEku.length === 0) {
-      throw E("path/bad-input", "validate: opts.requiredEku must be a non-empty array of key-purpose OID names or dotted OID strings");
-    }
-    requiredEku = opts.requiredEku.map(function (p) {
-      if (typeof p !== "string" || p.length === 0) throw E("path/bad-input", "validate: opts.requiredEku entries must be non-empty strings");
-      // A dotted-form attempt (leads with a digit) must be a canonical OID -- a
-      // loose regex accepted a leading-zero / out-of-bounds key that would never
-      // match the canonical EKU the target advertises; anything else is a name.
-      if (/^[0-9]/.test(p)) return guard.identifier.assertCanonicalOid(p, E, "path/bad-input", "validate: opts.requiredEku entry " + JSON.stringify(p));
-      var dotted = oid.byName(p);
-      if (typeof dotted !== "string") throw E("path/bad-input", "validate: opts.requiredEku entry " + JSON.stringify(p) + " is not a registered OID name");
-      return dotted;
-    });
-  }
-  // opts.checkPurpose -- the single key purpose the ANCHOR's NSS trust metadata
-  // (distrustAfter / purposes) is consulted for. Independent of requiredEku
-  // (which gates the leaf's own EKU extension): this selects the per-purpose
-  // key in the trust-anchor constraint contract. A purpose OID name (or a
-  // canonical dotted OID normalized to its name); a bad value throws here.
-  var checkPurpose = null;
-  if (opts.checkPurpose !== undefined) {
-    if (typeof opts.checkPurpose !== "string" || opts.checkPurpose.length === 0) {
-      throw E("path/bad-input", "validate: opts.checkPurpose must be a key-purpose OID name or dotted OID string");
-    }
-    if (/^[0-9]/.test(opts.checkPurpose)) {
-      var cpDotted = guard.identifier.assertCanonicalOid(opts.checkPurpose, E, "path/bad-input", "validate: opts.checkPurpose");
-      checkPurpose = oid.name(cpDotted) || cpDotted;   // normalize a dotted purpose OID to its name for the anchor map
-    } else {
-      if (typeof oid.byName(opts.checkPurpose) !== "string") throw E("path/bad-input", "validate: opts.checkPurpose " + JSON.stringify(opts.checkPurpose) + " is not a registered OID name");
-      checkPurpose = opts.checkPurpose;
-    }
-  }
+  var purposeOpts = resolvePurposeOpts(opts);
+  var requiredEku = purposeOpts.requiredEku;
+  var checkPurpose = purposeOpts.checkPurpose;
 
   var state = initialize(certs, opts, seeds);
   state._n = n;
@@ -1385,9 +1355,8 @@ async function validate(path, opts) {
       // NaN time) would make `notBefore > it` NaN-false and SILENTLY drop the distrust
       // restriction -- the NaN-Date fail-open. Validate a present date fail-closed
       // before the comparison; an absent (undefined/null) date is no restriction.
-      var distrustDate = (checkPurpose && ta.distrustAfter) ? ta.distrustAfter[checkPurpose] : null;
+      var distrustDate = assertAnchorConstraints(ta, checkPurpose);
       if (distrustDate != null) {
-        distrustDate = guard.time.assertValid(distrustDate, E, "path/bad-input", "trustAnchor.distrustAfter." + checkPurpose);
         // STRICTLY > : a leaf whose notBefore == the distrust date stays trusted
         // (Mozilla certverifier isDistrustedCertificateChain: endEntityNotBefore
         // <= distrustAfterTime -> not distrusted; the end-of-day ...235959Z
@@ -2211,6 +2180,16 @@ var ocspCore = ocspVerify.makeOcspVerify({
 cmpVerify.setEngine({ verifyWithSpki: _verifyWithSpki, build: build, validate: validate });
 // pki.cmp.session validates the ISSUED leaf certificate (its signature + chain) through the same engine.
 cmpSession.setEngine({ build: build, validate: validate, toAnchor: toAnchor, coerceCert: coerceCert });
+// pki.cms.verify chains a SignedData's signer certificate to the anchors the CALLER named, so its
+// `trusted` is decided by this one path engine rather than a second, weaker walk of its own.
