@blamejs/pki 0.5.6 → 0.5.7

package/CHANGELOG.md

@@ -4,7 +4,29 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## v0.5.6 — 2026-08-16
+## v0.5.7 — 2026-08-16
+
+A CMS signature made over signed attributes can no longer be re-presented as one made over content.
+
+### Added
+
+- The pki.cms.verify verdict carries eContentType, and each signers[i] carries signedAttributesPresent. Signing with attributes and signing the content directly are different claims -- attributes bind a content type and a signing time alongside the digest, content-only binds nothing but the bytes -- and one message may carry a signer of each. A caller whose profile is stricter than RFC 5652's, such as RFC 8551 S/MIME which requires signed attributes, can now enforce that from the verdict instead of parsing the message a second time. A check that needs a second parse is a check most callers will not write.
+
+### Changed
+
+- Because the producing verbs now copy their arguments at entry, each property of a spec or options object -- own or inherited -- is read exactly once, when the verb is called. A field defined as a getter is therefore evaluated at that point even if the verb has no use for it, and a getter that throws surfaces as that module's bad-input fault before its own validation of any other field. Reading each property once is the point rather than a side effect: a getter consulted twice can answer differently the second time, which is the same problem the copy exists to remove. Plain data specs are unaffected.
+- One argument shape is refused rather than copied: an object whose state this toolkit cannot read -- a WeakMap or WeakSet, a promise, a CryptoKey -- carrying its own named fields alongside. There is no safe handling for it, because it cannot be copied and passing it through would leave those fields changeable after the checks had read them, so it fails with the module's bad-input code and says to pass the fields as a plain object. The same objects are accepted as before when they carry only what their kind defines, which is what a real key, a real promise and a real WeakMap do.
+- SECURITY.md previously said an attacker could "neither swap the content out from under a set of signed attributes, nor strip the attributes and present a signature made over them as one made over the content". The first half was true; the second was not, and had not been since the claim was written. The entry now describes what is actually defended and how, and names the case it costs: content which genuinely is an encoded SignedAttributes block must be signed WITH signed attributes. The v0.5.6 notes described the parsed-object re-derivation as closing this forgery; it closed the half reachable through a caller-assembled object, and this release closes the half reachable from bytes.
+
+### Fixed
+
+- pki.cms.verify refuses a SignerInfo with no signed attributes whose content is itself an encoded SignedAttributes block, as cms/ambiguous-content. This is Attack Type 1 of draft-vangeest-lamps-cms-euf-cma-signeddata: take a message signed with attributes present, drop the signedAttrs field, set the encapsulated content to the DER of those attributes, keep the signature. The signature genuinely verifies over those bytes -- the refusal is the shape, not a failed signature check, which is why it has its own code rather than reading as cms/bad-signature. The condition is necessary to the attack rather than a guess at anything SET OF shaped: RFC 5652 section 5.3 requires signed attributes to carry both a content-type and a message-digest attribute, so every message the attack produces has content carrying both, and content that is a set of attributes missing either one is not refused. Ordinary content -- a certificate, a JSON payload, arbitrary bytes -- does not have the shape at all. Verified against the shipped verb before and after, and the standards fixes for this are protocol changes (signing under a context string that names the mode) which no verifier can apply on its own.
+- pki.cms.sign refuses to sign content that is itself an encoded SignedAttributes block when signedAttributes is false. That is the other direction of the same problem (Attack Type 2): such a signature can afterwards be promoted into an attributes-present message, because the signature does not commit to which mode was used -- the attacker attaches the signed bytes AS the SignedAttributes and swaps in whatever content their message-digest attribute names. Refusing to mint the ambiguous signature is the only point at which that direction can be stopped. Sign the same content WITH signed attributes and it is unambiguous again.
+- A byte argument whose backing store has been transferred away is refused instead of read as empty. Transferring an ArrayBuffer -- a structuredClone with transfer, a worker hand-off, a stream that adopts the buffer -- leaves every view of it reading zero-length rather than throwing, so a boundary that passed the caller's object straight on operated on nothing and succeeded: pki.cms.sign produced a sound, verifiable signature covering no content at all, pki.cms.compress the same, and pki.pkcs12.build derived its MAC and encryption keys from the empty password. Every boundary that takes caller bytes now re-views the input first and refuses a detached one with that module's own bad-input code. Where the empty read already failed further down -- an empty certificate does not parse, an empty private key does not import -- the refusal now carries the calling module's code and names the argument, rather than surfacing whatever the later failure raised.
+- A producing verb reads its arguments once, at entry. Every one of them does work across more than one promise turn, so a caller still holding a spec, an options object or a signer could change a field after the call returned and have a later turn read the new value -- the checks ran against one input and the artifact was built from another. Every argument of pki.cms.sign, pki.cms.countersign, pki.x509.sign, pki.csr.sign, pki.crl.sign, pki.attrcert.sign, pki.crmf.build, pki.cmc.build, pki.cmp.build, pki.ocsp.buildRequest, pki.ocsp.sign, pki.tsp.sign and pki.pkcs12.build is now copied whole at entry, at every depth, and each copy is cleared when the call settles. Reachable cases included flipping signedAttributes from true to false to skip the content check the entry above describes, rewriting a certificate's key identifier or a CRL's authority key identifier between the check and the encoding, changing the encoding pki.x509.sign returns after the signature came back, rewriting the PKCS#12 password partway through so the file's MAC and its bag encryption were keyed to two different values, and rewriting the nested pki.cmp.build MAC secret so the message went out authenticated under a value the caller never supplied. Copying at one level does not cover the last of those and copying without clearing duplicates the secret, so both halves are the rule. A parsed structure passed inside a spec keeps its identity rather than being copied, so it still satisfies the verbs that require parser provenance, and a CryptoKey is used rather than cloned.
+- The verbs documented as returning a Promise now run their body at the call, not a turn later. Ten of them deferred everything -- including reading the caller's arguments -- until after the call had already returned, which left the window above open even for a verb that copies its input on the first line. They still report a fault by rejecting rather than throwing; only the timing of the work changed.
+
+## v0.5.6 — 2026-08-15
 
