@blamejs/pki 0.5.3 → 0.5.5

package/lib/validator-cose.js

@@ -156,6 +156,90 @@ function credentialKey(node, E, code, unsupportedCode) {
   // CANONICAL CTAP2 COSE_Key: exactly the type's parameters, nothing more.
   var expectedParams = kty === 2n ? 5 : 4;
   if (node.children.length !== expectedParams) throw bad("the COSE_Key carries parameters beyond the canonical set for its key type (WebAuthn sec. 6.5.1)");
+  return assertKeyMaterial(key, E, code, unsupportedCode);
+}
+
+// assertKeyMaterial(key, E, code, unsupportedCode) -> key | throws
+//
+// The rules about the KEY, split from the rules about its CBOR encoding, because the
+// toolkit accepts a stored credential key in two forms and both reach a signature
+// verification. `pki.webauthn.verifyAssertion` takes the COSE bytes or the object
+// `pki.webauthn.verify` returned; the bytes went through every check below and the
+// object went through none, so the same 1-byte modulus was refused as a credential key
+// in one form and imported for verification in the other. A caller stores whichever
+// form their datastore round-trips, which is not a choice about how carefully their
+// credential is checked.
+//
+// Everything above this line is about the ENCODING -- a CBOR map, integer labels, byte
+// strings, the canonical parameter count -- and can only be asked of bytes. Everything
+// here is about the key, and is asked of both.
+//
+// @enforced-by behavioral -- key-material rules have no rename-proof code shape distinct
+//   from ordinary length and byte comparisons; the RED vectors that drive BOTH accepted
+//   forms of a stored credential key (the COSE bytes and the object) through
+//   pki.webauthn.verifyAssertion with an undersized modulus, e = 1, a curve/length
+//   mismatch and a short OKP x are the guard.
+function assertKeyMaterial(key, E, code, unsupportedCode) {
+  function bad(msg, cause) { return new E(code, msg, cause); }
+  if (!key || typeof key !== "object") throw bad("a credential key must be a decoded COSE_Key object");
+  // ONE read of each field, into a plain object, before anything is checked or used.
+  //
+  // The object form comes from the caller, so any of these can be an accessor. One that THROWS
+  // turns a validation into a raw fault -- the thing this function exists to prevent -- and one
+  // that returns DIFFERENT values on successive reads makes the field that was checked and the
+  // field that is used two different values, which is the check defeated rather than merely
+  // reported badly. Reading each exactly once settles both, and settles them for every field
+  // rather than for the ones a particular branch happens to reach.
+  try {
+    key = { kty: key.kty, alg: key.alg, crv: key.crv, x: key.x, y: key.y, n: key.n, e: key.e };
+  } catch (e) { throw bad("a credential key field could not be read", e); }
+  // Then the TYPE and the VALUE. BigInt() throws a raw TypeError on a Symbol and on undefined, and
+  // a raw RangeError on a fractional or non-finite number, so "it is a number" is not the check --
+  // "it is an integer" is. EVERY integer label the branches below read, not the two the dispatch
+  // happens to need first:
+  // crv indexes a lookup table, and a Symbol thrown at a property read is the same raw fault as a
+  // Symbol thrown at BigInt(). The decoded form gets these from the CBOR reader, which has already
+  // established them; the object form gets them from the caller, so this is where they are settled.
+  // A BigInt is bounded too. COSE labels are small registry integers, and an unbounded one converts
+  // to Infinity, which then throws a raw RangeError at the next conversion -- the same defeat as a
+  // fractional number, reached by a value that IS an integer. "It is an integer" is not the whole
