@blamejs/pki 0.5.32 → 0.5.33

package/lib/cms-verify.js

@@ -52,6 +52,13 @@ var pkix = require("./schema-pkix");
 
 var CmsError = frameworkError.CmsError;
 function _err(code, message, cause) { return new CmsError(code, message, cause); }
+// Promise.resolve captured at load and invoked through the captured Reflect.apply, so a streamed
+// opts.content -- whose iterator runs during the digest await and can replace Promise.resolve -- cannot
+// turn a resolved { ok: false } verdict into acceptance. The verify path resolves every value through
+// this and awaits every step: Promise.all is deliberately NOT used, since its spec-internal element
+// handling dispatches through the caller-replaceable Promise.prototype.then, which await does not.
+var _Promise = Promise, _promiseResolveRaw = Promise.resolve;
+function _pResolve(v) { return intrinsic.apply(_promiseResolveRaw, _Promise, [v]); }
 
 var OID_MESSAGE_DIGEST = oid.byName("messageDigest");
 var OID_CONTENT_TYPE = oid.byName("contentType");
@@ -76,8 +83,8 @@ var SIG_HASH = { sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "S
 // Is `name` a message-digest algorithm this verifier supports?
 function _supportedDigest(name) { return intrinsic.hasOwn(DIGEST_HASH, name) && !!DIGEST_HASH[name]; }
 // The digest of `content` under the named algorithm, resolved to a Buffer.
-function _computeDigest(name, content) {
-  return subtle.digest(DIGEST_HASH[name], content).then(function (d) { return Buffer.from(d); });
+async function _computeDigest(name, content) {
+  return intrinsic.bufferFrom(await subtle.digest(DIGEST_HASH[name], content));
 }
 // A signatureAlgorithm name -> its verify scheme. A combined OID (sha256WithRSAEncryption,
 // ecdsaWithSHA256) carries its own hash; a bare key OID (rsaEncryption, ecPublicKey) takes the
@@ -136,9 +143,11 @@ function _findSignerCerts(sid, parsedCerts) {
   for (var i = 0; i < parsedCerts.length; i++) {
     var c = parsedCerts[i];
     if (sid.subjectKeyIdentifier != null) {
-      if (c.ski && c.ski.equals(_toBuf(sid.subjectKeyIdentifier, "sid.subjectKeyIdentifier"))) out.push(c);
+      // Captured equality: over a streamed content the untrusted iterator ran during the digest await
+      // and could replace Buffer.prototype.equals to match the wrong certificate to a signer.
+      if (c.ski && intrinsic.bufferEquals(c.ski, _toBuf(sid.subjectKeyIdentifier, "sid.subjectKeyIdentifier"))) intrinsic.push(out, c);
     } else if (sid.issuer && sid.serialNumberHex != null) {
-      if (c.cert.serialNumberHex === sid.serialNumberHex && guard.name.dnEqual(c.cert.issuer.rdns, sid.issuer.rdns, _err, "cms/bad-name", "the signer certificate issuer")) out.push(c);
+      if (c.cert.serialNumberHex === sid.serialNumberHex && guard.name.dnEqual(c.cert.issuer.rdns, sid.issuer.rdns, _err, "cms/bad-name", "the signer certificate issuer")) intrinsic.push(out, c);
     }
   }
   return out;
@@ -150,27 +159,29 @@ function _findSignerCerts(sid, parsedCerts) {
 // through to the next -- so a colliding certificate cannot make a valid signature read invalid.
 // When no candidate verifies, a plain false is a code-less verdict; the last structural fault's
 // code is surfaced if one occurred (so the diagnostic is not lost).
-function _verifyAgainstCandidates(scheme, sigHash, sigBytes, signedBytes, sid, candidates, pssSalt, expectedKeyOid) {
+async function _verifyAgainstCandidates(scheme, sigHash, sigBytes, signedBytes, sid, candidates, pssSalt, expectedKeyOid) {
   var lastErr = null;
-  function attempt(idx) {
-    if (idx >= candidates.length) {
-      return lastErr ? { ok: false, code: lastErr.code, sid: sid, cert: candidates[0].der, message: lastErr.message }
-        : { ok: false, sid: sid, cert: candidates[0].der };
-    }
+  for (var idx = 0; idx < candidates.length; idx++) {
     var c = candidates[idx];
     // One-shot family (EdDSA/ML-DSA): the signer cert public-key algorithm OID MUST equal the
     // SignerInfo signatureAlgorithm OID. A candidate whose SPKI disagrees is skipped with a precise
     // verdict; importing it under the wrong name would surface a foreign webcrypto/data throw.
     if (expectedKeyOid && c.cert.subjectPublicKeyInfo.algorithm.oid !== expectedKeyOid) {
       lastErr = _err("cms/unsupported-algorithm", "the signer certificate public-key algorithm does not match the SignerInfo signatureAlgorithm");
-      return attempt(idx + 1);
+      continue;
+    }
+    // `await`, not `.then`: over a streamed content the untrusted iterator ran during the digest await
+    // and could replace Promise.prototype.then to return a fabricated `true`; await is immune (it does
+    // not dispatch through the caller-replaceable prototype method).
+    try {
+      var ok = await _verifySignature(scheme, sigHash, sigBytes, c.cert.subjectPublicKeyInfo.bytes, signedBytes, _certCurveOid(c.cert), pssSalt);
+      if (ok === true) return { ok: true, sid: sid, cert: c.der };
+    } catch (e) {
+      lastErr = (e instanceof CmsError) ? e : _err("cms/verify-error", "the SignerInfo signature could not be evaluated", e);
     }
-    return Promise.resolve()
-      .then(function () { return _verifySignature(scheme, sigHash, sigBytes, c.cert.subjectPublicKeyInfo.bytes, signedBytes, _certCurveOid(c.cert), pssSalt); })
-      .then(function (ok) { return ok === true ? { ok: true, sid: sid, cert: c.der } : attempt(idx + 1); },
-        function (e) { lastErr = (e instanceof CmsError) ? e : _err("cms/verify-error", "the SignerInfo signature could not be evaluated", e); return attempt(idx + 1); });
   }
-  return attempt(0);
+  return lastErr ? { ok: false, code: lastErr.code, sid: sid, cert: candidates[0].der, message: lastErr.message }
+    : { ok: false, sid: sid, cert: candidates[0].der };
 }
 
 // The cert's subjectKeyIdentifier extension value (the raw key id), or null.
@@ -255,14 +266,17 @@ function _resolvePss(paramsBytes) {
 // Verify the signature over `signedBytes` with the signer certificate's public key under the
 // resolved scheme + hash. Resolves true/false (a false verdict is a verdict); a structural
 // fault throws a typed CmsError.
-function _verifySignature(scheme, hashName, sigBytes, spki, signedBytes, curveOid, pssSalt) {
+async function _verifySignature(scheme, hashName, sigBytes, spki, signedBytes, curveOid, pssSalt) {
+  // `await` throughout, never `.then`: a streamed content's untrusted iterator ran during the digest
+  // await and could replace Promise.prototype.then to answer a fabricated `true`; await does not
+  // dispatch through it.
   if (scheme.kind === "rsa") {
-    return subtle.importKey("spki", spki, { name: "RSASSA-PKCS1-v1_5", hash: hashName }, false, ["verify"])
-      .then(function (k) { return subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, k, sigBytes, signedBytes); });
+    var kRsa = await subtle.importKey("spki", spki, { name: "RSASSA-PKCS1-v1_5", hash: hashName }, false, ["verify"]);
+    return subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, kRsa, sigBytes, signedBytes);
   }
   if (scheme.kind === "rsapss") {
-    return subtle.importKey("spki", spki, { name: "RSA-PSS", hash: hashName }, false, ["verify"])
-      .then(function (k) { return subtle.verify({ name: "RSA-PSS", saltLength: pssSalt }, k, sigBytes, signedBytes); });
+    var kPss = await subtle.importKey("spki", spki, { name: "RSA-PSS", hash: hashName }, false, ["verify"]);
+    return subtle.verify({ name: "RSA-PSS", saltLength: pssSalt }, kPss, sigBytes, signedBytes);
   }
   if (scheme.kind === "ec") {
     var ec = EC_CURVE[curveOid];
@@ -270,23 +284,23 @@ function _verifySignature(scheme, hashName, sigBytes, spki, signedBytes, curveOi
     // The ORDER-AWARE gate: r,s in [1, n-1] per FIPS 186-5 sec. 6.4.2 (rejecting an out-of-range r/s >= the
     // curve order n, not only the r=s=0 forgery). A verifier that knows the curve MUST use it.
     var raw = validator.sig.ecdsaDerToP1363(sigBytes, ec.curve, CmsError, "cms/bad-signature");
-    return subtle.importKey("spki", spki, { name: "ECDSA", namedCurve: ec.curve }, false, ["verify"])
-      .then(function (k) { return subtle.verify({ name: "ECDSA", hash: hashName }, k, raw, signedBytes); });
+    var kEc = await subtle.importKey("spki", spki, { name: "ECDSA", namedCurve: ec.curve }, false, ["verify"]);
+    return subtle.verify({ name: "ECDSA", hash: hashName }, kEc, raw, signedBytes);
   }
   if (scheme.kind === "mldsa" || scheme.kind === "slhdsa") {
     // ML-DSA (RFC 9882) / SLH-DSA (RFC 9814): a one-shot post-quantum verify, pure mode, empty
     // context -- no external signature hash and no Edwards-point validation (FIPS 204 sec. 5.3 /
     // FIPS 205 sec. 10.3; node structurally validates the SPKI on import). The signature is raw and
     // fixed-length (not ECDSA-DER).
-    return subtle.importKey("spki", spki, { name: scheme.name }, false, ["verify"])
-      .then(function (k) { return subtle.verify({ name: scheme.name }, k, sigBytes, signedBytes); });
+    var kPq = await subtle.importKey("spki", spki, { name: scheme.name }, false, ["verify"]);
+    return subtle.verify({ name: scheme.name }, kPq, sigBytes, signedBytes);
   }
   // EdDSA -- the WebCrypto name follows the signing key's SPKI OID (Ed25519 / Ed448). node/
   // OpenSSL imports any Ed25519/Ed448 SPKI without validating the point, and a low-order (e.g.
   // all-zeroes) key verifies a forged signature, so reject a non-full-order point first.
   _requireValidEdPoint(spki, scheme.name);
-  return subtle.importKey("spki", spki, { name: scheme.name }, false, ["verify"])
-    .then(function (k) { return subtle.verify({ name: scheme.name }, k, sigBytes, signedBytes); });
+  var kEd = await subtle.importKey("spki", spki, { name: scheme.name }, false, ["verify"]);
+  return subtle.verify({ name: scheme.name }, kEd, sigBytes, signedBytes);
 }
 
