@blamejs/pki 0.7.40 → 0.7.42

package/CHANGELOG.md

@@ -4,6 +4,27 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.7.42 — 2026-09-12
+
+An S/MIME message is signed only under a certificate a receiving agent accepts a mail signature from.
+
+### Changed
+
+- pki.smime.sign refuses, with smime/bad-signer-certificate, a signer certificate whose keyUsage extension asserts neither digitalSignature nor nonRepudiation (RFC 8550 sec. 4.4.2) or whose extendedKeyUsage extension carries neither emailProtection nor anyExtendedKeyUsage (sec. 4.4.4), naming the signer by position. A certificate that carries neither extension signs, as a reader presumes both key usage bits and any purpose for it. The rule is about the certificate the message carries: a key-only signer, which RFC 8550 sec. 3 permits where correspondents hold each other's certificates by other means, still signs, and the reader holds the certificate it supplies to the same rule. The signer descriptors are read once, so a certificate accessor answers the same certificate to this check and to the signing, and a sparse signer list is refused before it is traversed.
+
+### Fixed
+
+- The emailProtection requirement pki.smime.verify applies to a trusted signer is cited to RFC 8550 sec. 4.4.4, the certificate-handling specification, in the README and the reference; it was cited to RFC 8551.
+
+## v0.7.41 — 2026-09-12
+
+A delivered or archived private key is proven the private half of its certificate with the key itself.
+
+### Fixed
+
+- pki.est.serverkeygen proves a cleartext server-generated private key is the private half of the returned certificate it binds it to (a signature, an agreement, or an encapsulation the key completes), and refuses with est/key-cert-mismatch a key whose stated public half matches the certificate while its private material cannot use it. The selection of the certificate by public-key match and the ambiguity refusal are unchanged, and a finite-field Diffie-Hellman key, whose private structure carries the exponent alone, is still bound by the value it derives, at any width the runtime reads.
+- pki.crmf.build proves the key enclosed in an encryptedKey proof of possession is the private half of certTemplate.publicKey with the key itself, and refuses with crmf/bad-popo an RSA, EC, EdDSA, ML-DSA, ML-KEM or composite key that only states the template's public components; a key the toolkit cannot read stays crmf/bad-input. A finite-field Diffie-Hellman key, whose private structure carries the exponent alone, keeps the derived comparison at any width, so the archival path still accepts a key wider than any group the toolkit agrees over.
+
 ## v0.7.40 — 2026-09-12
 
 A PKCS#12 store links a certificate only to its own key.

