@blamejs/pki 0.6.14 → 0.6.16

package/lib/cms-decrypt.js

@@ -1,18 +1,8 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright (c) blamejs contributors
 "use strict";
-//
-// @internal -- the pki.cms.decrypt implementation. The operator-facing @module pki.cms + the
+// @internal
 // @primitive pki.cms.decrypt block live in cms-verify.js, which re-exports this function.
-//
-// CMS EnvelopedData / AuthEnvelopedData / EncryptedData decryption (RFC 5652/5083/5084/3560/5753/
-// 8418/9629/9936/3211/8018), the consuming side of pki.cms.encrypt. Three stages behind one
-// oracle-free choke point: (1) select the recipient (identifier matching, typed + distinct),
-// (2) acquire the CEK (per-arm unwrap/decap/derive), (3) open the content (AEAD verify / CBC
-// decrypt+unpad). Every secret-dependent failure in stages 2-3 collapses to the single uniform
-// verdict `cms/decrypt-failed` (Bleichenbacher / EFAIL / PWRI-check-byte oracle freedom); the
-// ktri v1.5 arm substitutes a random CEK on any decode fault (RFC 3218 implicit rejection) so its
-// failure emerges at stage 3 identically to every other bad-key path.
 
 var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
@@ -31,20 +21,15 @@ var subtle = webcrypto.webcrypto.subtle;
 var CmsError = frameworkError.CmsError;
 var WRAP_KEK_LENGTHS = schemaCms.WRAP_KEK_LENGTHS;
 var KEM_CT_LENGTHS = schemaCms.KEM_CT_LENGTHS;
-// The parser's own AEAD table: the single place that decides whether a content-encryption OID names
-// an authenticated encryption algorithm, so the container-vs-mode rule below cannot drift from the
-// parameter validation that accepted the message.
 var AEAD_ALGS = schemaCms.AEAD_ALGS;
 
 function O(n) { return oid.byName(n); }
 function _err(code, message, cause) { return new CmsError(code, message, cause); }
-// The single uniform secret-dependent-failure verdict. No cause chaining that distinguishes the site.
 function _fail() { return new CmsError("cms/decrypt-failed", "the CMS content could not be decrypted (uniform by design -- padding / integrity / key-unwrap failures are indistinguishable to defeat oracles)"); }
 
-var CONTENT_KEYBITS = pbes2.CONTENT_KEYBITS; // content-encryption OID -> key bits (the shared PBES2 table)
-var CONTENT_MODE = pbes2.CONTENT_MODE;       // the same rows' cipher mode ("cbc" | "gcm")
+var CONTENT_KEYBITS = pbes2.CONTENT_KEYBITS;
+var CONTENT_MODE = pbes2.CONTENT_MODE;
 
-// ---- entry -----------------------------------------------------------------
 async function decrypt(input, keyMaterial, opts) {
   opts = opts || {};
   if (keyMaterial == null || typeof keyMaterial !== "object") throw _err("cms/bad-input", "decrypt requires a key-material object");
@@ -56,24 +41,7 @@ async function decrypt(input, keyMaterial, opts) {
   return decryptEnvelopedData(parsed, keyMaterial, opts, ct);
 }
 
-// The post-parse decrypt of an already-parsed EnvelopedData / AuthEnvelopedData: select a recipient, acquire
-// the CEK, open the content, oracle-free (every secret-dependent failure collapses to cms/decrypt-failed).
-// @internal -- not re-exported on pki.cms. Taking the parsed structure in place of DER is a deliberate seam
-// for a sibling composer that already holds a strictly-walked content node it must not re-serialize/re-parse:
-// pki.pkcs12.open drives this off the pkcs12 parser's walkEnvelopedData result so an RFC 7292 privacy safe
-// whose EnvelopedData is BER-encoded (indefinite lengths, some NSS output the pkcs12 parser accepts)
-// opens without hitting the public decrypt()'s strict-DER re-parse. Callers pass a trusted parse result only.
-// `authenticated` answers a question about the content and the key that opened it. It
-// cannot answer the question an operator hears in the word -- who sent this -- and no
-// recipient type this toolkit supports authenticates an individual originator: a ktri or
-// ephemeral-static kari message is minted by anyone holding the recipient's PUBLIC key,
-// and a password or KEK message is minted by any co-recipient sharing the secret. The
-// origin question therefore gets its own field instead of being left to the reader's
-// inference. originatorInfo rides outside the AEAD's authenticated data, so it is a hint
-// the sender chose, never evidence, and it is surfaced saying so rather than dropped.
-// Every verdict this module returns carries all three, including the unauthenticated
-// ciphers: a field present on some returns and absent on others is read as a capability
-// difference, and the caller cannot tell "no origin" from "this path forgot to say".
+// @internal
 function _originFields(res, authenticatedBy, originatorInfo) {
   res.authenticatedBy = authenticatedBy || null;
   res.originAuthenticated = false;
@@ -86,31 +54,16 @@ async function decryptEnvelopedData(parsed, keyMaterial, opts, contentTypeName)
   if (keyMaterial == null || typeof keyMaterial !== "object") throw _err("cms/bad-input", "decrypt requires a key-material object");
   var ct = contentTypeName || "envelopedData";
   var recips = parsed.recipientInfos || [];
-  var candidates = _selectCandidates(recips, keyMaterial, opts);   // stage 1 (typed, distinct)
+  var candidates = _selectCandidates(recips, keyMaterial, opts);
   var eci = parsed.encryptedContentInfo;
-  // The content cipher's mode is a structural property of the message, readable from the algorithm
-  // identifier with no key material at all, so it is decided here, before any recipient is tried.
-  // Deciding it per candidate would make a structural verdict depend on key acquisition succeeding
-  // first: several password or KEK recipients can match the same key material, so the distinct
-  // cms/unsupported-algorithm would be swallowed by the ambiguous-candidate loop below and the caller
-  // told their key was wrong, after repeating a PBKDF2 derivation for every candidate to learn it.
   _assertContentCipherMode(eci, ct);
-  // Password- and KEK-based recipients carry no rid, so several may match the same key material; try
-  // each until one yields a CEK that opens the content. A single candidate propagates its exact
-  // verdict; multiple ambiguous candidates collapse to the uniform verdict so nothing is leaked.
   for (var ci = 0; ci < candidates.length; ci++) {
     try {
-      _assertSupported(candidates[ci].ri, keyMaterial);                    // distinct-code reject (MQV / non-KEM ori)
-      var cek = await _acquireCek(candidates[ci].ri, keyMaterial, opts);   // stage 2 (uniform)
-      // The recovered CEK is cleared only after the content is open: it is the key the next stage
-      // needs, so an earlier wipe would break decryption instead of protecting it. The returned object
-      // is built before the `finally` runs and holds the plaintext, not the key.
+      _assertSupported(candidates[ci].ri, keyMaterial);
+      var cek = await _acquireCek(candidates[ci].ri, keyMaterial, opts);
       try {
-        // Lazy CBC streaming (the memory win) is safe only with one candidate; several ambiguous
-        // candidates need the content decrypt to run eagerly so a wrong recipient is rejected and the
-        // next tried, exactly as the buffered path disambiguates.
         var streamMode = opts.stream === true ? (candidates.length > 1 ? "eager" : "lazy") : null;
-        var content = await _openContent(parsed, eci, cek, ct, streamMode);   // stage 3 (uniform)
+        var content = await _openContent(parsed, eci, cek, ct, streamMode);
         return _originFields({
           content: content,
           contentType: eci.contentType, contentTypeName: oid.name(eci.contentType) || eci.contentType,
@@ -122,15 +75,13 @@ async function decryptEnvelopedData(parsed, keyMaterial, opts, contentTypeName)
         guard.secret.zeroize(cek, CmsError, "cms/bad-input", "the recovered content-encryption key");
       }
     } catch (e) {
-      if (candidates.length === 1) throw e;   // one candidate: preserve its exact (distinct or uniform) verdict
+      if (candidates.length === 1) throw e;
     }
   }
-  throw _fail();   // every ambiguous candidate failed -> uniform, leaking nothing about which
+  throw _fail();
 }
 