 // The EdDSA signer key's point MUST be a valid, canonical, full-order Edwards point: reject an
@@ -313,7 +327,7 @@ function _certCurveOid(cert) {
 function _decodeSignedAttrs(setOfBytes) {
   var set = asn1.decode(setOfBytes);
   if (set.tagClass !== "universal" || set.tagNumber !== asn1.TAGS.SET || !set.children) throw _err("cms/bad-signed-attrs", "signedAttrs is not a SET OF Attribute");
-  return set.children.map(function (attr) {
+  return intrinsic.map(set.children, function (attr) {
     if (attr.tagClass !== "universal" || attr.tagNumber !== asn1.TAGS.SEQUENCE || !attr.children || attr.children.length !== 2) throw _err("cms/bad-signed-attrs", "a signed Attribute is not a SEQUENCE { type, values }");
     var valuesSet = attr.children[1];
     if (valuesSet.tagClass !== "universal" || valuesSet.tagNumber !== asn1.TAGS.SET || !valuesSet.children) throw _err("cms/bad-signed-attrs", "a signed Attribute values field is not a SET OF");
@@ -327,23 +341,23 @@ function _decodeSignedAttrs(setOfBytes) {
 // preimage is the countersigned signature octets, not the sec. 5.4 content preimage, and no
 // content-type attribute is required or checked (_computeCountersigBytes). content/eContentType are
 // unused in that mode.
-function _verifyOne(si, content, eContentType, parsedCerts, csTarget) {
+async function _verifyOne(si, content, eContentType, parsedCerts, csTarget, digestByName) {
   // A composite ML-DSA SignerInfo (draft-ietf-lamps-cms-composite-sigs) is keyed by its composite
   // OID, not a SIG_SCHEME name; intercept it before the classical dispatch (its verify has no
   // single external signature hash, so it never routes through the SIG_SCHEME/sigHash gate below).
   var composite = compositeSig.COMPOSITE_ALGS[si.signatureAlgorithm.oid];
-  if (composite) return _verifyComposite(si, composite, content, eContentType, parsedCerts, csTarget);
+  if (composite) return _verifyComposite(si, composite, content, eContentType, parsedCerts, csTarget, digestByName);
   var scheme = SIG_SCHEME[si.signatureAlgorithm.name];
-  if (!scheme) return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "unsupported signature algorithm " + JSON.stringify(si.signatureAlgorithm.name) });
+  if (!scheme) return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "unsupported signature algorithm " + JSON.stringify(si.signatureAlgorithm.name) });
   var digestHash = SIG_HASH[si.digestAlgorithm.name];
   // RSASSA-PSS takes its signature hash and salt length from the RSASSA-PSS-params, not the
   // digestAlgorithm; a non-conformant parameter set is a fail-closed unsupported verdict.
   var pss = scheme.kind === "rsapss" ? _resolvePss(si.signatureAlgorithm.parameters) : null;
-  if (scheme.kind === "rsapss" && !pss) return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "unsupported or non-conformant RSASSA-PSS parameters (RFC 4055)" });
+  if (scheme.kind === "rsapss" && !pss) return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "unsupported or non-conformant RSASSA-PSS parameters (RFC 4055)" });
   // signatureAlgorithm is outside the signed preimage, so a forbidden/missing parameters field
   // (a present parameter on ECDSA/EdDSA, a non-NULL or absent one on RSA) must fail closed --
   // otherwise it is a parser differential a caller trusting the verdict inherits (RFC 5754).
-  if (scheme.params && !_algParamsOk(scheme.params, si.signatureAlgorithm.parameters)) return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the " + si.signatureAlgorithm.name + " signature algorithm parameters must be " + (scheme.params === "null" ? "DER NULL (RFC 4055)" : "absent (RFC 5758/8410)") });
+  if (scheme.params && !_algParamsOk(scheme.params, si.signatureAlgorithm.parameters)) return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the " + si.signatureAlgorithm.name + " signature algorithm parameters must be " + (scheme.params === "null" ? "DER NULL (RFC 4055)" : "absent (RFC 5758/8410)") });
   // The digestAlgorithm parameters, when present, MUST be a DER NULL (RFC 5754 sec. 2 accepts
   // absent OR NULL; a present non-NULL is malformed and, being outside the signed preimage,
   // must fail closed like the signatureAlgorithm parameters above). EXCEPT for an ML-DSA
@@ -351,39 +365,40 @@ function _verifyOne(si, content, eContentType, parsedCerts, csTarget) {
   // has no meaning there and MUST be ignored, so neither its parameters nor its name may reject.
   var dp = si.digestAlgorithm.parameters;
   var mldsaNoAttrs = scheme.kind === "mldsa" && !si.signedAttrsBytes;
-  if (!mldsaNoAttrs && dp !== null && dp !== undefined && !_isDerNull(dp)) return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the " + si.digestAlgorithm.name + " digest algorithm parameters must be absent or DER NULL (RFC 5754 sec. 2)" });
+  if (!mldsaNoAttrs && dp !== null && dp !== undefined && !_isDerNull(dp)) return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the " + si.digestAlgorithm.name + " digest algorithm parameters must be absent or DER NULL (RFC 5754 sec. 2)" });
   // A SHAKE digest algorithm identifier (id-shake128 / id-shake256) carries NO parameters at all --
   // not even a DER NULL (RFC 8702 sec. 3.1) -- so for a one-shot PQC SignerInfo (ML-DSA per RFC 9882,
   // SLH-DSA per RFC 9814 sec. 4, both citing RFC 8702) with signed attributes a present SHAKE
   // parameter fails closed. The SHA-2 digests (id-sha256/384/512) follow RFC 5754, which requires a
   // verifier to accept absent OR NULL (the generic rule above); the RFCs' omit-on-encode rule binds
   // the signer, not the verifier, so a SHA-2 NULL is not tightened here.
-  if ((scheme.kind === "mldsa" || scheme.kind === "slhdsa") && si.signedAttrsBytes && (si.digestAlgorithm.name === "shake128" || si.digestAlgorithm.name === "shake256") && dp !== null && dp !== undefined) return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "a SHAKE digestAlgorithm carries no parameters (RFC 8702 sec. 3.1)" });
+  if ((scheme.kind === "mldsa" || scheme.kind === "slhdsa") && si.signedAttrsBytes && (si.digestAlgorithm.name === "shake128" || si.digestAlgorithm.name === "shake256") && dp !== null && dp !== undefined) return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "a SHAKE digestAlgorithm carries no parameters (RFC 8702 sec. 3.1)" });
   var sigHash = pss ? pss.hash : (scheme.hash || digestHash);
   // The signature hash is required for every non-EdDSA scheme (EdDSA hashes internally);
   // the content digest is required whenever signed attributes are present, for every scheme
   // (the message-digest attribute is computed under digestAlgorithm). Either gap is a
   // fail-closed unsupported-algorithm verdict, never a foreign-domain throw from the digest.
-  if ((scheme.kind !== "eddsa" && scheme.kind !== "mldsa" && scheme.kind !== "slhdsa" && !sigHash) || (si.signedAttrsBytes && !_supportedDigest(si.digestAlgorithm.name))) return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "unsupported digest algorithm " + JSON.stringify(si.digestAlgorithm.name) });
+  if ((scheme.kind !== "eddsa" && scheme.kind !== "mldsa" && scheme.kind !== "slhdsa" && !sigHash) || (si.signedAttrsBytes && !_supportedDigest(si.digestAlgorithm.name))) return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "unsupported digest algorithm " + JSON.stringify(si.digestAlgorithm.name) });
   // ML-DSA (RFC 9882 sec. 3.3): with signed attributes present, the message-digest algorithm MUST
   // meet the parameter set's security strength -- a below-strength digest is the weaker link and is
   // rejected fail-closed (the RFC's "verifiers MAY reject", taken by the strict-verifier posture).
   // With signed attributes absent the digestAlgorithm has no meaning (sec. 3.3) and is not checked.
-  if (scheme.kind === "mldsa" && si.signedAttrsBytes && !_mldsaDigestSuitable(scheme.name, si.digestAlgorithm.name)) return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the " + si.digestAlgorithm.name + " message digest is below the security strength of " + scheme.name + " (RFC 9882 sec. 3.3)" });
+  if (scheme.kind === "mldsa" && si.signedAttrsBytes && !_mldsaDigestSuitable(scheme.name, si.digestAlgorithm.name)) return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the " + si.digestAlgorithm.name + " message digest is below the security strength of " + scheme.name + " (RFC 9882 sec. 3.3)" });
   // RFC 9814 sec. 4: an SLH-DSA SignerInfo's message-digest algorithm is the one paired with the
   // parameter set (the sec. 4 list, always at least twice the tree-hash size); the signer emits it
   // and this strict verifier requires it, so a digest that does not match the set's paired hash fails
   // closed -- otherwise a signer could compute the message-digest attribute under a weaker hash the
   // set does not pair. Gated on signed attributes (absent -> the digest is not consulted, sec. 4).
-  if (scheme.kind === "slhdsa" && si.signedAttrsBytes && si.digestAlgorithm.name !== scheme.digest) return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "SLH-DSA " + scheme.name + " requires the " + scheme.digest + " message digest (RFC 9814 sec. 4)" });
+  if (scheme.kind === "slhdsa" && si.signedAttrsBytes && si.digestAlgorithm.name !== scheme.digest) return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "SLH-DSA " + scheme.name + " requires the " + scheme.digest + " message digest (RFC 9814 sec. 4)" });
   var signers = _findSignerCerts(si.sid, parsedCerts);
-  if (!signers.length) return Promise.resolve({ ok: false, code: "cms/signer-cert-not-found", sid: si.sid, message: "no certificate matches this SignerInfo's signer identifier" });
+  if (!signers.length) return _pResolve({ ok: false, code: "cms/signer-cert-not-found", sid: si.sid, message: "no certificate matches this SignerInfo's signer identifier" });
   var sigBytes = _toBuf(si.signature, "the SignerInfo signature");
 