package/README.md

@@ -240,7 +240,7 @@ comment blocks, is at [pkijs.com](https://pkijs.com).
 | `pki.key` | Key-material lifecycle (RFC 5958 / RFC 8018). `encrypt(privateKey, password, opts)` wraps a PKCS#8 private key (DER, PEM, or an extractable `CryptoKey`) into an `EncryptedPrivateKeyInfo` under PBES2 (PBKDF2 with AES-CBC-Pad), where `opts` selects the `cipher` (`aes-256-cbc` default, `aes-192-cbc`, `aes-128-cbc`), the `prf` (`hmacWithSHA256` default, SHA-384/512, SHA-1), the `iterations` (default 600000), and the `salt`. The plaintext is validated as PKCS#8 before encryption, a default `prf` and `keyLength` are omitted so the parameters are byte-exact with OpenSSL, and the output is re-parsed before return. `decrypt(encrypted, password, opts)` recovers the inner `PrivateKeyInfo`, re-validated through `pki.schema.pkcs8.parse`: only PBES2 / PBKDF2 / AES-CBC is accepted (PBES1, PBMAC1, and scrypt are refused), the salt and iteration count are bounded before any derivation (`opts.maxIterations` lowers the cap), and a malformed parameter set or wrong-length IV is a distinct typed error. Because a MAC-less PBES2-CBC decrypt must not become a padding oracle (RFC 8018 §8), a wrong password and a valid-pad-but-not-a-key both surface the one uniform `key/decrypt-failed`. `export(key, opts)` and `import(input, opts)` move a private key as PKCS#8 or a public key as SubjectPublicKeyInfo. The key may come from the platform's WebCrypto or from a separately installed copy of this toolkit, and is exported through whichever holds its material; a non-extractable key, or one whose implementation keeps its material out of reach, is refused with that as the reason. Encoding is delegated to WebCrypto, so RSA carries an explicit NULL, EC a named curve, and Ed25519/Ed448/X25519/X448 omit parameters, and an ambiguous RSA or EC import requires `opts.algorithm`. `generate(algorithm, opts)` produces a key pair over RSA, ECDSA/ECDH, the Edwards and Montgomery curves, and the FIPS post-quantum ML-DSA and ML-KEM; `publicFromPrivate(privateKey)` derives the public key. Returns DER or PEM, with a typed `KeyError` on failure. Parsing stays at `pki.schema.pkcs8.parse` — `encrypt`, `decrypt`, `export`, `import`, `generate`, `publicFromPrivate` |
 | `pki.pkcs12` | PKCS#12 (.p12/.pfx) issuance and reading (RFC 7292 / RFC 9579). `build(spec, opts)` assembles a store from the OpenSSL-style `{ key, cert, ca?, friendlyName?, localKeyId? }` or the full `{ safeContents: [...] }`, where each element is a plaintext or PBES2-encrypted `SafeContents` of key, shroudedKey, cert, crl, secret, or nested `safeContents` bags. Keys and certs are validated before wrapping, a key paired with a certificate (the `{ key, cert }` form, or bags sharing a `localKeyId`) must be the private half of that certificate's public key, and `friendlyName` (BMPString) and `localKeyId` are single-value. Integrity is a classic Appendix B HMAC (the default, for maximum interoperability) or an RFC 9579 PBMAC1 (`opts.mac.algorithm`) over SHA-256/384/512, with shrouded keys and cert safes encrypted under RFC 8018 PBES2 (AES-128/192/256-CBC). Every password is encoded the PKCS#12 way — BMPString+NULL for the classic MAC, UTF-8 for the PBES2 bags and PBMAC1 — which is what OpenSSL and NSS consume, so a file it emits opens in both, cross-checked bidirectionally. The MAC covers the exact AuthenticatedSafe byte range, a DEFAULT-1 `MacData.iterations` is rejected up front, and the store is re-parsed before return. `verifyMac(pfx, password, opts)` recomputes a classic or PBMAC1 MAC over `macedBytes` and constant-time-compares it, throwing on a MAC-less or public-key-integrity store. Public-key integrity (`opts.integrity.mode: "public-key"`) wraps the AuthenticatedSafe in a CMS SignedData instead of a MAC, signed by any `pki.cms.sign` signer and carrying no MacData (§4); privacy stays independent, so `password` still PBES2-encrypts the bags. Public-key privacy wraps a SafeContents as a CMS EnvelopedData (AES-CBC, `id-envelopedData`, never GCM) encrypted to recipient public keys through the `pki.cms.encrypt` recipient model, via per-safe `recipients` or the `opts.recipientCerts` convenience, restricted to certificate recipients (RSA-OAEP, ECDH, X25519, X448, ML-KEM) since a password or KEK recipient could not be reopened by `open`. All four integrity-by-privacy combinations are permitted (§3.1). `open(pfx, password, opts)` reads a store back: it verifies the MAC first, so a wrong password is the MAC verdict rather than a decrypt error, then PBES2-decrypts every privacy safe and shrouded key bag and returns `{ integrityMode, macVerified, signers, keys, certs, crls, secrets }` — keys as re-validated PKCS#8 DER, certs, CRLs and secrets as raw DER, all with `friendlyName` and `localKeyId`, nested safes recursively. A MAC-less store is refused unless `opts.allowUnauthenticated`. A public-key-integrity store is verified through its CMS SignedData signature first (`pkcs12/signature-invalid` on failure), with the signer surfaced in `signers` but never trust-chained, which remains the caller's `pki.path.validate` step. A legacy-PBE store's Appendix C 3DES and RC2 bags are decrypted, RC2 through an in-tree RFC 2268 cipher, so an `openssl pkcs12 -legacy` or NSS store opens; the legacy RC4 schemes are refused. An `id-envelopedData` safe is decrypted with `opts.recipientKey` after the integrity gate (`pkcs12/no-recipient-key` when absent), every recipient-side fault and every post-integrity decrypt failure collapsing to the uniform `pkcs12/decrypt-failed`, and `opts.keys: 'crypto'` imports each key to a `CryptoKey`. It reads what OpenSSL and NSS produce. Returns DER or a PEM `PKCS12`, with a typed `Pkcs12Error` on failure. Parsing stays at `pki.schema.pkcs12.parse` — `build`, `verifyMac`, `open` |
 | `pki.cms` | CMS signing, verification, encryption, and compression (RFC 5652). `sign(content, signers, opts)` produces a SignedData (§5), attached or detached, with one or many signers over RSA, RSASSA-PSS, ECDSA, EdDSA, the post-quantum ML-DSA-44/65/87 (RFC 9882) and SLH-DSA (all twelve FIPS 205 sets, RFC 9814), and composite ML-DSA pairing ML-DSA with a traditional RSA, ECDSA, or EdDSA key (accepted only when both components verify, draft-ietf-lamps-cms-composite-sigs). It builds the signed attributes (content-type, message-digest, signing-time) as canonical DER, signs the exact §5.4 preimage, and emits a DER `Buffer` or PEM. The content may also be an async iterable of byte chunks, which signs a large detached payload without holding it in memory: the payload is hashed incrementally under every signer's digest algorithm in one pass, and `verify` accepts the same streamed form as its `content` option. A signer may also be key-only — `{ key, spki, keyIdentifier }` with no certificate — which RFC 5272 §3.2 requires when a Full PKI Request's signer is the key of a certification request that request carries: the signer identifier takes the subjectKeyIdentifier form carrying the identifier the request declares, the signature scheme resolves from the request's own public key, and no certificate is embedded. `verify(input, opts)` parses a SignedData over the strict `pki.schema.cms` codec, locates each SignerInfo's signer certificate by its issuerAndSerialNumber or subjectKeyIdentifier, and checks the signature over the exact §5.4 preimage: with signed attributes present it confirms the message-digest attribute equals the content digest and verifies over the DER re-encoding of the SignedAttributes (the on-wire `[0]` tag replaced by a universal SET OF), and otherwise directly over the content. It returns a per-signer verdict with the matched signer certificate. `valid` and `trusted` are separate claims and neither implies the other: a SignedData carries its own certificates, so `valid` says the signature is sound under one of them and nothing about who signed, while `trusted` says every signer chained to a root named in `opts.trustAnchors`, validated through the same RFC 5280 path engine `pki.path.validate` uses. Without anchors there is nothing to chain to and `trusted` is `false`; anchors that cannot be read throw, rather than reading as untrusted. An unrecognized option is refused rather than ignored. `countersign(cms, signers, opts)` adds a countersignature (§11.4) — a `SignerInfo` over the countersigned SignerInfo's signature value, any signer algorithm, nestable, with the primary bytes preserved so it still verifies — attached as the id-countersignature unsigned attribute; `verify` returns each countersignature's verdict under `signers[i].countersignatures` and every unsigned attribute — including an RFC 3161 timestamp token, attachable via `sign`'s `unsignedAttributes` — under `signers[i].unsignedAttrs`, surfaced unauthenticated. `encrypt(content, recipients, opts)` produces an EnvelopedData, AuthEnvelopedData (AES-GCM, the authenticated default), or EncryptedData, with recipients auto-dispatched off the certificate key to key transport (RSAES-OAEP; v1.5 is never emitted), key agreement (ephemeral-static ECDH over P-256/384/521 with the X9.63 KDF, and X25519/X448 with HKDF), symmetric key wrap, password (PBKDF2 with RFC 3211 PWRI-KEK), or the post-quantum ML-KEM (and composite ML-KEM, draft-lamps-pq-composite-kem) KEMRecipientInfo (RFC 9629/9936), wrapping one fresh content key for every recipient. The content may also be an async iterable of byte chunks, streamed through the AES-GCM or AES-CBC content cipher so a large plaintext is encrypted without being buffered whole; the ciphertext is assembled before the definite-length encryptedContent is emitted, byte-for-byte the buffered form. `decrypt(input, keyMaterial, opts)` recovers the content through the matching arm and returns it with an `authenticated` flag; every secret-dependent failure collapses to one uniform `cms/decrypt-failed` verdict (Bleichenbacher, EFAIL, and password-oracle freedom), and PKCS#1 v1.5 is decrypt-only under the RFC 3218 implicit-rejection countermeasure. With `opts.stream: true` the recovered `content` is an async iterable of plaintext chunks instead of a single Buffer, for a payload too large to hold whole; the authenticated modes (AuthEnvelopedData, AuthenticatedData, AES-GCM) verify integrity before the iterable yields, so a forged message throws before any plaintext is exposed, while a CBC