@blamejs/pki 0.5.4 → 0.5.6

package/lib/tsp-sign.js

@@ -27,18 +27,40 @@ var guard = require("./guard-all");
 var frameworkError = require("./framework-error");
 
 var pkix = require("./schema-pkix");
+var pkiBuild = require("./pki-build");
 var TspError = frameworkError.TspError;
 var _NS = pkix.makeNS("tsp", TspError, oid);
 var b = asn1.build;
 function _err(code, message, cause) { return new TspError(code, message, cause); }
 function O(name) { return oid.byName(name); }
 
+// The shared authoring-side builder, for the same pre-encoded-Extension validation every other
+// request builder uses (a CSR's extensionRequest, a CRMF CertTemplate, a CRL's entry extensions).
+var _b = pkiBuild.makeBuilder({
+  ErrorClass: TspError, prefix: "tsp", O: O, NS: _NS,
+  NAME_SCHEMA: pkix.name(_NS), SPKI_SCHEMA: pkix.spki(_NS),
+});
+
 // Digest names whose imprint / certHash this producer supports (the SHA-2 family).
 var NODE_DIGEST = { sha256: "sha256", sha384: "sha384", sha512: "sha512" };
 // The message-imprint hash MUST be exactly the digest algorithm's output length (RFC 3161 sec.
 // 2.4.1 -- hashedMessage is "the hash of the datum to be time-stamped").
 var HASH_LEN = { sha256: 32, sha384: 48, sha512: 64 };
 
+// How much a `pki.path.validate` revocationChecked outcome ESTABLISHED, ordered. `false` is "no
+// checker ran at all"; "undetermined" is "one ran and could not answer"; "waived" is an
+// undetermined one a caller chose to pass; "determined" is an explicit good-or-revoked answer.
+// Ranking them lets a caller trying several candidate paths keep the most established outcome any
+// of them reached, rather than whichever happened to run last.
+var _REVOCATION_RANK = { "false": 0, "undetermined": 1, "waived": 2, "determined": 3 };
+function _rankRevocation(v) {
+  var r = _REVOCATION_RANK[String(v)];
+  return r === undefined ? 0 : r;   // an unrecognized value establishes nothing
+}
+function _moreEstablished(candidate, current) {
+  return _rankRevocation(candidate) > _rankRevocation(current);
+}
+
 // A hash AlgorithmIdentifier { OID, NULL } -- messageImprint and ESSCertIDv2 hash algorithms
 // carry an explicit NULL parameter (the form RFC 3161 / RFC 5035 producers emit).
 function _hashAlgId(name) {
@@ -109,7 +131,13 @@ function _signingCertV2(certDer, hashName) {
  *   var token = await pki.tsp.sign(imprint, { cert: signerCertDer, key: signerKeyPkcs8 }, { policy: "1.3.6.1.4.1.1", serialNumber: 1 });
  *   (await pki.cms.verify(token)).valid;   // true
  */
+// Documented `-> Promise`, so a fault leaves as a REJECTION (guard-async); the checks stay
+// synchronous because they read the caller's mutable imprint, TSA material and options.
 function sign(messageImprint, tsa, opts) {
+  return guard.async.deferred(function () { return _sign(messageImprint, tsa, opts); });
+}
+
+function _sign(messageImprint, tsa, opts) {
   opts = opts || {};
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("tsp/bad-input", "pki.tsp.sign options must be an object");
   var mi = messageImprint || {};
@@ -130,10 +158,14 @@ function sign(messageImprint, tsa, opts) {
   // non-Date or an Invalid Date that would encode a garbage GeneralizedTime).
   if (opts.genTime != null) guard.time.assertValid(opts.genTime, _err, "tsp/bad-input", "genTime");
   var genTime = opts.genTime instanceof Date ? opts.genTime : new Date();
-  var fields = [b.integer(1n), _policy(opts.policy), imprint, b.integer(BigInt(opts.serialNumber)), b.generalizedTime(genTime)];
+  // A caller-authored INTEGER is coerced through the shared guard, so a value that is not one is a
+  // typed tsp/bad-input rather than a raw SyntaxError or RangeError out of BigInt() -- an untyped
+  // fault escaping a public verb, which a caller cannot catch by code.
+  var serial = guard.range.authoredInteger(opts.serialNumber, _err, "tsp/bad-input", "serialNumber");
+  var fields = [b.integer(1n), _policy(opts.policy), imprint, b.integer(serial), b.generalizedTime(genTime)];
   if (opts.accuracy) fields.push(_accuracy(opts.accuracy));
   if (opts.ordering === true) fields.push(b.boolean(true));
-  if (opts.nonce != null) fields.push(b.integer(BigInt(opts.nonce)));
+  if (opts.nonce != null) fields.push(b.integer(guard.range.authoredInteger(opts.nonce, _err, "tsp/bad-input", "nonce")));
   var tstInfo = b.sequence(fields);
 