-  return (csTarget != null ? _computeCountersigBytes(si, csTarget) : _computeSignedBytes(si, content, eContentType)).then(function (signedBytes) {
-    if (signedBytes && signedBytes.mismatch) return { ok: false, code: signedBytes.mismatch.code, sid: si.sid, cert: signers[0].der, message: signedBytes.mismatch.message };
-    return _verifyAgainstCandidates(scheme, sigHash, sigBytes, signedBytes, si.sid, signers, pss ? pss.saltLength : 0, scheme.sameKeyOid ? oid.byName(si.signatureAlgorithm.name) : null);
-  });
+  // `await`, not `.then`: see _verifyAgainstCandidates -- a streamed content's iterator could replace
+  // Promise.prototype.then to skip the signed-bytes computation and fabricate a passing verdict.
+  var signedBytes = await (csTarget != null ? _computeCountersigBytes(si, csTarget) : _computeSignedBytes(si, content, eContentType, digestByName));
+  if (signedBytes && signedBytes.mismatch) return { ok: false, code: signedBytes.mismatch.code, sid: si.sid, cert: signers[0].der, message: signedBytes.mismatch.message };
+  return _verifyAgainstCandidates(scheme, sigHash, sigBytes, signedBytes, si.sid, signers, pss ? pss.saltLength : 0, scheme.sameKeyOid ? oid.byName(si.signatureAlgorithm.name) : null);
 }
 
 // The exact bytes a countersignature covers (RFC 5652 sec. 11.4): the countersigned SignerInfo's
@@ -392,88 +407,102 @@ function _verifyOne(si, content, eContentType, parsedCerts, csTarget) {
 // covers the re-tagged SignedAttributes ([0] -> universal SET OF) -- the identical transform the
 // top-level signer uses, minus the content-type attribute (which sec. 11.4 FORBIDS). Resolves the
 // signed bytes, or { mismatch } when the message-digest disagrees.
-function _computeCountersigBytes(si, csTarget) {
-  return Promise.resolve().then(function () {
-    if (!si.signedAttrsBytes) return csTarget;   // no signed attributes: sign over the target signature octets directly
-    var reTagged = Buffer.from(si.signedAttrsBytes);
-    reTagged[0] = 0x31;   // [0] IMPLICIT -> universal SET OF
-    var attrs;
-    try {
-      attrs = _decodeSignedAttrs(reTagged);
-    } catch (e) { if (e instanceof CmsError) throw e; throw _err("cms/bad-signed-attrs", "the countersignature signedAttrs is not a valid SET OF Attribute", e); }
-    // sec. 11.4: a content-type attribute MUST NOT appear (the parser already rejects it at parse, but
-    // verify never relies on the parse alone: a parsed-object input could carry one).
-    if (attrs.filter(function (a) { return a.type === OID_CONTENT_TYPE; }).length) throw _err("cms/misplaced-attr", "a countersignature must not carry a content-type attribute (RFC 5652 sec. 11.4)");
-    var mdAttr = attrs.filter(function (a) { return a.type === OID_MESSAGE_DIGEST; })[0];
-    if (!mdAttr || mdAttr.values.length !== 1) throw _err("cms/bad-signed-attrs", "a countersignature's signedAttrs must carry exactly one message-digest attribute (RFC 5652 sec. 11.4)");
-    var declared;
-    try {
-      declared = asn1.read.octetString(mdAttr.values[0]);
-    } catch (e) { throw _err("cms/bad-signed-attrs", "the message-digest attribute value is not an OCTET STRING", e); }
-    return _computeDigest(si.digestAlgorithm.name, csTarget).then(function (d) {
-      if (!d.equals(declared)) return { mismatch: { code: "cms/message-digest-mismatch", message: "the countersignature message-digest does not match the countersigned signature" } };
-      return reTagged;
-    });
-  });
+async function _computeCountersigBytes(si, csTarget) {
+  // async, not `_pResolve().then`: a synchronous throw still becomes a rejection, and the digest await
+  // below dispatches through no caller-replaceable Promise.prototype.then (see _verifyAgainstCandidates).
+  if (!si.signedAttrsBytes) return csTarget;   // no signed attributes: sign over the target signature octets directly
+  var reTagged = intrinsic.bufferFrom(si.signedAttrsBytes);
+  reTagged[0] = 0x31;   // [0] IMPLICIT -> universal SET OF
+  var attrs;
+  try {
+    attrs = _decodeSignedAttrs(reTagged);
+  } catch (e) { if (e instanceof CmsError) throw e; throw _err("cms/bad-signed-attrs", "the countersignature signedAttrs is not a valid SET OF Attribute", e); }
+  // sec. 11.4: a content-type attribute MUST NOT appear (the parser already rejects it at parse, but
+  // verify never relies on the parse alone: a parsed-object input could carry one).
+  if (intrinsic.filter(attrs, function (a) { return a.type === OID_CONTENT_TYPE; }).length) throw _err("cms/misplaced-attr", "a countersignature must not carry a content-type attribute (RFC 5652 sec. 11.4)");
+  var mdAttr = intrinsic.filter(attrs, function (a) { return a.type === OID_MESSAGE_DIGEST; })[0];
+  if (!mdAttr || mdAttr.values.length !== 1) throw _err("cms/bad-signed-attrs", "a countersignature's signedAttrs must carry exactly one message-digest attribute (RFC 5652 sec. 11.4)");
+  var declared;
+  try {
+    declared = asn1.read.octetString(mdAttr.values[0]);
+  } catch (e) { throw _err("cms/bad-signed-attrs", "the message-digest attribute value is not an OCTET STRING", e); }
+  var d = await _computeDigest(si.digestAlgorithm.name, csTarget);
+  if (!intrinsic.bufferEquals(d, declared)) return { mismatch: { code: "cms/message-digest-mismatch", message: "the countersignature message-digest does not match the countersigned signature" } };
+  return reTagged;
 }
 