EnvelopedData or EncryptedData yields the plaintext as the cipher produces it. Every key-establishment secret the toolkit allocates is wiped once used, on the failing path as well as the succeeding one: the KEM shared secret and its derived key-encryption key, the raw ECDH / X25519 / X448 agreement secret, a password-derived key-encryption key, and the content-encryption key itself, cleared once the message is complete since all recipients share it. Caller-supplied key material is never written to (best-effort; NIST SP 800-227 §4.2, RFC 9629 §7). `authenticate(content, recipients, opts)` produces an `id-ct-authData` (§9): cleartext content plus an HMAC-SHA-256/384/512 MAC, authenticated but not encrypted, with the fresh MAC key wrapped for every recipient through the same RecipientInfo model. The MAC covers the authenticated attributes (content-type and message-digest) re-tagged to the EXPLICIT SET OF (§9.2), or the content octets directly; `decrypt` recovers the MAC key, recomputes the MAC and independently the message-digest (§9.3), and releases the content only after both pass, with every secret-dependent failure collapsing to the uniform `cms/decrypt-failed`. `compress(content, opts)` and `decompress(input, opts)` produce and consume a CompressedData (RFC 3274; ZLIB, version 0, id-alg-zlibCompress); decompress bounds the uncompressed output at 16 MiB and stops before it is materialized, so a decompression bomb fails closed as `cms/decompress-too-large`. Compression is a size transform with no integrity or confidentiality (RFC 8551 §2.4.5). `certsOnly(certs, opts?)` builds a certs-only certificate-management message (RFC 8551 §3.8): a degenerate SignedData with an empty signerInfos and no eContent that conveys certificates and CRLs without signing anything, `parseCertsOnly(input, opts?)` reads one back to its raw certificate and CRL DER (a CRL-only message is valid here, unlike the cert-required RFC 5272 form that `pki.est.parseCertsOnly` reads), and `isCertsOnly(input)` recognizes one structurally. Fail-closed with typed `cms/*` errors — `sign`, `verify`, `countersign`, `encrypt`, `authenticate`, `decrypt`, `compress`, `decompress`, `certsOnly`, `parseCertsOnly`, `isCertsOnly` |
-| `pki.smime` | S/MIME message assembly, verification, encryption, and compression over the CMS layer (RFC 8551). `sign(content, signers, opts)` wraps a MIME entity in either form: `multipart/signed`, where the content stays readable in any MUA and a detached CMS SignedData rides alongside as `application/pkcs7-signature` with a matching `micalg`, or `application/pkcs7-mime; smime-type=signed-data`, where the whole entity is a base64 CMS SignedData. The signed bytes are the entity's §3.1.1 canonical form with CRLF line endings, and `verify(message, opts)` unwraps both forms and recomputes over the same canonicalizer, so a transport that re-wraps line endings still verifies while a tampered part fails. `encrypt(content, recipients, opts)` envelopes a MIME entity as an opaque `application/pkcs7-mime` message and `decrypt(message, keyMaterial, opts)` opens one, as `smime-type=authEnveloped-data` (AES-GCM, confidentiality and integrity, the default) or `smime-type=enveloped-data` (AES-CBC, confidentiality only, so `decrypt` reports `authenticated: false`, the §3.3 no-integrity caveat). The `smime-type` is derived from the CMS body rather than the header, and decryption is fail-closed and oracle-free. The crypto is entirely `pki.cms.sign` / `verify` / `encrypt` / `decrypt`, so it is algorithm-agnostic: any RSA / RSASSA-PSS / ECDSA / EdDSA / ML-DSA / SLH-DSA signer and any RSA-OAEP / ECDH / X25519 / X448 / AES-KW / PBKDF2 / ML-KEM recipient carries through. As with `cms.verify`, `verify` returns the per-signer verdict plus the recovered content, and `valid` and `trusted` are separate claims: `valid` says the signature is sound under a certificate the message carried, `trusted` says every signer chained to a root named in `opts.trustAnchors`. Anchoring here is validated for email at both ends of the chain — the signer certificate must carry `emailProtection` (RFC 8551 §4.4.4) and the anchor's own trust metadata must permit that purpose, since a root can be distrusted for email while remaining a good TLS root. Override either with `requiredEku` / `checkPurpose`. `compress(content, opts)` and `decompress(message, opts)` add the opaque `application/pkcs7-mime; smime-type=compressed-data; name=smime.p7z` frame (§3.6, RFC 3274), a size transform with no integrity or confidentiality (§2.4.5), bounded against a bomb; the recovered content, which may itself be signed or enveloped, is returned for the caller to re-verify. Header protection (RFC 9788): `sign` and `encrypt` take `opts.protectHeaders`, which inlines the caller's `opts.headers` on the Cryptographic Payload root (its Content-Type gaining `hp="clear"` when signed or `hp="cipher"` when encrypted) so the CMS signature or encryption covers them, defeating a transport that rewrites or reads Subject, From, and the rest. `verify` and `decrypt` surface the authenticated inner set as `protectedHeaders` plus `headerProtection { present, mode, fromMismatch, confidential, legacy }`, so a tampered outer header cannot alter it and `fromMismatch` flags an outer From that disagrees. Encryption applies a Header Confidentiality Policy: the default `hcp_baseline` obscures the outer Subject to `[...]` and removes Comments and Keywords, so the real values live only in the ciphertext, and `decrypt` recovers them. Every emitted header routes through a fail-closed injection guard that rejects a CR, LF, or NUL value and a non-ftext name, and a malformed or contradictory `hp` wrap fails closed as `smime/bad-header-protection` rather than silently downgrading. The CMS crypto is unchanged. Inbound legacy RFC 8551 header protection is recognized opt-in: `verify` and `decrypt` with `opts.legacyHeaderProtection` detect a legacy `message/rfc822`-wrapped payload by the RFC 9788 §4.10.1 four-condition identification and surface the inner headers under `headerProtection.legacy = { headers, mode, fromMismatch, confidential }`, where `headers` is an ordered `[{ name, value }]` array retaining legally repeated fields such as `Received`. Those never appear in `protectedHeaders` and never set `present: true`. Because a legacy message is structurally indistinguishable from an ordinary forwarded `message/rfc822`, this is an explicit heuristic (§4.10.2, "no strong end-to-end guarantees"): a caller keying trust off `present` or `protectedHeaders` is never misled, and only one that explicitly reads `headerProtection.legacy.headers` and cross-checks `legacy.fromMismatch` consumes it. It is off by default, and a nested crypto layer, an inner `hp=`, a non-`message/rfc822` payload, or a duplicate Content-Type reports `legacy: null`. Bidirectionally interoperable with `openssl smime` and `openssl cms`. `buildCertsOnly(certs, opts?)` wraps a `pki.cms.certsOnly` certificate-management message in one `application/pkcs7-mime; smime-type=certs-only; name=smime.p7c` entity, read back by OpenSSL's `pkcs7 -print_certs`. Fail-closed with typed `smime/*` errors — `sign`, `verify`, `encrypt`, `decrypt`, `compress`, `decompress`, `buildCertsOnly` |
+| `pki.smime` | S/MIME message assembly, verification, encryption, and compression over the CMS layer (RFC 8551). `sign(content, signers, opts)` wraps a MIME entity in either form: `multipart/signed`, where the content stays readable in any MUA and a detached CMS SignedData rides alongside as `application/pkcs7-signature` with a matching `micalg`, or `application/pkcs7-mime; smime-type=signed-data`, where the whole entity is a base64 CMS SignedData. The signed bytes are the entity's §3.1.1 canonical form with CRLF line endings, and `verify(message, opts)` unwraps both forms and recomputes over the same canonicalizer, so a transport that re-wraps line endings still verifies while a tampered part fails. `encrypt(content, recipients, opts)` envelopes a MIME entity as an opaque `application/pkcs7-mime` message and `decrypt(message, keyMaterial, opts)` opens one, as `smime-type=authEnveloped-data` (AES-GCM, confidentiality and integrity, the default) or `smime-type=enveloped-data` (AES-CBC, confidentiality only, so `decrypt` reports `authenticated: false`, the §3.3 no-integrity caveat). The `smime-type` is derived from the CMS body rather than the header, and decryption is fail-closed and oracle-free. The crypto is entirely `pki.cms.sign` / `verify` / `encrypt` / `decrypt`, so it is algorithm-agnostic: any RSA / RSASSA-PSS / ECDSA / EdDSA / ML-DSA / SLH-DSA signer and any RSA-OAEP / ECDH / X25519 / X448 / AES-KW / PBKDF2 / ML-KEM recipient carries through. As with `cms.verify`, `verify` returns the per-signer verdict plus the recovered content, and `valid` and `trusted` are separate claims: `valid` says the signature is sound under a certificate the message carried, `trusted` says every signer chained to a root named in `opts.trustAnchors`. Anchoring here is validated for email at both ends of the chain — the signer certificate must carry `emailProtection` (RFC 8550 §4.4.4) and the anchor's own trust metadata must permit that purpose, since a root can be distrusted for email while remaining a good TLS root. `sign` refuses a signer certificate a conforming reader would reject: a `keyUsage` extension without `digitalSignature` or `nonRepudiation` (RFC 8550 §4.4.2), or an `extendedKeyUsage` extension without `emailProtection` or `anyExtendedKeyUsage` (§4.4.4); a certificate carrying neither extension signs. Override either with `requiredEku` / `checkPurpose`. `compress(content, opts)` and `decompress(message, opts)` add the opaque `application/pkcs7-mime; smime-type=compressed-data; name=smime.p7z` frame (§3.6, RFC 3274), a size transform with no integrity or confidentiality (§2.4.5), bounded against a bomb; the recovered content, which may itself be signed or enveloped, is returned for the caller to re-verify. Header protection (RFC 9788): `sign` and `encrypt` take `opts.protectHeaders`, which inlines the caller's `opts.headers` on the Cryptographic Payload root (its Content-Type gaining `hp="clear"` when signed or `hp="cipher"` when encrypted) so the CMS signature or encryption covers them, defeating a transport that rewrites or reads Subject, From, and the rest. `verify` and `decrypt` surface the authenticated inner set as `protectedHeaders` plus `headerProtection { present, mode, fromMismatch, confidential, legacy }`, so a tampered outer header cannot alter it and `fromMismatch` flags an outer From that disagrees. Encryption applies a Header Confidentiality Policy: the default `hcp_baseline` obscures the outer Subject to `[...]