   var signCert = { type: "signingCertificateV2", values: [_signingCertV2(certDer, certHashAlg)] };
@@ -237,12 +269,26 @@ function request(messageImprint, opts) {
   // extensions in schema order. certReq DEFAULT FALSE -> only an explicit TRUE is encoded (DER).
   var fields = [b.integer(1n), imprint];
   if (opts.reqPolicy != null) fields.push(_policy(opts.reqPolicy));
-  if (opts.nonce != null) fields.push(b.integer(BigInt(opts.nonce)));
+  if (opts.nonce != null) fields.push(b.integer(guard.range.authoredInteger(opts.nonce, _err, "tsp/bad-input", "nonce")));
   if (opts.certReq != null && typeof opts.certReq !== "boolean") throw _err("tsp/bad-input", "certReq must be a boolean");
   if (opts.certReq === true) fields.push(b.boolean(true));
   if (opts.extensions != null) {
     if (!Array.isArray(opts.extensions) || !opts.extensions.every(function (e) { return Buffer.isBuffer(e) || e instanceof Uint8Array; })) throw _err("tsp/bad-input", "extensions must be an array of encoded Extension DER buffers");
-    if (opts.extensions.length) fields.push(b.contextConstructed(0, Buffer.concat(opts.extensions.map(function (e) { return Buffer.from(e); }))));
+    // Each pre-encoded Extension is validated as one, and its extnID must not repeat -- the same
+    // gate every other request builder applies. Spliced in unchecked, a caller relaying a blob it
+    // did not author put fully chosen bytes inside [0] and this encoder emitted DER its own
+    // parseRequest refuses: an undecodable value, a duplicate extnID, an explicit critical=FALSE
+    // the DER DEFAULT rule forbids.
+    var seenExt = {};
+    var encoded = opts.extensions.map(function (e, i) {
+      var der = Buffer.from(e);
+      _b.assertValidExtension(der, i);
+      var extnId = asn1.read.oid(asn1.decode(der).children[0]);
+      if (seenExt[extnId]) throw _err("tsp/bad-input", "duplicate request extension " + extnId + " (RFC 5280 sec. 4.2)");
+      seenExt[extnId] = true;
+      return der;
+    });
+    if (encoded.length) fields.push(b.contextConstructed(0, Buffer.concat(encoded)));
   }
   var der = b.sequence(fields);
   return opts.pem ? schemaTsp.pemEncode(der, "TIMESTAMP REQUEST") : der;
@@ -564,7 +610,8 @@ function _buildTsaChains(leaf, pool) {
  * PEM (never a parsed object -- every checked field is read from the CMS-verified eContent, so a
  * mutated parsed structure cannot desynchronize the checks from the signed bytes). `data` is the
  * original bytes (hashed under the token's messageImprint algorithm) or a precomputed
- * `{ hashAlgorithm, hashedMessage }`. Returns `{ valid, trusted, genTime, accuracy, serialNumber,
+ * `{ hashAlgorithm, hashedMessage }`. Returns `{ valid, trusted, revocationChecked,
+ * anchorConstraints, genTime, accuracy, serialNumber,
  * serialNumberHex, policy, nonce, tsa, tstInfo, signer, code?, reason? }`. `valid` is true only
  * when the CMS signature, the imprint match, the eContentType, the ESSCertID(V2) binding, the
  * RFC 3161 sec. 2.3 critical single-`timeStamping` extendedKeyUsage rule, the requested nonce (when
@@ -579,11 +626,19 @@ function _buildTsaChains(leaf, pool) {
  * accepting one. A timestamp is archived precisely to be re-read years later, and one boolean
  * cannot answer both questions then.
  *
+ * `revocationChecked` is the third claim, for the same reason. Revocation runs only when a
+ * `revocationChecker` is supplied, so a `trusted` token whose TSA was never checked against a CRL
+ * or an OCSP responder reads identically to one established un-revoked -- unless the verdict says
+ * which. It is `false` whenever no path ran at all. `anchorConstraints` carries whatever the anchor
+ * itself constrained, from `pki.path.validate`.
+ *
  * @opts  trustAnchor   Anchor `{ name, publicKey, algorithm }` -- runs `pki.path.validate` on the
  *                       TSA certificate chain ordered from the token's embedded certificates
- *                       (validity at genTime, requiredEku timeStamping, revocation), so a TSA under
- *                       an intermediate CA validates, not only one directly under the anchor. Omit
- *                       to verify signature + imprint + binding + EKU only and anchor the cert yourself.
+ *                       (validity at genTime, requiredEku timeStamping, and revocation when a
+ *                       `revocationChecker` is supplied -- `revocationChecked` reports which), so a
+ *                       TSA under an intermediate CA validates, not only one directly under the
+ *                       anchor. Omit to verify signature + imprint + binding + EKU only and anchor
+ *                       the cert yourself.
  * @opts  nonce         Require the token's TSTInfo.nonce to equal this (a number/BigInt).
  * @opts  reqPolicy     Require the token's policy to equal this (an OID name or dotted string).
  * @opts  certs         Out-of-band TSA certificates (an array of DER `Buffer`s) added to the signer
@@ -630,8 +685,15 @@ async function verify(token, data, opts) {
   // `res.trusted` must get an answer on both branches -- an undefined on the failure path is the
   // same "cannot tell what was checked" the field was added to remove, and `!res.trusted` reading
   // true by accident is not the same as its reading true because nothing anchored the TSA.
+  // What a path established travels with the REFUSAL as well. Hardcoding these to false/null here
+  // would misreport the one case the field matters most for: a path that ran, established the TSA
+  // REVOKED, and refused on that basis did check revocation, and saying it did not is the same
+  // "cannot tell what was checked" the field was added to remove. They stay false/null until a path
+  // actually produces them, which is the honest answer before one runs.
+  var revocationChecked = false;
+  var anchorConstraints = null;
   function fail(code, reason) {
-    return { valid: false, trusted: false, code: code, reason: reason || null, genTime: tst.genTime, accuracy: tst.accuracy, serialNumber: tst.serialNumber, serialNumberHex: tst.serialNumberHex, policy: tst.policy, nonce: tst.nonce, tsa: tst.tsa, tstInfo: tst, signer: null };
