@blamejs/pki 0.5.5 → 0.5.7

package/lib/pbes2.js

@@ -177,7 +177,12 @@ function pbes2Encrypt(pwBytes, plaintext, opts, E, prefix) {
 // <prefix>/bad-input a param guard raises is normalized to the structural <prefix>/bad-algorithm-parameters.
 // A wrong key / bad PKCS#7 pad collapses to the UNIFORM <prefix>/decrypt-failed (RFC 8018 sec. 8). The
 // plaintext integrity re-check (re-parse as a PrivateKeyInfo / SafeContents) is the CALLER's step.
-function pbes2Decrypt(pwBytes, params, ciphertext, opts, E, prefix) {
+// `budget` (optional) is a shared { rounds } tally a caller decrypting MANY structures under one
+// call charges against, so the per-structure iteration cap cannot simply reset each time: PBKDF2
+// runs on the event loop, and a store that repeats a costly bag up to the parser's element limit
+// otherwise multiplies the cap by that limit. A caller decrypting exactly one structure passes
+// nothing and is bounded by the cap alone.
+function pbes2Decrypt(pwBytes, params, ciphertext, opts, E, prefix, budget) {
   var keyBits, iv, pb;
   try {
     var p = seqChildren(params, 2, "PBES2 parameters", E, prefix);
@@ -197,6 +202,11 @@ function pbes2Decrypt(pwBytes, params, ciphertext, opts, E, prefix) {
     }
     throw E(prefix + "/bad-algorithm-parameters", "malformed PBES2 parameters", e);
   }
+  // Charge the shared budget BEFORE deriving, so the work is refused rather than performed.
+  if (budget) {
+    budget.rounds -= pb.iterations;
+    if (budget.rounds < 0) throw E(prefix + "/iteration-limit", "the aggregate PBKDF2 key-derivation work exceeds the budget (a hostile many-element input)");
+  }
   var dk = nodeCrypto.pbkdf2Sync(pwBytes, pb.salt, pb.iterations, keyBits / 8, pb.prfNode);
   try { return cbcDecrypt(dk, iv, ciphertext, keyBits); }
   catch (_e) { throw E(prefix + "/decrypt-failed", "decryption failed"); }

package/lib/pkcs12-build.js

@@ -69,12 +69,14 @@ var MAX_PBMAC1_KEYLEN = 1024;   // an HMAC key beyond a hash block is pointless
 // pkcs12-local (its KDF is bespoke here) while PBMAC1 reuses the toolkit-wide PBKDF2 ceiling. 1e6 is ~500x
 // the OpenSSL default (2048) yet still bounds the loop to ~1 second.
 var CLASSIC_MAC_MAX_ITERATIONS = 1000000;
-// The AGGREGATE cap on synchronous legacy-PBE App. B KDF work across a single open() -- SHA-1 rounds summed
-// over every legacy bag (its KDF block count x iterations). The per-bag iteration cap resets per bag, so a
-// hostile store that duplicates a costly legacy bag up to the parser's 1024-bag limit would otherwise block
-// the event loop for minutes; this bounds the total to ~the classic MAC ceiling. A conforming store runs only
-// a few thousand rounds (its handful of bags at ~2048 iterations).
-var LEGACY_KDF_MAX_ROUNDS = CLASSIC_MAC_MAX_ITERATIONS;
+// The AGGREGATE cap on synchronous KDF work across a single open() -- rounds summed over every encrypted
+// bag and safe, whichever scheme it uses: the legacy App. B KDF (its block count x iterations) and PBKDF2
+// alike. The per-bag iteration cap resets per bag, so a hostile store that duplicates a costly bag up to the
+// parser's 1024-element limit would otherwise block the event loop for minutes; this bounds the total to
+// ~the classic MAC ceiling. It covers BOTH schemes because covering only the legacy one left the modern
+// path -- the one every current producer emits -- free to multiply its cap by the element limit.
+// A conforming store runs only a few thousand rounds (its handful of bags at ~2048 iterations).
+var KDF_MAX_ROUNDS = CLASSIC_MAC_MAX_ITERATIONS;
 
 // The classic App. B.2 KDF (u = hash output bytes, v = compression block bytes) per RFC 7292 App. B.2.
 var P12_KDF_UV = {
@@ -102,19 +104,32 @@ var DIGEST_NAME = { sha1: "sha1", sha256: "sha256", sha384: "sha384", sha512: "s
 // is taken verbatim as already-formatted bytes (an escape hatch for a caller that pre-encodes).
 function _p12Password(pw) { return _p12PasswordOwned(pw).bytes; }
 