+// `toAnchor` so cms.verify can validate the caller's anchors ONCE at entry, before any signer is
+// walked -- otherwise a message whose signers all failed would never reach a build call and a
+// malformed anchor would pass unnoticed.
+// `resolvePurposeOpts` so cms.verify can reject a malformed requiredEku / checkPurpose at ITS entry
+// point, through the SAME definition the walk uses -- a message whose signers all failed never
+// reaches a build call, and a caller's configuration must not be judged by the message's quality.
+cmsVerify.setEngine({ build: build, validate: validate, toAnchor: toAnchor,
+  resolvePurposeOpts: resolvePurposeOpts, assertAnchorConstraints: assertAnchorConstraints });
 
 /**
  * @primitive  pki.path.ocspChecker
@@ -2440,6 +2419,63 @@ function coerceCert(input) {
 // tuple. The algorithm is the SPKI KEY-algorithm OID (the sec. 6.1.4(f)
 // parameter-inheritance value), mirroring trust.js _mkAnchor -- NOT the
 // signature OID. The anchor is an input to validate, never one of the path certs.
+// The two key-purpose options, resolved and typo-checked. Extracted so a CALLER can validate them
+// at ITS entry point rather than only when a path is actually walked: a format verb that skips the
+// walk -- pki.cms.verify does when no signer verified -- would otherwise accept a malformed
+// purpose in silence, making configuration validity depend on the message. One definition, so the
+// answer cannot drift between the caller's early check and the walk's own.
+//
+// `requiredEku` gates the TARGET certificate's own EKU extension; `checkPurpose` selects which
+// per-purpose key the ANCHOR's NSS trust metadata (purposes / distrustAfter) is consulted under.
+// They are independent, and each is a registered OID name or a canonical dotted OID.
+// An anchor's CONSTRAINT metadata for one purpose, validated fail-closed and returned normalized.
+// A PRESENT-but-malformed distrustAfter (an Invalid Date: instanceof Date yet a NaN time) would
+// make `notBefore > it` NaN-false and SILENTLY drop the distrust restriction -- the NaN-Date
+// fail-open. Absent metadata is no restriction and returns null.
+//
+// Separate from resolvePurposeOpts because it validates the ANCHOR rather than the options, and
+// exposed for the same reason: a caller that may never reach the walk -- pki.cms.verify when no
+// signer verified -- has to be able to reject a malformed anchor at ITS entry point, through this
+// same definition, so configuration validity never depends on the message.
+function assertAnchorConstraints(ta, checkPurpose) {
+  var d = (checkPurpose && ta && ta.distrustAfter) ? ta.distrustAfter[checkPurpose] : null;
+  if (d == null) return null;
+  return guard.time.assertValid(d, E, "path/bad-input", "trustAnchor.distrustAfter." + checkPurpose);
+}
+
+function resolvePurposeOpts(opts) {
+  var requiredEku = null;
+  if (opts.requiredEku !== undefined) {
+    if (!Array.isArray(opts.requiredEku) || opts.requiredEku.length === 0) {
+      throw E("path/bad-input", "validate: opts.requiredEku must be a non-empty array of key-purpose OID names or dotted OID strings");
+    }
+    requiredEku = opts.requiredEku.map(function (p) {
+      if (typeof p !== "string" || p.length === 0) throw E("path/bad-input", "validate: opts.requiredEku entries must be non-empty strings");
+      // A dotted-form attempt (leads with a digit) must be a canonical OID -- a
+      // loose regex accepted a leading-zero / out-of-bounds key that would never
+      // match the canonical EKU the target advertises; anything else is a name.