+    return { valid: false, trusted: false, revocationChecked: revocationChecked, anchorConstraints: anchorConstraints, code: code, reason: reason || null, genTime: tst.genTime, accuracy: tst.accuracy, serialNumber: tst.serialNumber, serialNumberHex: tst.serialNumberHex, policy: tst.policy, nonce: tst.nonce, tsa: tst.tsa, tstInfo: tst, signer: null };
   }
   // M12 -- the CMS signature over the exact RFC 5652 sec. 5.4 preimage (message-digest bound to the
   // authenticated eContent). cms.verify re-parses the same bytes; a failure is a fail-closed verdict.
@@ -647,7 +709,7 @@ async function verify(token, data, opts) {
   if (mi !== true) return fail(mi);
   // M14 -- if a request nonce is supplied, the token MUST echo it (BigInt-exact).
   if (opts.nonce != null) {
-    var wantNonce = BigInt(opts.nonce);
+    var wantNonce = guard.range.authoredInteger(opts.nonce, _err, "tsp/bad-input", "opts.nonce");
     if (tst.nonce == null || tst.nonce !== wantNonce) return fail("tsp/nonce-mismatch");
   }
   // M15 -- if the requested policy is supplied, the token's policy MUST equal it.
@@ -713,23 +775,54 @@ async function verify(token, data, opts) {
       // end of the chain and not the other, and a root explicitly distrusted for timestamping would
       // still answer trusted. The purpose is not a caller choice here: this verb validates timestamp
       // tokens and nothing else, so there is exactly one purpose its anchors can be judged under.
+      // EVERY path result goes through this one function, so none can be produced without being
+      // accumulated. The alternative -- validating in several places and accumulating afterwards --
+      // is what let a result be overwritten before it was counted, first across candidate chains and
+      // then across the two endpoints of one candidate. There is now one door and it always counts.
+      //
+      // The two fields accumulate INDEPENDENTLY because they are independent facts. Whether
+      // revocation was established and which anchor constraints were consulted do not imply each
+      // other: an anchor that rejects the TSA on its own purposes or distrustAfter metadata, with no
+      // revocationChecker configured, establishes constraints while establishing nothing about
+      // revocation.
+      async function validateAt(chain, when) {
+        var res = await pathValidate.validate(chain, {
+          time: when, trustAnchor: opts.trustAnchor, requiredEku: ["timeStamping"], checkPurpose: "timeStamping", revocationChecker: opts.revocationChecker,
+        });
+        // The most any attempt ESTABLISHED, kept across every attempt: backtracking tries several
+        // chains for one TSA certificate and a fractional genTime validates each at two endpoints,
+        // so an attempt that fails earlier than another must not erase what that other established.
+        if (_moreEstablished(res.revocationChecked, revocationChecked)) revocationChecked = res.revocationChecked;
+        // Every attempt validates against the SAME opts.trustAnchor under the same purpose, so any
+        // non-null value describes that one anchor; the first to report them is as good as the last.
+        if (anchorConstraints == null && res.anchorConstraints != null) anchorConstraints = res.anchorConstraints;
+        return res;
+      }
       var chains = _buildTsaChains(pkiX509.parse(tsaCertDer), pool);
       for (var ci = 0; ci < chains.length && !(pathRes && pathRes.valid); ci++) {
-        pathRes = await pathValidate.validate(chains[ci], {
-          time: floorT, trustAnchor: opts.trustAnchor, requiredEku: ["timeStamping"], checkPurpose: "timeStamping", revocationChecker: opts.revocationChecker,
-        });
-        if (pathRes.valid && ceilT !== floorT) {
-          pathRes = await pathValidate.validate(chains[ci], {
-            time: ceilT, trustAnchor: opts.trustAnchor, requiredEku: ["timeStamping"], checkPurpose: "timeStamping", revocationChecker: opts.revocationChecker,
-          });
-        }
+        pathRes = await validateAt(chains[ci], floorT);
+        if (pathRes.valid && ceilT !== floorT) pathRes = await validateAt(chains[ci], ceilT);
       }
     } catch (e) { return fail("tsp/untrusted-tsa", (e && e.message) || String(e)); }
+    // On a REFUSAL the question is whether ANYTHING established the TSA's revocation status, so the
+    // accumulated best answers it: a candidate that reached the checker and was rejected as revoked
+    // did check revocation, and saying otherwise would misdescribe the reason for the refusal.
     if (!pathRes || !pathRes.valid) return fail("tsp/untrusted-tsa", "the TSA certificate did not validate to the trust anchor at genTime");
+    // On ACCEPTANCE the question is narrower and the accumulated best would OVERCLAIM: what matters
+    // is what was checked on the path actually accepted, not what some rejected candidate managed.
+    // The loop stops at the first valid path, so `pathRes` is that path.
+    revocationChecked = pathRes.revocationChecked;
+    anchorConstraints = pathRes.anchorConstraints;
+    // Reduced to a bare `trusted: true`, this answered the same way whether the TSA was established
+    // un-revoked or revocation was never consulted at all -- and revocation only runs when a
+    // revocationChecker is supplied, so the second case is the DEFAULT. A caller archiving a
+    // timestamp verdict could not tell the two apart later, which is the distinction the
+    // valid/trusted split exists to keep.
     trusted = true;
   }
   return {
-    valid: true, trusted: trusted, genTime: tst.genTime, accuracy: tst.accuracy,
+    valid: true, trusted: trusted, revocationChecked: revocationChecked, anchorConstraints: anchorConstraints,
+    genTime: tst.genTime, accuracy: tst.accuracy,
     serialNumber: tst.serialNumber, serialNumberHex: tst.serialNumberHex,
     policy: tst.policy, policyName: tst.policyName, nonce: tst.nonce, tsa: tst.tsa,
     tstInfo: tst, signer: { cert: tsaCertDer, sid: signer.sid },

