@blamejs/pki 0.5.6 → 0.5.7

package/lib/schema-cms.js

@@ -212,6 +212,138 @@ function _checkContentBindingAttrs(attrs, mode) {
   if (md === 0) throw NS.E("cms/missing-message-digest", "the attribute set must contain a message-digest attribute (RFC 5652 sec. 11.2)");
 }
 
+// looksLikeSignedAttributes(bytes) -> boolean.
+//
+// Does `bytes` parse as a DER SignedAttributes block -- a SET OF Attribute carrying BOTH the
+// content-type and message-digest attributes RFC 5652 sec. 5.3 makes mandatory whenever signed
+// attributes are present?
+//
+// This is the detector for the signed-attribute stripping forgery
+// (draft-vangeest-lamps-cms-euf-cma-signeddata, Attack Type 1). A CMS signature does not commit to
+// WHETHER signed attributes were present, so a signature made over a SignedAttributes block can be
+// re-presented as one made over content: drop the signedAttrs field and set the encapsulated
+// content to the DER of those same attributes. Sec. 5.4 then says the signature is over the content
+// itself, which is exactly what it covers, and with no attributes there is no message-digest or
+// content-type attribute left to disagree. The proposed standards fixes are protocol changes -- a
+// context string naming which mode was signed -- that no verifier can apply on its own.
+//
+// What a verifier CAN do is refuse the shape. Every message produced by the attack has, as its
+// content, the encoded SignedAttributes of a real message, and sec. 5.3 requires those to carry
+// both attributes named above. That makes their presence a NECESSARY condition of the attack rather
+// than a guess, and the shape is one ordinary content does not have: a certificate, a JSON payload,
+// arbitrary bytes, and even a SET OF other attributes all fail it. The cost is a message whose
+// legitimate content really is an encoded SignedAttributes block signed WITHOUT attributes, which
+// is refused as genuinely ambiguous -- sign it with attributes and it is unambiguous again.
+//
+// One mandatory attribute value, held to all three conditions a real SignedAttributes meets:
+// exactly one value (RFC 5652 sec. 11.1 / sec. 11.2 make both single-valued), the right tag, and a
+// body that actually READS as that type. All three together, for each attribute -- checking the
+// cardinality and the tag while letting an undecodable body through would refuse content the real
+// SignedAttributes parser could never have produced, which is the false positive this whole
+// detector is shaped to avoid.
+function _readsAs(vals, tagNumber, reader) {
+  if (vals.length !== 1 || !schema.isUniversal(vals[0], tagNumber)) return false;
+  var reads = true;
+  try { reader(vals[0]); }
+  catch (_e) {
+    reads = false;   // right tag, unreadable body -- not a preimage anything signed
+  }
+  return reads;
+}
+// SigningTime ::= Time is a CHOICE of UTCTime and GeneralizedTime, so the tag is one of two and the
+// reader settles which -- _readsAs pins a single tag and cannot express it.
+function _readsAsTime(vals) {
+  if (vals.length !== 1) return false;
+  var reads = true;
+  try { asn1.read.time(vals[0]); }
+  catch (_e) {
+    reads = false;
+  }
+  return reads;
+}
+
+// Deliberately a total function: it answers about arbitrary attacker bytes and must never throw.
+// The X.690 sec. 11.6 SET OF ordering rule, as the schema engine applies it: each component's
+// encoding is greater than or equal to the one before it.
+function _ascendingDer(nodes) {
+  for (var i = 1; i < nodes.length; i++) {
+    if (Buffer.compare(nodes[i - 1].bytes, nodes[i].bytes) > 0) return false;
+  }
+  return true;
+}
+
+function looksLikeSignedAttributes(bytes) {
+  if (!bytes || !bytes.length) return false;
+  var node;
+  try { node = asn1.decode(bytes); }
+  catch (_e) { return false; }   // not DER at all -- not this shape
+  if (!schema.isUniversal(node, asn1.TAGS.SET) || !node.constructed) return false;
+  var kids = node.children || [];
+  if (!kids.length) return false;
+  // Every rule _checkContentBindingAttrs applies to a REAL SignedAttributes is applied here, and
+  // for one reason: the detector must match only what a conforming block can be. A set the real
+  // parser would have rejected cannot be the preimage of any signature, so matching it would refuse
+  // content no attack could have produced. Enumerated against that function rather than discovered
+  // one rule at a time -- no duplicate attribute types (sec. 5.3), content-type single-valued and a
+  // readable OID (sec. 11.1), message-digest single-valued and a readable OCTET STRING (sec. 11.2),