 function _parse(input) {
-  // Always drive the strict parser over caller-supplied bytes: an arbitrary object that merely
-  // carries a contentTypeName is not a trusted parse result and must not bypass DER validation.
   return schemaCms.parse(_toDer(input));
 }
 function _toDer(input) {
@@ -139,9 +90,6 @@ function _toDer(input) {
   throw _err("cms/bad-input", "input must be a DER Buffer, Uint8Array, or PEM string");
 }
 
-// ---- stage 1: recipient selection (not secret-dependent) -------------------
-// Returns every recipient the key material may target. An explicit recipientIndex or an rid match
-// yields exactly one; unlabeled pwri / kekri recipients yield all matches for the caller to try.
 function _selectCandidates(recips, km, opts) {
   if (!recips.length) throw _err("cms/no-matching-recipient", "the message carries no RecipientInfos");
   if (opts.recipientIndex != null) {
@@ -155,7 +103,7 @@ function _selectCandidates(recips, km, opts) {
   for (var k = 0; k < recips.length; k++) {
     var r = recips[k];
     if (want === "asym" && (r.type === "ktri" || r.type === "kari" || r.type === "ori")) {
-      if (cert && _ridMatches(r, cert)) out.push({ ri: r, index: k });   // a cert may match several recipients
+      if (cert && _ridMatches(r, cert)) out.push({ ri: r, index: k });
     } else if (want === "pwri" && r.type === "pwri") { out.push({ ri: r, index: k }); }
     else if (want === "kekri" && r.type === "kekri") {
       if (km.kekId == null || _kekIdMatches(r, km.kekId)) out.push({ ri: r, index: k });
@@ -171,7 +119,7 @@ function _riKindForKey(km) {
   throw _err("cms/bad-input", "key material needs { key, cert }, { password }, { kek }, or { cek }");
 }
 function _assertSupported(ri, km) {
-  if (ri.type === "kari" && ri.keyEncryptionAlgorithm && intrinsic.stringIndexOf(intrinsic.toLowerCase(ri.keyEncryptionAlgorithm.name || ""), "mqv") !== -1) throw _err("cms/unsupported-algorithm", "ECMQV kari is not supported");   // /mqv/i (ASCII name)
+  if (ri.type === "kari" && ri.keyEncryptionAlgorithm && intrinsic.stringIndexOf(intrinsic.toLowerCase(ri.keyEncryptionAlgorithm.name || ""), "mqv") !== -1) throw _err("cms/unsupported-algorithm", "ECMQV kari is not supported");
   if (ri.type === "ori") {
     if (ri.oriType !== O("kem")) throw _err("cms/unsupported-recipient-type", "unsupported OtherRecipientInfo type " + ri.oriType);
     if (ri.kemri && ri.kemri.kem && ri.kemri.kem.oid === O("id-kem-rsa")) throw _err("cms/unsupported-algorithm", "RSA-KEM is not supported");
@@ -180,8 +128,6 @@ function _assertSupported(ri, km) {
 }
 
 function _ridMatches(ri, cert) {
-  // A kari carries a RecipientEncryptedKey per agreeing recipient (RFC 5652 sec. 6.2.2); this
-  // recipient may be at ANY position, so match against every rek, not just element 0.
   if (ri.type === "kari") return !!_kariRekFor(ri, cert);
   var rid = ri.rid || (ri.kemri && ri.kemri.rid);
   if (!rid) return false;
@@ -198,7 +144,7 @@ function _ridEq(rid, cert) {
     catch (_e) { return false; }
   }
   if (rid.subjectKeyIdentifier) { var ski = _skiOf(cert); return !!ski && Buffer.compare(ski, rid.subjectKeyIdentifier) === 0; }
-  return false; // coverage residual: unreachable -- a parsed rid is always issuerAndSerialNumber or a SKI form
+  return false;
 }
 function _skiOf(cert) {
   var exts = cert.extensions || [];
@@ -213,11 +159,8 @@ function _kekIdMatches(ri, kekId) {
   return Buffer.compare(id, guard.bytes.view(kekId, CmsError, "cms/bad-input", "kekId")) === 0;
 }
 
-// Codes that name a structural / resource / config fault and MUST NOT be masked by the uniform
-// secret-dependent verdict (they leak nothing about the key or plaintext).
 var _passThrough = { "cms/unsupported-algorithm": 1, "cms/unsupported-recipient-type": 1, "cms/bad-input": 1, "cms/iteration-limit": 1, "cms/missing-key-derivation": 1, "cms/no-encrypted-content": 1 };
 
-// ---- stage 2: acquire the CEK (uniform failure) ----------------------------
 async function _acquireCek(ri, km, opts) {
   try {
     if (ri.type === "ktri") return await _ktriCek(ri, km);
@@ -226,21 +169,15 @@ async function _acquireCek(ri, km, opts) {
     if (ri.type === "pwri") return await _pwriCek(ri, km, opts);
     if (ri.type === "ori") return await _kemriCek(ri, km);
   } catch (e) {
-    // Structural / resource / config faults keep their own code; only secret-dependent failures
-    // (a bad unwrap, a wrong key, a padding fault) collapse to the uniform verdict.
     if (e instanceof CmsError && _passThrough[e.code]) throw e;
     throw _fail();
   }
-  // Coverage residual: unreachable, since _selectCandidates only returns one of the five handled types.
   throw _err("cms/unsupported-recipient-type", "unsupported recipient type " + ri.type);
 }
 
