@blamejs/pki 0.7.45 → 0.8.1

package/CHANGELOG.md

@@ -4,6 +4,61 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.1 — 2026-09-19
+
+CMS gains its last RFC 5652 content type, and the OID registry names every curve a certificate can declare.
+
+### Added
+
+- `pki.cms.digest(content, opts)` builds an RFC 5652 DigestedData under SHA-256, SHA-384 or SHA-512, attached or detached, and returns DER or PEM. `pki.cms.verifyDigest(message, opts)` recomputes the digest and compares it in constant time, returning `{ valid, digestAlgorithm, content, contentType }` with `code` set to `cms/digest-mismatch` when the content does not match. The verdict carries no signer and no trusted field: a DigestedData establishes that content matches a digest and nothing about who produced either, so its worth is the worth of the channel the two traveled over. Use `pki.cms.sign` to establish origin, or `pki.cms.authenticate` to establish it under a shared key.
+- `pki.schema.cms.parse` decodes a DigestedData ContentInfo instead of reporting it unparsed, and enforces the RFC 5652 section 7 version rule across fields: version 0 when the encapsulated content type is id-data, version 2 otherwise. A version that disagrees with the content type is `cms/bad-version`.
+- The OID registry names thirty-three elliptic curves, covering RFC 5480 section 2.1.1.1, RFC 5639 section 4.1 and secp256k1. `pki.oid.name` and `pki.oid.byName` resolve each in both directions, under the name `node:crypto` knows the curve by.
+
+### Changed
+
+- A `lint/cabf-tls/weak-key` finding raised against a non-approved elliptic curve names that curve in its context; the field was null for every curve outside the approved three. `pki.inspect.certificate` prints an `ASN1 OID:` line for those curves as well. Neither changes what the crypto engine accepts: importing a key on a curve the engine does not carry still fails with `webcrypto/not-supported`.
+
+### Fixed
+
+- A digest AlgorithmIdentifier carrying parameters that are neither absent nor DER NULL is refused with `cms/unsupported-algorithm` on the two paths that read one without checking it: the `digestAlgorithm` of a DigestedData, and the `digestAlgorithm` beside the `macAlgorithm` of an AuthenticatedData, which `pki.cms.decrypt` reads to check the message-digest attribute. RFC 5754 section 2 allows only those two forms, so a parameter value that is neither does not name the algorithm the message claims; both paths would otherwise have reported the content verified or authenticated under it. The `macAlgorithm` beside it, and every SignerInfo digest, were already held to the rule.
+
+### Documentation
+
+- `pki.path.validate` documents `opts.verifier`, which replaces the built-in signature check with `verifier.verify({ cert, workingPublicKey, workingPublicKeyAlgorithm, workingPublicKeyParameters })`. It is how a chain on a curve the engine does not carry, such as a brainpool one, is validated. It replaces the signature step alone: the RSA key-strength floor and every other RFC 5280 check still apply.
+- `pki.hpke` is described as carrying the three ML-KEM suites alongside the four DHKEM suites, which is what shipped.
+- The reference site at pkijs.com renders all 256 documented primitives; 46 of them reached no page. A page is identified by its URL, and a page built from two source files kept only one of them, so `pki.x509.sign`, the seven `pki.smime` verbs, `pki.tsp.sign` and every `pki.schema.*` parser were documented in the source and absent from the site. The symbol search and the API index resolve a primitive the same way the page does, so a search result and the section it links to agree.
+- Roadmap rows that claimed capability the code does not have are corrected. RFC 6961 multi-stapling, RFC 6979 deterministic (EC)DSA and the RFC 5915 `ECPrivateKey` structure are not implemented. A distinguished name is emitted as an RFC 4514 string and is not read back from one. AES-CCM content encryption parses but is not produced. The OpenSSL interop statement names the seven algorithm arms it covers rather than claiming all of them. No registry rows are reserved for FN-DSA or HQC. The CMC rows record that RFC 5272, RFC 5273 and RFC 5274 were obsoleted by RFC 10002, RFC 10003 and RFC 10004 in July 2026, which the shipped surface predates. The CVE-2022-0778 row states that a named curve is required when a key is imported to verify with, not when a certificate is parsed, since parsing stays deliberately permissive so a non-conforming certificate can be inspected and linted.
+
+## v0.8.0 — 2026-09-19
+
+Verification is held to the rules signing already applied.
+
+### Added
+
+- `pki.C.LIMITS.OID_MAX_SUBIDENTIFIERS` (128) bounds how many sub-identifiers an OBJECT IDENTIFIER may carry, alongside the existing per-sub-identifier octet bound.
+- `pki.C.LIMITS.RSA_MIN_MODULUS_BITS` (2048) and `pki.path.validate` option `minRsaModulusBits`, which may only raise the floor.
+- `allowWeakDigests` on `pki.cms.verify`, `pki.smime.verify` and `pki.tsp.verify`, for verifying an archived signature made under a digest that is no longer collision resistant.
+
+### Changed
+
+- `pki.cms.verify` reports a SignerInfo whose message digest is SHA-1 as `cms/weak-digest` instead of verifying it, and does the same for a countersignature at any nesting depth. `pki.smime.verify` and `pki.tsp.verify` inherit this through the same signature check. Pass `allowWeakDigests: true` to verify an archived signature under it. A message digest of MD5, MD4 or MD2 is reported `cms/unsupported-algorithm` and the opt-in does not apply, there being no verification path for those digests. The RFC 3161 message imprint is unaffected: that digest is the requester's choice and an archived timestamp under SHA-1 remains readable.
+- `pki.path.validate` refuses an RSA issuer key below 2048 bits with `path/weak-key`. Raise the floor with `minRsaModulusBits`; it cannot be lowered.
+- A key the crypto engine cannot import now reports `path/unsupported-algorithm` instead of `path/bad-signature`, so a certificate on a curve the engine does not carry no longer reads as forged.
+- `pki.webcrypto.subtle.importKey("spki", ...)` refuses an ECDSA or ECDH key whose parameters are explicit domain parameters or the implicitlyCA form, as RFC 5480 section 2.1.1 requires a namedCurve. Certificate parsing still accepts such a key so it can be inspected and linted.
+- `lint/rfc5280/ski-missing` and `lint/rfc5280/aki-missing` are graded `error` rather than `notice`, matching the RFC 5280 section 4.2.1.1 and 4.2.1.2 MUST clauses and the grade the CRL profile already gives the same absence. `lint/rfc5280/ski-missing-ee` is graded `warn`, its clause being a SHOULD. A pipeline gating on `--severity error` will see findings it did not see before.
+- A `PkiError` whose reason is `timeout` carries `permanent: false`, so a caller can decide to retry from the error itself rather than from a code list of its own. The reason is read without its domain, so a timeout raised by a protocol client under its own prefix (`acme/timeout`, `est/timeout`) carries the flag too. Every other code stays `permanent: true`, including a proxy that refuses CONNECT with a definite status.
+
+### Fixed
+
+- Reading an OBJECT IDENTIFIER with more than 128 sub-identifiers throws `oid/too-many-subidentifiers` rather than expanding it. Each sub-identifier costs a bignum and a decimal string, so a 400 KB certificate carrying one such OID cost 55 MB of memory to parse and the ceiling scaled with the 16 MiB input bound. Every format parser reads OIDs through the bounded reader. Encoding is held to the same count, so a value the reader refuses cannot be produced. The generic `pki.asn1.decode` still returns such a value as an opaque primitive node, which allocates nothing beyond the input.
+- `pki.cms.sign` and `pki.cms.countersign` over more than 16 MiB of buffered content threw an untyped `RangeError` instead of a `PkiError`.
+- A CRL extension is decoded only in the scope RFC 5280 defines it for: `cRLNumber` at CRL scope (section 5.2.3), `reasonCode` and `invalidityDate` in a revoked-certificate entry (sections 5.3.1 and 5.3.2). An extension carried in the other scope is left with its raw value, as an unrecognized non-critical extension should be, instead of failing the whole CRL when its value does not parse as that type.
+- The `pki.cms.verify` reference example built a signature with `detached` in the signer descriptor, where it is ignored; the example produced an attached SignedData while describing a detached one.
+
+### Documentation
+
+- SECURITY.md states that the toolkit matches no reference identity: name constraints reach the name forms a certificate carries plus the `emailAddress` synthesis RFC 5280 section 4.2.1.10 requires, and a `dNSName` constraint does not reach a subject `commonName`. RFC 9525 section 1.3 retires `commonName` as a source of hostname identity.
+
 ## v0.7.45 — 2026-09-13
 