+  // check either; "it is an integer this code can carry" is.
+  var MAX = BigInt(Number.MAX_SAFE_INTEGER);
+  function _isInt(v) {
+    if (typeof v === "bigint") return v <= MAX && v >= -MAX;
+    return typeof v === "number" && Number.isSafeInteger(v);
+  }
+  if (!_isInt(key.kty)) throw bad("a COSE_Key kty (label 1) must be an integer");
+  if (!_isInt(key.alg)) throw bad("a COSE_Key alg (label 3) must be an integer");
+  if (key.crv !== undefined && key.crv !== null && !_isInt(key.crv)) throw bad("a COSE_Key crv (label -1) must be an integer");
+  // ONE representation from here down. A label may arrive as a Number or a BigInt -- a CBOR reader
+  // hands out BigInt, an object built in JavaScript is likelier to hold Number -- and everything
+  // below compares with === against the Number-keyed profile table and the curve tables. Accepting
+  // both forms at the gate and then comparing only one is a check that answers by how the caller
+  // happened to spell the value; the decoded arm normalizes here too, for the same reason.
+  key.kty = Number(key.kty);
+  key.alg = Number(key.alg);
+  if (key.crv !== undefined && key.crv !== null) key.crv = Number(key.crv);
+  var kty = BigInt(key.kty);
+  if (kty === 2n) {
+    var el2 = EC2_CRV_LEN[key.crv];
+    if (!Buffer.isBuffer(key.x) || !Buffer.isBuffer(key.y)) throw bad("an EC2 COSE_Key must carry crv (-1), x (-2), and y (-3)");
+    if (!el2 || key.x.length !== el2 || key.y.length !== el2) throw bad("an EC2 COSE_Key x/y length is inconsistent with its curve");
+  } else if (kty === 1n) {
+    var okp2 = OKP_CRV[key.crv];
+    if (!okp2 || !Buffer.isBuffer(key.x) || key.x.length !== okp2.len) throw bad("an OKP COSE_Key must be Ed25519 (crv 6) or Ed448 (crv 7) with a matching-length x (-2)");
+  } else if (kty === 3n) {
+    if (!Buffer.isBuffer(key.n) || !key.n.length || !Buffer.isBuffer(key.e) || !key.e.length) throw bad("an RSA COSE_Key must carry n (-1) and e (-2)");
+    if (key.n[0] === 0) throw bad("an RSA COSE_Key modulus (-1) must be minimally encoded, with no leading zero byte (RFC 8230 sec. 4)");
+    if (key.e[0] === 0) throw bad("an RSA COSE_Key exponent (-2) must be minimally encoded, with no leading zero byte (RFC 8230 sec. 4)");
+    var bits = _modulusBits(key.n);
+    if (bits < RSA_MIN_MODULUS_BITS) throw bad("an RSA COSE_Key modulus (-1) is " + bits + " bits, below the " + RSA_MIN_MODULUS_BITS + "-bit minimum");
+    if (key.e.length > RSA_MAX_EXPONENT_BYTES) throw bad("an RSA COSE_Key exponent (-2) is longer than " + RSA_MAX_EXPONENT_BYTES + " bytes");
+    if ((key.e[key.e.length - 1] & 1) === 0) throw bad("an RSA COSE_Key exponent (-2) must be odd");
+    if (key.e.length === 1 && key.e[0] <= 1) throw bad("an RSA COSE_Key exponent (-2) must be greater than 1 -- e = 1 makes RSA the identity function");
+  } else {
+    throw bad("unsupported COSE_Key kty " + Number(key.kty));
+  }
   // PROFILE: the declared alg must match the key type (and, for EC2, the curve).
   var prof = ALG_PROFILE[String(key.alg)];
   // An algorithm this verifier does not implement is NOT a malformed key. The key can be perfectly
@@ -173,7 +257,7 @@ function credentialKey(node, E, code, unsupportedCode) {
   // OpenSSL does NOT validate an OKP (Ed25519/Ed448) point on import -- an all-zeroes key
   // parses, and even verifies a trivial signature -- so an OKP point needs an explicit
   // on-curve + full-order (non-low-order) check (RFC 8032 decode + the cofactor check).
-  if (kty === 1n && !edwardsPoint.validate(key.x, key.crv)) throw bad("the OKP credential public key is not a valid, full-order Edwards point");
+  if (Number(key.kty) === 1 && !edwardsPoint.validate(key.x, key.crv)) throw bad("the OKP credential public key is not a valid, full-order Edwards point");
   return key;
 }
 