 A CMS SignedData is verified over the bytes it was parsed from, an omitted PKCS#12 password is refused rather than encoded as the empty one, and a verb documented as returning a Promise rejects instead of throwing past your .catch.
 

package/MIGRATING.md

@@ -14,6 +14,28 @@ The toolkit has no `deprecate()`-marked surface awaiting removal.
 
 Listed newest-first.
 
+### v0.5.7 — `content that is an encoded SignedAttributes block`
+
+Signing or verifying such content WITHOUT signed attributes is refused as cms/ambiguous-content.
+
+A CMS signature does not commit to whether signed attributes were present, so a signature made
+over a SignedAttributes block can be re-presented as one made over content. The shape is now
+refused at both ends.
+
+This only affects you if your CMS content genuinely IS a DER SET OF Attribute carrying both a
+content-type and a message-digest attribute -- the shape RFC 5652 sec. 5.3 gives a
+SignedAttributes -- AND you sign it with `signedAttributes: false`. Ordinary content is
+unaffected, and so is a set of attributes missing either of those two.
+
+```js
+await pki.cms.sign(attrShapedContent, signer, { signedAttributes: false });  // cms/ambiguous-content
+await pki.cms.sign(attrShapedContent, signer);                              // signed attributes: fine
+```
+
+Signing it WITH signed attributes makes the message unambiguous and it verifies normally.
+Existing messages of this shape already in your archive will not verify; re-sign them with
+signed attributes.
+
 ### v0.5.6 — `try { pki.<verb>(...) } catch`
 
 A verb documented `-> Promise` rejects on a bad input instead of throwing before the promise exists.

package/lib/attrcert-sign.js

@@ -456,7 +456,11 @@ function _buildExtensions(extSpec, aaSpki) {
  *   pki.schema.attrcert.parse(ac).attributes[0].type;   // the role attribute OID
  */
 function sign(spec, issuer, opts) {
-  return Promise.resolve().then(function () { return _sign(spec, issuer, opts); });
+  // Every caller-owned argument copied at entry and released when the call settles -- see the note
+  // on the same call in x509-sign.
+  return guard.bytes.fixedCall(AttrCertError, "attrcert/bad-input", [
+    [spec, "the attribute-certificate spec"], [issuer, "the issuer"], [opts, "pki.attrcert.sign options"],
+  ], _sign);
 }
 
 function _sign(spec, issuer, opts) {

package/lib/cmc-build.js

@@ -365,8 +365,7 @@ function _assertNoDuplicateBinding(callerControls, spec) {
 function _asBigInt(v, what) { return guard.range.authoredInteger(v, E, "cmc/bad-input", what); }
 