+  // signing-time when present single-valued and a readable Time (sec. 11.3).
+  // X.690 sec. 11.6: the components of a SET OF appear in ascending DER order, and the schema
+  // engine enforces exactly that on the real SignedAttributes. An out-of-order set is one the
+  // walker refuses, so it is not the preimage of any signature either.
+  if (!_ascendingDer(kids)) return false;
+  var sawContentType = false, sawMessageDigest = false, seenTypes = Object.create(null);
+  for (var i = 0; i < kids.length; i++) {
+    var a = kids[i];
+    // Attribute ::= SEQUENCE { attrType OBJECT IDENTIFIER, attrValues SET OF ANY }
+    if (!schema.isUniversal(a, asn1.TAGS.SEQUENCE)) return false;
+    if (!a.children || a.children.length !== 2) return false;
+    var t = a.children[0], vs = a.children[1];
+    if (!schema.isUniversal(t, asn1.TAGS.OBJECT_IDENTIFIER)) return false;
+    if (!schema.isUniversal(vs, asn1.TAGS.SET)) return false;
+    var attrOid;
+    try { attrOid = asn1.read.oid(t); }
+    catch (_e2) { return false; }
+    if (seenTypes[attrOid]) return false;   // a repeated attribute type -- sec. 5.3 forbids it
+    seenTypes[attrOid] = true;
+    // The sec. 11 PLACEMENT rows, from the same table the real parser reads. An attribute the
+    // parser refuses to see in signedAttrs -- id-countersignature is the one sec. 11.4 names --
+    // cannot appear in a conforming SignedAttributes, so a set containing it is not a preimage any
+    // signature covers. Missing this row was the difference between a necessary condition and a
+    // guess: it would have refused ordinary content that merely carried that attribute encoding.
+    var placement = ATTR_FORBIDDEN_IN[attrOid];
+    if (placement && placement.signed) return false;
+    // RFC 5652 gives every AttributeValue set SIZE (1..MAX), so an attribute with an EMPTY value
+    // set is one no conforming signer produced and no signature covers. The upper bound is
+    // deliberately not applied: this decoder caps values per attribute as a resource limit of its
+    // own, and a limit this implementation chose is not a fact about what a signature can cover.
+    // An external signer may sign a conforming set larger than that cap, and the stripped message
+    // presents those bytes as opaque content where the cap never applies -- refusing to recognize
+    // it because of a local limit would miss exactly the preimage the attack reuses.
+    var n = (vs.children || []).length;
+    if (n < 1) return false;
+    if (!_ascendingDer(vs.children || [])) return false;   // the inner SET OF is ordered too
+    // The two mandatory attributes are checked down to their VALUES, not just their type OIDs.
+    // RFC 5652 sec. 11.1 makes content-type a single OBJECT IDENTIFIER and sec. 11.2 makes
+    // message-digest a single OCTET STRING, so a set carrying those OIDs over an empty or
+    // wrongly-typed value CANNOT be the preimage of a real signature -- and refusing it would be a
+    // false positive on content that merely resembles the shape. The detector has to stay a
+    // necessary condition of the attack; anything broader costs a legitimate caller.
+    var vals = vs.children || [];
+    if (attrOid === OID_CONTENT_TYPE) {
+      if (!_readsAs(vals, asn1.TAGS.OBJECT_IDENTIFIER, asn1.read.oid)) return false;
+      sawContentType = true;
+    } else if (attrOid === OID_MESSAGE_DIGEST) {
+      if (!_readsAs(vals, asn1.TAGS.OCTET_STRING, asn1.read.octetString)) return false;
+      sawMessageDigest = true;
+    } else if (attrOid === OID_SIGNING_TIME) {
+      // Not mandatory, but when present sec. 11.3 constrains it the same way, so a set carrying an
+      // unreadable signing-time is one the real parser would have refused.
+      if (!_readsAsTime(vals)) return false;
+    }
+  }
+  return sawContentType && sawMessageDigest;
+}
+
 // RFC 5652 sec. 5.3 / sec. 9.3 -- when a content-type attribute is present, it MUST
 // be single-valued (sec. 11.1) and its value MUST equal the eContentType (a
 // cross-field consistency both parsed here). Shared by SignedData signedAttrs,
@@ -1310,6 +1442,7 @@ module.exports = {
   walkSignedData: walkSignedData,
   walkEncryptedData: walkEncryptedData,
   walkCountersignature: walkCountersignature,
+  looksLikeSignedAttributes: looksLikeSignedAttributes,
   assertAttachedCiphertext: assertAttachedCiphertext,
   // The structure's own algorithm tables, exported (like the walk* helpers) as the single source
   // of truth the crypto layer (cms-encrypt / cms-decrypt) shares -- so the wrap<->KEK-length, the