-// ktri: OAEP or PKCS#1 v1.5 (v1.5 = decrypt-only + RFC 3218 implicit rejection).
 async function _ktriCek(ri, km) {
   var kea = ri.keyEncryptionAlgorithm;
   var k = _normKeyDer(km.key);
-  // The wipe is in a `finally` so it happens on the reject path too: a message crafted to fail the
-  // unwrap must not be a way to leave the key copy in memory.
   try {
     if (kea.oid === O("rsaesOaep")) {
       var hash = _oaepHashFromParams(kea.parameters);
@@ -248,32 +185,20 @@ async function _ktriCek(ri, km) {
       return Buffer.from(await subtle.decrypt({ name: "RSA-OAEP" }, pub, ri.encryptedKey));
     }
     if (kea.oid === O("rsaEncryption")) {
-      // RFC 3218 sec. 2.3.2 implicit rejection: NEVER surface a v1.5 failure here. Any decode fault
-      // yields a fresh random CEK of the content-alg length; the mismatch emerges at stage 3.
       var keyObj = nodeCrypto.createPrivateKey({ key: k.der, format: "der", type: "pkcs8" });
       try { return nodeCrypto.privateDecrypt({ key: keyObj, padding: nodeCrypto.constants.RSA_PKCS1_PADDING }, ri.encryptedKey); }
       catch (_e) {
-        return null; // signal: use a random CEK (length decided at open time)
+        return null;
       }
     }
-    // Coverage residual: reachable only from a hostile message (our encrypt emits only OAEP; OpenSSL
-    // emits OAEP or rsaEncryption): a fail-closed reject the fuzz harness exercises.
     throw _err("cms/unsupported-algorithm", "unsupported ktri keyEncryptionAlgorithm " + kea.oid);
   } finally {
     _releaseKeyDer(k);
   }
 }
 
-// kari: reconstruct Z from the originatorKey + recipient private key, KDF -> KEK, AES-KW unwrap.
 async function _kariCek(ri, km) {
-  // The copy is taken and the protected region opens IMMEDIATELY. Everything between them would
-  // otherwise be an unprotected window, and it is not a narrow one: reading the wrap algorithm, the
-  // originator's key, the recipient's certificate and the matching RecipientEncryptedKey all parse
-  // attacker-supplied structure and all throw on malformed input. A message crafted to fail any one
-  // of them would be a way to leave the key copy in the heap, the exact outcome the wipe is for.
   var k = _normKeyDer(km.key);
-  // The agreement secret and the KEK derived from it are both allocated here; one `finally` clears
-  // whichever branch produced them, including when the unwrap below throws on a tampered key.
   var kek, z, mz;
   try {
     var keyDer = k.der;
@@ -281,8 +206,6 @@ async function _kariCek(ri, km) {
     var wrapAlg = _kariWrap(kea);
     var scheme = kea.oid;
     var origSpki = _originatorSpki(ri.originator);
-    // Unwrap this recipient's own RecipientEncryptedKey (matched by rid), not element 0; a kari may list
-    // several recipients under one ephemeral key.
     var rek = (km.cert != null && _kariRekFor(ri, x509.parse(_normCertDer(km.cert)))) || ri.recipientEncryptedKeys[0];
     var kekBytes = WRAP_KEK_LENGTHS[wrapAlg.oid];
     if (!kekBytes) throw _err("cms/unsupported-algorithm", "unsupported kari key-wrap");
@@ -294,13 +217,8 @@ async function _kariCek(ri, km) {
       mz = Buffer.from(await subtle.deriveBits({ name: mont.name, public: origPub }, recipPriv, null));
       if (mz.every(function (x) { return x === 0; })) throw _fail();
       var mzKey = await subtle.importKey("raw", mz, { name: "HKDF" }, false, ["deriveBits"]);
-      // RFC 8418 sec. 2.2: a present ukm serves as both the HKDF salt and the ECC-CMS-SharedInfo
-      // entityUInfo, so mirror the producer and both sides derive the same KEK as a conformant peer.
       kek = Buffer.from(await subtle.deriveBits({ name: "HKDF", hash: mont.hkdf, salt: ukm || Buffer.alloc(0), info: _eccSharedInfo(wrapAlg.name, ukm, kekBytes) }, mzKey, kekBytes * 8));
     } else {
-      // RFC 5753 sec. 7.1 permits the originator EC key to omit its curve parameters, inheriting the
-      // curve from the recipient's certificate; resolve the curve from the recipient (authoritative)
-      // and rebuild the originator SPKI with explicit parameters so importKey can consume it.
       var origAlg = asn1.decode(origSpki).children[0];
       var origHasParams = origAlg.children.length > 1;
       var curveOid = (km.cert != null && _ecCurveFromCert(km.cert)) || (origHasParams ? asn1.read.oid(origAlg.children[1]) : null);
@@ -320,13 +238,11 @@ async function _kariCek(ri, km) {
   }
 }
 
-// kekri: AES-KW unwrap under the caller-supplied KEK.
 async function _kekriCek(ri, km) {
   var kek = guard.bytes.view(km.kek, CmsError, "cms/bad-input", "kek");
   return await _aesKwUnwrap(kek, ri.encryptedKey);
 }
 
-// pwri: PBKDF2 -> KEK, RFC 3211 double-CBC unwrap.
 async function _pwriCek(ri, km, opts) {
   var kdf = ri.keyDerivationAlgorithm;
   if (!kdf) throw _err("cms/missing-key-derivation", "the pwri recipient has no keyDerivationAlgorithm (externally-supplied KEK is not supported)");
@@ -334,19 +250,11 @@ async function _pwriCek(ri, km, opts) {
   var pb = pbes2.parsePbkdf2Params(kdf.parameters, opts, _err, "cms");
   var kea = ri.keyEncryptionAlgorithm;
   if (kea.oid !== O("id-alg-PWRI-KEK")) throw _err("cms/unsupported-algorithm", "unsupported pwri key-encryption " + kea.oid);
-  var inner = asn1.decode(kea.parameters);                 // inner AES-CBC AlgorithmIdentifier
+  var inner = asn1.decode(kea.parameters);
   var innerOid = asn1.read.oid(inner.children[0]);
   var innerBits = CONTENT_KEYBITS[innerOid];
-  // The mode comes from the OID-keyed table, not from the OID's display NAME: pki.oid.register() can
-  // override a built-in name, and a name-matched mode check would then admit a non-CBC inner cipher.
   if (!innerBits || CONTENT_MODE[innerOid] !== "cbc") throw _err("cms/unsupported-algorithm", "unsupported pwri inner cipher");
   var iv = asn1.read.octetString(inner.children[1]);
-  // The derived KEK is ours and is cleared once the unwrap has consumed it, on the failing path
-  // too, which is the one an attacker induces by tampering with the wrapped key. The caller's
-  // password is not touched: passwordBytes returns a caller-supplied Buffer as-is.
-  // A string / Uint8Array password is encoded into a buffer this toolkit allocated, a credential
-  // copy, so it is cleared once the derivation has consumed it. A caller-supplied Buffer is
-  // borrowed and left intact.
   var pw = pbes2.passwordBytesOwned(km.password, _err, "cms");
   var kek;
   try { kek = nodeCrypto.pbkdf2Sync(pw.bytes, pb.salt, pb.iterations, innerBits / 8, pb.prfNode); }
@@ -358,34 +266,23 @@ async function _pwriCek(ri, km, opts) {
   }
 }
 