` and removes Comments and Keywords, so the real values live only in the ciphertext, and `decrypt` recovers them. Every emitted header routes through a fail-closed injection guard that rejects a CR, LF, or NUL value and a non-ftext name, and a malformed or contradictory `hp` wrap fails closed as `smime/bad-header-protection` rather than silently downgrading. The CMS crypto is unchanged. Inbound legacy RFC 8551 header protection is recognized opt-in: `verify` and `decrypt` with `opts.legacyHeaderProtection` detect a legacy `message/rfc822`-wrapped payload by the RFC 9788 §4.10.1 four-condition identification and surface the inner headers under `headerProtection.legacy = { headers, mode, fromMismatch, confidential }`, where `headers` is an ordered `[{ name, value }]` array retaining legally repeated fields such as `Received`. Those never appear in `protectedHeaders` and never set `present: true`. Because a legacy message is structurally indistinguishable from an ordinary forwarded `message/rfc822`, this is an explicit heuristic (§4.10.2, "no strong end-to-end guarantees"): a caller keying trust off `present` or `protectedHeaders` is never misled, and only one that explicitly reads `headerProtection.legacy.headers` and cross-checks `legacy.fromMismatch` consumes it. It is off by default, and a nested crypto layer, an inner `hp=`, a non-`message/rfc822` payload, or a duplicate Content-Type reports `legacy: null`. Bidirectionally interoperable with `openssl smime` and `openssl cms`. `buildCertsOnly(certs, opts?)` wraps a `pki.cms.certsOnly` certificate-management message in one `application/pkcs7-mime; smime-type=certs-only; name=smime.p7c` entity, read back by OpenSSL's `pkcs7 -print_certs`. Fail-closed with typed `smime/*` errors — `sign`, `verify`, `encrypt`, `decrypt`, `compress`, `decompress`, `buildCertsOnly` |
 | `pki.tsp` | Time-Stamp Protocol (RFC 3161). `sign(messageImprint, tsa, opts)` produces a TimeStampToken: a CMS SignedData over `pki.cms.sign` whose content is a `TSTInfo` carrying the timestamped message imprint, the TSA policy, a serial number, and `genTime` with optional accuracy, nonce, and ordering, plus the §2.4.2 signing-certificate attribute binding the token to the TSA certificate (SHA-2 imprints, any `pki.cms.sign` TSA key). The TSA certificate is held to §2.3 before signing (one critical extendedKeyUsage naming timeStamping alone) with the codes `verify` answers, `genTime` keeps its milliseconds as the §2.4.2 fraction of a second, and an accuracy naming no field is refused. `request` and `parseRequest` build and parse the TimeStampReq a client sends (imprint, requested policy, nonce, certReq); `response` and `parseResponse` handle the TimeStampResp a TSA returns, either a granted status wrapping a token or a rejection with PKIStatus and failure info, with the §2.4.2 status-to-token coupling enforced in both directions. `verify(token, data, opts)` verifies a token fail-closed: the CMS signature over the exact signed bytes, the message imprint recomputed from the data, the TSTInfo content type, the ESSCertID(V2) binding to the TSA certificate, the §2.3 critical timeStamping-only extendedKeyUsage, the request nonce when used, and, with a trust anchor supplied, full certification-path validation of the TSA certificate at the token's `genTime` — judged under the `timeStamping` purpose, so an anchor's own per-purpose trust metadata reaches the decision rather than sitting inert. It returns `{ valid, trusted, genTime, serialNumber, tstInfo, ... }`, where `trusted` is the separate claim that the authority chained to an anchor you named: without one there is nothing to chain to and it is `false`, which is the distinction a timestamp re-read years later turns on — `sign`, `request`, `parseRequest`, `response`, `parseResponse`, `verify` |
 | `pki.ocsp` | Online Certificate Status Protocol (RFC 6960), both the responder and relying-party surface. `buildRequest(query, opts)` builds an OCSPRequest for one or more `{ cert, issuer }` pairs, with the CertID hashed under SHA-1 by default per the RFC 5019 lightweight profile or under SHA-2, plus an optional RFC 9654 nonce (32 to 128 octets, the requester floor that section sets) and an optional requestor signature, under which the signer certificate's subject is the requestorName unless one is stated (RFC 6960 §4.1.2). `sign(responseData, responder, opts)` produces a signed BasicOCSPResponse over the exact `ResponseData` DER, from the issuing CA directly or a delegated responder, under any `pki.cms.sign` key including the post-quantum ML-DSA and SLH-DSA sets, with `good`, `revoked` (reason and time), or `unknown` per-certificate status, and per-response `singleExtensions` naming the §4.4.4 archive cutoff and the §4.4.2 CRL reference as fields, each read back by name by the parser. The signer refuses what its own lint would grade an error: a pre-encoded singleExtension that RFC 6960 places in requests or in responseExtensions, a CRL entry extension carried at the wrong criticality, and CRL references or entry extensions on a non-issued response, which itself places the §4.4.8 extended revoked definition in responseExtensions without being asked. `buildErrorResponse(status)` produces the unsigned §2.3 error (`tryLater`, `unauthorized`, and the rest). `verify(response, opts)` verifies a response fail-closed against the same hardened gates `pki.path.ocspChecker` runs: the CertID binding, responder authorization (the issuing CA, or a CA-issued delegate bearing id-kp-OCSPSigning and id-pkix-ocsp-nocheck and passing the full out-of-path certificate gates), the signature over `tbsResponseDataBytes`, currency against `thisUpdate` and `nextUpdate`, and the request-nonce echo. It returns `{ status: "good" / "revoked" / "unknown", ... }` and never silently accepts. `verifyRequest(request, opts)` is the responder-side inverse of `buildRequest`: it verifies a client's signed request (RFC 6960 §4.1.1) under the requestor certificate the request carries, trying each embedded certificate since the field is unordered, and reports `signed`, `signatureValid`, every certificate whose key verified the signature and whose subject is the `requestorName` the request states (`signerCerts`, so a key carried under an expired certificate beside its renewal is not hidden behind ordering, while a same-key certificate under another name is not the requestor) with the first one's decoded subject, the full embedded certificate bag (`certs`, including intermediates for path building), and the request's CertIDs; the name check is reported as `requestorNamed` (RFC 6960 §4.1.2) and `valid` requires it, a request no verifying certificate names falls back to listing the verifying ones with `valid: false`, and an unsigned request is reported with `signed: false` rather than refused. Transport-free — `buildRequest`, `sign`, `buildErrorResponse`, `verify`, `verifyRequest` |
 | `pki.ct` | Certificate Transparency (RFC 6962). `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries, a TLS-presentation-language payload inside the §3.3 double DER wrap, into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature. `reconstructSignedData` rebuilds the exact `digitally-signed` preimage, and `verifySct` verifies an SCT signature against a log's public key, routing an ECDSA signature through the strict DER-conformance gate and verifying through the crypto engine, resolving true or false and throwing a typed error on a structural fault. On the producing side, `encodeSctList` builds the extension value byte for byte as the exact inverse of `parseSctList`, and `signSct` performs a log's signing step. For trust, `parseLogList` ingests the CT log-list JSON into constraint-carrying trusted logs, recomputing each log's id as SHA-256 of its key and refusing a disagreeing id (a swapped key, §3.2) and decoding the state and temporal-interval constraints; `verifySctWithLogList` resolves the log key from an SCT's log id, enforces the state (usable, qualified, and readonly trusted; retired only before retirement; pending and rejected refused) and the temporal-interval window, then delegates the signature check to `verifySct`. `verifyLogListSignature(json, signature, publicKey)` verifies the detached `log_list.sig` over the raw log-list bytes against a caller-pinned signer key (RSASSA-PKCS1-v1.5/SHA-256 and an EC P-256 arm, with forgeable-key defenses failing closed), cross-checked against `openssl dgst`. `fetchLogList(opts)` turns that chain into a live client: it GETs the `log_list.json` and its detached `log_list.sig` over `pki.transport`, verifies the detached signature over the raw fetched bytes against a caller-pinned distributor key before parsing, so an unverified document is never parsed, read, cached, or surfaced, then ingests the same bytes through `parseLogList` and returns the trusted-log set plus the surfaced `version` and `timestamp`. Above the per-SCT layer, `verifySctList` renders a certificate-level verdict over every SCT a certificate carries (§3.3), reporting how many distinct trusted logs verified an SCT (so a duplicated SCT cannot inflate the count) and from how many distinct trusted operators against a caller's CT policy (`minScts` and `minOperators`, both defaulting to the RFC floor of one), where a policy shortfall is a verdict and a per-SCT failure is a recorded row rather than a thrown call; `x509CertEntry` reconstructs the precertificate log entry from a final certificate by removing the SCT-list extension from its TBSCertificate as byte surgery, so its embedded SCTs verify end to end (§3.2). The toolkit bakes in no vendor URL or key, TLS trust is explicit with `rejectUnauthorized` always on, each response is size-capped before the trust chain, and the transport is injectable so the whole path is testable offline — `parseSctList`, `reconstructSignedData`, `verifySct`, `encodeSctList`, `signSct`, `parseLogList`, `verifySctWithLogList`, `verifySctList`, `x509CertEntry`, `verifyLogListSignature`, `fetchLogList` |