 A signature-protected CMP message fills an omitted sender with the signer's subject.

package/index.js

@@ -99,6 +99,7 @@ module.exports = {
   // and exporting the module wholesale would put it on the public surface.
   cms:       { verify: cms.verify, sign: cms.sign, countersign: cms.countersign, encrypt: cms.encrypt,
     authenticate: cms.authenticate, decrypt: cms.decrypt, compress: cms.compress, decompress: cms.decompress,
+    digest: cms.digest, verifyDigest: cms.verifyDigest,
     certsOnly: cms.certsOnly, parseCertsOnly: cms.parseCertsOnly, isCertsOnly: cms.isCertsOnly },
   smime:     smime,
   // `cmc` interprets an RFC 5272 Full PKI Response into one terminal verdict;
@@ -160,7 +161,8 @@ module.exports = {
   shbs:      shbs,
   // `hpke` is RFC 9180 Hybrid Public Key Encryption -- the KEM + HKDF key
   // schedule + AEAD context construction behind TLS ECH / MLS / OHTTP. Pure
-  // composition over node:crypto; the classical DHKEM suites, all four modes.
+  // composition over node:crypto; the four DHKEM suites and the three ML-KEM
+  // suites, all four modes.
   hpke:      hpke,
   // `kem` is composite ML-KEM key establishment (draft-ietf-lamps-pq-composite-kem):
   // pki.kem.encapsulate / decapsulate over a post-quantum ML-KEM hybridized with a

package/lib/asn1-der.js

@@ -483,6 +483,10 @@ function decodeOidContent(buf) {
         "OID sub-identifier exceeds " + constants.LIMITS.OID_MAX_SUBIDENTIFIER_BYTES + " octets");
     }
     if ((b & 0x80) === 0) {
+      if (arcs.length >= constants.LIMITS.OID_MAX_SUBIDENTIFIERS) {
+        throw new OidError("oid/too-many-subidentifiers",
+          "OBJECT IDENTIFIER carries more than " + constants.LIMITS.OID_MAX_SUBIDENTIFIERS + " sub-identifiers");
+      }
       var value = 0n;
       for (var k = arcStart; k <= i; k++) value = value * 128n + BigInt(buf[k] & 0x7f);
       arcs.push(value);
@@ -777,7 +781,7 @@ function intToDer(v) {
 }
 
 function encodeOidContent(dotted) {
-  guard.identifier.assertCanonicalOid(dotted, _oidErr, "oid/bad-input", "OID", "oid/bad-arc");
+  guard.identifier.assertCanonicalOid(dotted, _oidErr, "oid/bad-input", "OID", "oid/bad-arc", "oid/too-many-subidentifiers");
   var arcs = dotted.split(".").map(function (p) { return BigInt(p); });
   var a1 = arcs[0], a2 = arcs[1];
   var subids = [a1 * 40n + a2].concat(arcs.slice(2));

package/lib/cmc-build.js

@@ -199,8 +199,7 @@ async function _assertTcrPops(requests, popProvenRequest) {
 /** @internal The parameters an algorithm identifier carries, which for these four are absent or NULL. */
 function _assertNoAlgorithmParameters(algId, what) {
   var params = algId.parameters;
-  if (params == null) return;
-  if (params.length === 2 && params[0] === 0x05 && params[1] === 0x00) return;
+  if (guard.der.paramsAbsentOrNull(params)) return;
   throw E("cmc/bad-pop-challenge",
     "the challenge's " + what + " carries a parameter value, and the algorithms RFC 5274 sec. 4.2 " +
     "names take none: they are encoded with the parameters absent or NULL");

package/lib/cms-decrypt.js

@@ -569,7 +569,7 @@ function _explicitSetOf(implicitBytes) {
 var MAC_HASH = intrinsic.assign(intrinsic.create(null), { hmacWithSHA256: "SHA-256", hmacWithSHA384: "SHA-384", hmacWithSHA512: "SHA-512" });
 var DIGEST_WC = intrinsic.assign(intrinsic.create(null), { sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" });
 var MAC_KEY_MIN_OCTETS = 16;
-function _isDerNull(p) { return Buffer.isBuffer(p) && p.length === 2 && p[0] === 0x05 && p[1] === 0x00; }
+function _isDerNull(p) { return guard.der.isNull(p); }
 
 async function _verifyAuthenticatedData(parsed, km, opts) {
   var macAlg = parsed.macAlgorithm;
@@ -583,6 +583,8 @@ async function _verifyAuthenticatedData(parsed, km, opts) {
   if (parsed.authAttrsBytes) {
     var dHash = DIGEST_WC[parsed.digestAlgorithm && parsed.digestAlgorithm.name];
     if (!dHash) throw _err("cms/unsupported-algorithm", "unsupported digestAlgorithm " + JSON.stringify(parsed.digestAlgorithm && parsed.digestAlgorithm.name));
+    guard.der.assertParams(parsed.digestAlgorithm.parameters, "absentOrNull", _err,
+      "cms/unsupported-algorithm", parsed.digestAlgorithm.name + " digestAlgorithm (RFC 5754 sec. 2)");
     preimage = _explicitSetOf(parsed.authAttrsBytes);
     var mdAttr = (parsed.authAttrs || []).filter(function (a) { return a.type === O("messageDigest"); })[0];
     mdCheck = { hash: dHash, declared: asn1.read.octetString(asn1.decode(mdAttr.values[0])) };