+      if (/^[0-9]/.test(p)) return guard.identifier.assertCanonicalOid(p, E, "path/bad-input", "validate: opts.requiredEku entry " + JSON.stringify(p));
+      var dotted = oid.byName(p);
+      if (typeof dotted !== "string") throw E("path/bad-input", "validate: opts.requiredEku entry " + JSON.stringify(p) + " is not a registered OID name");
+      return dotted;
+    });
+  }
+  var checkPurpose = null;
+  if (opts.checkPurpose !== undefined) {
+    if (typeof opts.checkPurpose !== "string" || opts.checkPurpose.length === 0) {
+      throw E("path/bad-input", "validate: opts.checkPurpose must be a key-purpose OID name or dotted OID string");
+    }
+    if (/^[0-9]/.test(opts.checkPurpose)) {
+      var cpDotted = guard.identifier.assertCanonicalOid(opts.checkPurpose, E, "path/bad-input", "validate: opts.checkPurpose");
+      checkPurpose = oid.name(cpDotted) || cpDotted;   // normalize a dotted purpose OID to its name for the anchor map
+    } else {
+      if (typeof oid.byName(opts.checkPurpose) !== "string") throw E("path/bad-input", "validate: opts.checkPurpose " + JSON.stringify(opts.checkPurpose) + " is not a registered OID name");
+      checkPurpose = opts.checkPurpose;
+    }
+  }
+  return { requiredEku: requiredEku, checkPurpose: checkPurpose };
+}
+
 function toAnchor(entry) {
   if (entry && typeof entry === "object" && !Buffer.isBuffer(entry) && entry.name && entry.publicKey && entry.algorithm) {
     // A ready anchor tuple: validate the shape build + validate consume -- name.rdns

package/lib/sign-scheme.js

@@ -67,23 +67,61 @@ function _pssAlgId(digestName) {
   var params = b.sequence([b.explicit(0, hashAlg), b.explicit(1, mgf), b.explicit(2, b.integer(BigInt(PSS_SALT[HASH[digestName]])))]);
   return b.sequence([b.oid(O("rsassaPss")), params]);
 }
-// An id-RSASSA-PSS SPKI MAY pin its permitted hash in the params (RFC 4055 sec. 1.2 / 3.1). Read
-// it so signing honors the restriction; absent params or an unrecognized hash returns null.
+// The hash an id-RSASSA-PSS SPKI restricts its key to, or null when it restricts none.
+//
+// RFC 4055 sec. 3.1 draws the line at whether the parameters are THERE: "if present, the parameters
+// field MUST contain RSASSA-PSS-params", and "if RSASSA-PSS-params is present, the certificate user
+// MUST perform those operations using the one-way hash function ... identified in the ...
+// parameters". Absent parameters therefore restrict nothing, and null says so.
+//
+// PRESENT parameters are a restriction even where they look empty. `hashAlgorithm` is
+// `[0] HashAlgorithm DEFAULT sha1Identifier`, so a params SEQUENCE that omits it names SHA-1 --
+// it does not decline to name anything. Reading the omission as "no restriction" is the fail-open
+// that matters here: it turns a key its own certificate confines to SHA-1 into one that will verify
+// a SHA-512 signature. And parameters that are present but unreadable are a restriction this code
+// cannot honor, which is not the same as no restriction either, so they are refused.
 function _pssHashFromSpki(cert, E) {
   var params = cert.subjectPublicKeyInfo.algorithm.parameters;
   if (params == null) return null;
-  var node = asn1.decode(params);
-  if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children) return null;
+  var node;
+  try { node = asn1.decode(params); }
+  catch (e) { throw E("unsupported-algorithm", "the id-RSASSA-PSS key parameters are not decodable, so the restriction they carry cannot be honored", e); }
+  if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children) {
+    throw E("unsupported-algorithm", "the id-RSASSA-PSS key parameters are not an RSASSA-PSS-params SEQUENCE (RFC 4055 sec. 3.1)");
+  }
   var hashField = node.children.filter(function (c) { return c.tagClass === "context" && c.tagNumber === 0; })[0];
-  if (!hashField || !hashField.children || !hashField.children[0] || !hashField.children[0].children) return null;
+  // DEFAULT sha1Identifier -- an omitted hashAlgorithm names SHA-1, which this toolkit does not
+  // sign or verify with, so it is reported as the pin it is and refused by the caller's own table.
+  if (!hashField) return "sha1";
+  if (!hashField.children || !hashField.children[0] || !hashField.children[0].children) {
+    throw E("unsupported-algorithm", "the id-RSASSA-PSS key parameters carry a malformed hashAlgorithm");
+  }
   var oidNode = hashField.children[0].children[0];
-  if (!oidNode || oidNode.tagClass !== "universal" || oidNode.tagNumber !== asn1.TAGS.OBJECT_IDENTIFIER) return null;
+  if (!oidNode || oidNode.tagClass !== "universal" || oidNode.tagNumber !== asn1.TAGS.OBJECT_IDENTIFIER) {
+    throw E("unsupported-algorithm", "the id-RSASSA-PSS key parameters hashAlgorithm is not an OBJECT IDENTIFIER");
+  }
   var pinnedOid = asn1.read.oid(oidNode);
   var name = HASH_NAME_BY_OID[pinnedOid];
   if (!name) throw E("unsupported-algorithm", "the id-RSASSA-PSS signer key pins an unsupported hash algorithm (" + pinnedOid + ")");
   return name;
 }
 
+// @internal -- the WebCrypto hash name an id-RSASSA-PSS SPKI pins, or null when it pins none.