package/lib/crmf-sign.js

@@ -836,7 +836,38 @@ function _buildEncryptedKeyPop(pop, outerTag, template) {
   }
 }
 
+async function _assertEnclosedKeyCorresponds(privateKeyDer, templateSpki) {
+  var pair;
+  try {
+    pair = await key.correspondsTo(privateKeyDer, templateSpki);
+  } catch (e) {
+    if (e instanceof CrmfError) throw e;
+    /** @internal A key the key module cannot read at all is bad input; one it reads and cannot
+     * exercise together with the template's key proves possession of nothing, which is the proof
+     * failing, not the input. */
+    if (e && e.isPkiError === true && e.code === "key/bad-input") {
+      throw _err("crmf/bad-input", "pop.privateKey could not be read as a private key to check against " +
+        "certTemplate.publicKey: " + (e.message || e), e);
+    }
+    throw _err("crmf/bad-popo", "the private key enclosed in the encryptedKey proof of possession could not be " +
+      "exercised with certTemplate.publicKey, so it cannot be shown to be that key's private half (RFC 4211 sec. 4.2)", e);
+  }
+  if (pair !== true) {
+    throw _err("crmf/bad-popo", "the private key enclosed in the encryptedKey proof of possession is not the " +
+      "private half of certTemplate.publicKey, so it proves possession of a key this request does not ask to " +
+      "have certified (RFC 4211 sec. 4.2)");
+  }
+}
+
 function _assertEnclosedKeyMatches(privateKeyDer, templateSpki) {
+  /** @internal Which proof the enclosed key takes depends on what its structure can carry. A
+   * finite-field PrivateKeyInfo carries the exponent alone, so the public value derived from it IS
+   * the proof, and this arm keeps that derivation at any width, with the cheap tests below. Every
+   * other family's private structure carries public components of its own (RFC 5958 sec. 2,
+   * RFC 5915, PKCS #1), which a caller could set to the template's beside private material that
+   * cannot use it, so those are proven by USING the key against the template. */
+  var enclosedAlg = key.algorithmOidAt(privateKeyDer, 1);
+  if (enclosedAlg !== null && !key.isDhOid(enclosedAlg)) return _assertEnclosedKeyCorresponds(privateKeyDer, templateSpki);
   return Promise.resolve()
     .then(function () { return key.publicFromPrivate(privateKeyDer); })
     .then(function (derivedSpki) {
@@ -991,7 +1022,9 @@ function _buildProofOfPossession(pop, certReqDer, template, signingKey, opts) {
  *   intended, so it takes `pop.archive: true`; `pop.privateKey` is the PKCS#8 DER, `pop.recipients` the CMS
  *   recipients to envelope it to, and `pop.identifier` (a string or GeneralName) is required, because
  *   sec. 4.2.1 makes it mandatory whenever the purpose is proving possession: without it a decrypting
- *   agent cannot tell whose key it holds. `pop.contentEncryptionAlgorithm` defaults to `aes-256-cbc`; an
+ *   agent cannot tell whose key it holds. The enclosed key is proven the private half of
+ *   `certTemplate.publicKey` with the key itself (`crmf/bad-popo` when it is not), not by the public
+ *   components its structure states. `pop.contentEncryptionAlgorithm` defaults to `aes-256-cbc`; an
  *   AEAD algorithm is refused, since it would produce an `AuthEnvelopedData` this field cannot carry.
  * - `agreeMAC`, which agrees a secret with the authority and MACs the request under a key derived from it,
  *   so nothing is signed (RFC 4211 sec. 4.3, RFC 2875 sec. 3). `pop.key` is the requester's finite-field

package/lib/est.js

@@ -1742,6 +1742,18 @@ async function _serverkeygenResult(res, opts, derived) {
     var bound = findIssuedCert(out.certificates, spki);
     if (!bound) throw E("est/key-cert-mismatch", "the cleartext server-generated private key matches no returned certificate's public key (RFC 7030 sec. 4.4.2)");
     if (findIssuedCert(out.certificates.filter(function (c) { return c !== bound; }), spki)) throw E("est/ambiguous-issued-cert", "more than one returned certificate carries the server-generated key; the issued certificate is ambiguous (RFC 7030 sec. 4.4.2)");
+    /** @internal The public half the key states selected the certificate; the pair is then proven
+     * with the PRIVATE half, since a private structure states public components of its own that a
+     * server could set to the certificate's beside private material that cannot use it. A
+     * finite-field Diffie-Hellman PrivateKeyInfo carries the exponent alone, so the value derived
+     * from it above IS the proof, at any width the runtime reads. */
+    var keyAlg = key.algorithmOidAt(out.privateKeyDer, 1);
+    if (keyAlg === null || !key.isDhOid(keyAlg)) {
+      var pair;
+      try { pair = await key.correspondsTo(out.privateKeyDer, spki); }
+      catch (e2) { throw E("est/key-cert-mismatch", "the cleartext server-generated private key could not be exercised with the returned certificate's public key, so the two cannot be shown to be a pair (RFC 7030 sec. 4.4.2)", e2); }
+      if (pair !== true) throw E("est/key-cert-mismatch", "the cleartext server-generated private key is not the private half of the returned certificate's public key (RFC 7030 sec. 4.4.2)");
+    }
     delete out.privateKeyDer;
   }
   return out;
@@ -1765,7 +1777,9 @@ async function _serverkeygenResult(res, opts, derived) {
  * the key so the issued certificate's public key is the generated one, not the throwaway CSR key. A cleartext
  * key is bound to its certificate before it resolves: the delivered private key's public half MUST match
  * exactly one returned certificate (`est/key-cert-mismatch` on none, `est/ambiguous-issued-cert` on more than
- * one), so a mis-associated key is refused, never handed back unusable.
+ * one), and the key is then proven the private half of that certificate's public key with the key itself
+ * (`est/key-cert-mismatch` when it is not; a finite-field DH key, whose structure carries the exponent alone,
+ * is proven by the value it derives), so a mis-associated or unusable key is refused, never handed back.
  * The encryption requirement + expected recipient are derived from the CSR's own DecryptKeyIdentifier /
  * AsymmetricDecryptKeyIdentifier attribute; an `opts` value that contradicts the CSR is `est/bad-input`
  * (a cleartext-key downgrade cannot slip past). The delivered key's channel is asserted confidentiality-