package/lib/validator-cose.js

@@ -156,6 +156,90 @@ function credentialKey(node, E, code, unsupportedCode) {
   // CANONICAL CTAP2 COSE_Key: exactly the type's parameters, nothing more.
   var expectedParams = kty === 2n ? 5 : 4;
   if (node.children.length !== expectedParams) throw bad("the COSE_Key carries parameters beyond the canonical set for its key type (WebAuthn sec. 6.5.1)");
+  return assertKeyMaterial(key, E, code, unsupportedCode);
+}
+
+// assertKeyMaterial(key, E, code, unsupportedCode) -> key | throws
+//
+// The rules about the KEY, split from the rules about its CBOR encoding, because the
+// toolkit accepts a stored credential key in two forms and both reach a signature
+// verification. `pki.webauthn.verifyAssertion` takes the COSE bytes or the object
+// `pki.webauthn.verify` returned; the bytes went through every check below and the
+// object went through none, so the same 1-byte modulus was refused as a credential key
+// in one form and imported for verification in the other. A caller stores whichever
+// form their datastore round-trips, which is not a choice about how carefully their
+// credential is checked.
+//
+// Everything above this line is about the ENCODING -- a CBOR map, integer labels, byte
+// strings, the canonical parameter count -- and can only be asked of bytes. Everything
+// here is about the key, and is asked of both.
+//
+// @enforced-by behavioral -- key-material rules have no rename-proof code shape distinct
+//   from ordinary length and byte comparisons; the RED vectors that drive BOTH accepted
+//   forms of a stored credential key (the COSE bytes and the object) through
+//   pki.webauthn.verifyAssertion with an undersized modulus, e = 1, a curve/length
+//   mismatch and a short OKP x are the guard.
+function assertKeyMaterial(key, E, code, unsupportedCode) {
+  function bad(msg, cause) { return new E(code, msg, cause); }
+  if (!key || typeof key !== "object") throw bad("a credential key must be a decoded COSE_Key object");
+  // ONE read of each field, into a plain object, before anything is checked or used.
+  //
+  // The object form comes from the caller, so any of these can be an accessor. One that THROWS
+  // turns a validation into a raw fault -- the thing this function exists to prevent -- and one
+  // that returns DIFFERENT values on successive reads makes the field that was checked and the
+  // field that is used two different values, which is the check defeated rather than merely
+  // reported badly. Reading each exactly once settles both, and settles them for every field
+  // rather than for the ones a particular branch happens to reach.
+  try {
+    key = { kty: key.kty, alg: key.alg, crv: key.crv, x: key.x, y: key.y, n: key.n, e: key.e };
+  } catch (e) { throw bad("a credential key field could not be read", e); }
+  // Then the TYPE and the VALUE. BigInt() throws a raw TypeError on a Symbol and on undefined, and
+  // a raw RangeError on a fractional or non-finite number, so "it is a number" is not the check --
+  // "it is an integer" is. EVERY integer label the branches below read, not the two the dispatch
+  // happens to need first:
+  // crv indexes a lookup table, and a Symbol thrown at a property read is the same raw fault as a
+  // Symbol thrown at BigInt(). The decoded form gets these from the CBOR reader, which has already
+  // established them; the object form gets them from the caller, so this is where they are settled.
+  // A BigInt is bounded too. COSE labels are small registry integers, and an unbounded one converts
+  // to Infinity, which then throws a raw RangeError at the next conversion -- the same defeat as a
+  // fractional number, reached by a value that IS an integer. "It is an integer" is not the whole