-// kemri (ML-KEM ori): decapsulate -> ss, HKDF(CMSORIforKEMOtherInfo) -> KEK, AES-KW unwrap.
 async function _kemriCek(ri, km) {
   var k = ri.kemri;
   var wcName = _mlkemName(k.kem.oid);
   if (!wcName) throw _err("cms/unsupported-algorithm", "unsupported KEM " + k.kem.oid);
-  // Honor the declared key-derivation function: we implement HKDF-SHA256 (RFC 9629), so a message
-  // naming any other KDF is rejected, never silently derived with the wrong one.
   if (k.kdf.oid !== O("hkdfWithSha256")) throw _err("cms/unsupported-algorithm", "unsupported KEM key-derivation " + k.kdf.oid);
   var wantCt = KEM_CT_LENGTHS[k.kem.oid];
   var kemct = k.kemct;
-  // Coverage residual (both _fail re-checks): unreachable via a parsed message, because the strict parser
-  // already rejects a wrong kemct length (cms/bad-kem-ciphertext) and a kekLength != wrap size
-  // (cms/kek-length-mismatch). These are defense-in-depth on the consumer path (M32 / M29).
-  if (wantCt && kemct.length !== wantCt) throw _fail();          // M32: exact ct length before decap
+  if (wantCt && kemct.length !== wantCt) throw _fail();
   var kekBytes = Number(k.kekLength);
   var wrapAlg = k.wrap;
-  if (WRAP_KEK_LENGTHS[wrapAlg.oid] !== kekBytes) throw _fail(); // M29 re-check on the consumer path
-  // The decapsulation key copy is released as soon as the engine has imported it: the import is
-  // the only thing that reads it, so its lifetime does not need to span the decapsulation below.
+  if (WRAP_KEK_LENGTHS[wrapAlg.oid] !== kekBytes) throw _fail();
   var keyCopy = _normKeyDer(km.key);
   var priv;
   try { priv = await subtle.importKey("pkcs8", keyCopy.der, { name: wcName }, false, ["decapsulateBits"]); }
   finally { _releaseKeyDer(keyCopy); }
   var ss = null, kek = null, ssAb = null, kekAb = null;
   try {
-    // The engine hands back an ArrayBuffer it allocated, and the Buffer below is a copy of it. Both
-    // hold the secret, so both are wiped: clearing only the copy this function made would leave the
-    // engine's return value readable, which is the same omission one level up.
     ssAb = await subtle.decapsulateBits({ name: wcName }, priv, kemct);
     ss = Buffer.from(ssAb);
     var ssKey = await subtle.importKey("raw", ss, { name: "HKDF" }, false, ["deriveBits"]);
@@ -393,32 +290,11 @@ async function _kemriCek(ri, km) {
     kek = Buffer.from(kekAb);
     return await _aesKwUnwrap(kek, k.encryptedKey);
   } finally {
-    // NIST SP 800-227 RS5 / sec. 4.2 and RFC 9629 sec. 7: the shared secret and the KEK it derives
-    // are destroyed as soon as they stop being needed. In a `finally`, so an unwrap that fails
-    // (the common case under a wrong key or a tampered encryptedKey) leaves nothing behind either;
-    // a wipe on the success path alone would keep the secret exactly when an attacker made it fail.
-    // Only buffers allocated here are wiped: km.key, the message bytes and the returned CEK are the
-    // caller's or the caller's to consume.
-    // A Uint8Array view aliases the ArrayBuffer's own bytes, so wiping the view wipes the buffer
-    // the engine returned -- no further copy is made in order to destroy one.
     guard.secret.zeroizeAll([ss, kek, ssAb ? new Uint8Array(ssAb) : null, kekAb ? new Uint8Array(kekAb) : null],
       CmsError, "cms/bad-input", "the KEM shared secret");
   }
 }
 
-// The declared cipher MODE must match the container's authentication model: an AEAD cipher belongs in
-// AuthEnvelopedData and a plain CBC cipher in EnvelopedData (RFC 5083 sec. 2). Key length alone does
-// not separate them, so without this an EnvelopedData naming AES-GCM was opened as unauthenticated CBC
-// while the result still reported the AEAD algorithm, telling the caller the content was authenticated
-// when nothing had authenticated it. The mirror case dereferenced AEAD parameters the parser leaves
-// null for a non-AEAD algorithm, faulting instead of failing closed.
-//
-// The line drawn here is AEAD-vs-not, which is the line RFC 5083 draws. GCM-vs-CBC is a narrower
-// line this toolkit draws, because AES-GCM is the only AEAD it implements, and stating the narrower
-// one as though the RFC required it sends an operator to argue with a specification that says the
-// opposite: RFC 5084 sec. 3.1 defines AES-CCM for this content type. So an AEAD reaching the right
-// container passes here even when decryption will later decline it, and it is _openContent that says
-// why, by name. An unresolvable OID is left to _openContent too, as the unsupported algorithm it is.
 function _assertContentCipherMode(eci, ct) {
   var oidStr = eci.contentEncryptionAlgorithm.oid;
   var isAead = intrinsic.hasOwn(AEAD_ALGS, oidStr);
@@ -431,51 +307,26 @@ function _assertContentCipherMode(eci, ct) {
   throw _err("cms/unsupported-algorithm", "contentEncryptionAlgorithm " + oidStr + " is an authenticated encryption algorithm, which belongs in an authEnvelopedData rather than a " + ct + " (RFC 5083 sec. 2)");
 }
 