package/lib/key.js

@@ -680,7 +680,22 @@ function _dhAsPkcs3(der, at, what) {
   if (!algNode.children || algNode.children.length !== 2) {
     throw _err("key/bad-input", what + " X9.42 AlgorithmIdentifier does not carry DomainParameters");
   }
-  var dom = x942Domain(algNode.children[1], KeyError, "key/bad-input", what);
+  /** @internal A field the codec refuses to read as the type the structure states is a malformed
+   * key, reported as one rather than as the codec's own complaint. */
+  var dom, y = null;
+  try {
+    dom = x942Domain(algNode.children[1], KeyError, "key/bad-input", what);
+    if (at === 0) {
+      var pub = asn1.read.bitString(node.children[1]);
+      if (!guard.crypto.isOctetAligned(pub)) {
+        throw _err("key/bad-input", what + " Diffie-Hellman public key BIT STRING must be octet-aligned (0 unused bits)");
+      }
+      y = asn1.read.integer(asn1.decode(pub.bytes));
+    }
+  } catch (e) {
+    if (e instanceof KeyError) throw e;
+    throw _err("key/bad-input", what + " X9.42 Diffie-Hellman key could not be read", e);
+  }
   assertDhOperandsWithin([dom.p, dom.g, dom.q, dom.j], KeyError, "key/bad-input", what);
   assertDhDomainCoherent(dom.p, dom.g, dom.q, dom.j, KeyError, "key/bad-input", what);
   assertDhGeneratorOrder(dom.p, dom.g, dom.q, KeyError, "key/bad-input", what);
@@ -689,11 +704,6 @@ function _dhAsPkcs3(der, at, what) {
   /** @internal The one field the X9.42 form states that the PKCS #3 form cannot be held to is the
    * subgroup, so a public value is held to it here, where q is still known. */
   if (at === 0) {
-    var pub = asn1.read.bitString(node.children[1]);
-    if (!guard.crypto.isOctetAligned(pub)) {
-      throw _err("key/bad-input", what + " Diffie-Hellman public key BIT STRING must be octet-aligned (0 unused bits)");
-    }
-    var y = asn1.read.integer(asn1.decode(pub.bytes));
     if (y <= 1n || y >= dom.p - 1n) {
       throw _err("key/bad-input", what + " Diffie-Hellman public value is outside the group (RFC 2875 sec. 3)");
     }
@@ -711,19 +721,45 @@ function _dhAsPkcs3(der, at, what) {
  * algorithm; every secret the probe makes is wiped on every way out. A public key of another
  * algorithm, composite or not, is another family and not a pair. */
 async function _compositeCorrespondsTo(privDer, spkiDer, privateOid) {
+  /** @internal The private half is read first, as on the classical route: a composite key the KEM
+   * cannot read is bad input whatever the public half names, decided before the family shortcut
+   * answers that the two are not a pair. The derivation's result is not what is compared; the
+   * read is what it answers for. */
+  try { await compositeKem.publicFromPrivate(privDer); }
+  catch (e0) {
+    if (_isKemStructureFault(e0)) throw _err("key/bad-input", "the private key could not be read", e0);
+    throw _err("key/unsupported-algorithm", "the key pair could not be exercised to decide whether its two halves correspond", e0);
+  }
   if (_algorithmOidAt(spkiDer, 0) !== privateOid) return false;
   var sealed = null, opened = null;
   try {
-    sealed = await compositeKem.encapsulate(spkiDer);
-    opened = await compositeKem.decapsulate(privDer, sealed.ciphertext);
+    /** @internal A structure the KEM cannot read is bad input, the verdict an unreadable classical
+     * key gets from the runtime import above; a decapsulation that runs and fails is the pair not
+     * deciding. The KEM tells the two apart by its own codes, and so does this. */
+    try { sealed = await compositeKem.encapsulate(spkiDer); }
+    catch (e) {
+      if (_isKemStructureFault(e)) throw _err("key/bad-input", "the public key could not be read", e);
+      throw _err("key/unsupported-algorithm", "the key pair could not be exercised to decide whether its two halves correspond", e);
+    }
+    try { opened = await compositeKem.decapsulate(privDer, sealed.ciphertext); }
+    catch (e2) {
+      if (_isKemStructureFault(e2)) throw _err("key/bad-input", "the private key could not be read", e2);
+      throw _err("key/unsupported-algorithm", "the key pair could not be exercised to decide whether its two halves correspond", e2);
+    }
     return guard.crypto.constantTimeEqual(opened, sealed.sharedSecret);
-  } catch (e) {
-    throw _err("key/unsupported-algorithm", "the key pair could not be exercised to decide whether its two halves correspond", e);
   } finally {
     guard.secret.zeroizeAll([sealed && sealed.sharedSecret, opened], KeyError, "key/bad-input", "the correspondence probe secrets");
   }
 }
 
+var _KEM_STRUCTURE_FAULTS = _assign(_create(null), { "kem/bad-key": 1, "kem/bad-input": 1, "kem/bad-algorithm": 1, "kem/bad-ciphertext": 1 });
+
+/** @internal Whether a KEM error says the key or ciphertext could not be READ, as opposed to a
+ * decapsulation that ran and failed. */
+function _isKemStructureFault(e) {
+  return !!(e && e.isPkiError === true && _KEM_STRUCTURE_FAULTS[guard.text.keyOf(e.code)] === 1);
+}
+
 async function publicFromPrivate(privateKey, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.publicFromPrivate options");
   guard.identifier.assertKnownKeys(opts, _PUBLIC_FROM_PRIVATE_OPTS, _err, "key/bad-input",
@@ -860,13 +896,15 @@ function _pssSalt(a, b) {
 