package/lib/sign-scheme.js

@@ -195,8 +195,11 @@ function _assertKeyMatchesScheme(key, imp, E) {
   if (imp.namedCurve && ka.namedCurve !== imp.namedCurve) throw E("bad-input", "the signer CryptoKey curve (" + ka.namedCurve + ") does not match the certificate curve (" + imp.namedCurve + ")");
 }
 function _normPkcs8(k, label, E) {
-  if (Buffer.isBuffer(k)) return k;
-  if (k instanceof Uint8Array) return Buffer.from(k);
+  // A caller's own Buffer is BORROWED, not copied -- the same rule _importKey states below. Every
+  // other form is copied, and neither copy is duplicated further, so a private key never gains a
+  // plaintext duplicate this module cannot account for.
+  if (Buffer.isBuffer(k)) return guard.bytes.view(k, E, "bad-input", label);
+  if (k instanceof Uint8Array) return guard.bytes.snapshot(k, E, "bad-input", label);
   if (typeof k === "string") { try { return pkcs8.pemDecode(k); } catch (e) { throw E("bad-input", label + " PEM could not be decoded", e); } }
   throw E("bad-input", label + " must be a PKCS#8 DER Buffer, Uint8Array, or PEM string");
 }
@@ -219,8 +222,8 @@ function _importKey(key, imp, E) {
   // only thing that reads it. A caller's own Buffer is passed through untouched: they hold a live
   // reference and will use it again, so clearing it would destroy their key.
   var der, owned = false;
-  if (Buffer.isBuffer(key)) der = key;
-  else if (key instanceof Uint8Array) { der = Buffer.from(key); owned = true; }
+  if (Buffer.isBuffer(key)) der = guard.bytes.view(key, E, "bad-input", "the signer private key");
+  else if (key instanceof Uint8Array) { der = guard.bytes.snapshot(key, E, "bad-input", "the signer private key"); owned = true; }
   else if (typeof key === "string") {
     try { der = pkcs8.pemDecode(key); }
     catch (e) { throw E("bad-input", "the signer PEM private key could not be decoded", e); }

package/lib/tsp-sign.js

@@ -134,7 +134,11 @@ function _signingCertV2(certDer, hashName) {
 // Documented `-> Promise`, so a fault leaves as a REJECTION (guard-async); the checks stay
 // synchronous because they read the caller's mutable imprint, TSA material and options.
 function sign(messageImprint, tsa, opts) {
-  return guard.async.deferred(function () { return _sign(messageImprint, tsa, opts); });
+  // Every caller-owned argument copied at entry and released when the call settles -- see the note
+  // on the same call in x509-sign. The imprint matters most: it is the digest the token attests to.
+  return guard.bytes.fixedCall(TspError, "tsp/bad-input", [
+    [messageImprint, "the messageImprint"], [tsa, "the TSA"], [opts, "pki.tsp.sign options"],
+  ], _sign);
 }
 
 function _sign(messageImprint, tsa, opts) {

package/lib/validator-tpm.js

@@ -225,7 +225,7 @@ function normalizeObjectAttributePolicy(policy, E, code) {
       // canonical round-trip -- the same three checks written here by hand, and now written
       // once. It also decodes, so the hex path cannot validate one string and decode another.
       allow = ap.allow.map(function (entry, i) {
-        if (Buffer.isBuffer(entry)) return entry;
+        if (Buffer.isBuffer(entry)) return guard.bytes.snapshot(entry, E, code, "opts.tpmPolicy.authPolicy.allow[" + i + "]");
         var label = "opts.tpmPolicy.authPolicy.allow[" + i + "]";
         if (typeof entry !== "string" || entry.length === 0) {
           throw new E(code, label + " must be a Buffer or an even-length hex string");