-// ---- stage 3: open the content (uniform failure) ---------------------------
 async function _openContent(parsed, eci, cek, ct, streamMode) {
   var alg = eci.contentEncryptionAlgorithm;
   var keyBits = intrinsic.hasOwn(CONTENT_KEYBITS, alg.oid) ? CONTENT_KEYBITS[alg.oid] : 0;
   if (!keyBits) {
-    // AES-CCM parses completely here -- registered OIDs, the sec. 3.1 nonce bound, the seven legal
-    // ICV lengths -- and is then declined, because AES-GCM is the only AEAD this toolkit implements
-    // for content encryption. Saying only "unsupported <oid>" is what an operator also sees for an
-    // OID nothing in the toolkit recognizes, and the two call for different things: one is a
-    // capability gap to route around, the other is a malformed or exotic message.
     if (intrinsic.hasOwn(AEAD_ALGS, alg.oid) && AEAD_ALGS[alg.oid] === "ccm") {
       throw _err("cms/unsupported-algorithm", "contentEncryptionAlgorithm " + alg.oid + " is AES-CCM. RFC 5084 sec. 3.1 permits it for this content type; this toolkit implements AES-GCM only for content encryption");
     }
     throw _err("cms/unsupported-algorithm", "unsupported contentEncryptionAlgorithm " + alg.oid);
   }
   if (eci.encryptedContent == null) throw _err("cms/no-encrypted-content", "the message has no encryptedContent (detached; supply it out of band)");
-  // A null CEK (v1.5 implicit rejection) or a wrong-length CEK -> a fresh random key of the right
-  // length, so the failure surfaces here as the uniform verdict, never earlier.
-  //
-  // The substitute is this function's own allocation, so this function clears it: reassigning the
-  // parameter does not change the caller's variable, so the caller's `finally` would wipe the
-  // original null / wrong-length value and leave the substitute behind. It is held separately
-  // and `cek` is left alone here, because on the normal path `cek` is the caller's recovered key
-  // and is still in use after this returns.
   var substitute = null;
   if (cek == null || cek.length !== keyBits / 8) { substitute = nodeCrypto.randomBytes(keyBits / 8); cek = substitute; }
   try {
     if (ct === "authEnvelopedData") {
       var aad = parsed.authAttrsBytes != null ? _explicitSetOf(parsed.authAttrsBytes) : Buffer.alloc(0);
-      // GCM authenticates before it yields: the tag is verified here, so a forged message throws
-      // cms/decrypt-failed now and the streamed form never yields a chunk of unverified plaintext
-      // (RFC 5083 sec. 1). The stream is therefore a chunker over the already-verified plaintext -- no
-      // memory win for GCM, which is the correct trade for the integrity guarantee.
       var pt = _gcmOpen(cek, parsed.aead.nonce, eci.encryptedContent, parsed.mac, aad, keyBits, parsed.aead.icvLen);
       return streamMode ? _bufferChunks(pt) : pt;
     }
     var iv = asn1.read.octetString(asn1.decode(alg.parameters));
     if (iv.length !== 16) throw _fail();
-    // A lazy CBC stream defers the padding check to iteration. The ambiguous-candidate loop cannot use a
-    // deferred check to reject a wrong recipient and try the next, so lazy streaming is used ONLY when a
-    // single candidate remains (a wrong key then has nothing to fall back to, so its uniform failure at
-    // iteration is the right verdict). "lazy" is the real memory win: the whole plaintext is never held,
-    // and the caller opted into receiving chunks before the final() padding check. With several ambiguous
-    // candidates the decrypt runs eagerly HERE -- it IS the disambiguator -- and the validated plaintext
-    // is then chunked, so the fallback the buffered path relies on is preserved.
     if (streamMode === "lazy") return _cbcStream(cek, iv, eci.encryptedContent, keyBits);
     if (streamMode === "eager") return _bufferChunks(pbes2.cbcDecrypt(cek, iv, eci.encryptedContent, keyBits, CmsError, "cms/decrypt-failed"));
     return pbes2.cbcDecrypt(cek, iv, eci.encryptedContent, keyBits, CmsError, "cms/decrypt-failed");
@@ -487,22 +338,13 @@ async function _openContent(parsed, eci, cek, ct, streamMode) {
   }
 }
 function _gcmOpen(cek, nonce, ct, tag, aad, keyBits, icvLen) {
-  // Coverage residual: unreachable via a parsed message, since the strict parser rejects any
-  // AuthEnvelopedData whose mac length != aes-ICVlen (cms/mac-length-mismatch) before we get here.
   if (!tag || tag.length !== icvLen) throw _fail();
   var d = nodeCrypto.createDecipheriv("aes-" + keyBits + "-gcm", cek, nonce, { authTagLength: icvLen });
   d.setAuthTag(tag);
   if (aad && aad.length) d.setAAD(aad);
-  // final() throws on a tag mismatch, and update() has already produced the whole plaintext by
-  // then. RFC 5083 sec. 1 requires a receiver whose integrity check fails to DESTROY the plaintext,
-  // not merely withhold it, so the intermediate is cleared on both exits.
   return guard.secret.cipherFinish(d, ct, CmsError, "cms/decrypt-failed", "the recovered content");
 }
 
-// ---- streaming content (opts.stream): `content` becomes an async iterable of plaintext chunks -------
-// The already-verified GCM plaintext, yielded a chunk at a time so the streamed and buffered forms have
-// the same `content` shape. GCM holds the whole plaintext (it was verified before this ran), so this is
-// a chunker, not a memory win -- the win is CBC's, below.
 async function* _bufferChunks(buf) {
   var chunk = C.BYTES.kib(64);
   for (var off = 0; off < buf.length; off += chunk) {
@@ -510,11 +352,6 @@ async function* _bufferChunks(buf) {
     yield intrinsic.subarray(buf, off, end < buf.length ? end : buf.length);
   }
 }
-// The CBC streaming content. The engine decipher is created EAGERLY (subtle.decryptStream copies the key
-// at creation), so the caller's post-open `cek` zeroize does not disturb it; the drive is lazy. A wrong
-// key or bad padding surfaces at the engine's final() as an untyped throw, which this collapses to the
-// uniform cms/decrypt-failed -- the same verdict the buffered path returns, so the stream never leaks a
-// distinct failure reason. `await`, not `.then`: the drive dispatches through no caller-replaceable method.
 function _cbcStream(key, iv, ct, keyBits) {
   return _translateCbcStream(subtle.decryptStream({ algNode: "aes-" + keyBits + "-cbc", key: key, iv: iv }, ct));
 }
@@ -523,7 +360,6 @@ async function* _translateCbcStream(engineIter) {
   catch (_e) { throw _fail(); }
 }
 
-// ---- EncryptedData (sec. 8) ------------------------------------------------
 async function _decryptEncryptedData(parsed, km, opts) {
   var eci = parsed.encryptedContentInfo;
   var alg = eci.contentEncryptionAlgorithm;
@@ -540,9 +376,6 @@ async function _decryptEncryptedData(parsed, km, opts) {
 }
 async function _decryptPbes2(parsed, eci, km, opts) {
   if (km.password == null) throw _err("cms/bad-input", "this EncryptedData needs a { password }");
-  // The PBES2 parameters are attacker-controlled structure the strict parser surfaces raw (PBES2 is
-  // not an AEAD it validates): parse them behind a structural guard so a malformed shape is a typed
-  // cms/bad-input, never a raw dereference fault (the PBES2 structure is public, not a decrypt oracle).
   var kdf, encOid, iv, pb;
   try {
     var params = pbes2.seqChildren(eci.contentEncryptionAlgorithm.parameters, 2, "PBES2 parameters", _err, "cms");
@@ -558,11 +391,6 @@ async function _decryptPbes2(parsed, eci, km, opts) {
   }
   var keyBits = CONTENT_KEYBITS[encOid];
   if (!keyBits) throw _err("cms/unsupported-algorithm", "unsupported PBES2 content cipher " + encOid);
-  // The password-derived content key is ours; the caller's password buffer is not (passwordBytes
-  // passes a supplied Buffer straight through) and is left intact.
-  // A string / Uint8Array password is encoded into a buffer this toolkit allocated, a credential
-  // copy, so it is cleared once the derivation has consumed it. A caller-supplied Buffer is
-  // borrowed and left intact.
   var pwE = pbes2.passwordBytesOwned(km.password, _err, "cms");
   var key;
   try { key = nodeCrypto.pbkdf2Sync(pwE.bytes, pb.salt, pb.iterations, keyBits / 8, pb.prfNode); }
@@ -572,23 +400,11 @@ async function _decryptPbes2(parsed, eci, km, opts) {
   finally { guard.secret.zeroize(key, CmsError, "cms/bad-input", "the password-derived content-encryption key"); }
 }
 