 async function correspondsTo(privateKey, spkiDer) {
   var privDer = await _toPrivateKeyDer(privateKey);
+  var spki = _bufferFrom(spkiDer);
   var compositeOid = _compositeKemOidOf(privDer);
-  if (compositeOid !== null) return _compositeCorrespondsTo(privDer, _bufferFrom(spkiDer), compositeOid);
-  /** @internal Whether the two halves are finite-field Diffie-Hellman is answered from their
-   * algorithm identifiers before either structure is validated: a DH structure's validation proves
-   * its modulus prime, and a half of another family is not a pair with it whatever it states, so
-   * that proof is never run to say so. */
-  if (_isDhOid(_algorithmOidAt(privDer, 1)) !== _isDhOid(_algorithmOidAt(_bufferFrom(spkiDer), 0))) return false;
+  if (compositeOid !== null) return _compositeCorrespondsTo(privDer, spki, compositeOid);
+  /** @internal The private half is read FIRST, whatever the public half names: a private key that
+   * cannot be read is bad input, and a caller tells that apart from a pair that is not one. Only
+   * then is the family question asked, from the two identifiers, before the public structure is
+   * validated: a composite or a finite-field half against a half of another family is not a pair
+   * whatever it states, so the runtime is never asked to read a structure it cannot, and a DH
+   * structure's validation, which proves its modulus prime, is never run to say so. */
   var priv, pub;
   /** @internal The PKCS #3 rewrite of an X9.42 private key is this function's own copy of the
    * exponent, wiped once the runtime holds the key. */
@@ -876,7 +914,10 @@ async function correspondsTo(privateKey, spkiDer) {
     try { priv = nodeCrypto.createPrivateKey({ key: privAsPkcs3, format: "der", type: "pkcs8" }); }
     catch (e) { throw _err("key/bad-input", "the private key could not be read", e); }
   } finally { if (privAsPkcs3 !== privDer) guard.secret.zeroize(privAsPkcs3, KeyError, "key/bad-input", "the rewritten private key"); }
-  var pubAsPkcs3 = _dhAsPkcs3(_bufferFrom(spkiDer), 0, "the public key's");
+  var publicOid = _algorithmOidAt(spki, 0);
+  if (publicOid !== null && compositeKem.isCompositeKem(publicOid)) return false;
+  if (_isDhOid(_algorithmOidAt(privDer, 1)) !== _isDhOid(publicOid)) return false;
+  var pubAsPkcs3 = _dhAsPkcs3(spki, 0, "the public key's");
   _assertDhWithin(pubAsPkcs3, 0, "the public key's");
   try { pub = nodeCrypto.createPublicKey({ key: pubAsPkcs3, format: "der", type: "spki" }); }
   catch (e) { throw _err("key/bad-input", "the public key could not be read", e); }
@@ -1000,6 +1041,7 @@ module.exports = {
   x942Domain: x942Domain,   // @internal
   pkcs3Params: pkcs3Params,   // @internal
   isDhOid: _isDhOid,   // @internal
+  algorithmOidAt: _algorithmOidAt,   // @internal
   assertDhOperandsWithin: assertDhOperandsWithin,   // @internal
   assertDhDomainCoherent: assertDhDomainCoherent,   // @internal
   assertDhGeneratorOrder: assertDhGeneratorOrder,   // @internal

package/lib/smime.js

@@ -41,7 +41,9 @@ var schemaX509 = require("./schema-x509.js");
 var pkix = require("./schema-pkix.js");
 var oid = require("./oid.js");
 var guard = require("./guard-all.js");
+var pkiBuild = require("./pki-build.js");
 var C = require("./constants.js");
+var nodeUtil = require("util");
 var nodeCrypto = require("crypto");
 