+  // check either; "it is an integer this code can carry" is.
+  var MAX = BigInt(Number.MAX_SAFE_INTEGER);
+  function _isInt(v) {
+    if (typeof v === "bigint") return v <= MAX && v >= -MAX;
+    return typeof v === "number" && Number.isSafeInteger(v);
+  }
+  if (!_isInt(key.kty)) throw bad("a COSE_Key kty (label 1) must be an integer");
+  if (!_isInt(key.alg)) throw bad("a COSE_Key alg (label 3) must be an integer");
+  if (key.crv !== undefined && key.crv !== null && !_isInt(key.crv)) throw bad("a COSE_Key crv (label -1) must be an integer");
+  // ONE representation from here down. A label may arrive as a Number or a BigInt -- a CBOR reader
+  // hands out BigInt, an object built in JavaScript is likelier to hold Number -- and everything
+  // below compares with === against the Number-keyed profile table and the curve tables. Accepting
+  // both forms at the gate and then comparing only one is a check that answers by how the caller
+  // happened to spell the value; the decoded arm normalizes here too, for the same reason.
+  key.kty = Number(key.kty);
+  key.alg = Number(key.alg);
+  if (key.crv !== undefined && key.crv !== null) key.crv = Number(key.crv);
+  var kty = BigInt(key.kty);
+  if (kty === 2n) {
+    var el2 = EC2_CRV_LEN[key.crv];
+    if (!Buffer.isBuffer(key.x) || !Buffer.isBuffer(key.y)) throw bad("an EC2 COSE_Key must carry crv (-1), x (-2), and y (-3)");
+    if (!el2 || key.x.length !== el2 || key.y.length !== el2) throw bad("an EC2 COSE_Key x/y length is inconsistent with its curve");
+  } else if (kty === 1n) {
+    var okp2 = OKP_CRV[key.crv];
+    if (!okp2 || !Buffer.isBuffer(key.x) || key.x.length !== okp2.len) throw bad("an OKP COSE_Key must be Ed25519 (crv 6) or Ed448 (crv 7) with a matching-length x (-2)");
+  } else if (kty === 3n) {
+    if (!Buffer.isBuffer(key.n) || !key.n.length || !Buffer.isBuffer(key.e) || !key.e.length) throw bad("an RSA COSE_Key must carry n (-1) and e (-2)");
+    if (key.n[0] === 0) throw bad("an RSA COSE_Key modulus (-1) must be minimally encoded, with no leading zero byte (RFC 8230 sec. 4)");
+    if (key.e[0] === 0) throw bad("an RSA COSE_Key exponent (-2) must be minimally encoded, with no leading zero byte (RFC 8230 sec. 4)");
+    var bits = _modulusBits(key.n);
+    if (bits < RSA_MIN_MODULUS_BITS) throw bad("an RSA COSE_Key modulus (-1) is " + bits + " bits, below the " + RSA_MIN_MODULUS_BITS + "-bit minimum");
+    if (key.e.length > RSA_MAX_EXPONENT_BYTES) throw bad("an RSA COSE_Key exponent (-2) is longer than " + RSA_MAX_EXPONENT_BYTES + " bytes");
+    if ((key.e[key.e.length - 1] & 1) === 0) throw bad("an RSA COSE_Key exponent (-2) must be odd");
+    if (key.e.length === 1 && key.e[0] <= 1) throw bad("an RSA COSE_Key exponent (-2) must be greater than 1 -- e = 1 makes RSA the identity function");
+  } else {
+    throw bad("unsupported COSE_Key kty " + Number(key.kty));
+  }
   // PROFILE: the declared alg must match the key type (and, for EC2, the curve).
   var prof = ALG_PROFILE[String(key.alg)];
   // An algorithm this verifier does not implement is NOT a malformed key. The key can be perfectly
@@ -173,7 +257,7 @@ function credentialKey(node, E, code, unsupportedCode) {
   // OpenSSL does NOT validate an OKP (Ed25519/Ed448) point on import -- an all-zeroes key
   // parses, and even verifies a trivial signature -- so an OKP point needs an explicit
   // on-curve + full-order (non-low-order) check (RFC 8032 decode + the cofactor check).
-  if (kty === 1n && !edwardsPoint.validate(key.x, key.crv)) throw bad("the OKP credential public key is not a valid, full-order Edwards point");
+  if (Number(key.kty) === 1 && !edwardsPoint.validate(key.x, key.crv)) throw bad("the OKP credential public key is not a valid, full-order Edwards point");
   return key;
 }
 