-// ---- shared helpers (mirror cms-encrypt's builders) ------------------------
 async function _aesKwUnwrap(kek, wrapped) {
   var kekKey = await subtle.importKey("raw", kek, { name: "AES-KW" }, false, ["unwrapKey"]);
-  // Import the unwrapped key as HMAC, not AES-CBC: this function exports to raw bytes, so the CryptoKey
-  // type is transient and the exported bytes are identical for an AES CEK, while HMAC accepts any wrap
-  // length, so an AuthenticatedData MAC key that is not 16/24/32 octets (e.g. a 64-octet HMAC-SHA-512
-  // key from another implementation) is recovered instead of rejected before the MAC is even checked.
   var raw = await subtle.unwrapKey("raw", wrapped, kekKey, { name: "AES-KW" }, { name: "HMAC", hash: "SHA-256" }, true, ["sign"]);
-  // exportKey allocates an ArrayBuffer holding the unwrapped key; the Buffer below is a copy of it,
-  // and the original would otherwise stay readable with nothing referencing it. That is a
-  // controllable allocation, not one of the runtime-internal copies the best-effort caveat covers.
-  // Only the intermediate is wiped: the returned Buffer is the key the caller must use to open
-  // the content, so wiping it here would destroy the result instead of protecting it.
   var rawAb = await subtle.exportKey("raw", raw);
   try {
-    // An explicit copy, not Buffer.from(arrayBuffer): that form returns a view sharing the
-    // ArrayBuffer's memory, so wiping the intermediate below would zero the key being returned.
     var view = new Uint8Array(rawAb);
     var out = Buffer.alloc(view.length);
     out.set(view);
@@ -609,20 +425,10 @@ function _kemOtherInfo(wrapName, kekBytes, ukm) {
   if (ukm) kids.push(b.explicit(0, b.octetString(ukm)));
   return b.sequence(kids);
 }
-// RFC 3211 double-CBC unwrap (M26): decrypt pass 2 (IV = last block of pass 1), then pass 1
-// (IV = first block), validate the count + complement check bytes, with uniform failure on mismatch.
 function _pwriUnwrap(kek, wrapped, iv, keyBits) {
   var blk = 16, alg = "aes-" + keyBits + "-cbc";
   if (wrapped.length < 2 * blk || wrapped.length % blk !== 0) throw _fail();
   var n = wrapped.length;
-  // pass2 = CBC(kek, iv2 = pass1[last block], pass1). Recover pass1's last block by decrypting the
-  // last ciphertext block (ECB) and XORing the previous ciphertext block, a standard CBC last-
-  // block decrypt that needs no IV, then CBC-decrypt pass2 under that recovered iv2 to get pass1.
-  // Every intermediate below is derived from the KEK and reveals key material, so all three are
-  // named before the try and cleared in one finally. pass1 and body hold the wrapped key in the
-  // clear; lastDec is pass1's final block, recovered ahead of it. The two validation rejects are
-  // inside the same scope because they are the paths an attacker induces by tampering with the
-  // wrapped key, and they are where an unswept intermediate would otherwise be abandoned.
   var lastDec = null, pass1 = null, body = null;
   try {
     var ecb = nodeCrypto.createDecipheriv("aes-" + keyBits + "-ecb", kek, Buffer.alloc(0)); ecb.setAutoPadding(false);
@@ -637,34 +443,27 @@ function _pwriUnwrap(kek, wrapped, iv, keyBits) {
     if (count < 1 || count + 4 > body.length) throw _fail();
     var cek = body.subarray(4, 4 + count);
     var bad = 0;
-    for (var j = 0; j < 3; j++) bad |= (body[1 + j] ^ 0xff) ^ cek[j]; // complement check bytes
+    for (var j = 0; j < 3; j++) bad |= (body[1 + j] ^ 0xff) ^ cek[j];
     if (bad !== 0) throw _fail();
-    return Buffer.from(cek);   // the caller's copy, independent of the block cleared below
+    return Buffer.from(cek);
   } finally {
     guard.secret.zeroizeAll([body, pass1, lastDec], CmsError, "cms/bad-input", "the PWRI plaintext block");
   }
 }
-// Coverage residual (the unsupported-algorithm throw arm of each lookup below: _hashW3c,
-// _x963Hash, and _originatorSpki that follow): reachable only from a fully well-formed recipient that
-// names an inner algorithm we do not implement (a non-registry OAEP hash / kari scheme / originator
-// form). The producer never emits one; the fuzz harness (fuzz/cms-decrypt.fuzz.js) drives these arms
-// behaviorally under the PkiError-only contract.
 
 function _oaepHashFromParams(paramsBytes) {
-  if (paramsBytes == null) return "SHA-1"; // absent = the RFC 4055 defaults (accept floor)
+  if (paramsBytes == null) return "SHA-1";
   var node = asn1.decode(paramsBytes);
   var hashName = "SHA-1", mgfHash = null, label = null;
   (node.children || []).forEach(function (ch) {
     if (ch.tagClass !== "context") return;
-    if (ch.tagNumber === 0) { hashName = _hashW3c(asn1.read.oid(ch.children[0].children[0])); }               // hashAlgorithm [0]
-    else if (ch.tagNumber === 1) {                                                                            // maskGenAlgorithm [1]
+    if (ch.tagNumber === 0) { hashName = _hashW3c(asn1.read.oid(ch.children[0].children[0])); }
+    else if (ch.tagNumber === 1) {
       var mg = ch.children[0];
       if (asn1.read.oid(mg.children[0]) !== O("mgf1")) throw _err("cms/unsupported-algorithm", "unsupported OAEP mask generation function");
       mgfHash = _hashW3c(asn1.read.oid(mg.children[1].children[0]));
-    } else if (ch.tagNumber === 2) { label = asn1.read.octetString(ch.children[0].children[1]); }             // pSourceAlgorithm [2]
+    } else if (ch.tagNumber === 2) { label = asn1.read.octetString(ch.children[0].children[1]); }
   });
-  // WebCrypto RSA-OAEP ties the MGF1 hash to the OAEP hash and supports only an empty label, so any
-  // parameter set we cannot faithfully honor is rejected, never silently ignored.
   if (mgfHash != null && mgfHash !== hashName) throw _err("cms/unsupported-algorithm", "the OAEP MGF1 hash must equal the OAEP hash");
   if (label != null && label.length > 0) throw _err("cms/unsupported-algorithm", "a non-empty OAEP label is not supported");
   return hashName;
@@ -672,7 +471,7 @@ function _oaepHashFromParams(paramsBytes) {
 var HASH_W3C = {}; HASH_W3C[O("sha1")] = "SHA-1"; HASH_W3C[O("sha256")] = "SHA-256"; HASH_W3C[O("sha384")] = "SHA-384"; HASH_W3C[O("sha512")] = "SHA-512";
 function _hashW3c(o) { if (!HASH_W3C[o]) throw _err("cms/unsupported-algorithm", "unsupported OAEP hash " + o); return HASH_W3C[o]; }
 