 function _der(v, what) {
-  if (Buffer.isBuffer(v)) return v;
-  if (v instanceof Uint8Array) return Buffer.from(v);
+  if (Buffer.isBuffer(v) || v instanceof Uint8Array) return guard.bytes.snapshot(v, CmcError, "cmc/bad-input", what);
   throw E("cmc/bad-input", what + " must be DER bytes");
 }
 function _oidOf(v) {
@@ -481,17 +480,13 @@ function popLinkWitnessV2(secret, R) {
 // The operator-facing @primitive block for this function lives beside its
 // re-export in cmc-verify.js, the pki.cmc @module home.
 function build(spec, signer, opts) {
-  // Assembled SYNCHRONOUSLY. _build reads the spec, every request buffer and the
-  // signer as it goes, so deferring that work would read them a turn after the
-  // call -- and a caller reusing a pooled CSR buffer, or reaching back into the
-  // spec on the next line, would have the message signed over something other
-  // than what was handed in. Only the signing itself is async, and by then the
-  // bytes are fixed.
-  try {
-    return _build(spec, signer, opts);
-  } catch (e) {
-    return Promise.reject(e);   // the surface stays promise-rejecting, never throwing
-  }
+  // Every caller-owned argument copied at entry and released when the call settles -- see the note
+  // on the same call in x509-sign. It matters most here: the Identity Proof and POP Link witnesses
+  // are computed over the bytes this builder is about to emit, so a spec that changed in between
+  // would witness a different request than the one that goes out.
+  return guard.bytes.fixedCall(CmcError, "cmc/bad-input", [
+    [spec, "the CMC request spec"], [signer, "the signer"], [opts, "pki.cmc.build options"],
+  ], _build);
 }
 
 function _build(spec, signer, opts) {

package/lib/cmc-verify.js

@@ -318,7 +318,7 @@ function verify(response, sent) {
   } catch (e) {
     return Promise.reject(e);   // the surface stays promise-rejecting, never throwing
   }
-  return Promise.resolve().then(function () { return _verify(frozenResponse, frozenSent); });
+  return guard.async.deferred(function () { return _verify(frozenResponse, frozenSent); });
 }
 
 function _assertOpts(sent) {
@@ -354,7 +354,7 @@ function _snapshotIfBytes(input) {
 // the very gap this closes -- reopening the window for exactly the inputs that came in by the
 // wider one. A DataView is copied over its OWN window, not the whole buffer it happens to sit in.
 function _copyAnyBytes(v) {
-  if (Buffer.isBuffer(v) || v instanceof Uint8Array) return Buffer.from(v);
+  if (Buffer.isBuffer(v) || v instanceof Uint8Array) return guard.bytes.snapshot(v, CmcError, "cmc/bad-input", "a byte field of the request");
   if (ArrayBuffer.isView(v)) return Buffer.from(new Uint8Array(v.buffer, v.byteOffset, v.byteLength));
   if (v instanceof ArrayBuffer) return Buffer.from(new Uint8Array(v));
   return v;

package/lib/cmp-build.js

@@ -550,7 +550,12 @@ function _resolveProtection(opts) {
 // ---- orchestrator ----
 
 function build(message, opts) {
-  return Promise.resolve().then(function () { return _build(message, opts); });
+  // Every caller-owned argument copied at entry and released when the call settles -- see the note
+  // on the same call in x509-sign. `opts.mac.secret` is why the copy has to be deep: it sits a
+  // level below the options object and is read by the PBMAC1 derivation after the first turn.
+  return guard.bytes.fixedCall(CmpError, "cmp/bad-input", [
+    [message, "the PKIMessage spec"], [opts, "pki.cmp.build options"],
+  ], _build);
 }
 
 function _build(message, opts) {
@@ -733,7 +738,7 @@ function _classifyCmpResponse(status, headers, body, tls) {
 }
 
 function transfer(url, message, opts) {
-  return Promise.resolve().then(function () { return _transfer(url, message, opts); });
+  return guard.async.deferred(function () { return _transfer(url, message, opts); });
 }
 