package/lib/cms-digest.js

@@ -0,0 +1,191 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * @module     pki.cms
+ * @nav        Messaging
+ * @title      CMS DigestedData
+ * @order      95
+ * @slug       cms-digest
+ *
+ * @intro
+ *   RFC 5652 sec. 7 DigestedData, the integrity-only CMS content type. It carries the
+ *   content, the digest algorithm, and the digest over the content octets. There is no
+ *   signer and no key, so it establishes that content matches a digest and nothing about
+ *   who produced either: its worth is the worth of the channel the message and the digest
+ *   traveled over. `pki.cms.sign` establishes origin, `pki.cms.authenticate` establishes
+ *   origin under a shared key.
+ *
+ *   The version follows the encapsulated type, 0 for `id-data` and 2 for anything else.
+ *   The verifying half recomputes the digest and compares it in constant time, and its
+ *   verdict carries no signer and no trust field, so it cannot be read as a signature.
+ *
+ * @spec RFC 5652 sec. 7
+ * @card
+ *   Build and verify RFC 5652 DigestedData: SHA-256/384/512 over the content octets,
+ *   attached or detached, constant-time comparison, fail-closed.
+ */
+
+var nodeCrypto = require("node:crypto");
+var oid = require("./oid");
+var schemaCms = require("./schema-cms");
+var frameworkError = require("./framework-error");
+var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
+var asn1 = require("./asn1-der");
+var b = asn1.build;
+
+var CmsError = frameworkError.CmsError;
+function _err(code, message, cause) { return new CmsError(code, message, cause); }
+function O(name) { return oid.byName(name); }
+
+var OID_DATA = O("data");
+var OID_DIGESTED_DATA = O("digestedData");
+
+var NODE_DIGEST = intrinsic.assign(intrinsic.create(null), {
+  sha256: "sha256", sha384: "sha384", sha512: "sha512",
+});
+
+var _DIGEST_OPTS = intrinsic.assign(intrinsic.create(null), {
+  digestAlgorithm: 1, contentType: 1, detached: 1, pem: 1,
+});
+var _VERIFY_DIGEST_OPTS = intrinsic.assign(intrinsic.create(null), { content: 1 });
+
+function _digestName(opts) {
+  var name = opts.digestAlgorithm === undefined ? "sha256" : opts.digestAlgorithm;
+  var key = guard.text.keyOf(name);
+  if (!NODE_DIGEST[key]) {
+    throw _err("cms/unsupported-algorithm", "unsupported digest algorithm " + guard.text.showValue(name) +
+      " (sha256 / sha384 / sha512)");
+  }
+  return key;
+}
+
+/**
+ * @primitive  pki.cms.digest
+ * @signature  pki.cms.digest(content, opts?) -> Promise<Buffer|string>
+ * @since      0.8.1
+ * @status     stable
+ * @spec       RFC 5652 sec. 7
+ * @related    pki.cms.verifyDigest, pki.cms.sign, pki.cms.authenticate
+ *
+ * Build an RFC 5652 `DigestedData`: the content, the digest algorithm, and the digest over
+ * the content octets. It carries no signer and no key, so it establishes that content
+ * matches a digest and nothing about who produced either. Use `pki.cms.sign` for origin,
+ * or `pki.cms.authenticate` for origin under a shared key.
+ *
+ * The version follows the encapsulated type, 0 for `id-data` and 2 for anything else.
+ *
+ * @opts
+ *   - `digestAlgorithm` (string) -- `sha256` (default), `sha384` or `sha512`.
+ *   - `contentType` (string) -- the encapsulated content type by OID name, default `data`.
+ *   - `detached` (boolean) -- omit the content, leaving the digest to travel alone.
+ *   - `pem` (boolean) -- return a PEM `CMS` block instead of DER.
+ * @example
+ *   var der = await pki.cms.digest(Buffer.from("hello"));
+ *   (await pki.cms.verifyDigest(der)).valid;   // -> true
+ */
+function digest(content, opts) {
+  return guard.bytes.fixedCall(CmsError, "cms/bad-input", [
+    [content, "content"], [opts, "pki.cms.digest options"],
+  ], _digest);
+}
+
+async function _digest(content, opts) {
+  opts = guard.identifier.optionsObject(opts, _err, "cms/bad-input", "pki.cms.digest options");
+  guard.identifier.assertKnownKeys(opts, _DIGEST_OPTS, _err, "cms/bad-input",
+    "pki.cms.digest has an unknown option ");
+  var raw = guard.bytes.source(content, CmsError, "cms/bad-input", "content");
+  var alg = _digestName(opts);
+  var ctName = opts.contentType === undefined ? "data" : opts.contentType;
+  var ctOid = O(ctName);
+  if (!ctOid) throw _err("cms/bad-input", "opts.contentType is not a known OID name: " + guard.text.showValue(ctName));
+
+  var value = nodeCrypto.createHash(NODE_DIGEST[alg]).update(raw).digest();
+  var eciChildren = opts.detached === true
+    ? [b.oid(ctOid)]
+    : [b.oid(ctOid), b.explicit(0, b.octetString(raw))];
+  var dd = b.sequence([
+    b.integer(ctOid === OID_DATA ? 0 : 2),
+    b.sequence([b.oid(O(alg))]),
+    b.sequence(eciChildren),
+    b.octetString(value),
+  ]);
+  var ci = b.sequence([b.oid(OID_DIGESTED_DATA), b.explicit(0, dd)]);
+  return opts.pem === true ? schemaCms.pemEncode(ci, "CMS") : ci;
+}
+
+/**
+ * @primitive  pki.cms.verifyDigest
+ * @signature  pki.cms.verifyDigest(input, opts?) -> Promise<verdict>
+ * @since      0.8.1
+ * @status     stable
+ * @spec       RFC 5652 sec. 7
+ * @related    pki.cms.digest, pki.cms.verify
+ *
+ * Recompute the digest of a `DigestedData`'s content and compare it with the digest the
+ * message carries, in constant time. Returns `{ valid, digestAlgorithm, content, contentType }`,
+ * with `code` set to `cms/digest-mismatch` when the content does not match.
+ *
+ * A DigestedData proves neither origin nor authority. A caller that needs either verifies a
+ * `SignedData` instead; this verdict carries no signer and no trust field, so it cannot be
+ * mistaken for one.
+ *
+ * @opts
+ *   - `content` (BufferSource) -- the detached content the digest covers. Required when the
+ *     message omits its own content, refused as redundant when it carries it.
+ * @example
+ *   var der = await pki.cms.digest(Buffer.from("hello"));
+ *   var v = await pki.cms.verifyDigest(der);
+ *   v.valid;             // -> true
+ *   v.digestAlgorithm;   // -> "sha256"
+ */
+function verifyDigest(input, opts) {
+  return guard.bytes.fixedCall(CmsError, "cms/bad-input", [
+    [input, "the CMS message"], [opts, "pki.cms.verifyDigest options"],
+  ], _verifyDigest);
+}
+
+async function _verifyDigest(input, opts) {
+  opts = guard.identifier.optionsObject(opts, _err, "cms/bad-input", "pki.cms.verifyDigest options");
+  guard.identifier.assertKnownKeys(opts, _VERIFY_DIGEST_OPTS, _err, "cms/bad-input",
+    "pki.cms.verifyDigest has an unknown option ");
+  var parsed = guard.parsed.acceptDerived(input, "cms", function (bytes) {
+    return schemaCms.parse(bytes);
+  }, _err, "cms/bad-input", "the DigestedData");
+  if (parsed.contentType !== OID_DIGESTED_DATA) {
+    throw _err("cms/not-a-digested-data", "pki.cms.verifyDigest reads a DigestedData (RFC 5652 sec. 7) and this is " +
+      (oid.name(parsed.contentType) || parsed.contentType));
+  }
+  var alg = guard.text.keyOf(parsed.digestAlgorithm.name || "");
+  if (!NODE_DIGEST[alg]) {
+    throw _err("cms/unsupported-algorithm", "unsupported digest algorithm " +
+      guard.text.showValue(parsed.digestAlgorithm.name || parsed.digestAlgorithm.oid));
+  }
+  guard.der.assertParams(parsed.digestAlgorithm.parameters, "absentOrNull", _err,
+    "cms/unsupported-algorithm", parsed.digestAlgorithm.name + " digest algorithm (RFC 5754 sec. 2)");
+  var embedded = parsed.encapContentInfo.eContent;
+  var supplied = opts.content === undefined ? null
+    : guard.bytes.snapshotSource(opts.content, CmsError, "cms/bad-input", "opts.content");
+  if (embedded != null && supplied != null) {
+    throw _err("cms/bad-input", "the DigestedData carries its own content, so opts.content is redundant");
+  }
+  if (embedded == null && supplied == null) {
+    throw _err("cms/bad-input", "the DigestedData is detached, so opts.content must supply the content it covers");
+  }
+  var covered = embedded != null
+    ? guard.bytes.snapshotSource(embedded, CmsError, "cms/bad-input", "the encapsulated content")
+    : supplied;
+  var recomputed = nodeCrypto.createHash(NODE_DIGEST[alg]).update(covered).digest();
+  var matched = guard.crypto.constantTimeEqual(recomputed, parsed.digest);
+  return guard.verdict.of({
+    valid: matched,
+    code: matched ? undefined : "cms/digest-mismatch",
+    digestAlgorithm: alg,
+    contentType: parsed.encapContentInfo.eContentType,
+    contentTypeName: oid.name(parsed.encapContentInfo.eContentType) || null,
+    content: covered,
+  });
+}
+
+module.exports = { digest: digest, verifyDigest: verifyDigest };