+// An ABSENT password is refused rather than encoded as the empty one. The two are not the same
+// credential, and the difference is invisible at the call site: a caller who misspells the option,
+// or threads it through a layer that drops it, otherwise gets a store whose private key is
+// protected by nothing and no error anywhere saying so. The empty password remains available --
+// it just has to be asked for, as "".
+var _MISSING_PASSWORD = "a password must be a string, Buffer, or Uint8Array -- an omitted password " +
+  "is not the empty password; pass \"\" to use the empty one deliberately";
+
+// Every field opts.integrity reads. Adding one here is the only way to make it accepted, so a
+// capability cannot arrive with its option silently ignored at this boundary.
+var _INTEGRITY_OPTS = { mode: 1, signer: 1, signers: 1, certificates: 1, sid: 1, signingTime: 1 };
+
 // The same encoding, reporting OWNERSHIP -- mirroring pbes2.passwordBytesOwned. A caller-supplied
 // Buffer is returned AS-IS and is BORROWED: clearing it would destroy the caller's own credential,
 // which is a worse defect than leaving a copy readable. Every other input is re-encoded into a
 // buffer this module allocated, which it must clear once a derivation has consumed it.
 function _p12PasswordOwned(pw) {
-  if (Buffer.isBuffer(pw)) return { bytes: pw, owned: false };
+  if (Buffer.isBuffer(pw)) return { bytes: guard.bytes.view(pw, Pkcs12Error, "pkcs12/bad-input", "the password"), owned: false };
   return { bytes: _p12Encode(pw), owned: true };
 }
 function _p12Encode(pw) {
-  if (pw == null) pw = "";
-  if (Buffer.isBuffer(pw)) return pw;
-  if (pw instanceof Uint8Array) return Buffer.from(pw);
-  if (typeof pw !== "string") throw _err("pkcs12/bad-input", "a password must be a string, Buffer, or Uint8Array");
+  // A view first, so a detached backing store is a reject rather than an empty password; then a COPY,
+  // because everything this function returns is reported OWNED and gets zeroized after derivation --
+  // handing back a view of a caller's Uint8Array would wipe the caller's own credential.
+  if (Buffer.isBuffer(pw) || pw instanceof Uint8Array) return guard.bytes.snapshot(pw, Pkcs12Error, "pkcs12/bad-input", "the password");
+  if (typeof pw !== "string") throw _err("pkcs12/bad-input", _MISSING_PASSWORD);
   var out = Buffer.alloc(pw.length * 2 + 2);   // + the 2-byte NULL terminator
   for (var i = 0; i < pw.length; i++) {
     var u = pw.charCodeAt(i);
@@ -130,12 +145,19 @@ function _p12Encode(pw) {
 // PBKDF2 the raw UTF-8 password for these modern schemes (confirmed byte-for-byte against `openssl pkcs12`),
 // reserving the BMPString+NULL form for the bespoke Appendix B KDF only. A file we emit must open in OpenSSL,
 // so the modern schemes use UTF-8 here; only the classic Appendix B MAC uses `_p12Password`.
-function _pbePassword(pw) {
-  if (pw == null) pw = "";
-  if (Buffer.isBuffer(pw)) return pw;
-  if (pw instanceof Uint8Array) return Buffer.from(pw);
-  if (typeof pw !== "string") throw _err("pkcs12/bad-input", "a password must be a string, Buffer, or Uint8Array");
-  return Buffer.from(pw, "utf8");
+// The UTF-8 encoding, reporting OWNERSHIP -- the sibling of _p12PasswordOwned, and it exists
+// for the same reason. A caller-supplied Buffer is BORROWED and left alone; every other input is
+// re-encoded into a buffer this module allocated, and a plaintext password copy this module made
+// is cleared once the derivation has consumed it. Without it the App. B.1 copy taken from the same
+// argument in the same call was wiped while this one was not.
+function _pbePasswordOwned(pw) {
+  if (Buffer.isBuffer(pw)) return { bytes: guard.bytes.view(pw, Pkcs12Error, "pkcs12/bad-input", "the password"), owned: false };
+  if (pw instanceof Uint8Array) return { bytes: guard.bytes.snapshot(pw, Pkcs12Error, "pkcs12/bad-input", "the password"), owned: true };
+  if (typeof pw !== "string") throw _err("pkcs12/bad-input", _MISSING_PASSWORD);
+  return { bytes: Buffer.from(pw, "utf8"), owned: true };
+}
+function _wipePw(owned) {
+  if (owned.owned) guard.secret.zeroize(owned.bytes, Pkcs12Error, "pkcs12/bad-input", "the password encoding");
 }
 