 var SmimeError = frameworkError.SmimeError;
@@ -322,9 +324,130 @@ function _legacyHpSurface(canon, outerEnt, mode, enabled) {
 var SAN_OID = oid.byName("subjectAltName");
 var SMTP_UTF8_MAILBOX = oid.byName("smtpUtf8Mailbox");
 var EMAIL_ADDRESS_ATTR = oid.byName("emailAddress");
+var EMAIL_PROTECTION_OID = oid.byName("emailProtection");
+var ANY_EKU_OID = oid.byName("anyExtendedKeyUsage");
+var DESCRIPTOR_MAX_PROTOTYPES = 32;
+var DESCRIPTOR_MAX_FIELDS = 64;
 var _extNs = pkix.makeNS("smime", SmimeError, oid);
 var _extDecoders = pkix.certExtensionDecoders(_extNs);
 var _extCtx = Object.assign(Object.create(null), { E: function (c, m, cause) { return new SmimeError(c, m, cause); }, oid: oid });
+
+/** @internal A signer certificate fit to sign mail. RFC 8550 sec. 4.4.2: a receiving agent "MUST
+ * NOT accept the signature of a message if it was verified using a certificate that contains a key
+ * usage extension without at least one of the digitalSignature or nonRepudiation bits set", and
+ * sec. 4.4.4: if the extended key usage extension is present, a receiving agent "MUST check that it
+ * contains either the id-kp-emailProtection OID or the anyExtendedKeyUsage OID". A message signed
+ * under such a certificate is refused by every conforming reader, so it is not produced. An absent
+ * extension permits signing: sec. 4.4.2 has a reader presume both bits, and sec. 4.4.4 lets a
+ * certificate with no extended key usage sign. */
+function _assertSignerFitForMail(certDer, position) {
+  var parsed;
+  try { parsed = schemaX509.parse(certDer); }
+  catch (e) { throw _err("smime/bad-input", "signer " + position + "'s certificate is not a well-formed X.509 certificate", e); }
+  var label = "signer " + position + "'s certificate";
+  var ku = pkix.keyUsageOf(_extNs, parsed, _err, "smime/bad-signer-certificate", label);
+  if (ku !== null && !(ku.digitalSignature === true || ku.nonRepudiation === true)) {
+    throw _err("smime/bad-signer-certificate", label + " carries a keyUsage extension with neither digitalSignature nor nonRepudiation, and a receiving agent must not accept a signature under it (RFC 8550 sec. 4.4.2)");
+  }
+  var purposes = pkix.extKeyUsageOf(_extNs, parsed, _err, "smime/bad-signer-certificate", label);
+  if (purposes !== null && !guard.list.contains(purposes, EMAIL_PROTECTION_OID) && !guard.list.contains(purposes, ANY_EKU_OID)) {
+    throw _err("smime/bad-signer-certificate", label + " carries an extendedKeyUsage extension with neither emailProtection nor anyExtendedKeyUsage, and a receiving agent must check for one of them (RFC 8550 sec. 4.4.4)");
+  }
+}
+
+/** @internal The signer descriptors as this verb read them, held to the rule above before anything
+ * is signed, and handed on to pki.cms.sign as the SAME values: every field a descriptor carries, own
+ * or inherited, is read once with the descriptor as its receiver into a record, and the certificate
+ * is the DER it coerced to, so a `cert` accessor cannot answer one certificate to this check and
+ * another to the signing beneath, and an accessor over private state answers to the object it was
+ * defined for. A single descriptor is the list of one pki.cms.sign accepts. Anything that is not a
+ * descriptor travels as given, for pki.cms.sign to refuse in its own words. */
+function _snapshotSignersFitForMail(signers) {
+  /** @internal A proxy, as the list or as a descriptor, is refused before anything trusts what its
+   * traps answer, as the toolkit's guarded snapshots refuse one; nothing is read through it. A
+   * sparse list is refused at its first missing slot, as pki.cms.sign refuses it, before any slot
+   * is visited; a list whose own faults surface is this verb's error too. */
+  if (nodeUtil.types.isProxy(signers)) throw _err("smime/bad-input", "the signer list must not be a proxy");
+  var list;
+  try { list = Array.isArray(signers) ? pkiBuild.reqDenseArray(signers, "the signer list", _err, "smime/bad-input") : [signers]; }
+  catch (e) {
+    if (e instanceof SmimeError) throw e;
+    throw _err("smime/bad-input", "the signer list could not be read", e);
+  }
+  var out = [];
+  for (var i = 0; i < list.length; i++) {
+    var s = list[i];
+    /** @internal An object or a function is a descriptor pki.cms.sign reads. An absent one travels
+     * as given for pki.cms.sign to refuse in its own words; a primitive is refused here, since the
+     * only fields it could answer with are ones a built-in prototype was made to carry. */
+    if (s === null || s === undefined) { guard.list.append(out, s); continue; }
+    if (typeof s !== "object" && typeof s !== "function") throw _err("smime/bad-input", "signer " + (i + 1) + " is not a signer descriptor (an object carrying cert and key)");
+    if (nodeUtil.types.isProxy(s)) throw _err("smime/bad-input", "signer " + (i + 1) + " must not be a proxy");
+    var copy = _readDescriptor(s, i + 1);
+    /** @internal The one read of `cert`, whatever it answered: an absent certificate stays absent,
+     * so an accessor cannot answer nothing here and a certificate to the signing beneath. A present
+     * one is an owned copy of the bytes, not a view, since a later descriptor's accessor runs after
+     * this check and could rewrite a buffer the caller still holds. */
+    if (copy.cert != null) {
+      /** @internal A certificate that cannot be read, in either encoding, is this verb's bad
+       * input, never the PEM codec's own code. */
+      try { copy.cert = guard.bytes.snapshot(pkix.coerceToDer(copy.cert, { pemLabel: "CERTIFICATE", PemError: SmimeError, ErrorClass: SmimeError, prefix: "smime" }), SmimeError, "smime/bad-input", "signer " + (i + 1) + "'s certificate"); }
+      catch (e) { throw _err("smime/bad-input", "signer " + (i + 1) + "'s certificate could not be read as DER or PEM", e); }
+      _assertSignerFitForMail(copy.cert, i + 1);
+    }
+    guard.list.append(out, copy);
+  }
+  return out;
+}
+
+/** @internal Whether a prototype-level property is a method: a data property holding a function. */
+function _isMethod(proto, name) {
+  var d = Object.getOwnPropertyDescriptor(proto, name);
+  return !!d && !d.get && !d.set && typeof d.value === "function";
+}
+
+/** @internal Every named field of a descriptor, own or inherited up to the built-in roots (the
+ * object and function prototypes carry no descriptor field, and the function one carries accessors
+ * that throw on being read), read once with the descriptor as receiver into a record with no
+ * prototype. An accessor that throws is a caller fault reported in this verb's class. */
+function _readDescriptor(s, position) {
+  var copy = Object.create(null), seen = Object.create(null), fields = 0;
+  try {
+    /** @internal The descriptor's own level carries every key, Symbol-keyed and `constructor`
+     * included, as the caller set them; a prototype level's `constructor` is the class, not a
+     * field. A descriptor carries a handful of fields, so one answering more than the cap is
+     * refused before they are read. */
+    var symbols = Object.getOwnPropertySymbols(s);
+    for (var y = 0; y < symbols.length; y++) {
+      if (++fields > DESCRIPTOR_MAX_FIELDS) throw _err("smime/bad-input", "signer " + position + " carries more than " + DESCRIPTOR_MAX_FIELDS + " fields");
+      copy[symbols[y]] = s[symbols[y]];
+    }
+    /** @internal The walk is bounded: a proxy may answer itself, or another visited object, as its
+     * prototype, and a chain has a depth no descriptor reaches. A prototype level's methods are
+     * the class's, not signer fields: neither copied nor counted. */
+    var visited = [], depth = 0;
+    for (var proto = s; proto !== null && proto !== Object.prototype && proto !== Function.prototype; proto = Object.getPrototypeOf(proto)) {
+      if (visited.indexOf(proto) !== -1 || ++depth > DESCRIPTOR_MAX_PROTOTYPES) {
+        throw _err("smime/bad-input", "signer " + position + "'s prototype chain is cyclic or deeper than " + DESCRIPTOR_MAX_PROTOTYPES);
+      }
+      if (nodeUtil.types.isProxy(proto)) throw _err("smime/bad-input", "signer " + position + " must not inherit from a proxy");
+      guard.list.append(visited, proto);
+      var names = Object.getOwnPropertyNames(proto);
+      for (var n = 0; n < names.length; n++) {
+        var name = names[n];
+        if ((name === "constructor" && proto !== s) || seen[name] === 1) continue;
+        if (proto !== s && _isMethod(proto, name)) continue;
+        seen[name] = 1;
+        if (++fields > DESCRIPTOR_MAX_FIELDS) throw _err("smime/bad-input", "signer " + position + " carries more than " + DESCRIPTOR_MAX_FIELDS + " fields");
+        copy[name] = s[name];
+      }
+    }
+  } catch (e) {
+    if (e instanceof SmimeError) throw e;
+    throw _err("smime/bad-input", "signer " + position + " could not be read as a signer descriptor", e);
+  }
+  return copy;
+}
 function _signerEmails(certDer) {
   var out = { addresses: [], unreadable: 0 };
   var parsed = null;
@@ -473,7 +596,14 @@ function _base64Body(der) {
  * Assemble a signed S/MIME message (RFC 8551). `content` is the payload: a raw body wrapped as a
  * `text/plain` entity by default, or the caller's own complete MIME entity when `opts.entity` is set;
  * `signers` is the `pki.cms.sign` signer array (any RSA / RSASSA-PSS / ECDSA / EdDSA / ML-DSA / SLH-DSA
- * signer: the S/MIME layer is algorithm-agnostic). Two forms via `opts.form`:
+ * signer: the S/MIME layer is algorithm-agnostic). Each signer's certificate must be one a conforming
+ * receiving agent accepts a mail signature under: a `keyUsage` extension it carries must assert
+ * `digitalSignature` or `nonRepudiation` (RFC 8550 sec. 4.4.2) and an `extendedKeyUsage` extension it
+ * carries must include `emailProtection` or `anyExtendedKeyUsage` (sec. 4.4.4); a certificate with neither
+ * extension signs, and one failing either rule is refused with `smime/bad-signer-certificate`. The rule is
+ * about the certificate the message carries: a key-only signer (`{ key, spki, keyIdentifier }`, the form
+ * RFC 8550 sec. 3 permits where correspondents hold each other's certificates by other means) carries none,
+ * and the reader holds the certificate it supplies to the same rule. Two forms via `opts.form`:
  *   - `"multipart"` (default, clear-signed): a `multipart/signed` message carrying the canonical entity
  *     verbatim in the first part and a DETACHED CMS SignedData (`application/pkcs7-signature`) over its
  *     canonical form in the second, with `protocol="application/pkcs7-signature"` + a matching `micalg`.
@@ -505,6 +635,7 @@ function _base64Body(der) {
 async function sign(content, signers, opts) {
   opts = opts || {};
   opts = _knownOpts(opts, SIGN_OPTS, "sign");
+  signers = _snapshotSignersFitForMail(signers);
   var hp = opts.protectHeaders === true;
   var hpList = hp ? _hpHeaderList(opts.headers) : null;
   var outerList = hp ? _outerHeaderList(hpList, "clear", opts.hcp) : null;
@@ -553,7 +684,7 @@ function _capped(msg) {
  * certificates, so `valid` says the signature is sound under one of them and nothing about who signed.
  * Name the roots you accept in `opts.trustAnchors` and `trusted` says every signer chained to one,
  * validated for EMAIL, at both ends of the chain. The signer certificate must carry the
- * `emailProtection` key purpose (RFC 8551 sec. 4.4.4), because a certificate restricted to `serverAuth`
+ * `emailProtection` key purpose (RFC 8550 sec. 4.4.4), because a certificate restricted to `serverAuth`
  * chains to its root perfectly well and is still the wrong key to have signed a message; and the anchor's
  * own trust metadata must permit that purpose, because a root distributed with NSS trust bits can be
  * marked untrusted for email while remaining a good TLS root. Override either with `opts.requiredEku`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.7.40",
+  "version": "0.7.42",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:19ec3e74-60d4-4102-bfdf-50fadfa1aeaa",
+  "serialNumber": "urn:uuid:bc84167a-c3b5-4455-9b3b-6a818f51a616",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-12T19:13:54.735Z",
+    "timestamp": "2026-09-12T22:42:58.983Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.7.40",
+      "bom-ref": "@blamejs/pki@0.7.42",
       "type": "application",
       "name": "pki",
-      "version": "0.7.40",
+      "version": "0.7.42",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.7.40",
+      "purl": "pkg:npm/%40blamejs/pki@0.7.42",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.7.40",
+      "ref": "@blamejs/pki@0.7.42",
       "dependsOn": []
     }
   ]