+// Verifiers need the same restriction the signer above honors: a key whose certificate says
+// SHA-256 must not be handed a SHA-512 signature to check, and reading the pin in two places is
+// how the two directions come to disagree. Throws through the caller's E on a hash this toolkit
+// does not implement, so an unreadable restriction is never treated as no restriction.
+function pssSpkiPinnedHash(cert, E) {
+  var d = _pssHashFromSpki(cert, E);
+  if (!d) return null;
+  // A pin this toolkit has no WebCrypto hash for -- SHA-1, which RSASSA-PSS-params names by DEFAULT
+  // -- is still a pin. Returning undefined here would hand the caller a falsy value it reads as
+  // "unrestricted", which is the same fail-open the DEFAULT reading above exists to close, one
+  // layer up.
+  if (!HASH[d]) throw E("unsupported-algorithm", "the id-RSASSA-PSS key is restricted to " + d + ", which this toolkit does not verify with");
+  return HASH[d];
+}
+
 // resolveSignScheme(cert, so, noSignedAttrs, E) -> the signature scheme from the signer cert's
 // public-key algorithm + per-signer opts (so.digestAlgorithm / so.pss / so.combinedRsaSig -- the
 // last folds the digest into a combined RSA signature OID for a caller with no digestAlgorithm
@@ -205,6 +243,7 @@ function signOverTbs(scheme, key, signedBytes, E) {
 // no drift between the two.
 module.exports = {
   resolveSignScheme: resolveSignScheme,
+  pssSpkiPinnedHash: pssSpkiPinnedHash,
   signOverTbs: signOverTbs,
   MLDSA_SUITABLE_DIGEST: MLDSA_SUITABLE_DIGEST,
   SLHDSA_BY_OID: SLHDSA_BY_OID,

package/lib/smime.js

@@ -567,7 +567,7 @@ function _capped(msg) {
 
 /**
  * @primitive  pki.smime.verify
- * @signature  pki.smime.verify(message, opts?) -> Promise<{ valid, signers, form, content, micalg, protectedHeaders, headerProtection }>
+ * @signature  pki.smime.verify(message, opts?) -> Promise<{ valid, trusted, signers, form, content, micalg, protectedHeaders, headerProtection }>
  * @since      0.2.25
  * @status     stable
  * @spec       RFC 8551, RFC 5652, RFC 9788
@@ -577,9 +577,19 @@ function _capped(msg) {
  * `application/pkcs7-mime; smime-type=signed-data`. For `multipart/signed` the detached CMS signature
  * is recomputed over the first part's RFC 8551 sec. 3.1.1 canonical form (the SAME canonicalizer the
  * signer used); for `application/pkcs7-mime` the base64 body is the attached CMS SignedData. Returns
- * `pki.cms.verify`'s `{ valid, signers }` verdict PLUS `form`, the recovered `content` (the signed MIME
- * entity bytes), and the `micalg`. Like `cms.verify`, this returns the cryptographic verdict only --
- * chaining a signer certificate to a trust anchor is the caller's `pki.path.validate` step. A `micalg`
+ * `pki.cms.verify`'s `{ valid, trusted, signers }` verdict PLUS `form`, the recovered `content` (the
+ * signed MIME entity bytes), and the `micalg`.
+ *
+ * `valid` and `trusted` are separate claims, exactly as in `cms.verify`: a SignedData carries its own
+ * certificates, so `valid` says the signature is sound under one of them and nothing about who signed.