 function _transfer(url, message, opts) {

package/lib/cmp-session.js

@@ -892,8 +892,10 @@ function session(opts) {
       catch (_e) { /* allow:swallow-unverified an unparseable p10cr CSR fails closed at the cmp.build boundary; the key-match is simply not applied to a request that never sends */ return null; }
     }
     var pk = armSpec && armSpec.certTemplate ? armSpec.certTemplate.publicKey : null;
-    if (Buffer.isBuffer(pk)) return pk;
-    if (pk instanceof Uint8Array) return Buffer.from(pk);
+    // SNAPSHOT: this is held in session state across the transport round trip and then compared
+    // against the issued certificate's key, so an alias would let the caller rewrite the key the
+    // response is checked against after the request went out.
+    if (Buffer.isBuffer(pk) || pk instanceof Uint8Array) return guard.bytes.snapshot(pk, CmpError, "cmp/bad-input", "the certTemplate publicKey");
     return null;
   }
 

package/lib/cmp-verify.js

@@ -618,7 +618,7 @@ function _nonEmptySecret(s) {
 }
 
 function verify(message, opts) {
-  return Promise.resolve().then(function () { return _verify(message, opts); });
+  return guard.async.deferred(function () { return _verify(message, opts); });
 }
 
 async function _verify(message, opts) {

package/lib/cms-compress.js

@@ -86,8 +86,7 @@ async function decompress(input, opts) {
 }
 
 function _toDer(input) {
-  if (Buffer.isBuffer(input)) return input;
-  if (input instanceof Uint8Array) return Buffer.from(input);
+  if (Buffer.isBuffer(input) || input instanceof Uint8Array) return guard.bytes.snapshot(input, CmsError, "cms/bad-input", "input");
   if (typeof input === "string") { try { return schemaCms.pemDecode(input); } catch (e) { throw _err("cms/bad-input", "the CMS PEM could not be decoded", e); } }
   throw _err("cms/bad-input", "input must be a DER Buffer, Uint8Array, or PEM string");
 }

package/lib/cms-decrypt.js

@@ -106,8 +106,7 @@ function _parse(input) {
   return schemaCms.parse(_toDer(input));
 }
 function _toDer(input) {
-  if (Buffer.isBuffer(input)) return input;
-  if (input instanceof Uint8Array) return Buffer.from(input);
+  if (Buffer.isBuffer(input) || input instanceof Uint8Array) return guard.bytes.snapshot(input, CmsError, "cms/bad-input", "input");
   if (typeof input === "string") { try { return schemaCms.pemDecode(input); } catch (e) { throw _err("cms/bad-input", "the CMS PEM could not be decoded", e); } }
   throw _err("cms/bad-input", "input must be a DER Buffer, Uint8Array, or PEM string");
 }
@@ -754,8 +753,7 @@ function _releaseKeyDer(k) {
   if (k && k.owned) guard.secret.zeroize(k.der, CmsError, "cms/bad-input", "the recipient private-key copy");
 }
 function _normCertDer(cert) {
-  if (Buffer.isBuffer(cert)) return cert;
-  if (cert instanceof Uint8Array) return Buffer.from(cert);
+  if (Buffer.isBuffer(cert) || cert instanceof Uint8Array) return guard.bytes.snapshot(cert, CmsError, "cms/bad-input", "the recipient certificate");
   if (typeof cert === "string") { try { return x509.pemDecode(cert); } catch (e) { throw _err("cms/bad-input", "the recipient certificate PEM could not be decoded", e); } }
   throw _err("cms/bad-input", "the recipient certificate must be a DER Buffer or PEM string");
 }

package/lib/cms-encrypt.js

@@ -40,8 +40,7 @@ function _algId(name, shape) { return shape === "null" ? b.sequence([b.oid(O(nam
 // A certificate descriptor -> raw DER (the recipient cert is parsed for dispatch + rid; the caller
 // supplies bytes, not a re-encoded parse).
 function _normCertDer(cert, what) {
-  if (Buffer.isBuffer(cert)) return cert;
-  if (cert instanceof Uint8Array) return Buffer.from(cert);
+  if (Buffer.isBuffer(cert) || cert instanceof Uint8Array) return guard.bytes.snapshot(cert, CmsError, "cms/bad-input", what || "a certificate");
   if (typeof cert === "string") { try { return x509.pemDecode(cert); } catch (e) { throw _err("cms/bad-input", (what || "a certificate") + " PEM could not be decoded", e); } }
   throw _err("cms/bad-input", (what || "a certificate") + " must be a DER Buffer, Uint8Array, or PEM string");
 }