package/lib/cms-verify.js

@@ -38,6 +38,7 @@ var cmsSign = require("./cms-sign");
 var cmsEncrypt = require("./cms-encrypt");
 var cmsDecrypt = require("./cms-decrypt");
 var cmsCompress = require("./cms-compress");
+var cmsDigest = require("./cms-digest");
 var signScheme = require("./sign-scheme");
 var _mldsaDigestSuitable = signScheme.mldsaDigestSuitable;
 var SLHDSA_BY_OID = signScheme.SLHDSA_BY_OID;
@@ -69,6 +70,17 @@ var DIGEST_HASH = intrinsic.assign(intrinsic.create(null), {
   shake128: "SHAKE128", shake256: "SHAKE256",
 });
 var SIG_HASH = intrinsic.assign(intrinsic.create(null), { sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" });
+function _digestOidTable(named) {
+  var t = intrinsic.create(null);
+  intrinsic.forEach(named, function (pair) {
+    var dotted = oid.byName(pair[0]);
+    if (dotted) t[dotted] = pair[1];
+  });
+  return t;
+}
+var WEAK_DIGEST_OIDS = _digestOidTable([["sha1", "SHA-1"]]);
+var UNVERIFIABLE_DIGEST_OIDS = _digestOidTable([["md5", "MD5"], ["md4", "MD4"], ["md2", "MD2"]]);
+var WEAK_SIGNATURE_HASHES = intrinsic.assign(intrinsic.create(null), { "SHA-1": 1 });
 function _supportedDigest(name) { return intrinsic.hasOwn(DIGEST_HASH, name) && !!DIGEST_HASH[name]; }
 async function _computeDigest(name, content) {
   return intrinsic.bufferFrom(await subtle.digest(DIGEST_HASH[name], content));
@@ -94,7 +106,7 @@ var SIG_SCHEME = intrinsic.assign(intrinsic.create(null), {
 ["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
  "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
 ].forEach(function (s) { SIG_SCHEME["id-slh-dsa-" + s] = { kind: "slhdsa", name: "SLH-DSA-" + s.toUpperCase(), params: "absent", sameKeyOid: true, digest: SLHDSA_BY_OID[oid.byName("id-slh-dsa-" + s)].digest }; });
-function _isDerNull(p) { return Buffer.isBuffer(p) && p.length === 2 && p[0] === 0x05 && p[1] === 0x00; }
+function _isDerNull(p) { return guard.der.isNull(p); }
 function _algParamsOk(shape, p) { return shape === "null" ? _isDerNull(p) : (p === null || p === undefined); }
 var EC_CURVE = intrinsic.create(null);
 EC_CURVE[oid.byName("prime256v1")] = { curve: "P-256", coordLen: 32 };
@@ -247,11 +259,21 @@ function _decodeSignedAttrs(setOfBytes) {
   });
 }
 
-async function _verifyOne(si, content, eContentType, parsedCerts, csTarget, digestByName) {
+async function _verifyOne(si, content, eContentType, parsedCerts, csTarget, digestByName, allowWeakDigests) {
   var composite = compositeSig.COMPOSITE_ALGS[si.signatureAlgorithm.oid];
   if (composite) return _verifyComposite(si, composite, content, eContentType, parsedCerts, csTarget, digestByName);
   var scheme = SIG_SCHEME[si.signatureAlgorithm.name];
   if (!scheme) return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "unsupported signature algorithm " + JSON.stringify(si.signatureAlgorithm.name) });
+  var unverifiableDigest = UNVERIFIABLE_DIGEST_OIDS[si.digestAlgorithm.oid];
+  if (unverifiableDigest) {
+    return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid,
+      message: "the " + unverifiableDigest + " message digest is broken and this toolkit does not verify a signature under it" });
+  }
+  var weakDigest = WEAK_DIGEST_OIDS[si.digestAlgorithm.oid];
+  if (!allowWeakDigests && weakDigest) {
+    return _pResolve({ ok: false, code: "cms/weak-digest", sid: si.sid,
+      message: "the " + weakDigest + " message digest is not collision resistant; pass allowWeakDigests to verify an archived signature under it" });
+  }
   var digestHash = SIG_HASH[si.digestAlgorithm.name];
   var pss = scheme.kind === "rsapss" ? _resolvePss(si.signatureAlgorithm.parameters) : null;
   if (scheme.kind === "rsapss" && !pss) return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "unsupported or non-conformant RSASSA-PSS parameters (RFC 4055)" });
@@ -261,6 +283,10 @@ async function _verifyOne(si, content, eContentType, parsedCerts, csTarget, dige
   if (!mldsaNoAttrs && dp !== null && dp !== undefined && !_isDerNull(dp)) return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the " + si.digestAlgorithm.name + " digest algorithm parameters must be absent or DER NULL (RFC 5754 sec. 2)" });
   if ((scheme.kind === "mldsa" || scheme.kind === "slhdsa") && si.signedAttrsBytes && (si.digestAlgorithm.name === "shake128" || si.digestAlgorithm.name === "shake256") && dp !== null && dp !== undefined) return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "a SHAKE digestAlgorithm carries no parameters (RFC 8702 sec. 3.1)" });
   var sigHash = pss ? pss.hash : (scheme.hash || digestHash);
+  if (!allowWeakDigests && WEAK_SIGNATURE_HASHES[sigHash]) {
+    return _pResolve({ ok: false, code: "cms/weak-digest", sid: si.sid,
+      message: "the signature algorithm selects the " + sigHash + " digest, which is not collision resistant; pass allowWeakDigests to verify an archived signature under it" });
+  }
   if ((scheme.kind !== "eddsa" && scheme.kind !== "mldsa" && scheme.kind !== "slhdsa" && !sigHash) || (si.signedAttrsBytes && !_supportedDigest(si.digestAlgorithm.name))) return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "unsupported digest algorithm " + JSON.stringify(si.digestAlgorithm.name) });
   if (scheme.kind === "mldsa" && si.signedAttrsBytes && !_mldsaDigestSuitable(scheme.name, si.digestAlgorithm.name)) return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the " + si.digestAlgorithm.name + " message digest is below the security strength of " + scheme.name + " (RFC 9882 sec. 3.3)" });
   if (scheme.kind === "slhdsa" && si.signedAttrsBytes && si.digestAlgorithm.name !== scheme.digest) return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "SLH-DSA " + scheme.name + " requires the " + scheme.digest + " message digest (RFC 9814 sec. 4)" });
@@ -386,7 +412,7 @@ function _surfaceSignedAttrs(si) {
   });
 }
 
-async function _verifyCountersignatures(si, parsedCerts) {
+async function _verifyCountersignatures(si, parsedCerts, allowWeakDigests) {
   var targetSig = _toBuf(si.signature, "the countersigned signature");
   var values = [];
   intrinsic.forEach(si.unsignedAttrs || [], function (a) {
@@ -394,16 +420,16 @@ async function _verifyCountersignatures(si, parsedCerts) {
     intrinsic.forEach(a.values, function (v) { guard.list.append(values, v && v.bytes ? v.bytes : v); });
   });
   var out = [];
-  for (var _cp = 0; _cp < values.length; _cp++) guard.list.append(out, await _verifyOneCountersig(values[_cp], targetSig, parsedCerts));
+  for (var _cp = 0; _cp < values.length; _cp++) guard.list.append(out, await _verifyOneCountersig(values[_cp], targetSig, parsedCerts, allowWeakDigests));
   return out;
 }
 