-var X963_HASH = {}; // kari stdDH scheme OID -> W3C hash
+var X963_HASH = {};
 [["dhSinglePass-stdDH-sha1kdf-scheme", "SHA-1"], ["dhSinglePass-stdDH-sha224kdf-scheme", "SHA-224"], ["dhSinglePass-stdDH-sha256kdf-scheme", "SHA-256"], ["dhSinglePass-stdDH-sha384kdf-scheme", "SHA-384"], ["dhSinglePass-stdDH-sha512kdf-scheme", "SHA-512"],
  ["dhSinglePass-cofactorDH-sha1kdf-scheme", "SHA-1"], ["dhSinglePass-cofactorDH-sha224kdf-scheme", "SHA-224"], ["dhSinglePass-cofactorDH-sha256kdf-scheme", "SHA-256"], ["dhSinglePass-cofactorDH-sha384kdf-scheme", "SHA-384"], ["dhSinglePass-cofactorDH-sha512kdf-scheme", "SHA-512"]
 ].forEach(function (r) { X963_HASH[O(r[0])] = r[1]; });
@@ -683,9 +482,6 @@ function _kariWrap(kea) {
   return { oid: wrapOid, name: oid.name(wrapOid) };
 }
 function _originatorSpki(originator) {
-  // originator OriginatorIdentifierOrKey CHOICE; we require originatorKey [1] (RFC 5753 MUST for
-  // ephemeral-static). The parser surfaces { form, value:{ algorithm, publicKey } }, so reconstruct
-  // the SPKI (SEQUENCE { algorithm, subjectPublicKey BIT STRING }) for importKey.
   if (!originator || originator.form !== "originatorKey") throw _err("cms/unsupported-algorithm", "kari requires an originatorKey (ephemeral-static ECDH)");
   var v = originator.value;
   var algKids = [b.oid(v.algorithm.oid)];
@@ -696,13 +492,11 @@ var MONT = {}; MONT[O("X25519")] = { name: "X25519", hkdf: "SHA-256" }; MONT[O("
 function _isMont(spki) { var o = asn1.read.oid(asn1.decode(spki).children[0].children[0]); return !!MONT[o]; }
 function _montName(spki) { return MONT[asn1.read.oid(asn1.decode(spki).children[0].children[0])]; }
 var CURVE = {}; CURVE[O("prime256v1")] = { curve: "P-256" }; CURVE[O("secp384r1")] = { curve: "P-384" }; CURVE[O("secp521r1")] = { curve: "P-521" };
-// The recipient certificate's EC curve OID -- authoritative for the kari agreement (both keys share it).
 function _ecCurveFromCert(cert) {
   var spki = x509.parse(_normCertDer(cert)).subjectPublicKeyInfo;
   if (spki.algorithm.oid !== O("ecPublicKey") || spki.algorithm.parameters == null) return null;
   return asn1.read.oid(asn1.decode(spki.algorithm.parameters));
 }
-// Rebuild an EC SPKI with explicit namedCurve parameters (for an originator key that omitted them).
 function _withEcCurveParams(spki, curveOid) {
   var node = asn1.decode(spki);
   var alg = node.children[0];
@@ -712,30 +506,16 @@ var MLKEM = {}; MLKEM[O("id-ml-kem-512")] = "ML-KEM-512"; MLKEM[O("id-ml-kem-768
 function _mlkemName(o) { return MLKEM[o]; }
 
 function _explicitSetOf(implicitBytes) {
-  // The AAD is the authAttrs re-encoded under the EXPLICIT SET OF tag (RFC 5083 sec. 2.2). The
-  // parser surfaces authAttrsBytes as the transmitted [1] IMPLICIT form; retag 0xA1 -> 0x31.
-  // AuthenticatedData authAttrs are transmitted [2] IMPLICIT (0xA2); the same out[0]=0x31 handles it.
   var out = Buffer.from(implicitBytes);
   out[0] = 0x31;
   return out;
 }
 
-// ---- AuthenticatedData verification (RFC 5652 sec. 9.3) ---------------------
-// The macAlgorithm OID name -> WebCrypto HMAC hash, and the digestAlgorithm name -> hash (data-driven).
 var MAC_HASH = { hmacWithSHA256: "SHA-256", hmacWithSHA384: "SHA-384", hmacWithSHA512: "SHA-512" };
 var DIGEST_WC = { sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" };
-// The minimum conveyed MAC-key length (128-bit security floor). A ktri/pwri recipient can wrap a
-// key of any length (unlike AES-KW's 16-octet minimum), so a hostile message could convey a tiny or
-// empty MAC key that weakens the HMAC (or makes subtle.importKey throw); reject it fail-closed.
 var MAC_KEY_MIN_OCTETS = 16;
 function _isDerNull(p) { return Buffer.isBuffer(p) && p.length === 2 && p[0] === 0x05 && p[1] === 0x00; }
 
-// Verify a CMS AuthenticatedData (RFC 5652 sec. 9): recover the MAC key through the same RecipientInfo
-// unwrap decrypt uses, recompute the HMAC over the sec. 9.2 preimage (the re-tagged [2] authAttrs SET
-// OF when present, else the eContent value octets), constant-time-compare to the transmitted mac, and,
-// when authAttrs are present, independently confirm message-digest == digest(content) (sec. 9.3
-// do-not-trust-originator). The content is returned only after every check passes. Every
-// secret-dependent failure collapses to the uniform cms/decrypt-failed (no unwrap-success oracle).
 async function _verifyAuthenticatedData(parsed, km, opts) {
   var macAlg = parsed.macAlgorithm;
   var hash = MAC_HASH[macAlg.name];
@@ -744,15 +524,11 @@ async function _verifyAuthenticatedData(parsed, km, opts) {
   var content = parsed.encapContentInfo.eContent;
   if (content == null) throw _err("cms/bad-input", "a detached AuthenticatedData (absent eContent) is not supported");
 