package/lib/cms-sign.js

@@ -325,8 +325,10 @@ function _keyOnlyKeyId(so) {
 
 function _normCertDer(c) {
   if (c == null) throw _err("cms/bad-input", "each signer requires a certificate (cert)");
-  if (c instanceof Uint8Array && !Buffer.isBuffer(c)) c = Buffer.from(c);   // a Uint8Array -> Buffer (below)
-  if (Buffer.isBuffer(c)) return c[0] === 0x30 ? c : _pemToDer(c.toString("latin1"));   // DER as-is, else PEM
+  if (c instanceof Uint8Array || Buffer.isBuffer(c)) {
+    c = guard.bytes.snapshot(c, CmsError, "cms/bad-input", "a signer certificate");
+    return c[0] === 0x30 ? c : _pemToDer(c.toString("latin1"));   // DER as-is, else PEM
+  }
   if (typeof c === "string") return _pemToDer(c);
   throw _err("cms/bad-input", "a signer certificate must be a DER Buffer or a PEM string");
 }
@@ -340,12 +342,21 @@ function _pemToDer(text) {
 // Documented `-> Promise`, so a fault leaves as a REJECTION (guard-async); the checks stay
 // synchronous because they read the caller's mutable content and signer list.
 function sign(content, signers, opts) {
-  return guard.async.deferred(function () { return _sign(content, signers, opts); });
+  // Every caller-owned argument copied at entry and released when the call settles -- see the note
+  // on the same call in x509-sign. Here it is what makes the attribute-shaped-content refusal below
+  // hold: the value that decides it and the value that gets signed are now the same read.
+  return guard.bytes.fixedCall(CmsError, "cms/bad-input", [
+    [content, "content"], [signers, "the signer list"], [opts, "pki.cms.sign options"],
+  ], _sign);
 }
 
 function _sign(content, signers, opts) {
   opts = opts || {};
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("cms/bad-input", "pki.cms.sign options must be an object");
+  // The arguments were copied at entry (see `sign` above), which is what makes the refusal below
+  // hold: flipping signedAttributes from true to false after the call returns would otherwise skip
+  // the attribute-shaped-content check while the signer signs that content directly -- the very
+  // signature the stripping attack needs.
   var contentBuf = _toBuf(content, "content");
   var list = Array.isArray(signers) ? signers : [signers];
   if (!list.length) throw _err("cms/bad-input", "pki.cms.sign requires at least one signer");
@@ -369,6 +380,18 @@ function _sign(content, signers, opts) {
   if (opts.signedAttributes === false && eContentType !== OID_DATA) {
     throw _err("cms/bad-input", "signed attributes are required when eContentType is not id-data (RFC 5652 sec. 5.3)");
   }
+  // The signer's half of the signed-attribute stripping problem
+  // (draft-vangeest-lamps-cms-euf-cma-signeddata, Attack Type 2). Signing attribute-shaped content
+  // WITHOUT attributes produces a signature that can afterwards be promoted into an
+  // attributes-present message, because the signature does not commit to which mode was used: the
+  // attacker attaches the signed bytes AS the SignedAttributes and swaps in whatever content their
+  // message-digest attribute names. Refusing to mint the ambiguous signature is the only point at
+  // which this direction can be stopped -- by the time it is a message, the damage is done.
+  if (opts.signedAttributes === false && cms.looksLikeSignedAttributes(contentBuf)) {
+    throw _err("cms/ambiguous-content", "this content is itself an encoded SignedAttributes block, so signing " +
+      "it WITHOUT signed attributes would produce a signature that could be re-presented as one over " +
+      "attributes (RFC 5652 sec. 5.4); sign it with signed attributes instead");
+  }
   // A supplied signing-time MUST be a valid Date (or false to omit the attribute) -- never a
   // silently-ignored non-Date or an Invalid Date that would encode a garbage Time.
   if (opts.signingTime != null && opts.signingTime !== false) guard.time.assertValid(opts.signingTime, _err, "cms/bad-input", "signingTime");
@@ -411,8 +434,7 @@ function _dedupe(ders) {
 }
 
 function _toBuf(v, what) {
-  if (Buffer.isBuffer(v)) return v;
-  if (v instanceof Uint8Array) return Buffer.from(v);
+  if (Buffer.isBuffer(v) || v instanceof Uint8Array) return guard.bytes.snapshot(v, CmsError, "cms/bad-input", what);
   throw _err("cms/bad-input", what + " must be a Buffer");
 }
 