 // Concatenate copies of `src` to the smallest positive multiple of `blockSize` (>= src length), truncating
@@ -267,8 +289,10 @@ function _buildBag(bag, opts, depth) {
       var kDer = _coerceDer(bag.key, "shroudedKey key");
       try { pkcs8.parse(kDer); } catch (e2) { throw _err("pkcs12/bad-input", "shroudedKey key is not a well-formed PKCS#8 PrivateKeyInfo", e2); }
       var enc = bag.encrypt || {};
-      var pw = _pbePassword(enc.password != null ? enc.password : opts.password);
-      var r = pbes2.pbes2Encrypt(pw, kDer, _pbeOpts(enc), _err, "pkcs12");
+      var pw = _pbePasswordOwned(enc.password != null ? enc.password : opts.password);
+      var r;
+      try { r = pbes2.pbes2Encrypt(pw.bytes, kDer, _pbeOpts(enc), _err, "pkcs12"); }
+      finally { _wipePw(pw); }
       return _safeBag("pkcs8ShroudedKeyBag", b.sequence([r.algId, b.octetString(r.ct)]), bag);   // EncryptedPrivateKeyInfo
     }
     case "cert": {
@@ -376,8 +400,10 @@ async function _buildAuthSafeElement(sc, opts) {
     return b.sequence([b.oid(O("data")), b.explicit(0, b.octetString(safeContentsDer))]);
   }
   if (!sc.encrypt || typeof sc.encrypt !== "object") throw _err("pkcs12/bad-input", "safeContents.encrypt must be an object { password? } (RFC 7292 sec. 5.1) -- omit it entirely for a plaintext safe");
-  var pw = _pbePassword(sc.encrypt.password != null ? sc.encrypt.password : opts.password);
-  var r = pbes2.pbes2Encrypt(pw, safeContentsDer, _pbeOpts(sc.encrypt), _err, "pkcs12");
+  var pw = _pbePasswordOwned(sc.encrypt.password != null ? sc.encrypt.password : opts.password);
+  var r;
+  try { r = pbes2.pbes2Encrypt(pw.bytes, safeContentsDer, _pbeOpts(sc.encrypt), _err, "pkcs12"); }
+  finally { _wipePw(pw); }
   var eci = b.sequence([b.oid(O("data")), r.algId, b.contextPrimitive(0, r.ct)]);   // EncryptedContentInfo, [0] IMPLICIT ct
   var encData = b.sequence([b.integer(0n), eci]);                                    // EncryptedData { version 0, eci }
   return b.sequence([b.oid(O("encryptedData")), b.explicit(0, encData)]);
@@ -420,7 +446,10 @@ async function _buildMacData(macOpts, sharedPassword, authSafeDer) {
     var iter2 = _assertMacIter(macOpts.iterations == null ? DEFAULT_PBMAC1_ITER : macOpts.iterations, C.LIMITS.PBKDF2_MAX_ITERATIONS);
     var keyLen = macOpts.keyLength != null ? macOpts.keyLength : prf.keyLen;
     if (typeof keyLen !== "number" || !Number.isInteger(keyLen) || keyLen < 20 || keyLen > MAX_PBMAC1_KEYLEN) throw _err("pkcs12/bad-input", "PBMAC1 keyLength must be an integer in [20, " + MAX_PBMAC1_KEYLEN + "] (RFC 9579 sec. 9)");
-    var mac = await pbes2.pbmac1(_pbePassword(password), salt, iter2, keyLen, prf.wc, prf.wc, authSafeDer);   // PBKDF2 -> UTF-8; prf == messageAuthScheme on build
+    var macPw2 = _pbePasswordOwned(password);
+    var mac;
+    try { mac = await pbes2.pbmac1(macPw2.bytes, salt, iter2, keyLen, prf.wc, prf.wc, authSafeDer); }   // PBKDF2 -> UTF-8; prf == messageAuthScheme on build
+    finally { _wipePw(macPw2); }
     var desc = { salt: salt, iterationCount: iter2, keyLength: keyLen, prfName: prf.prfName, macName: prf.prfName };
     var digestInfo2 = b.sequence([pbes2.pbmac1AlgId(desc), b.octetString(mac)]);
     // MacData.macSalt + iterations are ignored on a PBMAC1 verify but MUST be present + non-1 (RFC 9579 4c/4d).
@@ -496,9 +525,33 @@ function _normalizeSpec(spec, opts) {
  *     { type: 'shroudedKey', key: signerKeyPkcs8, encrypt: { password: 'changeit' } } ] }] },
  *     { password: 'changeit', mac: { algorithm: 'hmac', hash: 'sha256' } });
  */
-async function build(spec, opts) {
+function build(spec, opts) {
+  // Both arguments copied at entry and released when the call settles -- see the note on the same
+  // call in x509-sign. A PKCS#12 file is assembled over many promise turns (a key derivation per
+  // bag, then the outer MAC) while the caller still owns the object holding the passwords and the
+  // bag contents. Rewriting a password buffer partway through produced a file whose MAC and whose
+  // bag encryption were keyed to two different values, so it opened with neither the password
+  // passed in nor the one written over it. The release is what keeps the copy of that password
+  // from outliving the call.
+  return guard.bytes.fixedCall(Pkcs12Error, "pkcs12/bad-input", [
+    [spec, "the PKCS#12 spec"], [opts, "pki.pkcs12.build options"],
+  ], _build);
+}
+