-  // Determine the sec. 9.2 preimage + (present mode) the message-digest claim, both structural.
   var preimage, mdCheck = null;
   if (parsed.authAttrsBytes) {
     var dHash = DIGEST_WC[parsed.digestAlgorithm && parsed.digestAlgorithm.name];
     if (!dHash) throw _err("cms/unsupported-algorithm", "unsupported digestAlgorithm " + JSON.stringify(parsed.digestAlgorithm && parsed.digestAlgorithm.name));
     preimage = _explicitSetOf(parsed.authAttrsBytes);
-    // The parser already enforced content-type == eContentType (cms/content-type-mismatch) and the
-    // single-valued message-digest attribute; read the claimed digest from the parsed authAttrs (which
-    // decrypt re-parses from the same bytes the MAC covers).
     var mdAttr = (parsed.authAttrs || []).filter(function (a) { return a.type === O("messageDigest"); })[0];
     mdCheck = { hash: dHash, declared: asn1.read.octetString(asn1.decode(mdAttr.values[0])) };
   } else {
@@ -763,29 +539,16 @@ async function _verifyAuthenticatedData(parsed, km, opts) {
   for (var ci = 0; ci < candidates.length; ci++) {
     try {
       _assertSupported(candidates[ci].ri, km);
-      var macKey = await _acquireCek(candidates[ci].ri, km, opts);   // recover the MAC key (uniform failure)
-      // RFC 3218 implicit rejection: _ktriCek returns null on an RSA v1.5 unwrap fault, and a hostile
-      // ktri/pwri could convey a below-floor (128-bit) key; in either case substitute a fresh random
-      // key so the MAC verify still runs and fails uniformly, never a fast-path that distinguishes an
-      // invalid/short unwrap from a MAC mismatch (Bleichenbacher / weak-key oracle freedom).
-      // The substitute is held separately, never overwriting macKey: a hostile recipient can
-      // unwrap to a non-null key that is merely too short, and assigning over it would drop the only
-      // reference to that recovered secret, leaving it readable while the cleanup cleared the random
-      // replacement instead. Both are this module's allocations and both are cleared below.
+      var macKey = await _acquireCek(candidates[ci].ri, km, opts);
       var macSubstitute = null;
       if (macKey == null || macKey.length < MAC_KEY_MIN_OCTETS) macSubstitute = nodeCrypto.randomBytes(MAC_KEY_MIN_OCTETS);
-      // The MAC key is this path's equivalent of the content-encryption key: whether recovered from
-      // the recipient entry or substituted, it is cleared once the verify and digest checks are done
-      // -- on the failing path too, and the returned object holds a copy of the content, never the key.
       try {
         var key = await subtle.importKey("raw", macSubstitute || macKey, { name: "HMAC", hash: hash }, false, ["verify"]);
         if (!(await subtle.verify({ name: "HMAC" }, key, Buffer.from(parsed.mac), preimage))) throw _fail();
         if (mdCheck) {
           var actual = Buffer.from(await subtle.digest(mdCheck.hash, content));
-          if (!actual.equals(mdCheck.declared)) throw _fail();   // sec. 9.3: recompute, never trust the originator's digest
+          if (!actual.equals(mdCheck.declared)) throw _fail();
         }
-        // Like GCM, the MAC is verified above before anything is yielded, so the stream is a chunker
-        // over the already-authenticated plaintext (uniform `content` shape, no memory win).
         var authedContent = Buffer.from(content);
         return _originFields({
           content: opts.stream === true ? _bufferChunks(authedContent) : authedContent,
@@ -799,38 +562,11 @@ async function _verifyAuthenticatedData(parsed, km, opts) {
         guard.secret.zeroizeAll([macKey, macSubstitute], CmsError, "cms/bad-input", "the message-authentication key");
       }
     } catch (e) {
-      if (candidates.length === 1) throw e;   // one candidate: preserve its exact (distinct or uniform) verdict
+      if (candidates.length === 1) throw e;
     }
   }
-  throw _fail();   // every ambiguous candidate failed -> uniform
-}
-// Coverage residual in _verifyAuthenticatedData -- defensive branches reachable only via a hand-built
-// malformed message (the producer never emits them) or unreachable behind an upstream guarantee:
-//   * the macAlgorithm-parameters-not-NULL reject and the unsupported-digestAlgorithm reject fire only
-//     on a hand-crafted message (this producer emits absent params + SHA-2); the behavioral guard is
-//     the frozen cms/unsupported-algorithm code, not a round-trip.
-//   * the detached (absent eContent) reject is the deferred-with-condition path (this producer always
-//     attaches the content); re-open when a detached AuthenticatedData caller appears.
-//   * `parsed.authAttrs || []` / `parsed.recipientInfos || []`: the parser always surfaces these as
-//     arrays (or rejects), so the `|| []` fallbacks never fire.
-//   * `oid.name(eContentType) || eContentType` fires only for an unregistered content type; `macAlg.name
-//     || macAlg.oid` and `digestAlgorithm.name || .oid` never reach the `.oid` fallback because the
-//     algorithm name was already validated against MAC_HASH / DIGEST_WC above.
-//   * the `macKey == null` half of the random-key substitution fires only for a hand-crafted RSA v1.5
-//     ktri (this producer emits OAEP); its behavior is identical to the tested below-floor path (a
-//     random key -> the MAC verify fails uniformly), so the < 16 vector covers the substitution.
-// _normKeyDer(key) -> { der, owned }: the recipient private key as PKCS#8 DER, and whether the
-// buffer is one this module made.
-//
-// The distinction decides who may wipe it. A caller handing in their own Buffer keeps a live
-// reference and will use it again; wiping that would destroy the key out from under them. The other
-// two forms produce a new buffer here (a Uint8Array is copied, a PEM string is decoded), and that
-// buffer is a second copy of a private key which nothing else can reach, so it lives until the
-// garbage collector happens to reuse the page unless this module clears it.
-//
-// Returning the flag, in place of always copying, keeps the caller's buffer un-duplicated: making our
-// own copy of every key so we could uniformly wipe it would add a copy of the secret to solve the
-// problem of having one.
+  throw _fail();
+}
 function _normKeyDer(key) {
   if (Buffer.isBuffer(key)) return { der: key, owned: false };
   if (key instanceof Uint8Array) return { der: Buffer.from(key), owned: true };
@@ -842,7 +578,6 @@ function _normKeyDer(key) {
   }
   throw _err("cms/bad-input", "the recipient private key must be a PKCS#8 DER Buffer or PEM string");
 }
-// Wipe a key buffer this module owns. A no-op for the caller's own Buffer, which is theirs.
 function _releaseKeyDer(k) {
   if (k && k.owned) guard.secret.zeroize(k.der, CmsError, "cms/bad-input", "the recipient private-key copy");
 }