-async function _verifyOneCountersig(vDer, targetSig, parsedCerts) {
+async function _verifyOneCountersig(vDer, targetSig, parsedCerts, allowWeakDigests) {
   var csSi;
   try { csSi = cms.walkCountersignature(asn1.decode(intrinsic.isBuffer(vDer) ? vDer : intrinsic.bufferFrom(vDer))); }
   catch (e) { return _row({ ok: false, code: (e instanceof CmsError ? e.code : "cms/bad-countersignature"), message: e && e.message }); }
-  var verdict = await _verifyOne(csSi, targetSig, null, parsedCerts, targetSig);
-  var nested = await _verifyCountersignatures(csSi, parsedCerts);
+  var verdict = await _verifyOne(csSi, targetSig, null, parsedCerts, targetSig, undefined, allowWeakDigests);
+  var nested = await _verifyCountersignatures(csSi, parsedCerts, allowWeakDigests);
   var head = { ok: verdict.ok, sid: verdict.sid, cert: verdict.cert, digestAlgorithm: csSi.digestAlgorithm.name };
   return guard.verdict.of(
     verdict.code ? guard.verdict.of(head, { code: verdict.code }) : head,
@@ -478,7 +504,7 @@ async function _verifyOneCountersig(vDer, targetSig, parsedCerts) {
  *   var cert = await pki.x509.sign({ subject: "Signer", subjectPublicKey: await pki.key.export(pair.publicKey),
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
  *   var detachedBytes = Buffer.from("hello");
- *   var p7sDer = await pki.cms.sign(detachedBytes, { cert: cert, key: key, detached: true });
+ *   var p7sDer = await pki.cms.sign(detachedBytes, { cert: cert, key: key }, { detached: true });
  *   var res = await pki.cms.verify(p7sDer, { content: detachedBytes });
  *   res.valid;                         // boolean
  *   res.signers[0].ok;                 // per-signer verdict
@@ -509,7 +535,7 @@ async function _resolveContentDigests(parsed, streamSource) {
   return byName;
 }
 
-var _VERIFY_OPTS = intrinsic.assign(intrinsic.create(null), { certs: 1, content: 1, trustAnchors: 1, time: 1, requiredEku: 1, checkPurpose: 1 });
+var _VERIFY_OPTS = intrinsic.assign(intrinsic.create(null), { certs: 1, content: 1, trustAnchors: 1, time: 1, requiredEku: 1, checkPurpose: 1, allowWeakDigests: 1 });
 
 function verify(input, opts) {
   return guard.async.deferred(function () { return _verify(input, opts); });
@@ -523,6 +549,7 @@ async function _verify(input, opts) {
   }, _err, "cms/bad-input", "the SignedData");
   if (!Array.isArray(parsed.signerInfos)) throw _err("cms/bad-input", "input is not a CMS SignedData");
   var trustCfg = _snapshotTrust(opts);
+  var allowWeakDigests = opts.allowWeakDigests === true;
   var parsedCerts = [];
   (parsed.certificates || []).forEach(function (c) { _addCert(parsedCerts, c && c.bytes ? c.bytes : c); });
   (opts.certs || []).forEach(function (c) { _addCert(parsedCerts, c); });
@@ -544,8 +571,8 @@ async function _verify(input, opts) {
   var signers = [];
   for (var _sp = 0; _sp < parsed.signerInfos.length; _sp++) {
     var siOne = parsed.signerInfos[_sp];
-    var verdict = await _verifyOne(siOne, content, eContentType, parsedCerts, null, digestByName);
-    var counters = await _verifyCountersignatures(siOne, parsedCerts);
+    var verdict = await _verifyOne(siOne, content, eContentType, parsedCerts, null, digestByName, allowWeakDigests);
+    var counters = await _verifyCountersignatures(siOne, parsedCerts, allowWeakDigests);
     guard.list.append(signers, guard.verdict.of(verdict, {
       countersignatures: counters,
       unsignedAttrs: _surfaceUnsignedAttrs(siOne),
@@ -1094,4 +1121,4 @@ function isCertsOnly(input) {
 }
 
 // @internal
-module.exports = { verify: verify, sign: sign, countersign: countersign, encrypt: encrypt, authenticate: authenticate, decrypt: decrypt, compress: compress, decompress: decompress, certsOnly: certsOnly, parseCertsOnly: parseCertsOnly, isCertsOnly: isCertsOnly, setEngine: setEngine };
+module.exports = { verify: verify, sign: sign, countersign: countersign, encrypt: encrypt, authenticate: authenticate, decrypt: decrypt, compress: compress, decompress: decompress, digest: cmsDigest.digest, verifyDigest: cmsDigest.verifyDigest, certsOnly: certsOnly, parseCertsOnly: parseCertsOnly, isCertsOnly: isCertsOnly, setEngine: setEngine };

package/lib/constants.js

@@ -112,14 +112,17 @@ var LIMITS = Object.assign(Object.create(null), {
   DER_MAX_BYTES: BYTES.mib(16),
   DER_MAX_DEPTH: 64,
   DER_MAX_ITEMS: 4000000,
+  NAMED_SCAN_MAX_ELEMENTS: 16777216,
   MAX_DECODE_DEPTH_CEILING: 256,
   PEM_MAX_BYTES: BYTES.mib(16),
   DER_MAX_INTEGER_BYTES: BYTES.kib(16),
   DH_MAX_MODULUS_BYTES: 512,
   DH_MIN_SUBGROUP_BYTES: 20,
   DH_MIN_MODULUS_BYTES: 256,
+  RSA_MIN_MODULUS_BITS: 2048,
   DH_PRIME_MEMO_ENTRIES: 64,
   OID_MAX_SUBIDENTIFIER_BYTES: 32,
+  OID_MAX_SUBIDENTIFIERS: 128,
   HTTP_MAX_RESPONSE_BYTES: BYTES.mib(24),
   HTTP_AUTH_HEADER_MAX_BYTES: BYTES.kib(8),
   CBOR_MAX_BYTES: BYTES.mib(16),

package/lib/framework-error.js

@@ -18,10 +18,14 @@
  *
  *   `code` is a stable, greppable `domain/reason` string
  *   (`asn1/indefinite-length`, `x509/not-a-certificate`): safe to switch
- *   on and safe to log. Because every failure here is a deterministic
- *   verdict on the bytes in hand (a malformed length, an unknown OID
- *   shape, a truncated certificate), errors are `permanent: true`. The
- *   same input will never parse on retry.
+ *   on and safe to log. A failure that is a deterministic verdict on the
+ *   bytes in hand (a malformed length, an unknown OID shape, a truncated
+ *   certificate) is `permanent: true`: the same input will never parse on
+ *   retry. A failure whose reason is `timeout` is `permanent: false`, so a
+ *   caller can retry on the error rather than on a code list of its own.
+ *   The reason is read without its domain, so the protocol clients that
+ *   raise the same failure under their own prefix (`acme/timeout`,
+ *   `est/timeout`) carry the flag too.
  *
  * @card
  *   `PkiError` base class + `defineClass` factory + the per-domain error
@@ -30,9 +34,17 @@
 
 var intrinsic = require("./guard-intrinsic");
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
+var _strSlice = intrinsic.uncurry(String.prototype.slice);
 var _String = intrinsic.String;
 var _defineProperty = intrinsic.defineProperty;
 