+async function _build(spec, opts) {
   opts = opts || {};
-  var pubKey = opts.integrity != null && opts.integrity.mode === "public-key";
+  // The integrity mode is checked against the permitted set rather than compared to one literal.
+  // Compared, any other spelling reads as "not public-key" and silently selects password integrity,
+  // dropping the signer with it: a caller who wrote "publicKey" gets a MAC where they asked for a
+  // signature, and nothing in the store or the call says which they got.
+  if (opts.integrity != null) {
+    if (typeof opts.integrity !== "object" || Array.isArray(opts.integrity)) throw _err("pkcs12/bad-input", "opts.integrity must be an object { mode, signer|signers, ... }");
+    guard.identifier.assertKnownKeys(opts.integrity, _INTEGRITY_OPTS, _err, "pkcs12/bad-input", "opts.integrity has an unknown option ");
+    if (opts.integrity.mode !== "public-key") {
+      throw _err("pkcs12/bad-integrity-mode", "opts.integrity.mode must be \"public-key\" (the only mode it selects); omit opts.integrity for password integrity, got " + JSON.stringify(opts.integrity.mode));
+    }
+  }
+  var pubKey = opts.integrity != null;
   // RFC 7292 sec. 4: public-key integrity OMITS MacData entirely -- a caller combining opts.mac with it is a
   // config-time reject (the self-check re-parse would otherwise fail the coherence rule anyway).
   if (pubKey && opts.mac != null && opts.mac !== false) throw _err("pkcs12/bad-integrity-mode", "public-key integrity has no MacData -- do not combine opts.mac with opts.integrity.mode 'public-key' (RFC 7292 sec. 4)");
@@ -590,7 +643,9 @@ async function _verifyMacOfStore(m, password, opts) {
     // downgraded store cannot pass under a weak MAC even though the algorithm identifiers parse.
     if (prfWc === "SHA-1" || macWc === "SHA-1") throw _err("pkcs12/unsupported-algorithm", "PBMAC1 with a <= 160-bit digest (SHA-1) is refused (RFC 9579 sec. 5/7)");
     _capWork(kdf.iterationCount, kdf.salt, opts, kdf.keyLength, C.LIMITS.PBKDF2_MAX_ITERATIONS);
-    computed = await pbes2.pbmac1(_pbePassword(password), kdf.salt, kdf.iterationCount, kdf.keyLength, prfWc, macWc, m.macedBytes);   // PBKDF2 -> UTF-8
+    var vPw = _pbePasswordOwned(password);
+    try { computed = await pbes2.pbmac1(vPw.bytes, kdf.salt, kdf.iterationCount, kdf.keyLength, prfWc, macWc, m.macedBytes); }   // PBKDF2 -> UTF-8
+    finally { _wipePw(vPw); }
   }
   return computed.length === expected.length && guard.crypto.constantTimeEqual(computed, expected);
 }
@@ -687,7 +742,7 @@ async function open(pfx, password, opts) {
   // wrong bag password fails at the first encrypted bag as the uniform pkcs12/decrypt-failed.
   var out = { integrityMode: m.integrityMode, macVerified: macVerified, signers: signers, keys: [], certs: [], crls: [], secrets: [] };
   var i;
-  var kdfBudget = { rounds: LEGACY_KDF_MAX_ROUNDS };   // aggregate legacy-PBE KDF work budget for this whole open()
+  var kdfBudget = { rounds: KDF_MAX_ROUNDS };   // aggregate KDF work budget for this whole open(), both schemes
   for (i = 0; i < m.safeBags.length; i++) _openBag(m.safeBags[i], password, opts, out, 0, kdfBudget);
   for (i = 0; i < m.encryptedSafes.length; i++) await _openEncryptedSafe(m.encryptedSafes[i], password, opts, out, 0, kdfBudget);
   if (opts.keys === "crypto") {
@@ -801,7 +856,15 @@ function _decryptLegacyPbe(ea, ct, password, opts, budget) {
 // Decrypt a PBES2 (RFC 8018) or legacy-PBE (RFC 7292 App. C) bag/safe -- dispatch on the encryptionAlgorithm
 // OID. PBES2 uses the UTF-8 password (the pinned interop convention); legacy PBE uses the App. B.1 BMPString.
 function _decryptBag(ea, ct, password, opts, budget) {
-  if (ea.oid === O("pbes2")) return pbes2.pbes2Decrypt(_pbePassword(password), ea.parameters, ct, opts, _err, "pkcs12");
+  // BOTH arms charge the one shared budget. Charging only the legacy arm left the modern one --
+  // the arm every current producer emits -- able to reset its per-bag cap on every bag, so a store
+  // that repeats a costly PBES2 bag up to the parser's element limit multiplied the cap by that
+  // limit in blocking pbkdf2Sync work.
+  if (ea.oid === O("pbes2")) {
+    var pw = _pbePasswordOwned(password);
+    try { return pbes2.pbes2Decrypt(pw.bytes, ea.parameters, ct, opts, _err, "pkcs12", budget); }
+    finally { _wipePw(pw); }
+  }
   return _decryptLegacyPbe(ea, ct, password, opts, budget);
 }
 