+ * Name the roots you accept in `opts.trustAnchors` and `trusted` says every signer chained to one --
+ * validated for EMAIL, at both ends of the chain. The signer certificate must carry the
+ * `emailProtection` key purpose (RFC 8551 sec. 4.4.4), because a certificate restricted to `serverAuth`
+ * chains to its root perfectly well and is still the wrong key to have signed a message; and the anchor's
+ * own trust metadata must permit that purpose, because a root distributed with NSS trust bits can be
+ * marked untrusted for email while remaining a good TLS root. Override either with `opts.requiredEku`
+ * and `opts.checkPurpose`. Supply no anchors and `trusted` is `false` -- there was nothing to chain to.
+ * A `micalg`
  * that disagrees with the actual digest is advisory unless `opts.strictMicalg` (then `smime/micalg-mismatch`).
  * If the message is header-protected (RFC 9788), `protectedHeaders` is the AUTHENTICATED inner header set (a
  * tampered outer header cannot alter it) and `headerProtection` is `{ present, mode, fromMismatch, confidential, legacy }`
@@ -596,6 +606,11 @@ function _capped(msg) {
  * `protectedHeaders` cannot mistake the opt-in heuristic for authenticated headers.
  *
  * @opts certs        extra signer certificates (DER `Buffer`s) to match, forwarded to `cms.verify`.
+ * @opts trustAnchors the roots you accept, forwarded to `cms.verify`; supplying them is what makes
+ *                    `trusted` answerable. Certificate DER or anchor tuples.
+ * @opts time         the instant the signer's chain is judged at (default now). Only read with `trustAnchors`.
+ * @opts requiredEku  key purposes the SIGNER certificate must carry. Defaults to `["emailProtection"]`.
+ * @opts checkPurpose the purpose the ANCHOR's own trust metadata must permit. Defaults to `"emailProtection"`.
  * @opts strictMicalg reject a `multipart/signed` whose `micalg` disagrees with the SignerInfo digest.
  * @opts legacyHeaderProtection  opt in to detecting a LEGACY RFC 8551 header-protected message (RFC 9788 sec. 4.10): a Cryptographic Payload that is a bare `message/rfc822` wrap with no `hp=` parameter. When set, a precisely-identified legacy message surfaces the inner message's headers under `headerProtection.legacy = { headers, mode, fromMismatch, confidential }` -- `headers` an ordered `[{ name, value }]` array (retaining legally-repeated fields such as `Received`), the mode inferred from the envelope (`clear` here) -- NOT under `protectedHeaders`, and `present` stays `false`. Consuming `headerProtection.legacy.headers` is an explicit choice: a legacy message is structurally indistinguishable from an ordinary forwarded `message/rfc822`, so this is a heuristic (RFC 9788 sec. 4.10.2: "not based on any strong end-to-end guarantees") -- cross-check `legacy.fromMismatch`. Anything not precisely identified (a nested crypto layer, an `hp=` on the inner message, a non-`message/rfc822` payload, a duplicate of a singleton field, or a duplicate Content-Type) reports `legacy: null`. Off by default. The signed-and-encrypted form (RFC 9788 Appendix C.3.17) is a documented gap (`legacy: null` at `decrypt`; surfaces as `clear` only via the caller's re-`verify` step) -- the non-recursive layered API exposes no single seam holding both the inner signature verdict and the outer header section.
  * @example
@@ -611,8 +626,28 @@ async function verify(message, opts) {
   opts = opts || {};
   var ent = mime.parse(message, SmimeError, "smime/bad-mime");
   var ct = ent.contentType;
+  // Forwarded, not re-decided here. This verb documents itself as pki.cms.verify's verdict plus the
+  // MIME surface, so the trust seam that verb offers has to reach it: building the options from
+  // scratch and passing only `certs` would leave a caller naming trust anchors with no way to have
+  // them applied, and a `trusted` that read false for want of ever being asked.
   var vOpts = {};
   if (opts.certs) vOpts.certs = opts.certs;
+  if (opts.trustAnchors != null) {
+    vOpts.trustAnchors = opts.trustAnchors;
+    // Trusted FOR THIS PURPOSE. A chain alone does not make a signer right for email: a
+    // certificate restricted to serverAuth chains to its root perfectly well and is still the
+    // wrong key to have signed a message. RFC 8551 sec. 4.4.4 names emailProtection as the purpose
+    // an S/MIME signer's certificate must carry, so this verb asks for it rather than accepting the
+    // purpose-neutral answer. A caller who means something else says so with `requiredEku`.