@@ -216,6 +300,7 @@ function toSpki(key, E, code) {
 
 module.exports = {
   credentialKey: credentialKey,
+  assertKeyMaterial: assertKeyMaterial,
   toSpki: toSpki,
   EC2_CRV_LEN: EC2_CRV_LEN,
   EC2_CRV_OID: EC2_CRV_OID,

package/lib/validator-tpm.js

@@ -221,12 +221,17 @@ function normalizeObjectAttributePolicy(policy, E, code) {
       // either of which could match a key this policy was written to exclude, including the
       // Empty Policy. An entry that is not a Buffer or a canonical even-length hex string is a
       // caller error, and it fails here rather than becoming a digest nobody intended.
+      // Through guard.encoding.hex, which owns the alphabet, the even-length rule and the
+      // canonical round-trip -- the same three checks written here by hand, and now written
+      // once. It also decodes, so the hex path cannot validate one string and decode another.
       allow = ap.allow.map(function (entry, i) {
         if (Buffer.isBuffer(entry)) return entry;
-        if (typeof entry !== "string" || entry.length === 0 || entry.length % 2 !== 0 || !/^[0-9a-fA-F]+$/.test(entry)) {
-          throw new E(code, "opts.tpmPolicy.authPolicy.allow[" + i + "] must be a Buffer or an even-length hex string");
+        var label = "opts.tpmPolicy.authPolicy.allow[" + i + "]";
+        if (typeof entry !== "string" || entry.length === 0) {
+          throw new E(code, label + " must be a Buffer or an even-length hex string");
         }
-        return Buffer.from(entry, "hex");
+        return guard.encoding.hex(entry, null, function (c, m) { return new E(c, m); }, code,
+          label + " must be a Buffer or an even-length hex string --");
       });
     }
   }

package/lib/webauthn-mds.js

@@ -20,7 +20,6 @@
 // FIDO Metadata Service v3.0 sec. 3.1 / sec. 3.2, RFC 7515 (JWS).
 
 var frameworkError = require("./framework-error");
-var asn1 = require("./asn1-der");
 var x509 = require("./schema-x509");
 var guard = require("./guard-all");
 var jose = require("./jose");
@@ -32,7 +31,10 @@ var edwardsPoint = require("./edwards-point");
 var webcrypto = require("./webcrypto");
 var nodeCrypto = require("crypto");
 
+var oid = require("./oid");
+var pkix = require("./schema-pkix");
 var WebauthnError = frameworkError.WebauthnError;
+var _KU_NS = pkix.makeNS("webauthn", WebauthnError, oid);
 function _err(code, message, cause) { return new WebauthnError(code, message, cause); }
 var C = constants.LIMITS;
 
@@ -183,17 +185,13 @@ var UNDERSTOOD_HEADER = Object.assign(Object.create(null), {
 
 // The BLOB's signing certificate must be allowed to sign. RFC 5280 sec. 4.2.1.3 numbers
 // digitalSignature bit 0 of the keyUsage BIT STRING; an absent extension places no restriction.
+// Through the shared reader, which applies the NamedBitList rules a local bit test does not: DER
+// drops trailing zero bits (X.690 sec. 11.2.2) and sec. 4.2.1.3 requires at least one bit set, so
+// reading the bits here would let a certificate the rest of the toolkit calls malformed sign a BLOB.
 function _assertLeafSigns(leaf) {
-  var exts = leaf.extensions || [];
-  for (var i = 0; i < exts.length; i++) {
-    if (exts[i].name !== "keyUsage" || exts[i].value == null) continue;
-    var ku;
-    try { ku = asn1.read.bitString(asn1.decode(exts[i].value)); }
-    catch (e) { throw _err("webauthn/bad-att-cert", "the metadata BLOB x5c leaf keyUsage extension is malformed", e); }
-    if (!ku.bytes.length || (ku.bytes[0] & 0x80) === 0) {
-      throw _err("webauthn/bad-att-cert", "the metadata BLOB x5c leaf keyUsage does not assert digitalSignature, so it may not sign the BLOB (RFC 5280 sec. 4.2.1.3)");
-    }
-    return;
+  var ku = pkix.keyUsageOf(_KU_NS, leaf, _err, "webauthn/bad-att-cert", "metadata BLOB x5c leaf");
+  if (ku && ku.digitalSignature !== true) {
+    throw _err("webauthn/bad-att-cert", "the metadata BLOB x5c leaf keyUsage does not assert digitalSignature, so it may not sign the BLOB (RFC 5280 sec. 4.2.1.3)");
   }
 }
 