+var _TRANSIENT_REASONS = intrinsic.assign(intrinsic.create(null), { timeout: 1 });
+
+function _reasonOf(c) {
+  for (var i = 0; i < c.length; i++) if (_charCodeAt(c, i) === 47) return _strSlice(c, i + 1);
+  return c;
+}
+
 function _isCodeShape(c) {
   var n = c.length, i, ch, slash = -1;
   if (n < 3) return false;
@@ -79,7 +91,7 @@ class PkiError extends Error {
     }
     this.code = c;
     this.isPkiError = true;
-    this.permanent = true;
+    this.permanent = !_TRANSIENT_REASONS[_reasonOf(c)];
   }
 }
 

package/lib/guard-bytes.js

@@ -6,6 +6,7 @@ var async = require("./guard-async");
 var identifier = require("./guard-identifier");
 var time = require("./guard-time");
 var intrinsic = require("./guard-intrinsic");
+var _NAMED_SCAN_MAX_ELEMENTS = require("./constants").LIMITS.NAMED_SCAN_MAX_ELEMENTS;
 var util = intrinsic.assign(intrinsic.create(null), { types: intrinsic.types });
 var _isArray = intrinsic.isArray;
 var _bufferFrom = intrinsic.bufferFrom;
@@ -358,7 +359,9 @@ function _deep(v, ErrorClass, code, label, cap, depth, collect) {
   }
   if (_isBuffer(v) || _isView(v) || _isArrayBuffer(v)) {
     var bytesCopy = _copyBytesSameKind(v, ErrorClass, code, label, collect);
-    _copyNamed(v, bytesCopy, ErrorClass, code, label, cap, depth, collect);
+    if (bytesCopy.byteLength <= _NAMED_SCAN_MAX_ELEMENTS) {
+      _copyNamed(v, bytesCopy, ErrorClass, code, label, cap, depth, collect);
+    }
     return bytesCopy;
   }
   if (require("./guard-parsed").isRecordedAsProduced(v)) return v;   // allow:inline-require -- circular load: guard-parsed requires this module

package/lib/guard-der.js

@@ -7,6 +7,7 @@ var _freeze = require("./guard-intrinsic").freeze;
 var _forEach = require("./guard-intrinsic").forEach;
 var _sizeOf = require("./guard-intrinsic").sizeOf;
 var _create = require("./guard-intrinsic").create;
+var _isBuffer = require("./guard-intrinsic").isBuffer;
 
 var asn1 = null;
 function _asn1() { if (asn1 === null) asn1 = require("./asn1-der"); return asn1; }
@@ -84,4 +85,28 @@ function tlv(content, E, code, label) {
   return content;
 }
 
-module.exports = _freeze({ element: element, tlv: tlv });
+// @enforced-by guard-shape-reinlined
+// @guard-shape \[0\] === 0x05
+function isNull(params) {
+  return _isBuffer(params) && _sizeOf(params) === 2 && params[0] === 0x05 && params[1] === 0x00;
+}
+
+// @enforced-by behavioral -- absence has no rename-proof shape; the RED vector per verb is the guard
+function paramsAbsentOrNull(params) {
+  return params === null || params === undefined || isNull(params);
+}
+
+// @enforced-by behavioral -- see paramsAbsentOrNull.
+function assertParams(params, shape, E, code, label) {
+  var ok = shape === "null" ? isNull(params) : (shape === "absent"
+    ? (params === null || params === undefined)
+    : paramsAbsentOrNull(params));
+  if (ok) return params;
+  throw E(code, "the " + label + " parameters must be " + (shape === "null"
+    ? "DER NULL" : (shape === "absent" ? "absent" : "absent or DER NULL")));
+}
+
+module.exports = _freeze({
+  element: element, tlv: tlv,
+  isNull: isNull, paramsAbsentOrNull: paramsAbsentOrNull, assertParams: assertParams,
+});

package/lib/guard-identifier.js

@@ -2,6 +2,7 @@
 // Copyright (c) blamejs contributors
 "use strict";
 var intrinsic = require("./guard-intrinsic");
+var constants = require("./constants");
 var util = intrinsic.assign(intrinsic.create(null), { types: intrinsic.types });
 // @internal
 
@@ -60,7 +61,7 @@ function _isDottedDecimal(str) {
 }
 
 // @enforced-by behavioral -- string-form OID canonicalization has no rename-proof
-function assertCanonicalOid(str, E, code, label, boundsCode) {
+function assertCanonicalOid(str, E, code, label, boundsCode, countCode) {
   var who = label || "OID";
   if (typeof str !== "string" || !_isDottedDecimal(str)) {
     throw E(code, who + " must be a canonical dotted-decimal OID string of two or more arcs with no leading-zero component");
@@ -68,6 +69,9 @@ function assertCanonicalOid(str, E, code, label, boundsCode) {
   if (boundsCode === null) return str;
   var bcode = boundsCode === undefined ? code : boundsCode;
   var parts = _strSplit(str, ".");
+  if (parts.length - 1 > constants.LIMITS.OID_MAX_SUBIDENTIFIERS) {
+    throw E(countCode || bcode, who + " carries more than " + constants.LIMITS.OID_MAX_SUBIDENTIFIERS + " sub-identifiers");
+  }
   var root = _BigInt(parts[0]);
   var second = _BigInt(parts[1]);
   if (root > 2n) throw E(bcode, who + " root arc must be 0, 1, or 2 (X.660)");

package/lib/lint.js

@@ -46,6 +46,12 @@ var MS_PER_DAY = C.TIME.days(1);
 var LintError = frameworkError.LintError;
 function _cfg(code, message, cause) { return new LintError(code, message, cause); }
 
+function _sameName(a, b) {
+  if (!a || !b || !a.rdns || !b.rdns) return false;
+  try { return guard.name.dnEqual(a.rdns, b.rdns, _cfg, "lint/bad-input", "distinguished name") === true; }
+  catch (_e) { return a.dn === b.dn; }
+}
+
 var NS = pkix.makeNS("lint", LintError, oid);
 var EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
 
@@ -368,15 +374,15 @@ var RFC5280_RULES = [
     },
   },
   {
-    id: "lint/rfc5280/ski-missing", severity: "notice", source: "rfc5280", citation: "RFC 5280 4.2.1.2",
-    message: "a CA certificate should carry a subjectKeyIdentifier extension",
+    id: "lint/rfc5280/ski-missing", severity: "error", source: "rfc5280", citation: "RFC 5280 4.2.1.2",
+    message: "a CA certificate must carry a subjectKeyIdentifier extension",
     appliesTo: function (cert, ctx) { var bc = ctx.decode("basicConstraints"); return !!(bc && bc.value && bc.value.cA === true); },
     check: function (cert, ctx) { return ctx.raw("subjectKeyIdentifier") ? null : true; },
   },
   {
-    id: "lint/rfc5280/aki-missing", severity: "notice", source: "rfc5280", citation: "RFC 5280 4.2.1.1",
-    message: "a non-self-issued certificate should carry an authorityKeyIdentifier extension",
-    appliesTo: function (cert) { return !!(cert.issuer && cert.subject && cert.issuer.dn !== cert.subject.dn); },
+    id: "lint/rfc5280/aki-missing", severity: "error", source: "rfc5280", citation: "RFC 5280 4.2.1.1",
+    message: "a non-self-issued certificate must carry an authorityKeyIdentifier extension",
+    appliesTo: function (cert) { return !!(cert.issuer && cert.subject) && !_sameName(cert.issuer, cert.subject); },
     check: function (cert, ctx) { return ctx.raw("authorityKeyIdentifier") ? null : true; },
   },
   {
@@ -466,7 +472,7 @@ var RFC5280_RULES = [
     },
   },
   {
-    id: "lint/rfc5280/ski-missing-ee", severity: "notice", source: "rfc5280", citation: "RFC 5280 4.2.1.2",
+    id: "lint/rfc5280/ski-missing-ee", severity: "warn", source: "rfc5280", citation: "RFC 5280 4.2.1.2",
     message: "an end-entity certificate should carry a subjectKeyIdentifier extension",
     appliesTo: function (cert, ctx) { var bc = ctx.decode("basicConstraints"); return !(bc && bc.value && bc.value.cA === true); },
     check: function (cert, ctx) { return ctx.raw("subjectKeyIdentifier") ? null : true; },

package/lib/oid.js

@@ -208,6 +208,7 @@ var FAMILIES = Object.assign(Object.create(null), {
     "pbeWithSHAAnd128BitRC2-CBC": 5, "pbeWithSHAAnd40BitRC2-CBC": 6 } },
 
   rsadsiDigest: { base: [1, 2, 840, 113549, 2], of: {
+    md2: 2, md4: 4, md5: 5,
     hmacWithSHA1: 7, hmacWithSHA224: 8, hmacWithSHA256: 9,
     hmacWithSHA384: 10, hmacWithSHA512: 11 } },
 