@@ -541,7 +563,12 @@ function _targetPreimage(siNode, opts) {
 // pki.cms.countersign -- documented by the @primitive block in cms-verify.js (the @module pki.cms home).
 // Documented `-> Promise`, so a fault leaves as a REJECTION (guard-async).
 function countersign(cmsInput, signers, opts) {
-  return guard.async.deferred(function () { return _countersign(cmsInput, signers, opts); });
+  // Every caller-owned argument copied at entry and released when the call settles -- see the note
+  // on the same call in x509-sign. `signerIndex` and `countersignatureOf` SELECT which signature is
+  // countersigned, so a late read could attach the countersignature to a different one.
+  return guard.bytes.fixedCall(CmsError, "cms/bad-input", [
+    [cmsInput, "the CMS message"], [signers, "the signer list"], [opts, "pki.cms.countersign options"],
+  ], _countersign);
 }
 
 function _countersign(cmsInput, signers, opts) {

package/lib/cms-verify.js

@@ -119,8 +119,7 @@ EC_CURVE[oid.byName("secp384r1")] = { curve: "P-384", coordLen: 48 };
 EC_CURVE[oid.byName("secp521r1")] = { curve: "P-521", coordLen: 66 };
 
 function _toBuf(v, what) {
-  if (Buffer.isBuffer(v)) return v;
-  if (v instanceof Uint8Array) return Buffer.from(v);
+  if (Buffer.isBuffer(v) || v instanceof Uint8Array) return guard.bytes.snapshot(v, CmsError, "cms/bad-input", what);
   throw _err("cms/bad-input", what + " must be a Buffer");
 }
 
@@ -420,7 +419,24 @@ function _computeCountersigBytes(si, csTarget) {
 // content-type / message-digest attribute disagrees.
 function _computeSignedBytes(si, content, eContentType) {
   return Promise.resolve().then(function () {
-    if (!si.signedAttrsBytes) return content;   // no signed attributes: sign over the content directly
+    if (!si.signedAttrsBytes) {
+      // No signed attributes: the signature is over the content itself (RFC 5652 sec. 5.4). That is
+      // also exactly what a stripped-attributes forgery looks like, because a CMS signature does not
+      // commit to whether attributes were present -- so a signature made over a SignedAttributes
+      // block re-presented as one made over content verifies, and with no attributes there is no
+      // message-digest or content-type attribute left to disagree. Refuse the shape: content that
+      // parses as a SignedAttributes block cannot be told apart from that forgery, and it is not
+      // the verifier's place to guess which one it is holding.
+      if (cms.looksLikeSignedAttributes(content)) {
+        return { mismatch: {
+          code: "cms/ambiguous-content",
+          message: "the content of a SignerInfo with no signed attributes is itself an encoded " +
+            "SignedAttributes block, which is indistinguishable from a signature over attributes " +
+            "re-presented as one over content (RFC 5652 sec. 5.4); sign such content WITH signed attributes",
+        } };
+      }
+      return content;
+    }
     // With signed attributes: decode them from the EXACT bytes the signature covers -- the
     // SignedAttributes SET OF, the on-wire [0] IMPLICIT tag replaced by a universal SET OF
     // (RFC 5652 sec. 5.4) -- so the content-type / message-digest checks bind the same bytes
@@ -574,7 +590,7 @@ function _verifyOneCountersig(vDer, targetSig, parsedCerts) {
 