@@ -214,24 +212,16 @@ function _isAnchorItself(cert, anchor) {
 // a hand-built object literal satisfies it too and then raises a raw TypeError from deep inside the
 // path validator, which is an untyped throw escaping a public verb.
 function _asCert(v, label) {
-  // A certificate arriving as BYTES arrives in whichever byte form the caller holds -- the same set
-  // every other byte argument in this namespace takes. A DataView or an ArrayBuffer over identical
-  // DER is the identical certificate, and refusing one of them makes the accepted set depend on how
-  // the caller happened to receive the file rather than on what it contains.
-  if (ArrayBuffer.isView(v) || v instanceof ArrayBuffer) {
-    v = guard.bytes.source(v, WebauthnError, "webauthn/bad-input", label);
-  }
-  if (v && typeof v === "object" && !Buffer.isBuffer(v) && !(v instanceof Uint8Array) &&
-      v.subject && v.subjectPublicKeyInfo && Buffer.isBuffer(v.subjectPublicKeyInfo.bytes) &&
-      v.signatureAlgorithm && typeof v.signatureAlgorithm.oid === "string" &&
-      // `validity` is what separates a certificate from the other signed structures that carry a
-      // subject, a public key and a signature algorithm: a parsed certification request has all
-      // three and would otherwise be installed as a trust anchor.
-      v.validity && v.validity.notBefore !== undefined) {
-    return v;
-  }
-  try { return x509.parse(v); }
-  catch (e) { throw _err("webauthn/bad-input", label + " is not a decodable certificate", e); }
+  // Through the shared certificate door: these become the anchors a metadata BLOB's signer chain is
+  // judged against, and an anchor's identity is its subject and its key. A caller-assembled object
+  // could carry a real root's subject beside a substituted key -- every field well-formed, nothing
+  // for a shape test to catch -- so the object is re-derived from the bytes its parser read instead.
+  // Bytes in any form (a Buffer, a typed-array view, a DataView, an ArrayBuffer) are parsed here;
+  // refusing one of those would make the accepted set depend on how the caller received the file.
+  return guard.parsed.acceptDerived(v, "certificate", function (bytes) {
+    try { return x509.parse(bytes); }
+    catch (e) { throw _err("webauthn/bad-input", label + " is not a decodable certificate", e); }
+  }, _err, "webauthn/bad-input", label);
 }
 
 // Verify a FIDO Metadata Service BLOB and return its entries indexed for lookup. `blob` is the

package/lib/webauthn.js

@@ -572,8 +572,13 @@ function _snapshotRoots(supplied) {
     if (_isBufferSource(root)) {
       return guard.bytes.snapshotSource(root, WebauthnError, "webauthn/bad-input", "opts.rootCertificates[]");
     }
-    if (root && typeof root === "object") return _cloneParsed(root, 0);
-    return root;   // a PEM string is immutable
+    // A PARSED certificate is kept AS IT IS, not deep-copied. The copy was this function's way of
+    // stopping a caller mutating a root after it was accepted, and it solved that by making a
+    // detached twin -- which loses the parser's record, so the door below could no longer re-derive
+    // the anchor from the bytes it was read from. The record is the stronger form of the same
+    // protection: the anchor is re-parsed from those bytes, so an edit made afterwards, at any depth,
+    // is discarded rather than copied. Cloning would trade that for a snapshot of a mutable object.
+    return root;   // a PEM string is immutable; a parsed certificate carries its own provenance
   });
 }
 