+    vOpts.requiredEku = opts.requiredEku != null ? opts.requiredEku : ["emailProtection"];
+    // Both ends of the chain. The EKU above constrains the LEAF; this selects the anchor's own
+    // trust metadata, which pki.path consults only when a purpose is named. A root distributed
+    // with NSS trust bits can be marked untrusted for email while remaining a good TLS root, so
+    // asking only the leaf would let a root explicitly distrusted for email still answer
+    // "trusted" for an email message.
+    vOpts.checkPurpose = opts.checkPurpose != null ? opts.checkPurpose : "emailProtection";
+  }
+  if (opts.time !== undefined) vOpts.time = opts.time;
   if (_isPkcs7(ct.type, "mime")) {
     if (ct.params["smime-type"] && ct.params["smime-type"] !== "signed-data") throw _err("smime/unsupported-type", "unsupported smime-type " + JSON.stringify(ct.params["smime-type"]) + " (only signed-data)");
     var p7m = _decodeCms(ent);
@@ -620,7 +655,7 @@ async function verify(message, opts) {
     var inner;
     try { inner = _toBuf(schemaCms.parse(p7m).encapContentInfo.eContent); }
     catch (e) { throw _err("smime/bad-mime", "the pkcs7-mime SignedData has no encapsulated content", e); }
-    return Object.assign({ valid: res.valid, signers: res.signers, form: "pkcs7-mime", content: inner, micalg: null }, _hpSurface(inner, ent, "clear", res.valid, opts.legacyHeaderProtection === true));
+    return Object.assign({ valid: res.valid, trusted: res.trusted, signers: res.signers, form: "pkcs7-mime", content: inner, micalg: null }, _hpSurface(inner, ent, "clear", res.valid, opts.legacyHeaderProtection === true));
   }
   if (ct.type === "multipart/signed") {
     if (ct.params.protocol && !_isPkcs7(ct.params.protocol, "signature")) throw _err("smime/bad-multipart", "multipart/signed protocol must be application/pkcs7-signature");
@@ -647,7 +682,7 @@ async function verify(message, opts) {
     if (opts.strictMicalg && micalg && _micalgSet(micalg) !== (_micalgOf(p7s) || "")) {
       throw _err("smime/micalg-mismatch", "the multipart/signed micalg " + JSON.stringify(micalg) + " disagrees with the SignerInfo digests");
     }
-    return Object.assign({ valid: res2.valid, signers: res2.signers, form: "multipart/signed", content: parts[0], micalg: micalg }, _hpSurface(parts[0], ent, "clear", res2.valid, opts.legacyHeaderProtection === true));
+    return Object.assign({ valid: res2.valid, trusted: res2.trusted, signers: res2.signers, form: "multipart/signed", content: parts[0], micalg: micalg }, _hpSurface(parts[0], ent, "clear", res2.valid, opts.legacyHeaderProtection === true));
   }
   throw _err("smime/unsupported-type", "not a signed S/MIME message (Content-Type " + JSON.stringify(ct.type) + ")");
 }

package/lib/tsp-sign.js

@@ -604,9 +604,19 @@ function _buildTsaChains(leaf, pool) {
  *   res.valid;     // boolean; pass opts.trustAnchor to also chain the TSA cert to a root
  *   res.genTime;   // Date, read from the verified eContent
  */
+// Every option pki.tsp.verify reads. Adding one here is the only way to make it accepted.
+var _VERIFY_OPTS = { certs: 1, trustAnchor: 1, nonce: 1, reqPolicy: 1, revocationChecker: 1 };
+
 async function verify(token, data, opts) {
   opts = opts || {};
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("tsp/bad-input", "pki.tsp.verify options must be an object");
+  // An unrecognized option is refused rather than ignored. This verb spells its anchor option
+  // SINGULAR -- `trustAnchor`, an anchor tuple -- while pki.cms.verify and pki.cmp.verify spell it
+  // `trustAnchors` and take certificate DER. A caller carrying the plural spelling here would
+  // otherwise get no anchoring and no error: the TSA certificate unchained, `valid: true`, and
+  // nothing to notice it by. Naming the difference at the boundary is the only place it is cheap.