 // The exact bytes the signature covers (RFC 5652 sec. 5.4), shared by the classical and composite
 // verify paths so both bind the message-digest / content-type checks to the VERIFIED preimage (not
 // the caller-mutable parsed si.signedAttrs). Resolves the signed bytes, or { mismatch } when a
 // content-type / message-digest attribute disagrees.
-function _computeSignedBytes(si, content, eContentType) {
-  return Promise.resolve().then(function () {
-    if (!si.signedAttrsBytes) {
-      // No signed attributes: the signature is over the content itself (RFC 5652 sec. 5.4). That is
-      // also exactly what a stripped-attributes forgery looks like, because a CMS signature does not
-      // commit to whether attributes were present -- so a signature made over a SignedAttributes
-      // block re-presented as one made over content verifies, and with no attributes there is no
-      // message-digest or content-type attribute left to disagree. Refuse the shape: content that
-      // parses as a SignedAttributes block cannot be told apart from that forgery, and it is not
-      // the verifier's place to guess which one it is holding.
-      if (cms.looksLikeSignedAttributes(content)) {
-        return { mismatch: {
-          code: "cms/ambiguous-content",
-          message: "the content of a SignerInfo with no signed attributes is itself an encoded " +
-            "SignedAttributes block, which is indistinguishable from a signature over attributes " +
-            "re-presented as one over content (RFC 5652 sec. 5.4); sign such content WITH signed attributes",
-        } };
-      }
-      return content;
+async function _computeSignedBytes(si, content, eContentType, digestByName) {
+  // async, not `_pResolve().then`: a synchronous throw still becomes a rejection, and every digest step
+  // dispatches through no caller-replaceable Promise.prototype.then (see _verifyAgainstCandidates).
+  if (!si.signedAttrsBytes) {
+    // No signed attributes: the signature is over the content itself (RFC 5652 sec. 5.4). A streamed
+    // content is not retained, so there are no content bytes to verify that signature against; this
+    // is a per-signer verdict, not a whole-message abort, so the other signers of a mixed message
+    // still verify (the same shape the buffered path gives every per-signer condition). `digestByName`
+    // is the streaming marker: an object (possibly empty) when streamed, null when buffered.
+    if (digestByName) {
+      return { mismatch: {
+        code: "cms/streamed-content-unverifiable",
+        message: "a SignerInfo that signs the content directly (no signed attributes) cannot be " +
+          "verified against a streamed content, whose bytes are not retained; pass opts.content as a Buffer",
+      } };
     }
-    // With signed attributes: decode them from the EXACT bytes the signature covers, namely the
-    // SignedAttributes SET OF with the on-wire [0] IMPLICIT tag replaced by a universal SET OF
-    // (RFC 5652 sec. 5.4). The content-type / message-digest checks then bind the same bytes
-    // that are verified. Reading the caller-mutable parsed si.signedAttrs instead would let a
-    // parsed-object input desync the checked attributes from the verified preimage.
-    var reTagged = Buffer.from(si.signedAttrsBytes);
-    reTagged[0] = 0x31;   // [0] IMPLICIT -> universal SET OF
-    var attrs;
-    try {
-      attrs = _decodeSignedAttrs(reTagged);
-    } catch (e) { if (e instanceof CmsError) throw e; throw _err("cms/bad-signed-attrs", "signedAttrs is not a valid SET OF Attribute", e); }
-    // The content-type attribute MUST be present, single-valued, and equal the eContentType
-    // (RFC 5652 sec. 5.3).
-    var ctAttr = attrs.filter(function (a) { return a.type === OID_CONTENT_TYPE; });
-    if (ctAttr.length !== 1 || ctAttr[0].values.length !== 1) throw _err("cms/bad-signed-attrs", "signedAttrs must carry exactly one content-type attribute (RFC 5652 sec. 5.3)");
-    var ctOid;
-    try {
-      ctOid = asn1.read.oid(ctAttr[0].values[0]);
-    } catch (e) { throw _err("cms/bad-signed-attrs", "the content-type attribute value is not an OBJECT IDENTIFIER", e); }
-    if (ctOid !== eContentType) return { mismatch: { code: "cms/content-type-mismatch", message: "the content-type signed attribute does not match the SignedData eContentType (RFC 5652 sec. 5.3)" } };
-    // The message-digest attribute MUST be present, single-valued, and equal the digest of the
-    // content (RFC 5652 sec. 5.4).
-    var mdAttr = attrs.filter(function (a) { return a.type === OID_MESSAGE_DIGEST; })[0];
-    if (!mdAttr || mdAttr.values.length !== 1) throw _err("cms/bad-signed-attrs", "signedAttrs must carry exactly one message-digest attribute (RFC 5652 sec. 5.4)");
-    var declared;
-    try {
-      declared = asn1.read.octetString(mdAttr.values[0]);
-    } catch (e) { throw _err("cms/bad-signed-attrs", "the message-digest attribute value is not an OCTET STRING", e); }
-    return _computeDigest(si.digestAlgorithm.name, content).then(function (d) {
-      if (!d.equals(declared)) return { mismatch: { code: "cms/message-digest-mismatch", message: "the message-digest attribute does not match the content digest" } };
-      return reTagged;
-    });
-  });
+    // Signing content directly is also exactly what a stripped-attributes forgery looks like, because
+    // a CMS signature does not commit to whether attributes were present -- so a signature made over a
+    // SignedAttributes block re-presented as one made over content verifies, and with no attributes
+    // there is no message-digest or content-type attribute left to disagree. Refuse the shape: content
+    // that parses as a SignedAttributes block cannot be told apart from that forgery, and it is not
+    // the verifier's place to guess which one it is holding.
+    if (cms.looksLikeSignedAttributes(content)) {
+      return { mismatch: {
+        code: "cms/ambiguous-content",
+        message: "the content of a SignerInfo with no signed attributes is itself an encoded " +
+          "SignedAttributes block, which is indistinguishable from a signature over attributes " +
+          "re-presented as one over content (RFC 5652 sec. 5.4); sign such content WITH signed attributes",
+      } };
+    }
+    return content;
+  }
+  // With signed attributes: decode them from the EXACT bytes the signature covers, namely the
+  // SignedAttributes SET OF with the on-wire [0] IMPLICIT tag replaced by a universal SET OF
+  // (RFC 5652 sec. 5.4). The content-type / message-digest checks then bind the same bytes
+  // that are verified. Reading the caller-mutable parsed si.signedAttrs instead would let a
+  // parsed-object input desync the checked attributes from the verified preimage.
+  var reTagged = intrinsic.bufferFrom(si.signedAttrsBytes);
+  reTagged[0] = 0x31;   // [0] IMPLICIT -> universal SET OF
+  var attrs;
+  try {
+    attrs = _decodeSignedAttrs(reTagged);
+  } catch (e) { if (e instanceof CmsError) throw e; throw _err("cms/bad-signed-attrs", "signedAttrs is not a valid SET OF Attribute", e); }
+  // The content-type attribute MUST be present, single-valued, and equal the eContentType
+  // (RFC 5652 sec. 5.3).
+  var ctAttr = intrinsic.filter(attrs, function (a) { return a.type === OID_CONTENT_TYPE; });
+  if (ctAttr.length !== 1 || ctAttr[0].values.length !== 1) throw _err("cms/bad-signed-attrs", "signedAttrs must carry exactly one content-type attribute (RFC 5652 sec. 5.3)");
+  var ctOid;
+  try {
+    ctOid = asn1.read.oid(ctAttr[0].values[0]);
+  } catch (e) { throw _err("cms/bad-signed-attrs", "the content-type attribute value is not an OBJECT IDENTIFIER", e); }
+  if (ctOid !== eContentType) return { mismatch: { code: "cms/content-type-mismatch", message: "the content-type signed attribute does not match the SignedData eContentType (RFC 5652 sec. 5.3)" } };
+  // The message-digest attribute MUST be present, single-valued, and equal the digest of the
+  // content (RFC 5652 sec. 5.4).
+  var mdAttr = intrinsic.filter(attrs, function (a) { return a.type === OID_MESSAGE_DIGEST; })[0];
+  if (!mdAttr || mdAttr.values.length !== 1) throw _err("cms/bad-signed-attrs", "signedAttrs must carry exactly one message-digest attribute (RFC 5652 sec. 5.4)");
+  var declared;
+  try {
+    declared = asn1.read.octetString(mdAttr.values[0]);
+  } catch (e) { throw _err("cms/bad-signed-attrs", "the message-digest attribute value is not an OCTET STRING", e); }
+  // Over a buffered content the digest is computed here; over a streamed content it was computed once,
+  // incrementally, before any signer was verified, and looked up by algorithm.
+  var d = digestByName ? digestByName[si.digestAlgorithm.name] : await _computeDigest(si.digestAlgorithm.name, content);
+  // Captured equality, not d.equals: over a streamed content the untrusted iterator's next() ran during
+  // the digest await and could have replaced Buffer.prototype.equals with one that always answers true,
+  // passing this message-digest check for content that was never signed (CWE-347).
+  if (!intrinsic.bufferEquals(d, declared)) return { mismatch: { code: "cms/message-digest-mismatch", message: "the message-digest attribute does not match the content digest" } };
+  return reTagged;
 }
 