package/lib/pki-build.js

@@ -223,15 +223,14 @@ function makeBuilder(ctx) {
     return nodeCrypto.createHash("sha1").update(keyBytes).digest();
   }
   function skiKeyId(val, spkiDer) {
-    if (Buffer.isBuffer(val)) return val;
+    if (Buffer.isBuffer(val)) return guard.bytes.snapshot(val, ErrorClass, ctx.prefix + "/bad-input", "subjectKeyIdentifier");
     if (val === true) return spkiKeyId(spkiDer);
     throw E("bad-input", "subjectKeyIdentifier must be true (auto-derive) or a Buffer key id");
   }
 
   // ---- embedded-input validators ----
   function reqDer(v, what) {
-    if (Buffer.isBuffer(v)) return v;
-    if (v instanceof Uint8Array) return Buffer.from(v);
+    if (Buffer.isBuffer(v) || v instanceof Uint8Array) return guard.bytes.snapshot(v, ErrorClass, ctx.prefix + "/bad-input", what);
     throw E("bad-input", what + " must be a DER Buffer");
   }
   // Full validation of an embedded SubjectPublicKeyInfo via the SAME parser the decoder uses.

package/lib/schema-cms.js

@@ -47,6 +47,7 @@
 var asn1 = require("./asn1-der");
 var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
+var guard = require("./guard-all");
 var oid = require("./oid");
 var frameworkError = require("./framework-error");
 var schemaX509 = require("./schema-x509");
@@ -211,6 +212,138 @@ function _checkContentBindingAttrs(attrs, mode) {
   if (md === 0) throw NS.E("cms/missing-message-digest", "the attribute set must contain a message-digest attribute (RFC 5652 sec. 11.2)");
 }
 