 /**
  * @primitive  pki.cms.verify
- * @signature  pki.cms.verify(input, opts?) -> Promise<{ valid, trusted, signers }>
+ * @signature  pki.cms.verify(input, opts?) -> Promise<{ valid, trusted, eContentType, signers }>
  * @since      0.2.14
  * @status     stable
  * @spec       RFC 5652
@@ -584,10 +600,17 @@ function _verifyOneCountersig(vDer, targetSig, parsedCerts) {
  * @related    pki.schema.cms.parse, pki.path.validate
  *
  * Verify a CMS SignedData signature (RFC 5652 sec. 5). `input` is a PEM string, a DER
- * `Buffer`, or a parsed `pki.schema.cms` object. Returns `{ valid, trusted, signers }` where each
- * `signers[i]` is `{ ok, sid, cert, trusted }` (`cert` the matched signer certificate DER) or carries
- * a `code` on a structural failure; `valid` is true when there is at least one signer and
- * every signer verified.
+ * `Buffer`, or a parsed `pki.schema.cms` object. Returns `{ valid, trusted, eContentType, signers }`
+ * where each `signers[i]` is `{ ok, sid, cert, trusted, signedAttributesPresent }` (`cert` the
+ * matched signer certificate DER) or carries a `code` on a structural failure; `valid` is true when
+ * there is at least one signer and every signer verified.
+ *
+ * `eContentType` and `signedAttributesPresent` are there for a caller whose profile is stricter
+ * than RFC 5652's. Signing WITH attributes and signing the content directly are different claims --
+ * attributes bind a content type and a signing time alongside the digest, content-only binds
+ * nothing but the bytes -- and one message may carry a signer of each. A profile that requires
+ * attributes (RFC 8551 S/MIME does) or a particular content type can enforce it from the verdict
+ * rather than parsing the message a second time.
  *
  * `valid` and `trusted` are DIFFERENT claims and neither implies the other. A SignedData carries
  * its own certificates, so `valid` establishes that the message is internally consistent -- the
@@ -721,11 +744,25 @@ function _verify(input, opts) {
       return _verifyCountersignatures(si, parsedCerts).then(function (countersignatures) {
         verdict.countersignatures = countersignatures;
         verdict.unsignedAttrs = _surfaceUnsignedAttrs(si);
+        // Whether THIS signer signed attributes or signed the content directly. The two are
+        // different claims -- attributes bind a content type and a signing time alongside the
+        // digest, and content-only binds nothing but the bytes -- and RFC 5652 lets a message carry
+        // one signer of each. A caller whose profile requires attributes (RFC 8551 S/MIME does) can
+        // only enforce it if the verdict says which they got.
+        verdict.signedAttributesPresent = !!si.signedAttrsBytes;
         return verdict;
       });
     });
   })).then(function (signers) {
-    var res = { valid: signers.length > 0 && signers.every(function (s) { return s.ok === true; }), signers: signers };
+    // The content type travels with the verdict. An operator applying a policy of their own -- "I
+    // only accept id-data", or a profile that names its own type -- otherwise had to parse the
+    // message a second time to learn it, and a check that needs a second parse is a check most
+    // callers will not write.
+    var res = {
+      valid: signers.length > 0 && signers.every(function (s) { return s.ok === true; }),
+      eContentType: parsed.encapContentInfo.eContentType,
+      signers: signers,
+    };
     return _applyTrust(res, parsedCerts, trustCfg).then(function () { return res; });
   });
 }

package/lib/crl-sign.js

@@ -144,7 +144,7 @@ function _resolveReason(reason, isDelta) {
 // The AKI keyIdentifier from the issuer: an explicit Buffer, or true -> the issuer cert's subjectKeyIdentifier,
 // else the SHA-1 of the issuer SPKI (RFC 5280 sec. 5.2.1 key-identifier method).
 function _akiKeyId(val, ctx) {
-  if (Buffer.isBuffer(val)) return val;
+  if (Buffer.isBuffer(val)) return guard.bytes.snapshot(val, CrlError, "crl/bad-input", "the authorityKeyIdentifier keyIdentifier");
   if (val === true) {
     if (ctx.issuerCert) {
       var ski = (ctx.issuerCert.extensions || []).filter(function (e) { return e.oid === OID_SKI; })[0];
@@ -507,7 +507,13 @@ function _sign(spec, issuer, opts) {
  *   }, { cert: signerCertDer, key: signerKeyPkcs8 });
  *   pki.schema.crl.parse(der).revokedCertificates[0].serialNumberHex;   // "1234"
  */
-function sign(spec, issuer, opts) { return Promise.resolve().then(function () { return _sign(spec, issuer, opts); }); }
+function sign(spec, issuer, opts) {
+  // Every caller-owned argument copied at entry and released when the call settles -- see the note
+  // on the same call in x509-sign.
+  return guard.bytes.fixedCall(CrlError, "crl/bad-input", [
+    [spec, "the CRL spec"], [issuer, "the issuer"], [opts, "pki.crl.sign options"],
+  ], _sign);
+}
 