 // Verify a composite ML-DSA SignerInfo (draft-ietf-lamps-cms-composite-sigs). The composite
@@ -484,14 +513,14 @@ function _computeSignedBytes(si, content, eContentType) {
 // pre-hash. It reuses the sec. 5.4 preimage + message-digest binding UNCHANGED, then dispatches
 // compositeVerify per candidate certificate (both components must verify, with no AND->OR
 // downgrade).
-function _verifyComposite(si, comp, content, eContentType, parsedCerts, csTarget) {
+async function _verifyComposite(si, comp, content, eContentType, parsedCerts, csTarget, digestByName) {
   if (si.signatureAlgorithm.parameters !== null && si.signatureAlgorithm.parameters !== undefined) {
-    return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the composite signatureAlgorithm parameters must be absent (draft-ietf-lamps-cms-composite-sigs sec. 3.4)" });
+    return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the composite signatureAlgorithm parameters must be absent (draft-ietf-lamps-cms-composite-sigs sec. 3.4)" });
   }
   // The 2 arms Node's WebCrypto surface cannot verify (the brainpool curves) fail closed --
   // never a silent single-component accept (the AND->OR downgrade this feature prevents).
   if (comp.trad.unsupported) {
-    return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "composite " + comp.name + ": " + comp.trad.unsupported });
+    return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "composite " + comp.name + ": " + comp.trad.unsupported });
   }
   // draft sec. 3.4: for a composite SignerInfo the digestAlgorithm parameters MUST be OMITTED
   // (id-sha256/id-sha512 and id-shake256). That is stricter than the generic RFC 5754 absent-OR-NULL
@@ -500,7 +529,7 @@ function _verifyComposite(si, comp, content, eContentType, parsedCerts, csTarget
   // (it is outside the signed preimage, so a parser differential must not verify).
   var dp = si.digestAlgorithm.parameters;
   if (dp !== null && dp !== undefined) {
-    return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the composite " + si.digestAlgorithm.name + " digestAlgorithm parameters must be omitted (draft-ietf-lamps-cms-composite-sigs sec. 3.4)" });
+    return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the composite " + si.digestAlgorithm.name + " digestAlgorithm parameters must be omitted (draft-ietf-lamps-cms-composite-sigs sec. 3.4)" });
   }
   // sec. 3.4 / sec. 5 (the one CMS-specific MUST the X.509 path does not cover): the SignerInfo
   // digestAlgorithm MUST equal the arm's pre-hash (Table 1) -- compositeVerify takes the pre-hash
@@ -508,15 +537,15 @@ function _verifyComposite(si, comp, content, eContentType, parsedCerts, csTarget
   // message-digest attribute under the WRONG algorithm. The sec. 5 SHOULD-reject is taken
   // fail-closed; the MAY-verify-anyway leniency is deliberately not taken.
   if (si.digestAlgorithm.name !== comp.phCms) {
-    return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the SignerInfo digestAlgorithm " + JSON.stringify(si.digestAlgorithm.name) + " is not the composite " + comp.name + " pre-hash " + JSON.stringify(comp.phCms) + " (draft-ietf-lamps-cms-composite-sigs sec. 3.4)" });
+    return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the SignerInfo digestAlgorithm " + JSON.stringify(si.digestAlgorithm.name) + " is not the composite " + comp.name + " pre-hash " + JSON.stringify(comp.phCms) + " (draft-ietf-lamps-cms-composite-sigs sec. 3.4)" });
   }
   var signers = _findSignerCerts(si.sid, parsedCerts);
-  if (!signers.length) return Promise.resolve({ ok: false, code: "cms/signer-cert-not-found", sid: si.sid, message: "no certificate matches this SignerInfo's signer identifier" });
+  if (!signers.length) return _pResolve({ ok: false, code: "cms/signer-cert-not-found", sid: si.sid, message: "no certificate matches this SignerInfo's signer identifier" });
   var sigBytes = _toBuf(si.signature, "the SignerInfo signature");
-  return (csTarget != null ? _computeCountersigBytes(si, csTarget) : _computeSignedBytes(si, content, eContentType)).then(function (signedBytes) {
-    if (signedBytes && signedBytes.mismatch) return { ok: false, code: signedBytes.mismatch.code, sid: si.sid, cert: signers[0].der, message: signedBytes.mismatch.message };
-    return _verifyCompositeAgainstCandidates(comp, sigBytes, signedBytes, si.sid, signers, si.signatureAlgorithm.oid);
-  });
+  // `await`, not `.then`: see _verifyAgainstCandidates.
+  var signedBytes = await (csTarget != null ? _computeCountersigBytes(si, csTarget) : _computeSignedBytes(si, content, eContentType, digestByName));
+  if (signedBytes && signedBytes.mismatch) return { ok: false, code: signedBytes.mismatch.code, sid: si.sid, cert: signers[0].der, message: signedBytes.mismatch.message };
+  return _verifyCompositeAgainstCandidates(comp, sigBytes, signedBytes, si.sid, signers, si.signatureAlgorithm.oid);
 }
 
 // Dispatch compositeVerify against each matching candidate; the signer is valid iff one candidate
@@ -524,26 +553,21 @@ function _verifyComposite(si, comp, content, eContentType, parsedCerts, csTarget
 // OID is skipped with a precise verdict (RFC 9814 sec. 4 key<->signature agreement); a candidate that
 // returns a structural fault code (bad split length, unsupported) falls through, its code surfaced if
 // none verifies. A clean both-components-checked failure (the AND-downgrade) is a code-less false.
-function _verifyCompositeAgainstCandidates(comp, sigBytes, signedBytes, sid, candidates, expectedKeyOid) {
+async function _verifyCompositeAgainstCandidates(comp, sigBytes, signedBytes, sid, candidates, expectedKeyOid) {
   var lastErr = null;
-  function attempt(idx) {
-    if (idx >= candidates.length) {
-      return lastErr ? { ok: false, code: lastErr.code, sid: sid, cert: candidates[0].der, message: lastErr.message }
-        : { ok: false, sid: sid, cert: candidates[0].der };
-    }
+  for (var idx = 0; idx < candidates.length; idx++) {
     var c = candidates[idx];
     if (c.cert.subjectPublicKeyInfo.algorithm.oid !== expectedKeyOid) {
       lastErr = _err("cms/unsupported-algorithm", "the signer certificate public-key algorithm does not match the SignerInfo signatureAlgorithm");
-      return attempt(idx + 1);
+      continue;
     }
-    return compositeSig.compositeVerify(c.cert.subjectPublicKeyInfo.bytes, sigBytes, signedBytes, comp, CmsError, "cms/unsupported-algorithm", "cms/bad-signature")
-      .then(function (r) {
-        if (r.ok === true) return { ok: true, sid: sid, cert: c.der };
-        if (r.code) lastErr = (r.error instanceof CmsError) ? r.error : _err(r.code, r.error && r.error.message ? r.error.message : "the composite signature could not be evaluated");
-        return attempt(idx + 1);
-      });
+    // `await`, not `.then`: see _verifyAgainstCandidates.
+    var r = await compositeSig.compositeVerify(c.cert.subjectPublicKeyInfo.bytes, sigBytes, signedBytes, comp, CmsError, "cms/unsupported-algorithm", "cms/bad-signature");
+    if (r.ok === true) return { ok: true, sid: sid, cert: c.der };
+    if (r.code) lastErr = (r.error instanceof CmsError) ? r.error : _err(r.code, r.error && r.error.message ? r.error.message : "the composite signature could not be evaluated");
   }
-  return attempt(0);
+  return lastErr ? { ok: false, code: lastErr.code, sid: sid, cert: candidates[0].der, message: lastErr.message }
+    : { ok: false, sid: sid, cert: candidates[0].der };
 }
 
 // The decoded unsigned attributes of a SignerInfo, surfaced UNAUTHENTICATED (they are outside
@@ -551,7 +575,7 @@ function _verifyCompositeAgainstCandidates(comp, sigBytes, signedBytes, sid, can
 // timestamp token or inspect a countersignature attribute. They are never counted toward a
 // signer's ok / res.valid.
 function _surfaceUnsignedAttrs(si) {
-  return (si.unsignedAttrs || []).map(function (a) {
+  return intrinsic.map(si.unsignedAttrs || [], function (a) {
     return { type: a.type, typeName: oid.name(a.type) || null, values: a.values };
   });
 }
@@ -566,19 +590,26 @@ function _surfaceUnsignedAttrs(si) {
 // the FINITE parsed structure: each nested countersignature value is a sub-encoding of its parent,
 // and the strict decoder already bounds total nesting by C.LIMITS.DER_MAX_DEPTH at parse
 // (CWE-834/770), so a hostile deep chain fails closed before verify.
-function _verifyCountersignatures(si, parsedCerts) {
+async function _verifyCountersignatures(si, parsedCerts) {
   // si.signature is always a Buffer from the strict parser (and from walkCountersignature on the
   // recursive path), so _toBuf is a pass-through here. The SignerInfo is already well-formed.
   var targetSig = _toBuf(si.signature, "the countersigned signature");
   var values = [];
-  (si.unsignedAttrs || []).forEach(function (a) {
+  // Captured enumeration: over a streamed content the untrusted iterator's next() ran during the
+  // digest await and could replace Array.prototype.forEach / push to drop a failing countersignature.
+  intrinsic.forEach(si.unsignedAttrs || [], function (a) {
     if (a.type !== OID_COUNTERSIGNATURE) return;
-    a.values.forEach(function (v) { values.push(v && v.bytes ? v.bytes : v); });
+    intrinsic.forEach(a.values, function (v) { intrinsic.push(values, v && v.bytes ? v.bytes : v); });
   });
-  return Promise.all(values.map(function (vDer) { return _verifyOneCountersig(vDer, targetSig, parsedCerts); }));
+  // Sequential, started only as awaited (see _verify): not Promise.all (its element handling dispatches
+  // through the replaceable Promise.prototype.then), and not started-all-then-awaited (an early
+  // rejection would leave a later one unobserved).
+  var out = [];
+  for (var _cp = 0; _cp < values.length; _cp++) intrinsic.push(out, await _verifyOneCountersig(values[_cp], targetSig, parsedCerts));
+  return out;
 }
 