+// looksLikeSignedAttributes(bytes) -> boolean.
+//
+// Does `bytes` parse as a DER SignedAttributes block -- a SET OF Attribute carrying BOTH the
+// content-type and message-digest attributes RFC 5652 sec. 5.3 makes mandatory whenever signed
+// attributes are present?
+//
+// This is the detector for the signed-attribute stripping forgery
+// (draft-vangeest-lamps-cms-euf-cma-signeddata, Attack Type 1). A CMS signature does not commit to
+// WHETHER signed attributes were present, so a signature made over a SignedAttributes block can be
+// re-presented as one made over content: drop the signedAttrs field and set the encapsulated
+// content to the DER of those same attributes. Sec. 5.4 then says the signature is over the content
+// itself, which is exactly what it covers, and with no attributes there is no message-digest or
+// content-type attribute left to disagree. The proposed standards fixes are protocol changes -- a
+// context string naming which mode was signed -- that no verifier can apply on its own.
+//
+// What a verifier CAN do is refuse the shape. Every message produced by the attack has, as its
+// content, the encoded SignedAttributes of a real message, and sec. 5.3 requires those to carry
+// both attributes named above. That makes their presence a NECESSARY condition of the attack rather
+// than a guess, and the shape is one ordinary content does not have: a certificate, a JSON payload,
+// arbitrary bytes, and even a SET OF other attributes all fail it. The cost is a message whose
+// legitimate content really is an encoded SignedAttributes block signed WITHOUT attributes, which
+// is refused as genuinely ambiguous -- sign it with attributes and it is unambiguous again.
+//
+// One mandatory attribute value, held to all three conditions a real SignedAttributes meets:
+// exactly one value (RFC 5652 sec. 11.1 / sec. 11.2 make both single-valued), the right tag, and a
+// body that actually READS as that type. All three together, for each attribute -- checking the
+// cardinality and the tag while letting an undecodable body through would refuse content the real
+// SignedAttributes parser could never have produced, which is the false positive this whole
+// detector is shaped to avoid.
+function _readsAs(vals, tagNumber, reader) {
+  if (vals.length !== 1 || !schema.isUniversal(vals[0], tagNumber)) return false;
+  var reads = true;
+  try { reader(vals[0]); }
+  catch (_e) {
+    reads = false;   // right tag, unreadable body -- not a preimage anything signed
+  }
+  return reads;
+}
+// SigningTime ::= Time is a CHOICE of UTCTime and GeneralizedTime, so the tag is one of two and the
+// reader settles which -- _readsAs pins a single tag and cannot express it.
+function _readsAsTime(vals) {
+  if (vals.length !== 1) return false;
+  var reads = true;
+  try { asn1.read.time(vals[0]); }
+  catch (_e) {
+    reads = false;
+  }
+  return reads;
+}
+
+// Deliberately a total function: it answers about arbitrary attacker bytes and must never throw.
+// The X.690 sec. 11.6 SET OF ordering rule, as the schema engine applies it: each component's
+// encoding is greater than or equal to the one before it.
+function _ascendingDer(nodes) {
+  for (var i = 1; i < nodes.length; i++) {
+    if (Buffer.compare(nodes[i - 1].bytes, nodes[i].bytes) > 0) return false;
+  }
+  return true;
+}
+
+function looksLikeSignedAttributes(bytes) {
+  if (!bytes || !bytes.length) return false;
+  var node;
+  try { node = asn1.decode(bytes); }
+  catch (_e) { return false; }   // not DER at all -- not this shape
+  if (!schema.isUniversal(node, asn1.TAGS.SET) || !node.constructed) return false;
+  var kids = node.children || [];
+  if (!kids.length) return false;
+  // Every rule _checkContentBindingAttrs applies to a REAL SignedAttributes is applied here, and
+  // for one reason: the detector must match only what a conforming block can be. A set the real
+  // parser would have rejected cannot be the preimage of any signature, so matching it would refuse
+  // content no attack could have produced. Enumerated against that function rather than discovered
+  // one rule at a time -- no duplicate attribute types (sec. 5.3), content-type single-valued and a
+  // readable OID (sec. 11.1), message-digest single-valued and a readable OCTET STRING (sec. 11.2),
+  // signing-time when present single-valued and a readable Time (sec. 11.3).
+  // X.690 sec. 11.6: the components of a SET OF appear in ascending DER order, and the schema
+  // engine enforces exactly that on the real SignedAttributes. An out-of-order set is one the
+  // walker refuses, so it is not the preimage of any signature either.
+  if (!_ascendingDer(kids)) return false;
+  var sawContentType = false, sawMessageDigest = false, seenTypes = Object.create(null);
+  for (var i = 0; i < kids.length; i++) {
+    var a = kids[i];
+    // Attribute ::= SEQUENCE { attrType OBJECT IDENTIFIER, attrValues SET OF ANY }
+    if (!schema.isUniversal(a, asn1.TAGS.SEQUENCE)) return false;
+    if (!a.children || a.children.length !== 2) return false;
+    var t = a.children[0], vs = a.children[1];
+    if (!schema.isUniversal(t, asn1.TAGS.OBJECT_IDENTIFIER)) return false;
+    if (!schema.isUniversal(vs, asn1.TAGS.SET)) return false;
+    var attrOid;
+    try { attrOid = asn1.read.oid(t); }
+    catch (_e2) { return false; }
+    if (seenTypes[attrOid]) return false;   // a repeated attribute type -- sec. 5.3 forbids it
+    seenTypes[attrOid] = true;
+    // The sec. 11 PLACEMENT rows, from the same table the real parser reads. An attribute the
+    // parser refuses to see in signedAttrs -- id-countersignature is the one sec. 11.4 names --
+    // cannot appear in a conforming SignedAttributes, so a set containing it is not a preimage any
+    // signature covers. Missing this row was the difference between a necessary condition and a
+    // guess: it would have refused ordinary content that merely carried that attribute encoding.
+    var placement = ATTR_FORBIDDEN_IN[attrOid];
+    if (placement && placement.signed) return false;
+    // RFC 5652 gives every AttributeValue set SIZE (1..MAX), so an attribute with an EMPTY value
+    // set is one no conforming signer produced and no signature covers. The upper bound is
+    // deliberately not applied: this decoder caps values per attribute as a resource limit of its
+    // own, and a limit this implementation chose is not a fact about what a signature can cover.
+    // An external signer may sign a conforming set larger than that cap, and the stripped message
+    // presents those bytes as opaque content where the cap never applies -- refusing to recognize
+    // it because of a local limit would miss exactly the preimage the attack reuses.
+    var n = (vs.children || []).length;
+    if (n < 1) return false;
+    if (!_ascendingDer(vs.children || [])) return false;   // the inner SET OF is ordered too
+    // The two mandatory attributes are checked down to their VALUES, not just their type OIDs.
+    // RFC 5652 sec. 11.1 makes content-type a single OBJECT IDENTIFIER and sec. 11.2 makes
+    // message-digest a single OCTET STRING, so a set carrying those OIDs over an empty or
+    // wrongly-typed value CANNOT be the preimage of a real signature -- and refusing it would be a
+    // false positive on content that merely resembles the shape. The detector has to stay a
+    // necessary condition of the attack; anything broader costs a legitimate caller.
+    var vals = vs.children || [];
+    if (attrOid === OID_CONTENT_TYPE) {
+      if (!_readsAs(vals, asn1.TAGS.OBJECT_IDENTIFIER, asn1.read.oid)) return false;
+      sawContentType = true;
+    } else if (attrOid === OID_MESSAGE_DIGEST) {
+      if (!_readsAs(vals, asn1.TAGS.OCTET_STRING, asn1.read.octetString)) return false;
+      sawMessageDigest = true;
+    } else if (attrOid === OID_SIGNING_TIME) {
+      // Not mandatory, but when present sec. 11.3 constrains it the same way, so a set carrying an
+      // unreadable signing-time is one the real parser would have refused.
+      if (!_readsAsTime(vals)) return false;
+    }
+  }
+  return sawContentType && sawMessageDigest;
+}
+
 // RFC 5652 sec. 5.3 / sec. 9.3 -- when a content-type attribute is present, it MUST
 // be single-valued (sec. 11.1) and its value MUST equal the eContentType (a
 // cross-field consistency both parsed here). Shared by SignedData signedAttrs,
@@ -1150,7 +1283,15 @@ var CONTENT_INFO = schema.seq([
  *   cms.signerInfos[0].sid.serialNumberHex;   // -> "0a1b"
  *   cms.encapContentInfo.eContent;            // -> Buffer | null (detached)
  */
-var parse = pkix.makeParser({ pemLabel: "CMS", PemError: PemError, ErrorClass: CmsError, prefix: "cms", what: "CMS ContentInfo", topSchema: CONTENT_INFO, ns: NS });
+// Recording, for the reason the certificate and CRL parsers are: a SignedData is one or more
+// signatures over byte ranges, and a parsed one presents those ranges (`signedAttrsBytes`, the
+// encapsulated `eContent`), the signatures, and the certificates that verify them as separate
+// properties of one object. Keep a genuine signer's `signature` and `signedAttrsBytes` and replace
+// the `eContent` beside them, and every part of the check still passes for content that signer never
+// signed -- which is exactly the forgery pki.cms.verify's own block claims to defend. The verdict
+// verbs re-derive from what is recorded here, so the object a caller passes names bytes rather than
+// asserting facts.
+var parse = pkix.makeRecordingParser({ pemLabel: "CMS", PemError: PemError, ErrorClass: CmsError, prefix: "cms", what: "CMS ContentInfo", topSchema: CONTENT_INFO, ns: NS }, "cms");
 