+  guard.identifier.assertKnownKeys(opts, _VERIFY_OPTS, _err, "tsp/bad-input",
+    "pki.tsp.verify has an unknown option (note the anchor option here is `trustAnchor`, singular, an anchor tuple -- not the `trustAnchors` certificate list pki.cms.verify takes) ");
   if (opts.certs != null && (!Array.isArray(opts.certs) || !opts.certs.every(function (c) { return Buffer.isBuffer(c) || c instanceof Uint8Array; }))) {
     throw _err("tsp/bad-input", "pki.tsp.verify opts.certs must be an array of DER certificate Buffers");   // a bad element is a caller error, never silently dropped
   }

package/lib/validator-cose.js

@@ -57,11 +57,27 @@ var OKP_CRV = { 6: { oid: "Ed25519", len: 32 }, 7: { oid: "Ed448", len: 57 } };
 // -8 (EdDSA) is Ed25519 ONLY, and the RFC 9864 fully-specified ids (-9 ESP256, -51 ESP384,
 // -52 ESP512, -19 Ed25519, -53 Ed448) each pin key type + curve. A verifier accepts the
 // fully-specified ids even though WebAuthn recommends against them for credential creation.
+// The RSA credential-key bounds. 2048 bits is the floor every current FIDO authenticator and
+// NIST SP 800-57 agree on; nothing in the field emits less, so the floor refuses forgeable keys
+// without refusing real ones. The exponent bound is a work bound, not a security one.
+var RSA_MIN_MODULUS_BITS = 2048;
+var RSA_MAX_EXPONENT_BYTES = 8;
+// The modulus BIT length. A byte count is not one: minimally encoded, a 256-byte modulus whose
+// leading byte is 0x01 is 2041 bits, and would clear a floor expressed in bytes while sitting below
+// the floor that floor exists to state. The leading byte is non-zero by the minimal-encoding check
+// above, so its position fixes the total.
+function _modulusBits(n) { return (n.length - 1) * 8 + (32 - Math.clz32(n[0])); }
+
 var ALG_PROFILE = {
   "-7": { kty: 2, crv: 1 }, "-35": { kty: 2, crv: 2 }, "-36": { kty: 2, crv: 3 },
   "-9": { kty: 2, crv: 1 }, "-51": { kty: 2, crv: 2 }, "-52": { kty: 2, crv: 3 },
   "-8": { kty: 1, crv: 6 }, "-19": { kty: 1, crv: 6 }, "-53": { kty: 1, crv: 7 },
-  "-257": { kty: 3 }, "-258": { kty: 3 }, "-259": { kty: 3 }, "-37": { kty: 3 }, "-65535": { kty: 3 },
+  // RSASSA-PSS at all three strengths. PS256 alone left PS384/PS512 refused at PARSE time on a key
+  // that is perfectly well-formed -- the same bytes accepted under -37 -- so the refusal blamed the
+  // key rather than the algorithm, and a relying party migrating credential rows written by another
+  // implementation could not tell which of its stored keys this verifier would decline, or why.
+  "-257": { kty: 3 }, "-258": { kty: 3 }, "-259": { kty: 3 },
+  "-37": { kty: 3 }, "-38": { kty: 3 }, "-39": { kty: 3 }, "-65535": { kty: 3 },
 };
 
 // credentialKey(node, E, code) -> the decoded + validated credential public key
@@ -72,7 +88,10 @@ var ALG_PROFILE = {
 // @enforced-by validator-shape-reinlined
 // @validator-shape kty\s*===\s*2n
 // @validator-shape EC2_CRV_LEN|ALG_PROFILE
-function credentialKey(node, E, code) {
+// `unsupportedCode` is OPTIONAL and names the code raised when the key is well-formed but its
+// algorithm is not one this verifier implements -- a different fact from a malformed key. Omit it
+// and that case keeps raising `code`, so an existing caller sees no change.