-function _verifyOneCountersig(vDer, targetSig, parsedCerts) {
+async function _verifyOneCountersig(vDer, targetSig, parsedCerts) {
   var csSi;
   // Coverage residual, and deliberately kept. Every value reaching here was already walked by the
   // decoder, which validates an id-countersignature by content and not by the attribute type. A
@@ -588,17 +619,16 @@ function _verifyOneCountersig(vDer, targetSig, parsedCerts) {
   // whole instead of surfaced as one failed countersignature.
   // cms-verify.test.js pins that through the shipped verbs; this stays because the walk is also
   // reachable recursively and a backstop that returns a NEGATIVE verdict costs nothing.
-  try { csSi = cms.walkCountersignature(asn1.decode(Buffer.isBuffer(vDer) ? vDer : Buffer.from(vDer))); }
-  catch (e) { return Promise.resolve({ ok: false, code: (e instanceof CmsError ? e.code : "cms/bad-countersignature"), message: e && e.message }); }
-  return _verifyOne(csSi, targetSig, null, parsedCerts, targetSig).then(function (verdict) {
-    return _verifyCountersignatures(csSi, parsedCerts).then(function (nested) {
-      var node = { ok: verdict.ok, sid: verdict.sid, cert: verdict.cert, digestAlgorithm: csSi.digestAlgorithm.name };
-      if (verdict.code) node.code = verdict.code;
-      node.unsignedAttrs = _surfaceUnsignedAttrs(csSi);
-      node.countersignatures = nested;
-      return node;
-    });
-  });
+  try { csSi = cms.walkCountersignature(asn1.decode(intrinsic.isBuffer(vDer) ? vDer : intrinsic.bufferFrom(vDer))); }
+  catch (e) { return { ok: false, code: (e instanceof CmsError ? e.code : "cms/bad-countersignature"), message: e && e.message }; }
+  // `await`, not `.then`: see _verifyAgainstCandidates.
+  var verdict = await _verifyOne(csSi, targetSig, null, parsedCerts, targetSig);
+  var nested = await _verifyCountersignatures(csSi, parsedCerts);
+  var node = { ok: verdict.ok, sid: verdict.sid, cert: verdict.cert, digestAlgorithm: csSi.digestAlgorithm.name };
+  if (verdict.code) node.code = verdict.code;
+  node.unsignedAttrs = _surfaceUnsignedAttrs(csSi);
+  node.countersignatures = nested;
+  return node;
 }
 
 /**
@@ -646,8 +676,11 @@ function _verifyOneCountersig(vDer, targetSig, parsedCerts) {
  * ML-DSA (draft-ietf-lamps-cms-composite-sigs), which pairs ML-DSA with a traditional
  * RSA / ECDSA / EdDSA and verifies only when both components pass (never an AND-to-OR downgrade).
  *
- * @opts  content  The detached content (a `Buffer`) when the SignedData carries no
- *                 encapsulated eContent. Required for a detached signature.
+ * @opts  content  The detached content when the SignedData carries no encapsulated eContent, and
+ *                 required for a detached signature. A `Buffer`, or an async iterable of byte chunks
+ *                 to verify a large payload without holding it in memory. The streamed form is hashed
+ *                 once for every signer, so every signer must carry signed attributes; a signer that
+ *                 signs the content directly needs the content as a `Buffer`.
  * @opts  certs    Extra signer certificates (an array of DER `Buffer`s) to match against, in
  *                 addition to the certificates embedded in the SignedData.
  * @opts  trustAnchors  The roots the caller accepts (DER `Buffer`s or anchor tuples). Supplying
@@ -685,6 +718,45 @@ function _snapshotIfBytes(input, label) {
   return input;
 }
 
+// For a streamed (async-iterable) detached content: hash the stream ONCE, incrementally, under every
+// distinct SUPPORTED SignerInfo digest algorithm, returning { <digestName>: Buffer } (streaming), or
+// null (not streaming; digest per-signer over the buffered content). No per-signer condition aborts
+// the whole message here, matching the buffered path's per-signer verdicts: a content-only signer
+// (no signed attributes, whose signature is over content a stream does not retain) and an unsupported
+// digest each contribute no name and are verdicted per-signer by _verifyOne / _computeSignedBytes.
+// An empty map is still the streaming marker, so those per-signer verdicts are produced. `streamSource`
+// is the lazy stream classified at the door (null when not streaming, buffered per-signer); its
+// iterator is acquired only if a digest is actually needed, so an all-content-only message never opens it.
+async function _resolveContentDigests(parsed, streamSource) {
+  if (streamSource == null) return null;
+  var names = [], seen = {};
+  intrinsic.forEach(parsed.signerInfos, function (si) {
+    var dn = si.digestAlgorithm.name;
+    if (si.signedAttrsBytes && _supportedDigest(dn) && !seen[dn]) { seen[dn] = 1; intrinsic.push(names, dn); }
+  });
+  // No signer needs a streamed digest (all content-only or unsupported): nothing to hash, but the
+  // empty map still marks streaming mode so each signer gets its per-signer verdict.
+  if (!names.length) return {};
+  // `await`, not `.then`: this is where the UNTRUSTED stream is consumed, so the very next promise step
+  // must not dispatch through a Promise.prototype.then the stream may have replaced.
+  var ds;
+  try {
+    ds = await subtle.digestStream(intrinsic.map(names, function (n) { return DIGEST_HASH[n]; }), streamSource);
+  } catch (e) {
+    // The engine reports malformed streamed content in its own domain; report it in this verb's domain
+    // instead, exactly as a buffered content's bad bytes are, rather than leaking the engine code. A
+    // non-byte chunk is webcrypto/data; a source whose async-iterator protocol is malformed (a
+    // non-callable next, or a factory returning a non-iterator) is webcrypto/syntax. The digest
+    // algorithm names are this module's own, so webcrypto/syntax here is never an algorithm fault.
+    if (e && e.code === "webcrypto/data") throw _err("cms/bad-input", "a streamed content chunk is not a byte source", e);
+    if (e && e.code === "webcrypto/syntax") throw _err("cms/bad-input", "the streamed content is not a valid async iterable of byte chunks", e);
+    throw e;
+  }
+  var byName = {};
+  intrinsic.forEach(names, function (n, i) { byName[n] = intrinsic.bufferFrom(ds[i]); });
+  return byName;
+}
+
 // Every option pki.cms.verify reads. Adding one here is the only way to make it accepted, so a
 // capability cannot arrive with its option silently ignored at this boundary.
 var _VERIFY_OPTS = { certs: 1, content: 1, trustAnchors: 1, time: 1, requiredEku: 1, checkPurpose: 1 };
@@ -696,7 +768,7 @@ function verify(input, opts) {
   return guard.async.deferred(function () { return _verify(input, opts); });
 }
 