package/lib/webauthn-mds.js

@@ -233,7 +233,7 @@ function _asCert(v, label) {
 // with this toolkit: which metadata authority to trust is the operator's choice, and a verifier
 // that bundled its own would be deciding trust on the caller's behalf.
 function verifyMetadataBlob(blob, opts) {
-  return Promise.resolve().then(function () { return _verifyMetadataBlob(blob, opts); });
+  return guard.async.deferred(function () { return _verifyMetadataBlob(blob, opts); });
 }
 
 function _verifyMetadataBlob(blob, opts) {

package/lib/webauthn.js

@@ -531,7 +531,7 @@ var _FORMAT_SCOPED_BOOLEAN_OPTS = ["verifySafetyNetJws", "requireCtsProfileMatch
 // object cannot recurse without end.
 function _cloneParsed(v, depth) {
   if (depth > 64) throw _err("webauthn/bad-input", "opts.rootCertificates[] is nested too deeply to be a parsed certificate");
-  if (Buffer.isBuffer(v) || v instanceof Uint8Array) return Buffer.from(v);
+  if (Buffer.isBuffer(v) || v instanceof Uint8Array) return guard.bytes.snapshot(v, _err, "webauthn/bad-input", "a byte field of opts.rootCertificates[]");
   if (Array.isArray(v)) return v.map(function (x) { return _cloneParsed(x, depth + 1); });
   if (v instanceof Date) return new Date(v.getTime());
   if (v && typeof v === "object") {

package/lib/x509-sign.js

@@ -78,7 +78,7 @@ function _skiValueOf(caCert) {
   return null;
 }
 function _akiKeyId(val, ctx) {
-  if (Buffer.isBuffer(val)) return val;
+  if (Buffer.isBuffer(val)) return guard.bytes.snapshot(val, CertificateError, "x509/bad-input", "the authorityKeyIdentifier keyIdentifier");
   if (val === true) {
     if (ctx.issuerCert) { var ski = _skiValueOf(ctx.issuerCert); if (ski) return ski; }
     return _spkiKeyId(ctx.issuerSpki);
@@ -265,7 +265,16 @@ function _hasCriticalSan(extSpec) {
  *   pki.schema.x509.parse(root).subject.dn;   // "CN=Example Root CA"
  */
 function sign(spec, issuer, opts) {
-  return Promise.resolve().then(function () { return _sign(spec, issuer, opts); });
+  // EVERY caller-owned argument is copied before a field of any of them is read, and every copy is
+  // cleared when the call settles. The checks below run NOW, and the values they approved are
+  // encoded, signed and emitted several promise turns afterwards, while the caller still owns all
+  // three objects -- so a spec, an option or a signer read again after the first turn need not be
+  // the one that passed. Copying only some of them leaves the rest reachable; copying without the
+  // release leaves a duplicate of whatever secret was nested in them. guard.bytes.fixArguments is
+  // both halves, and is what every producing verb in the toolkit opens with.
+  return guard.bytes.fixedCall(CertificateError, "x509/bad-input", [
+    [spec, "the certificate spec"], [issuer, "the issuer"], [opts, "pki.x509.sign options"],
+  ], _sign);
 }
 
 function _sign(spec, issuer, opts) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.6",
+  "version": "0.5.7",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:f56149c0-58f9-40e1-a0f0-36a0dd2e4ee9",
+  "serialNumber": "urn:uuid:a8c014a2-3631-443a-b33d-f10501d992fb",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-16T03:23:32.715Z",
+    "timestamp": "2026-08-16T09:48:05.398Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.6",
+      "bom-ref": "@blamejs/pki@0.5.7",
       "type": "application",
       "name": "pki",
-      "version": "0.5.6",
+      "version": "0.5.7",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.6",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.7",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.6",
+      "ref": "@blamejs/pki@0.5.7",
       "dependsOn": []
     }
   ]