@@ -216,6 +300,7 @@ function toSpki(key, E, code) {
 
 module.exports = {
   credentialKey: credentialKey,
+  assertKeyMaterial: assertKeyMaterial,
   toSpki: toSpki,
   EC2_CRV_LEN: EC2_CRV_LEN,
   EC2_CRV_OID: EC2_CRV_OID,

package/lib/validator-tpm.js

@@ -221,12 +221,17 @@ function normalizeObjectAttributePolicy(policy, E, code) {
       // either of which could match a key this policy was written to exclude, including the
       // Empty Policy. An entry that is not a Buffer or a canonical even-length hex string is a
       // caller error, and it fails here rather than becoming a digest nobody intended.
+      // Through guard.encoding.hex, which owns the alphabet, the even-length rule and the
+      // canonical round-trip -- the same three checks written here by hand, and now written
+      // once. It also decodes, so the hex path cannot validate one string and decode another.
       allow = ap.allow.map(function (entry, i) {
         if (Buffer.isBuffer(entry)) return entry;
-        if (typeof entry !== "string" || entry.length === 0 || entry.length % 2 !== 0 || !/^[0-9a-fA-F]+$/.test(entry)) {
-          throw new E(code, "opts.tpmPolicy.authPolicy.allow[" + i + "] must be a Buffer or an even-length hex string");
+        var label = "opts.tpmPolicy.authPolicy.allow[" + i + "]";
+        if (typeof entry !== "string" || entry.length === 0) {
+          throw new E(code, label + " must be a Buffer or an even-length hex string");
         }
-        return Buffer.from(entry, "hex");
+        return guard.encoding.hex(entry, null, function (c, m) { return new E(c, m); }, code,
+          label + " must be a Buffer or an even-length hex string --");
       });
     }
   }

package/lib/webauthn-mds.js

@@ -212,24 +212,16 @@ function _isAnchorItself(cert, anchor) {
 // a hand-built object literal satisfies it too and then raises a raw TypeError from deep inside the
 // path validator, which is an untyped throw escaping a public verb.
 function _asCert(v, label) {
-  // A certificate arriving as BYTES arrives in whichever byte form the caller holds -- the same set
-  // every other byte argument in this namespace takes. A DataView or an ArrayBuffer over identical
-  // DER is the identical certificate, and refusing one of them makes the accepted set depend on how
-  // the caller happened to receive the file rather than on what it contains.
-  if (ArrayBuffer.isView(v) || v instanceof ArrayBuffer) {
-    v = guard.bytes.source(v, WebauthnError, "webauthn/bad-input", label);
-  }
-  if (v && typeof v === "object" && !Buffer.isBuffer(v) && !(v instanceof Uint8Array) &&
-      v.subject && v.subjectPublicKeyInfo && Buffer.isBuffer(v.subjectPublicKeyInfo.bytes) &&
-      v.signatureAlgorithm && typeof v.signatureAlgorithm.oid === "string" &&
-      // `validity` is what separates a certificate from the other signed structures that carry a
-      // subject, a public key and a signature algorithm: a parsed certification request has all
-      // three and would otherwise be installed as a trust anchor.
-      v.validity && v.validity.notBefore !== undefined) {
-    return v;
-  }
-  try { return x509.parse(v); }
-  catch (e) { throw _err("webauthn/bad-input", label + " is not a decodable certificate", e); }
+  // Through the shared certificate door: these become the anchors a metadata BLOB's signer chain is
+  // judged against, and an anchor's identity is its subject and its key. A caller-assembled object
+  // could carry a real root's subject beside a substituted key -- every field well-formed, nothing
+  // for a shape test to catch -- so the object is re-derived from the bytes its parser read instead.
+  // Bytes in any form (a Buffer, a typed-array view, a DataView, an ArrayBuffer) are parsed here;
+  // refusing one of those would make the accepted set depend on how the caller received the file.
+  return guard.parsed.acceptDerived(v, "certificate", function (bytes) {
+    try { return x509.parse(bytes); }
+    catch (e) { throw _err("webauthn/bad-input", label + " is not a decodable certificate", e); }
+  }, _err, "webauthn/bad-input", label);
 }
 