-function _verify(input, opts) {
+async function _verify(input, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "cms/bad-input", "pki.cms.verify options");
   // An unrecognized option is refused, not swallowed. This is what kept the missing trust seam
   // silent: a caller writing `trustAnchors` before it existed -- or `trustAnchor` now -- got a
@@ -720,15 +792,43 @@ function _verify(input, opts) {
     return cms.parse(_snapshotIfBytes(bytes, "pki.cms.verify"));
   }, _err, "cms/bad-input", "the SignedData");
   if (!Array.isArray(parsed.signerInfos)) throw _err("cms/bad-input", "input is not a CMS SignedData");
+  // The trust configuration is snapshotted HERE, before opts.content is read at all. A streamed
+  // content's Symbol.asyncIterator accessor runs the moment asyncStreamOf reads it, one turn before a
+  // snapshot taken further down would run; from that accessor a caller can replace a global the snapshot
+  // itself relies on -- the Date it defaults the validation instant from, or the Array.isArray /
+  // Array.prototype.map / slice it copies the anchors and requiredEku with -- and steer the trust
+  // decision. Taken before the content object is touched, every value the snapshot reads comes from a
+  // pristine global. It also stays caller-owned across the later await: the array cannot be re-pointed,
+  // an anchor's DER rewritten, or the instant moved, once copied -- the same defense the input and the
+  // certificates already have.
+  var trustCfg = _snapshotTrust(opts);
+  // Pre-parse every candidate certificate (embedded + caller-supplied) once, BEFORE opts.content is
+  // touched. The caller-supplied set (opts.certs) is read here; a streamed content's accessor -- run the
+  // moment asyncStreamOf reads it below -- could otherwise mutate that array, or replace the
+  // Array.prototype.forEach this loop uses, and change which certificates the signer match and the trust
+  // build see. Taken first, the candidate pool is the one the caller passed.
+  var parsedCerts = [];
+  (parsed.certificates || []).forEach(function (c) { _addCert(parsedCerts, c && c.bytes ? c.bytes : c); });
+  (opts.certs || []).forEach(function (c) { _addCert(parsedCerts, c); });
   var content = parsed.encapContentInfo.eContent;
+  var streamSource = null;
   if (content == null) {
     if (opts.content == null) throw _err("cms/detached-content-required", "this SignedData is detached; opts.content (the external content) is required");
-    // Copied, not aliased: the digest over this content is computed in a later promise turn,
-    // and a detached signature's content is the whole of what the signature speaks about. A
-    // caller who rewrote the buffer in that gap would have the signature checked against the
-    // original bytes while holding the replacement, and the verdict would report a valid
-    // signature over content that was never signed.
-    content = _toBuf(_snapshotIfBytes(opts.content, "opts.content"), "opts.content");
+    // A streamed (async-iterable) detached content is classified by asyncStreamOf, which reads
+    // Symbol.asyncIterator a single time and returns a LAZY stream whose iterator is acquired only when
+    // it is driven below, after the per-signer digest algorithms are known, so a single-use stream
+    // serves every signer in one pass and a message needing no streamed digest never acquires it. It is
+    // not snapshotted: a stream has no bytes to copy, and it is consumed exactly once. A byte source (or
+    // any non-iterable) yields null and is buffered.
+    streamSource = guard.bytes.asyncStreamOf(opts.content);
+    if (streamSource == null) {
+      // Copied, not aliased: the digest over this content is computed in a later promise turn,
+      // and a detached signature's content is the whole of what the signature speaks about. A
+      // caller who rewrote the buffer in that gap would have the signature checked against the
+      // original bytes while holding the replacement, and the verdict would report a valid
+      // signature over content that was never signed.
+      content = _toBuf(_snapshotIfBytes(opts.content, "opts.content"), "opts.content");
+    }
   } else if (opts.content != null) {
     // A caller supplied external content AND the SignedData is attached. A redundant COPY that equals
     // the encapsulated content is fine; content that DIFFERS is a substitution trap -- silently
@@ -738,47 +838,46 @@ function _verify(input, opts) {
       throw _err("cms/content-conflict", "opts.content disagrees with this SignedData's own encapsulated content (a detached signature must omit eContent)");
     }
   }
-  // Pre-parse every candidate certificate (embedded + caller-supplied) once.
-  var parsedCerts = [];
-  (parsed.certificates || []).forEach(function (c) { _addCert(parsedCerts, c && c.bytes ? c.bytes : c); });
-  (opts.certs || []).forEach(function (c) { _addCert(parsedCerts, c); });
   var eContentType = parsed.encapContentInfo.eContentType;
-  // The trust configuration is captured SYNCHRONOUSLY here, before any signature work yields. It is
-  // read a promise turn later, and everything in it stays caller-owned across that gap: the array
-  // can be re-pointed, an anchor's DER rewritten, the validation instant moved. Any of those would
-  // have the chain judged against a configuration the caller never asked for while the verdict
-  // reports the one they did. The same defense the input and the certificates already have.
-  var trustCfg = _snapshotTrust(opts);
-  return Promise.all(parsed.signerInfos.map(function (si) {
+  // `await` throughout the aggregation, never `.then`: the streamed content is consumed inside
+  // _resolveContentDigests, so from here on every promise step must dispatch through no
+  // caller-replaceable Promise.prototype.then. Captured enumeration (intrinsic.map) guards
+  // Array.prototype.map; awaiting each promise (never Promise.all) guards the chaining (CWE-347).
+  var digestByName = await _resolveContentDigests(parsed, streamSource);
+  // Each signer is verified SEQUENTIALLY -- started only as it is awaited. NOT Promise.all: its
+  // spec-internal element handling calls the caller-replaceable Promise.prototype.then, so a streamed
+  // content that replaced it could fabricate a resolved `{ ok: true }` for every signer; await
+  // dispatches through no such method. And NOT started-all-then-awaited-each: an earlier signer's
+  // rejection would leave a later one's rejection unobserved, which Node can escalate to a crash.
+  // Per-signer work is small, so the sequential cost is negligible.
+  var signers = [];
+  for (var _sp = 0; _sp < parsed.signerInfos.length; _sp++) {
+    var siOne = parsed.signerInfos[_sp];
     // res.valid reflects only the PRIMARY signerInfos; a countersignature / unsigned attribute is
     // outside the signature and NEVER flips the top-level verdict. Both are surfaced per signer.
-    return _verifyOne(si, content, eContentType, parsedCerts).then(function (verdict) {
-      return _verifyCountersignatures(si, parsedCerts).then(function (countersignatures) {
-        verdict.countersignatures = countersignatures;
-        verdict.unsignedAttrs = _surfaceUnsignedAttrs(si);
-        // Whether THIS signer signed attributes or signed the content directly. The two are
-        // different claims -- attributes bind a content type and a signing time alongside the
-        // digest, and content-only binds nothing but the bytes -- and RFC 5652 lets a message carry
-        // one signer of each. A caller whose profile requires attributes (RFC 8551 S/MIME does) can
-        // only enforce it if the verdict says which they got.
-        verdict.signedAttributesPresent = !!si.signedAttrsBytes;
-        return verdict;
-      });
-    });
-  })).then(function (signers) {
-    // The content type travels with the verdict. An operator applying a policy of their own -- "I
-    // only accept id-data", or a profile that names its own type -- otherwise had to parse the
-    // message a second time to learn it, and a check that needs a second parse is a check most
-    // callers will not write.
-    var res = {
-      // Signature soundness is decided by comparison for the same reason the trust verdict below
-      // is: `every` replaced after load reports the whole set sound without reading one signer.
-      valid: signers.length > 0 && guard.list.allMatch(signers, function (s) { return s.ok === true; }),
-      eContentType: parsed.encapContentInfo.eContentType,
-      signers: signers,
-    };
-    return _applyTrust(res, parsedCerts, trustCfg).then(function () { return res; });
-  });
+    var verdict = await _verifyOne(siOne, content, eContentType, parsedCerts, null, digestByName);
+    verdict.countersignatures = await _verifyCountersignatures(siOne, parsedCerts);
+    verdict.unsignedAttrs = _surfaceUnsignedAttrs(siOne);
+    // Whether THIS signer signed attributes or signed the content directly. The two are different
+    // claims -- attributes bind a content type and a signing time alongside the digest, and content-only
+    // binds nothing but the bytes -- and RFC 5652 lets a message carry one signer of each. A caller
+    // whose profile requires attributes (RFC 8551 S/MIME does) can only enforce it if the verdict says
+    // which they got.
+    verdict.signedAttributesPresent = !!siOne.signedAttrsBytes;
+    intrinsic.push(signers, verdict);
+  }
+  // The content type travels with the verdict. An operator applying a policy of their own -- "I only
+  // accept id-data", or a profile that names its own type -- otherwise had to parse the message a
+  // second time to learn it, and a check that needs a second parse is a check most callers will not write.
+  var res = {
+    // Signature soundness is decided by comparison for the same reason the trust verdict below is:
+    // `every` replaced after load reports the whole set sound without reading one signer.
+    valid: signers.length > 0 && guard.list.allMatch(signers, function (s) { return s.ok === true; }),
+    eContentType: parsed.encapContentInfo.eContentType,
+    signers: signers,
+  };
+  await _applyTrust(res, parsedCerts, trustCfg);
+  return res;
 }
 