@@ -592,13 +597,16 @@ function _applyCallerRoots(res, supplied, vopts, onlyPaths) {
   // would fault on a field it does not have rather than naming the caller's mistake.
   // The same three forms opts.safetyNetRoots takes, since it is the same question.
   var roots = supplied.map(function (root, i) {
-    var cert;
-    try { cert = _isBufferSource(root) ? x509.parse(guard.bytes.source(root, WebauthnError, "webauthn/bad-input", "opts.rootCertificates[" + i + "]")) : (typeof root === "string" ? x509.parse(root) : root); }
-    catch (e) { throw _err("webauthn/bad-input", "opts.rootCertificates[" + i + "] is not a decodable certificate", e); }
-    if (!cert || !cert.subject || !cert.subjectPublicKeyInfo) {
-      throw _err("webauthn/bad-input", "opts.rootCertificates[" + i + "] is not a certificate");
-    }
-    return cert;
+    var label = "opts.rootCertificates[" + i + "]";
+    // These BECOME trust anchors, which is the sharpest form of the rule: the anchor's key is what
+    // the whole attestation chain is judged against, so a caller-assembled certificate carrying a
+    // real root's name beside a substituted key would anchor an attacker's chain. Re-derived from
+    // the bytes its parser read, exactly as at every other certificate door.
+    return guard.parsed.acceptDerived(root, "certificate", function (bytes) {
+      try {
+        return x509.parse(_isBufferSource(bytes) ? guard.bytes.source(bytes, WebauthnError, "webauthn/bad-input", label) : bytes);
+      } catch (e) { throw _err("webauthn/bad-input", label + " is not a decodable certificate", e); }
+    }, _err, "webauthn/bad-input", label);
   });
   // Same rule the metadata route applies: a compound element carrying no
   // certificates makes no claim there is anything to anchor, so it is not a reason to
@@ -1174,14 +1182,15 @@ function _safetyNetHostnameOk(leaf) {
 function _safetyNetChainTrusted(chain, roots, time) {
   var anchors;
   try {
+    // The same door opts.rootCertificates goes through, for the same reason: these become trust
+    // anchors, and an anchor's key is what the chain is judged against.
     anchors = roots.map(function (root, i) {
-      var anchorCert;
-      try { anchorCert = _isBufferSource(root) ? x509.parse(guard.bytes.source(root, WebauthnError, "webauthn/bad-input", "opts.safetyNetRoots[" + i + "]")) : (typeof root === "string" ? x509.parse(root) : root); }
-      catch (e) { throw _err("webauthn/bad-input", "opts.safetyNetRoots[" + i + "] is not a decodable certificate", e); }
-      if (!anchorCert || !anchorCert.subject || !anchorCert.subjectPublicKeyInfo) {
-        throw _err("webauthn/bad-input", "opts.safetyNetRoots[" + i + "] is not a certificate");
-      }
-      return anchorCert;
+      var label = "opts.safetyNetRoots[" + i + "]";
+      return guard.parsed.acceptDerived(root, "certificate", function (bytes) {
+        try {
+          return x509.parse(_isBufferSource(bytes) ? guard.bytes.source(bytes, WebauthnError, "webauthn/bad-input", label) : bytes);
+        } catch (e) { throw _err("webauthn/bad-input", label + " is not a decodable certificate", e); }
+      }, _err, "webauthn/bad-input", label);
     });
   } catch (e) { return Promise.reject(e); }
   return mds.chainToAnchor(chain, anchors, time === undefined ? new Date() : time,
@@ -2228,7 +2237,13 @@ function _snapshotAssertion(input) {
     var key = {}, kk;
     for (kk in out.credentialPublicKey) {
       if (!Object.prototype.hasOwnProperty.call(out.credentialPublicKey, kk)) continue;
-      var v = out.credentialPublicKey[kk];
+      // The read itself can fault: a stored key is a caller-supplied object, so a field may be an
+      // accessor, and one that THROWS would escape as a raw error from the very copy whose job is
+      // to make the descriptor stop being the caller's. The copy is the boundary, so the fault is
+      // named here rather than surfacing from wherever the field was later used.
+      var v;
+      try { v = out.credentialPublicKey[kk]; }
+      catch (e) { throw _err("webauthn/bad-cose-key", "credentialPublicKey." + kk + " could not be read", e); }
       key[kk] = _isBufferSource(v) ? guard.bytes.snapshotSource(v, WebauthnError, "webauthn/bad-input", "credentialPublicKey." + kk) : v;
     }
     out.credentialPublicKey = key;
@@ -2295,7 +2310,14 @@ function verifyAssertion(input) {
     var coseKey = input.credentialPublicKey;
     if (Buffer.isBuffer(coseKey) || ArrayBuffer.isView(coseKey) || coseKey instanceof ArrayBuffer) {
       coseKey = parseCoseKey(coseKey);
-    } else if (!_isPlainObject(coseKey)) {
+    } else if (_isPlainObject(coseKey)) {
+      // The OBJECT form is held to the same rules about the KEY as the bytes form. The bytes went
+      // through the curve/length, RSA modulus-floor and exponent checks; the object went through
+      // none, so one stored credential was refused in one form and imported for signature
+      // verification in the other. Which form a relying party stores is a question about what their
+      // datastore round-trips, not about how carefully their credential is checked.
+      coseKey = validator.cose.assertKeyMaterial(coseKey, WebauthnError, "webauthn/bad-cose-key", "webauthn/unsupported-algorithm");
+    } else {
       throw _err("webauthn/bad-input", "credentialPublicKey must be the stored COSE key -- the object pki.webauthn.verify returned, or its COSE bytes");
     }
     var bindingChecked = _applyBindings(authData, coseKey, input);