@@ -264,12 +265,19 @@ var FAMILIES = Object.assign(Object.create(null), {
     asymmDecryptKeyID: 54, certificationRequestInfoTemplate: 61, extensionReqTemplate: 62 } },
 
   ansiX962: { base: [1, 2, 840, 10045], of: {
-    ecPublicKey: [2, 1], prime256v1: [3, 1, 7],
+    ecPublicKey: [2, 1], prime192v1: [3, 1, 1], prime256v1: [3, 1, 7],
     ecdsaWithSHA256: [4, 3, 2], ecdsaWithSHA384: [4, 3, 3], ecdsaWithSHA512: [4, 3, 4] } },
 
-  secg: { base: [1, 3, 132, 0], of: { secp384r1: 34, secp521r1: 35 } },
+  secg: { base: [1, 3, 132, 0], of: {
+    sect163k1: 1, sect163r1: 2, secp256k1: 10, sect163r2: 15, sect283k1: 16, sect283r1: 17,
+    sect233k1: 26, sect233r1: 27, secp192k1: 31, secp224k1: 32, secp224r1: 33,
+    secp384r1: 34, secp521r1: 35, sect409k1: 36, sect409r1: 37, sect571k1: 38, sect571r1: 39 } },
 
-  brainpool: { base: [1, 3, 36, 3, 3, 2, 8, 1, 1], of: { brainpoolP256r1: 7, brainpoolP384r1: 11 } },
+  brainpool: { base: [1, 3, 36, 3, 3, 2, 8, 1, 1], of: {
+    brainpoolP160r1: 1, brainpoolP160t1: 2, brainpoolP192r1: 3, brainpoolP192t1: 4,
+    brainpoolP224r1: 5, brainpoolP224t1: 6, brainpoolP256r1: 7, brainpoolP256t1: 8,
+    brainpoolP320r1: 9, brainpoolP320t1: 10, brainpoolP384r1: 11, brainpoolP384t1: 12,
+    brainpoolP512r1: 13, brainpoolP512t1: 14 } },
 
   edwards: { base: [1, 3, 101], of: { X25519: 110, X448: 111, Ed25519: 112, Ed448: 113 } },
 

package/lib/path-validate.js

@@ -70,7 +70,10 @@ var edwardsPoint = require("./edwards-point");
 var PathError = errors.PathError;
 function E(code, message, cause) { return new PathError(code, message, cause); }
 function pathCode(e, fallback) {
-  return (e && typeof e.code === "string" && e.code.indexOf("path/") === 0) ? e.code : fallback;
+  if (!e || typeof e.code !== "string") return fallback;
+  if (e.code.indexOf("path/") === 0) return e.code;
+  if (e.code === "webcrypto/not-supported" || e.code === "webcrypto/data") return "path/unsupported-algorithm";
+  return fallback;
 }
 
 var contains = guard.list.contains;
@@ -151,6 +154,7 @@ _sig("id-ml-dsa-87", { name: "ML-DSA-87" }, { name: "ML-DSA-87" }, "absent", fal
 _sig("id-alg-hss-lms-hashsig", { name: "HSS-LMS" }, null, "absent", false, true).shbs = true;
 
 var OID_RSA_PSS = oid.byName("rsassaPss");
+var OID_RSA_ENCRYPTION = oid.byName("rsaEncryption");
 var OID_MGF1 = oid.byName("mgf1");
 var HASH_BY_OID = intrinsic.create(null);
 HASH_BY_OID[oid.byName("sha256")] = "SHA-256";
@@ -216,7 +220,7 @@ function resolveRsaPss(paramsBytes) {
   return { verify: { name: "RSA-PSS", saltLength: saltLength }, imp: { name: "RSA-PSS", hash: hash } };
 }
 
-function isDerNull(p) { return p && p.length === 2 && p[0] === 0x05 && p[1] === 0x00; }
+function isDerNull(p) { return guard.der.isNull(p); }
 
 function resolveDescriptor(sigAlg) {
   if (sigAlg.oid === OID_RSA_PSS) return resolveRsaPss(sigAlg.parameters);
@@ -344,6 +348,49 @@ function _shbsVerify(spkiBytes, sigBytes, message) {
   } catch (e) { return guard.verdict.of({ ok: false, code: pathCode(e, "path/bad-signature"), error: e }); }
 }
 
+function _weakIssuerKey(state) {
+  var spkiBytes = state.workingPublicKey;
+  var isRsa;
+  try { isRsa = _issuerKeyIsRsa(spkiBytes); }
+  catch (_e) { return null; }
+  if (!isRsa) return null;
+  var bits;
+  try { bits = _rsaModulusBits(spkiBytes); }
+  catch (_e) { bits = null; }
+  if (bits === null) {
+    return E("path/weak-key",
+      "the issuer's key names an RSA algorithm and its modulus cannot be read, so its strength cannot be established");
+  }
+  var floor = state.minRsaModulusBits || constants.LIMITS.RSA_MIN_MODULUS_BITS;
+  if (bits >= floor) return null;
+  return E("path/weak-key", "the issuer's RSA modulus is " + bits + " bits, below the " + floor + "-bit minimum");
+}
+
+function _issuerKeyIsRsa(spkiBytes) {
+  if (!spkiBytes || !spkiBytes.length) return false;
+  var kids = pkix.rootSequenceChildren(asn1.decode(spkiBytes), 2, 2);
+  if (!kids) return false;
+  var algKids = pkix.rootSequenceChildren(kids[0], 1);
+  if (!algKids) return false;
+  var keyAlg = asn1.read.oid(algKids[0]);
+  return keyAlg === OID_RSA_ENCRYPTION || keyAlg === OID_RSA_PSS;
+}
+
+function _rsaModulusBits(spkiBytes) {
+  var spki = asn1.decode(spkiBytes);
+  var keyBits = asn1.read.bitString(spki.children[1]);
+  var innerKids = pkix.rootSequenceChildren(asn1.decode(keyBits.bytes), 1);
+  if (!innerKids) return null;
+  var modulus = innerKids[0].content;
+  if (!modulus || !modulus.length) return null;
+  var i = 0;
+  while (i < modulus.length && modulus[i] === 0) i += 1;
+  if (i >= modulus.length) return 0;
+  var top = modulus[i], topBits = 0;
+  while (top > 0) { topBits += 1; top >>= 1; }
+  return (modulus.length - i - 1) * 8 + topBits;
+}
+
 function builtinVerify(state, cert) {
   var d;
   try {
@@ -702,6 +749,7 @@ function initialize(certs, params, seeds, anchor) {
     validPolicyTree: rootNode(),
     policyNodeCount: 1,
     maxPolicyNodes: params.maxPolicyNodes !== undefined ? params.maxPolicyNodes : constants.LIMITS.PATH_MAX_POLICY_NODES,
+    minRsaModulusBits: params.minRsaModulusBits !== undefined ? params.minRsaModulusBits : constants.LIMITS.RSA_MIN_MODULUS_BITS,
     permittedGenerations: intrinsic.filter(seeds.permittedGenerations, function (g) { return g.length > 0; }),
     excludedSubtrees: seeds.excluded,
     explicitPolicy: params.initialExplicitPolicy ? 0 : n + 1,
@@ -779,7 +827,7 @@ function addChild(state, parent, validPolicy, qualifiers, expectedPolicySet, che
 }
 
 function isNullOrAbsentParams(p) {
-  return p === null || p === undefined || (p.length === 2 && p[0] === 0x05 && p[1] === 0x00);
+  return guard.der.paramsAbsentOrNull(p);
 }
 