 // The full path build + validate, injected by path-validate the way it injects into crl-verify and
@@ -816,7 +915,7 @@ function _cloneAnchorValue(v, depth) {
   // neither throw out of the snapshot nor put a different instant in the copy than the original
   // holds -- which would leave the anchor policy that was checked and the one that is applied two
   // different values.
-  if (guard.time.isDate(v)) return new Date(guard.time.instantOf(v));
+  if (guard.time.isDate(v)) return new intrinsic.Date(guard.time.instantOf(v));
   // A structure too deep to copy is REFUSED, not shared. Returning it by reference at the cap
   // would leave part of the anchor caller-mutable across the chain walk while the rest was
   // snapshotted -- a guarantee that holds for the shallow fields and quietly lapses for the deep
@@ -844,7 +943,11 @@ function _snapshotTrust(opts) {
   }
   return {
     trustAnchors: anchors,
-    time: guard.time.isDate(opts.time) ? new Date(guard.time.instantOf(opts.time)) : opts.time,
+    // The validation instant, read from the captured Date intrinsic, never the live global Date. The
+    // snapshot is taken before opts.content is touched (see _verify), so no content accessor has run to
+    // replace a global yet; reading the instant through the captured constructor holds even if that
+    // ordering regresses. A caller Date is cloned; undefined becomes now.
+    time: guard.time.isDate(opts.time) ? new intrinsic.Date(guard.time.instantOf(opts.time)) : (opts.time === undefined ? new intrinsic.Date() : opts.time),
     requiredEku: Array.isArray(opts.requiredEku) ? opts.requiredEku.slice() : opts.requiredEku,
     checkPurpose: opts.checkPurpose,
   };
@@ -864,7 +967,11 @@ function _snapshotTrust(opts) {
 var _CERT_EXT_DECODERS = pkix.certExtensionDecoders(pkix.makeNS("cms", CmsError, oid)).byOid;
 
 function _keyUsagePermitsSigning(parsedCerts, der) {
-  var entry = parsedCerts.filter(function (c) { return c.der.equals(der); })[0];
+  // Captured filter + equality: this runs after the streamed content was consumed, and the fail-open
+  // `if (!entry) return true` below would otherwise be reachable by a hostile iterator that replaced
+  // Buffer.prototype.equals to return false, making the signer certificate un-findable and its
+  // keyUsage un-read -- a keyEncipherment-only certificate would then be reported trusted (CWE-347).
+  var entry = intrinsic.filter(parsedCerts, function (c) { return intrinsic.bufferEquals(c.der, der); })[0];
   if (!entry) return true;                    // not among the candidates: nothing to read
   var kuOid = oid.byName("keyUsage");
   var exts = entry.cert.extensions || [];
@@ -886,22 +993,27 @@ function _allTrusted(signers) {
 
 // `cfg` is verify's SNAPSHOT, never the caller's options object -- the parameter is named for that
 // so a future caller cannot hand it the live one without noticing.
-function _applyTrust(res, parsedCerts, cfg) {
+async function _applyTrust(res, parsedCerts, cfg) {
   res.trusted = false;
   // Every signer carries the field too, whether or not anchors were supplied. A verdict whose
   // per-signer shape depends on which options were passed makes a caller iterating `signers` write
   // a different loop for each case -- and the absent field reads as "unknown" where the answer is
   // a definite "nothing anchored this".
-  res.signers.forEach(function (s) { s.trusted = false; });
-  if (cfg.trustAnchors == null) return Promise.resolve();
+  // async + captured enumeration + await (see _verify): the trust verdict is decided after the streamed
+  // content was consumed, so a hostile iterator must not steer it through a replaced Array.prototype or
+  // Promise.prototype.then.
+  intrinsic.forEach(res.signers, function (s) { s.trusted = false; });
+  if (cfg.trustAnchors == null) return;
   if (!_engine) {
     throw _err("cms/bad-input", "opts.trustAnchors requires the path validator; load pki.path before verifying (require the toolkit through its index)");
   }
   // Every signer, not merely one: a multi-signer message's signers are independent claims, and
   // reporting the whole as trusted because one of them anchored would let an unanchored signer ride
   // out on another's chain -- the same rule the per-signer `ok` already follows for signatures.
-  var pool = parsedCerts.map(function (c) { return c.der; });
-  var at = cfg.time !== undefined ? cfg.time : new Date();
+  var pool = intrinsic.map(parsedCerts, function (c) { return c.der; });
+  // The default instant was captured at snapshot time (see _snapshotTrust), before the stream ran, so
+  // no live `new Date()` is read here where a replaced Date could steer the validation instant.
+  var at = cfg.time;
   var anchors = cfg.trustAnchors;
   // The configuration is checked HERE, once, before any signer is looked at. Leaving it to the
   // chain walk would make a caller's mistake depend on the message: a SignedData whose every signer
@@ -927,7 +1039,7 @@ function _applyTrust(res, parsedCerts, cfg) {
   // through the same definition the walk uses. Checking one and not the other is how this rule has
   // repeatedly come back: each new part of the configuration has to join the preflight, not wait
   // to be caught where it is consumed.
-  anchors.forEach(function (a) {
+  intrinsic.forEach(anchors, function (a) {
     _engine.toAnchor(a);
     if (purposes.checkPurpose != null) _engine.assertAnchorConstraints(a, purposes.checkPurpose);
   });
@@ -936,9 +1048,10 @@ function _applyTrust(res, parsedCerts, cfg) {
   // anchor's own constraint metadata -- all judged before a single signer is looked at, and all
   // through the definitions the walk itself uses. A new option joins it here; validating one only
   // where it is consumed is what made a caller's mistake depend on the message.
-  return res.signers.reduce(function (p, s) {
-    return p.then(function () {
-      if (s.ok !== true || !s.cert) { s.trusted = false; return null; }
+  for (var _si = 0; _si < res.signers.length; _si++) {
+    var s = res.signers[_si];
+    {
+      if (s.ok !== true || !s.cert) { s.trusted = false; continue; }
       var buildOpts = { trustAnchors: anchors, intermediates: pool, validate: true, time: at };
       // A key purpose, when the caller names one. "Trusted" is not a property of a chain alone: a
       // certificate restricted to serverAuth chains perfectly well and is still the wrong key to
@@ -963,27 +1076,29 @@ function _applyTrust(res, parsedCerts, cfg) {
       // Permitted to have signed, as well as chained. Checked BEFORE the chain walk because a
       // certificate that forbids signing cannot become trusted by chaining, so there is nothing to
       // learn from walking it.
-      if (!_keyUsagePermitsSigning(parsedCerts, s.cert)) { s.trusted = false; return null; }
-      return _engine.build(s.cert, buildOpts)
-        .then(function (r) { s.trusted = !!(r && r.valid); }, function (e) {
-          // A CONFIG fault -- unusable anchors, an invalid time -- is the caller's mistake and must
-          // not be absorbed into "untrusted", which would read as a verdict about the message. A
-          // chain that simply does not reach an anchor is not that: it is the answer.
-          if (e && e.code) {
-            var code = String(e.code);
-            if (intrinsic.stringIndexOf(code, "bad-input") !== -1 ||
-                intrinsic.stringIndexOf(code, "bad-anchor") !== -1 ||
-                intrinsic.stringIndexOf(code, "bad-time") !== -1) throw e;
-          }
-          s.trusted = false;
-        });
-    });
-  }, Promise.resolve()).then(function () {
-    // The trust verdict is decided by comparison, not by a prototype method: `every` replaced after
-    // load answers true without consulting a single signer, and a message no anchor covers reports
-    // trusted:true.
-    res.trusted = res.valid && res.signers.length > 0 && _allTrusted(res.signers);
-  });
+      if (!_keyUsagePermitsSigning(parsedCerts, s.cert)) { s.trusted = false; continue; }
+      // `await`, not `.then`: see _verify.
+      try {
+        var r = await _engine.build(s.cert, buildOpts);
+        s.trusted = !!(r && r.valid);
+      } catch (e) {
+        // A CONFIG fault -- unusable anchors, an invalid time -- is the caller's mistake and must
+        // not be absorbed into "untrusted", which would read as a verdict about the message. A
+        // chain that simply does not reach an anchor is not that: it is the answer.
+        if (e && e.code) {
+          var code = intrinsic.String(e.code);
+          if (intrinsic.stringIndexOf(code, "bad-input") !== -1 ||
+              intrinsic.stringIndexOf(code, "bad-anchor") !== -1 ||
+              intrinsic.stringIndexOf(code, "bad-time") !== -1) throw e;
+        }
+        s.trusted = false;
+      }
+    }
+  }
+  // The trust verdict is decided by comparison, not by a prototype method: `every` replaced after
+  // load answers true without consulting a single signer, and a message no anchor covers reports
+  // trusted:true.
+  res.trusted = res.valid && res.signers.length > 0 && _allTrusted(res.signers);
 }
 // Parse a candidate cert DER and index its SKI; a cert that will not parse is skipped (it
 // simply cannot be a signer match, and a malformed embedded cert must not fail the verify).
@@ -1041,6 +1156,12 @@ function _addCert(out, der) {
  * (draft-ietf-lamps-cms-composite-sigs), where the arm's pre-hash fixes the digestAlgorithm and
  * the two component keys are signed together.
  *
+ * `content` may instead be an async iterable of byte chunks, such as an async generator, which signs
+ * a large payload without holding it in memory. This form requires `detached: true` and signed
+ * attributes. The payload is hashed incrementally to build the message-digest attribute, in a single
+ * pass that serves every signer, so signers may use different digest algorithms. The signature covers
+ * the same content as the buffered form.
+ *
  * @opts  detached          Omit the encapsulated content (a detached signature; the verifier
  *                          supplies the content). Default false.
  * @opts  eContentType      The encapsulated content type (an OID name). Default `data`.