 // Verify a FIDO Metadata Service BLOB and return its entries indexed for lookup. `blob` is the

package/lib/webauthn.js

@@ -572,8 +572,13 @@ function _snapshotRoots(supplied) {
     if (_isBufferSource(root)) {
       return guard.bytes.snapshotSource(root, WebauthnError, "webauthn/bad-input", "opts.rootCertificates[]");
     }
-    if (root && typeof root === "object") return _cloneParsed(root, 0);
-    return root;   // a PEM string is immutable
+    // A PARSED certificate is kept AS IT IS, not deep-copied. The copy was this function's way of
+    // stopping a caller mutating a root after it was accepted, and it solved that by making a
+    // detached twin -- which loses the parser's record, so the door below could no longer re-derive
+    // the anchor from the bytes it was read from. The record is the stronger form of the same
+    // protection: the anchor is re-parsed from those bytes, so an edit made afterwards, at any depth,
+    // is discarded rather than copied. Cloning would trade that for a snapshot of a mutable object.
+    return root;   // a PEM string is immutable; a parsed certificate carries its own provenance
   });
 }
 
@@ -592,13 +597,16 @@ function _applyCallerRoots(res, supplied, vopts, onlyPaths) {
   // would fault on a field it does not have rather than naming the caller's mistake.
   // The same three forms opts.safetyNetRoots takes, since it is the same question.
   var roots = supplied.map(function (root, i) {
-    var cert;
-    try { cert = _isBufferSource(root) ? x509.parse(guard.bytes.source(root, WebauthnError, "webauthn/bad-input", "opts.rootCertificates[" + i + "]")) : (typeof root === "string" ? x509.parse(root) : root); }
-    catch (e) { throw _err("webauthn/bad-input", "opts.rootCertificates[" + i + "] is not a decodable certificate", e); }
-    if (!cert || !cert.subject || !cert.subjectPublicKeyInfo) {
-      throw _err("webauthn/bad-input", "opts.rootCertificates[" + i + "] is not a certificate");
-    }
-    return cert;
+    var label = "opts.rootCertificates[" + i + "]";
+    // These BECOME trust anchors, which is the sharpest form of the rule: the anchor's key is what
+    // the whole attestation chain is judged against, so a caller-assembled certificate carrying a
+    // real root's name beside a substituted key would anchor an attacker's chain. Re-derived from
+    // the bytes its parser read, exactly as at every other certificate door.
+    return guard.parsed.acceptDerived(root, "certificate", function (bytes) {
+      try {
+        return x509.parse(_isBufferSource(bytes) ? guard.bytes.source(bytes, WebauthnError, "webauthn/bad-input", label) : bytes);
+      } catch (e) { throw _err("webauthn/bad-input", label + " is not a decodable certificate", e); }
+    }, _err, "webauthn/bad-input", label);
   });
   // Same rule the metadata route applies: a compound element carrying no
   // certificates makes no claim there is anything to anchor, so it is not a reason to
@@ -1174,14 +1182,15 @@ function _safetyNetHostnameOk(leaf) {
 function _safetyNetChainTrusted(chain, roots, time) {
   var anchors;
   try {
+    // The same door opts.rootCertificates goes through, for the same reason: these become trust
+    // anchors, and an anchor's key is what the chain is judged against.
     anchors = roots.map(function (root, i) {
-      var anchorCert;
-      try { anchorCert = _isBufferSource(root) ? x509.parse(guard.bytes.source(root, WebauthnError, "webauthn/bad-input", "opts.safetyNetRoots[" + i + "]")) : (typeof root === "string" ? x509.parse(root) : root); }
-      catch (e) { throw _err("webauthn/bad-input", "opts.safetyNetRoots[" + i + "] is not a decodable certificate", e); }
-      if (!anchorCert || !anchorCert.subject || !anchorCert.subjectPublicKeyInfo) {
-        throw _err("webauthn/bad-input", "opts.safetyNetRoots[" + i + "] is not a certificate");
-      }
-      return anchorCert;
+      var label = "opts.safetyNetRoots[" + i + "]";
+      return guard.parsed.acceptDerived(root, "certificate", function (bytes) {
+        try {
+          return x509.parse(_isBufferSource(bytes) ? guard.bytes.source(bytes, WebauthnError, "webauthn/bad-input", label) : bytes);
+        } catch (e) { throw _err("webauthn/bad-input", label + " is not a decodable certificate", e); }
+      }, _err, "webauthn/bad-input", label);
     });
   } catch (e) { return Promise.reject(e); }
   return mds.chainToAnchor(chain, anchors, time === undefined ? new Date() : time,
@@ -2228,7 +2237,13 @@ function _snapshotAssertion(input) {
     var key = {}, kk;
     for (kk in out.credentialPublicKey) {
       if (!Object.prototype.hasOwnProperty.call(out.credentialPublicKey, kk)) continue;
-      var v = out.credentialPublicKey[kk];
+      // The read itself can fault: a stored key is a caller-supplied object, so a field may be an
+      // accessor, and one that THROWS would escape as a raw error from the very copy whose job is
+      // to make the descriptor stop being the caller's. The copy is the boundary, so the fault is
+      // named here rather than surfacing from wherever the field was later used.
+      var v;
+      try { v = out.credentialPublicKey[kk]; }
+      catch (e) { throw _err("webauthn/bad-cose-key", "credentialPublicKey." + kk + " could not be read", e); }
       key[kk] = _isBufferSource(v) ? guard.bytes.snapshotSource(v, WebauthnError, "webauthn/bad-input", "credentialPublicKey." + kk) : v;
     }
     out.credentialPublicKey = key;
@@ -2295,7 +2310,14 @@ function verifyAssertion(input) {
     var coseKey = input.credentialPublicKey;
     if (Buffer.isBuffer(coseKey) || ArrayBuffer.isView(coseKey) || coseKey instanceof ArrayBuffer) {
       coseKey = parseCoseKey(coseKey);
-    } else if (!_isPlainObject(coseKey)) {
+    } else if (_isPlainObject(coseKey)) {
+      // The OBJECT form is held to the same rules about the KEY as the bytes form. The bytes went
+      // through the curve/length, RSA modulus-floor and exponent checks; the object went through
+      // none, so one stored credential was refused in one form and imported for signature
+      // verification in the other. Which form a relying party stores is a question about what their
+      // datastore round-trips, not about how carefully their credential is checked.
+      coseKey = validator.cose.assertKeyMaterial(coseKey, WebauthnError, "webauthn/bad-cose-key", "webauthn/unsupported-algorithm");
+    } else {
       throw _err("webauthn/bad-input", "credentialPublicKey must be the stored COSE key -- the object pki.webauthn.verify returned, or its COSE bytes");
     }
     var bindingChecked = _applyBindings(authData, coseKey, input);