+function credentialKey(node, E, code, unsupportedCode) {
   function bad(msg, cause) { return new E(code, msg, cause); }
   if (!node || node.majorType !== 5) throw bad("a COSE_Key must be a CBOR map (RFC 9052 sec. 7)");
   // Every parameter read maps a wrong-type cbor/* fault to the caller's domain -- a
@@ -103,6 +122,34 @@ function credentialKey(node, E, code) {
   } else if (kty === 3n) {
     key.n = ib(-1); key.e = ib(-2);
     if (!key.n || !key.n.length || !key.e || !key.e.length) throw bad("an RSA COSE_Key must carry n (-1) and e (-2)");
+    // The MATERIAL, not merely its presence -- the same standard the other two key types are held
+    // to, where EC2 pins x/y to the curve's field size and has the point validated on the curve,
+    // and OKP pins x to an exact length. Checking only presence let a 1-byte modulus and an
+    // exponent of 1 through as conformant credential public keys, and both reach the WebCrypto
+    // import, so they reach real signature verification. e = 1 makes RSA the identity function:
+    // the "signature" is the message, and it verifies under any modulus.
+    // BOTH values first, before either is judged. RFC 8230 sec. 4 encodes n and e as unsigned
+    // big-endian integers with no leading zero, and every check below reads a byte LENGTH as though
+    // it were a magnitude: the modulus floor, the exponent bound, and the exponent's value. A
+    // padded encoding decouples the two, so `00 01` would be read as a two-byte exponent and skip
+    // the value check that refuses 1 -- the degenerate key the whole check exists to catch. (An EC2
+    // coordinate is the opposite case, fixed-width and zero-padded by definition, which is why this
+    // rule is stated for the RSA parameters and not for x/y.)
+    if (key.n[0] === 0) throw bad("an RSA COSE_Key modulus (-1) must be minimally encoded, with no leading zero byte (RFC 8230 sec. 4)");
+    if (key.e[0] === 0) throw bad("an RSA COSE_Key exponent (-2) must be minimally encoded, with no leading zero byte (RFC 8230 sec. 4)");
+    var modulusBits = _modulusBits(key.n);
+    if (modulusBits < RSA_MIN_MODULUS_BITS) {
+      throw bad("an RSA COSE_Key modulus (-1) is " + modulusBits + " bits, below the " +
+        RSA_MIN_MODULUS_BITS + "-bit minimum");
+    }
+    // e must be odd and greater than 1: RSA needs gcd(e, phi(n)) = 1, so an even exponent is not a
+    // valid RSA public exponent at all, and 1 is the degenerate case above. Bounded on the way in
+    // so a caller cannot hand over a megabyte of exponent for the modular exponentiation to chew.
+    if (key.e.length > RSA_MAX_EXPONENT_BYTES) throw bad("an RSA COSE_Key exponent (-2) is longer than " + RSA_MAX_EXPONENT_BYTES + " bytes");
+    if ((key.e[key.e.length - 1] & 1) === 0) throw bad("an RSA COSE_Key exponent (-2) must be odd");
+    // Minimal encoding above makes a one-byte e the ONLY way to express a value this small, so the
+    // comparison is on the value and not on where it happens to sit.
+    if (key.e.length === 1 && key.e[0] <= 1) throw bad("an RSA COSE_Key exponent (-2) must be greater than 1 -- e = 1 makes RSA the identity function");
   } else {
     throw bad("unsupported COSE_Key kty " + Number(kty));
   }
@@ -111,7 +158,12 @@ function credentialKey(node, E, code) {
   if (node.children.length !== expectedParams) throw bad("the COSE_Key carries parameters beyond the canonical set for its key type (WebAuthn sec. 6.5.1)");
   // PROFILE: the declared alg must match the key type (and, for EC2, the curve).
   var prof = ALG_PROFILE[String(key.alg)];
-  if (!prof) throw bad("unsupported credential key algorithm " + key.alg);
+  // An algorithm this verifier does not implement is NOT a malformed key. The key can be perfectly
+  // well-formed -- the same bytes may parse under a neighbouring algorithm id -- and a relying
+  // party migrating credential rows written elsewhere needs to tell "I cannot check this
+  // algorithm" from "these bytes are wrong", since only one of those is fixable by re-registering.
+  // Callers that do not distinguish the two pass one code and keep the previous behaviour.
+  if (!prof) throw new E(unsupportedCode || code, "unsupported credential key algorithm " + key.alg);
   if (prof.kty !== key.kty) throw bad("credential key algorithm " + key.alg + " is inconsistent with key type " + key.kty);
   if (prof.crv != null && prof.crv !== key.crv) throw bad("credential key algorithm " + key.alg + " requires a different curve");
   // ON-CURVE: import the SPKI so OpenSSL validates the EC point on its curve. An off-curve