 /**
  * @primitive  pki.schema.cms.pemDecode
@@ -1220,7 +1361,13 @@ function walkEnvelopedData(node) { return schema.walk(ENVELOPED_DATA, node, NS).
 // (an RFC 7292 PFX authSafe or encrypted safe, whose wire encoding may be BER
 // that the strict `parse` entry would refuse). Same contract as
 // walkEnvelopedData: the node is the bare structure, typed cms/* on rejection.
-function walkSignedData(node) { return schema.walk(SIGNED_DATA, node, NS).result; }
+// Records provenance, like parse: the structure a consumer hands to pki.cms.verify must be
+// re-derivable from the bytes it was walked from, and a PFX authSafe reaches verify this way. The
+// walker's own BER-tolerant decode is what replays it -- the strict `parse` entry would refuse the
+// indefinite-length encoding real stores carry.
+var walkSignedData = guard.parsed.recordingWalker("cms", function (node) {
+  return schema.walk(SIGNED_DATA, node, NS).result;
+}, function (der) { return asn1.decode(der, { ber: true }); });
 function walkEncryptedData(node) { return schema.walk(ENCRYPTED_DATA, node, NS).result; }
 // Validate + surface one countersignature value (RFC 5652 sec. 11.4, Countersignature ::=
 // SignerInfo) into the same parsed shape parse() gives a top-level SignerInfo -- so pki.cms.verify
@@ -1295,6 +1442,7 @@ module.exports = {
   walkSignedData: walkSignedData,
   walkEncryptedData: walkEncryptedData,
   walkCountersignature: walkCountersignature,
+  looksLikeSignedAttributes: looksLikeSignedAttributes,
   assertAttachedCiphertext: assertAttachedCiphertext,
   // The structure's own algorithm tables, exported (like the walk* helpers) as the single source
   // of truth the crypto layer (cms-encrypt / cms-decrypt) shares -- so the wrap<->KEK-length, the