package/lib/x509-sign.js

@@ -286,8 +286,12 @@ function _sign(spec, issuer, opts) {
     issuerDer = subjectDer;
     issuerSpki = spki;
   } else if (issuer.cert != null) {
-    issuerCert = (Buffer.isBuffer(issuer.cert) || typeof issuer.cert === "string") ? x509.parse(issuer.cert) : issuer.cert;
-    if (!issuerCert || !issuerCert.tbsBytes) throw _err("x509/bad-input", "issuer.cert must be a certificate DER/PEM or a parsed certificate");
+    // The CA-ness gate, the issuer name and the signing key are all read off this object, so a
+    // partial one decides them on fields that are not there.
+    // Re-derived from the bytes its parser read. The issuer certificate's subject and key identifier
+    // are copied into the certificate being signed, so they are a claim about who issued it -- an
+    // assembled object could name an issuer whose bytes the signer never saw.
+    issuerCert = guard.parsed.acceptDerived(issuer.cert, "certificate", x509.parse, _err, "x509/bad-input", "issuer.cert");
     issuerPathLen = _assertIssuerIsCa(issuerCert);
     issuerDer = pkiBuild.tbsNameField(issuerCert, "subject");
     issuerSpki = issuerCert.subjectPublicKeyInfo.bytes;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",
@@ -13,6 +13,10 @@
     "url": "https://github.com/blamejs/pki/issues"
   },
   "main": "index.js",
+  "exports": {
+    ".": "./index.js",
+    "./package.json": "./package.json"
+  },
   "bin": {
     "pki": "bin/pki.js"
   },

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:38c27a59-75b3-42df-a97a-b59d75f2a0e9",
+  "serialNumber": "urn:uuid:f56149c0-58f9-40e1-a0f0-36a0dd2e4ee9",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-15T08:44:34.920Z",
+    "timestamp": "2026-08-16T03:23:32.715Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.4",
+      "bom-ref": "@blamejs/pki@0.5.6",
       "type": "application",
       "name": "pki",
-      "version": "0.5.4",
+      "version": "0.5.6",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.4",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.6",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.4",
+      "ref": "@blamejs/pki@0.5.6",
       "dependsOn": []
     }
   ]