 // A CRL these verbs answer from is re-derived from the bytes its parser read. Completeness -- every
 // field present with the right type -- is not enough for a verdict: the signature covers a byte
@@ -598,7 +604,7 @@ function _issuerMaySign(parsed, cert) {
  *     { cert: signerCertDer, key: signerKeyPkcs8 });
  *   var ok = await pki.crl.verify(crlDer, { publicKey: signerSpki });   // true / false
  */
-function verify(crl, issuer) { return Promise.resolve().then(function () { return _verify(crl, issuer); }); }
+function verify(crl, issuer) { return guard.async.deferred(function () { return _verify(crl, issuer); }); }
 function _verify(crl, issuer) {
   var parsed = _coerceCrl(crl);
   var resolved = _resolveIssuer(issuer);

package/lib/crmf-sign.js

@@ -238,7 +238,11 @@ function _buildProofOfPossession(pop, certReqDer, template, signingKey, opts) {
  *   pki.schema.crmf.parse(msg).messages[0].certReq.certTemplate.subject.dn;   // "CN=device-42"
  */
 function build(spec, key, opts) {
-  return Promise.resolve().then(function () { return _build(spec, key, opts); });
+  // Every caller-owned argument copied at entry and released when the call settles -- see the note
+  // on the same call in x509-sign.
+  return guard.bytes.fixedCall(CrmfError, "crmf/bad-input", [
+    [spec, "the certificate-request-message spec"], [key, "the signing key"], [opts, "pki.crmf.build options"],
+  ], _build);
 }
 
 function _buildCertReqMsg(spec, key, opts) {

package/lib/csr-sign.js

@@ -101,7 +101,11 @@ function _challengePassword(pw) {
  *   pki.schema.csr.parse(req).subject.dn;   // "CN=req.example.com"
  */
 function sign(spec, key, opts) {
-  return Promise.resolve().then(function () { return _sign(spec, key, opts); });
+  // Every caller-owned argument copied at entry and released when the call settles -- see the note
+  // on the same call in x509-sign.
+  return guard.bytes.fixedCall(CsrError, "csr/bad-input", [
+    [spec, "the certification-request spec"], [key, "the signing key"], [opts, "pki.csr.sign options"],
+  ], _sign);
 }
 
 function _sign(spec, key, opts) {

package/lib/est.js

@@ -826,7 +826,7 @@ var MAX_TIMEOUT = constants.TIME.seconds(600);
 // The DER of a caller-supplied CSR: a DER Buffer as-is, or a PEM "CERTIFICATE REQUEST"
 // decoded. Any other input is a config-time est/bad-input.
 function _csrDer(input) {
-  if (Buffer.isBuffer(input)) return input;
+  if (Buffer.isBuffer(input)) return guard.bytes.snapshot(input, EstError, "est/bad-input", "a CSR");
   if (typeof input === "string") return csr.pemDecode(input);
   throw E("est/bad-input", "a CSR must be a DER Buffer or a PEM CERTIFICATE REQUEST string");
 }
@@ -1428,7 +1428,7 @@ function _cmcSent(opts, der) {
 // window this exists to close, open for exactly the inputs that came in by the wider door.
 // A DataView is copied over its OWN window, not the whole backing buffer it happens to sit in.
 function _copyBytes(v) {
-  if (Buffer.isBuffer(v) || v instanceof Uint8Array) return Buffer.from(v);
+  if (Buffer.isBuffer(v) || v instanceof Uint8Array) return guard.bytes.snapshot(v, EstError, "est/bad-input", "a byte field of the request");
   if (ArrayBuffer.isView(v)) return Buffer.from(new Uint8Array(v.buffer, v.byteOffset, v.byteLength));
   if (v instanceof ArrayBuffer) return Buffer.from(new Uint8Array(v));
   return v;
@@ -1591,8 +1591,9 @@ function _shallowCopy(o) {
 function _cmcRequestDer(request) {
   // COPIED, not aliased: these bytes are parsed now (for the requested keys) and
   // transmitted later, so sharing the caller's buffer would let the two disagree.
-  if (Buffer.isBuffer(request)) return Buffer.from(request);
-  if (request instanceof Uint8Array) return Buffer.from(request);
+  if (Buffer.isBuffer(request) || request instanceof Uint8Array) {
+    return guard.bytes.snapshot(request, EstError, "est/bad-input", "the Full PKI Request");
+  }
   if (typeof request === "string") return cms.pemDecode(request);
   throw E("est/bad-input", "pki.est.fullcmc requires the Full PKI Request as DER bytes or a PEM CMS block");
 }