package/lib/sign-scheme.js

@@ -195,8 +195,11 @@ function _assertKeyMatchesScheme(key, imp, E) {
   if (imp.namedCurve && ka.namedCurve !== imp.namedCurve) throw E("bad-input", "the signer CryptoKey curve (" + ka.namedCurve + ") does not match the certificate curve (" + imp.namedCurve + ")");
 }
 function _normPkcs8(k, label, E) {
-  if (Buffer.isBuffer(k)) return k;
-  if (k instanceof Uint8Array) return Buffer.from(k);
+  // A caller's own Buffer is BORROWED, not copied -- the same rule _importKey states below. Every
+  // other form is copied, and neither copy is duplicated further, so a private key never gains a
+  // plaintext duplicate this module cannot account for.
+  if (Buffer.isBuffer(k)) return guard.bytes.view(k, E, "bad-input", label);
+  if (k instanceof Uint8Array) return guard.bytes.snapshot(k, E, "bad-input", label);
   if (typeof k === "string") { try { return pkcs8.pemDecode(k); } catch (e) { throw E("bad-input", label + " PEM could not be decoded", e); } }
   throw E("bad-input", label + " must be a PKCS#8 DER Buffer, Uint8Array, or PEM string");
 }
@@ -219,8 +222,8 @@ function _importKey(key, imp, E) {
   // only thing that reads it. A caller's own Buffer is passed through untouched: they hold a live
   // reference and will use it again, so clearing it would destroy their key.
   var der, owned = false;
-  if (Buffer.isBuffer(key)) der = key;
-  else if (key instanceof Uint8Array) { der = Buffer.from(key); owned = true; }
+  if (Buffer.isBuffer(key)) der = guard.bytes.view(key, E, "bad-input", "the signer private key");
+  else if (key instanceof Uint8Array) { der = guard.bytes.snapshot(key, E, "bad-input", "the signer private key"); owned = true; }
   else if (typeof key === "string") {
     try { der = pkcs8.pemDecode(key); }
     catch (e) { throw E("bad-input", "the signer PEM private key could not be decoded", e); }

package/lib/sigstore.js

@@ -522,6 +522,9 @@ var IDENTITY_FIELDS = ["san", "issuer", "sourceRepositoryURI"];
 // The guard tests membership with hasOwnProperty, so the permitted set is a lookup object --
 // an array would treat "0"/"1" as the known keys and reject every real field name.
 var IDENTITY_KEYS = { san: 1, issuer: 1, sourceRepositoryURI: 1 };
+// Every option pki.sigstore.verifyBundle reads. Adding one here is the only way to make it
+// accepted, so a capability cannot arrive with its option silently ignored at this boundary.
+var _VERIFY_BUNDLE_OPTS = { fulcioRoots: 1, rekorKeys: 1, identity: 1, predicateType: 1, time: 1 };
 
 // Returns WHICH fields were actually compared. A bundle verifies its own signature and log
 // inclusion whoever signed it -- Fulcio issues to anyone who completes an OIDC flow -- so
@@ -633,6 +636,13 @@ async function verifyBundle(bundle, opts) {
     throw new TypeError("verifyBundle: bundle must be an object, JSON string, or Buffer");
   }
   opts = opts || {};
+  // An unrecognized option is refused, not swallowed. The identity policy one level down already
+  // closes this door for exactly the reason it needs closing here too: cosign spells the signer pin
+  // `certificateIdentity`, and a swallowed spelling checks nothing under a name the operator
+  // believes pins the signer. At the top level the same slip loses the SLSA predicate pin as well,
+  // and `predicateType` has no `identityChecked`-style field, so nothing in the verdict reveals
+  // that the pin never ran.
+  guard.identifier.assertKnownKeys(opts, _VERIFY_BUNDLE_OPTS, _err, "sigstore/bad-input", "pki.sigstore.verifyBundle has an unknown option ");
   var b = parseBundle(bundle);
   var vm = b.verificationMaterial;
   var env = b.dsseEnvelope;