package/lib/x509-sign.js

@@ -286,8 +286,12 @@ function _sign(spec, issuer, opts) {
     issuerDer = subjectDer;
     issuerSpki = spki;
   } else if (issuer.cert != null) {
-    issuerCert = (Buffer.isBuffer(issuer.cert) || typeof issuer.cert === "string") ? x509.parse(issuer.cert) : issuer.cert;
-    if (!issuerCert || !issuerCert.tbsBytes) throw _err("x509/bad-input", "issuer.cert must be a certificate DER/PEM or a parsed certificate");
+    // The CA-ness gate, the issuer name and the signing key are all read off this object, so a
+    // partial one decides them on fields that are not there.
+    // Re-derived from the bytes its parser read. The issuer certificate's subject and key identifier
+    // are copied into the certificate being signed, so they are a claim about who issued it -- an
+    // assembled object could name an issuer whose bytes the signer never saw.
+    issuerCert = guard.parsed.acceptDerived(issuer.cert, "certificate", x509.parse, _err, "x509/bad-input", "issuer.cert");
     issuerPathLen = _assertIssuerIsCa(issuerCert);
     issuerDer = pkiBuild.tbsNameField(issuerCert, "subject");
     issuerSpki = issuerCert.subjectPublicKeyInfo.bytes;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.3",
+  "version": "0.5.5",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",
@@ -13,6 +13,10 @@
     "url": "https://github.com/blamejs/pki/issues"
   },
   "main": "index.js",
+  "exports": {
+    ".": "./index.js",
+    "./package.json": "./package.json"
+  },
   "bin": {
     "pki": "bin/pki.js"
   },

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:cbb4691a-0291-4bc0-8d98-6333e4aa18ca",
+  "serialNumber": "urn:uuid:e4afed62-75b0-4b79-b65c-4d16c17ee70b",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-15T02:19:20.225Z",
+    "timestamp": "2026-08-15T23:54:15.184Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.3",
+      "bom-ref": "@blamejs/pki@0.5.5",
       "type": "application",
       "name": "pki",
-      "version": "0.5.3",
+      "version": "0.5.5",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.3",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.5",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.3",
+      "ref": "@blamejs/pki@0.5.5",
       "dependsOn": []
     }
   ]