 function spliceSpkiParameters(spki, algOid, paramsBytes) {
@@ -969,8 +1017,13 @@ function validateCriticalExtensionStructure(cert) {
  * optional `requiredEku` (key purposes the target's extendedKeyUsage must
  * assert, given as registered OID names or dotted OID strings; an absent
  * extension is unrestricted, RFC 5280 4.2.1.12), and an optional
- * `revocationChecker`. The value-carrying options (`time`, `maxPathCerts`,
- * `maxPolicyNodes`, the subtree seeds, `userInitialPolicySet`, `requiredEku`)
+ * `revocationChecker`. An optional `verifier` replaces the built-in signature
+ * check with `verifier.verify({ cert, workingPublicKey, workingPublicKeyAlgorithm,
+ * workingPublicKeyParameters })`, which is how a chain on a curve the engine does
+ * not carry, such as a brainpool one, is validated. It replaces the signature step
+ * only: the key-strength floor and every other RFC 5280 check still apply.
+ * The value-carrying options (`time`, `maxPathCerts`,
+ * `maxPolicyNodes`, `minRsaModulusBits`, the subtree seeds, `userInitialPolicySet`, `requiredEku`)
  * are validated at the entry point. A mis-shaped value throws `path/bad-input`,
  * so it cannot silently go unapplied. Returns `{ valid, revocationChecked, anchorConstraints,
  * path, results, workingPublicKey, workingPublicKeyAlgorithm,
@@ -1054,7 +1107,7 @@ function validateCriticalExtensionStructure(cert) {
 var _VALIDATE_OPTS = intrinsic.assign(intrinsic.create(null), {
   checkPurpose: 1, ctLogList: 1, ctPolicy: 1, historicalMode: 1, initialAnyPolicyInhibit: 1,
   initialExcludedSubtrees: 1, initialExplicitPolicy: 1, initialPermittedSubtrees: 1,
-  initialPolicyMappingInhibit: 1, maxPathCerts: 1, maxPolicyNodes: 1, requireRevocation: 1,
+  initialPolicyMappingInhibit: 1, maxPathCerts: 1, maxPolicyNodes: 1, minRsaModulusBits: 1, requireRevocation: 1,
   requiredEku: 1, revocationChecker: 1, softFail: 1, time: 1, trustAnchors: 1,
   userInitialPolicySet: 1, verifier: 1
 });
@@ -1100,6 +1153,14 @@ async function validate(path, opts) {
   if (!intrinsic.isArray(path)) throw E("path/bad-input", "validate: path must be an array of certificates");
   var maxCerts = guard.limits.cap(opts.maxPathCerts, "validate: opts.maxPathCerts", constants.LIMITS.PATH_MAX_CERTS, { E: E, code: "path/bad-input", min: 1 });
   if (path.length > maxCerts) throw E("path/bad-input", "validate: the certification path has " + path.length + " certificates, exceeding the maxPathCerts limit (" + maxCerts + ")");
+  if (opts.minRsaModulusBits != null) {
+    if (typeof opts.minRsaModulusBits !== "number" || !intrinsic.isInteger(opts.minRsaModulusBits)) {
+      throw E("path/bad-input", "validate: opts.minRsaModulusBits must be an integer");
+    }
+    if (opts.minRsaModulusBits < constants.LIMITS.RSA_MIN_MODULUS_BITS) {
+      throw E("path/bad-input", "validate: opts.minRsaModulusBits may only raise the " + constants.LIMITS.RSA_MIN_MODULUS_BITS + "-bit minimum, not lower it");
+    }
+  }
   var certs = path.map(function (c, ci) { return coerceCert(c, "validate: path[" + ci + "]"); });
   var n = certs.length;
   if (n < 1) throw E("path/empty-path", "validate: the certification path is empty");
@@ -1178,7 +1239,10 @@ async function validate(path, opts) {
     var checks = [];
 
     var sigRes;
-    if (verifier) {
+    var weak = _weakIssuerKey(state);
+    if (weak) {
+      sigRes = { ok: false, code: "path/weak-key", error: weak };
+    } else if (verifier) {
       var vv;
       try {
         vv = await verifier.verify({

package/lib/schema-cms.js

@@ -100,8 +100,8 @@ var AEAD_ALGS = Object.create(null);
 
 var DEFERRED = new Set([
   oid.byName("data"), oid.byName("signedAndEnvelopedData"),
-  oid.byName("digestedData"),
 ]);
+var OID_DIGESTED_DATA = oid.byName("digestedData");
 var OID_CONTENT_TYPE = oid.byName("contentType");
 var OID_MESSAGE_DIGEST = oid.byName("messageDigest");
 var OID_SIGNING_TIME = oid.byName("signingTime");
@@ -878,6 +878,32 @@ var COMPRESSED_DATA = schema.seq([
   },
 });
 
+var DIGESTED_DATA_VERSION = pkix.versionReader(NS, { "0": 0, "2": 2 });
+
+var DIGESTED_DATA = schema.seq([
+  schema.field("version", DIGESTED_DATA_VERSION),
+  schema.field("digestAlgorithm", ALGORITHM_IDENTIFIER),
+  schema.field("encapContentInfo", ENCAP_CONTENT_INFO),
+  schema.field("digest", schema.octetString()),
+], {
+  assert: "sequence", arity: { exact: 4 }, code: "cms/bad-digested-data", what: "DigestedData",
+  build: function (m, ctx) {
+    var version = m.fields.version.value;
+    var eci = m.fields.encapContentInfo.value.result;
+    var expected = eci.eContentType === OID_DATA ? 0 : 2;
+    if (version !== expected) {
+      throw ctx.E("cms/bad-version", "a DigestedData over " + (ctx.oid.name(eci.eContentType) || eci.eContentType) +
+        " is version " + expected + " (RFC 5652 sec. 7)");
+    }
+    return {
+      version: version,
+      digestAlgorithm: m.fields.digestAlgorithm.value.result,
+      encapContentInfo: eci,
+      digest: m.fields.digest.value,
+    };
+  },
+});
+
 var CONTENT_INFO = schema.seq([
   schema.field("contentType", schema.oidLeaf()),
   schema.field("content", schema.explicit(0, schema.any(), { code: "cms/not-a-content-info" })),
@@ -892,6 +918,7 @@ var CONTENT_INFO = schema.seq([
     else if (ct === OID_AUTH_DATA) inner = AUTHENTICATED_DATA;
     else if (ct === OID_AUTH_ENVELOPED_DATA) inner = AUTH_ENVELOPED_DATA;
     else if (ct === OID_COMPRESSED_DATA) inner = COMPRESSED_DATA;
+    else if (ct === OID_DIGESTED_DATA) inner = DIGESTED_DATA;
     if (inner === null) {
       if (DEFERRED.has(ct)) {
         throw NS.E("cms/unsupported-content-type", (ctx.oid.name(ct) || ct) + " is recognized but not parsed by this build");

package/lib/schema-crl.js

@@ -51,17 +51,19 @@ var TIME = pkix.time(NS);
 
 var CRL_VERSION = pkix.versionReader(NS, { "1": 2 });
 
-function decodeExt(ext) {
+function decodeExt(ext, scope) {
   var value = ext.value;
+  var atCrl = scope !== "entry";
+  var atEntry = scope !== "crl";
   try {
-    if (ext.oid === OID_CRL_NUMBER) {
+    if (ext.oid === OID_CRL_NUMBER && atCrl) {
       value = asn1.read.integer(asn1.decode(ext.value));
       if (value < 0n) throw new Error("cRLNumber must be non-negative (INTEGER 0..MAX)");
-    } else if (ext.oid === OID_REASON_CODE) {
+    } else if (ext.oid === OID_REASON_CODE && atEntry) {
       var reason = asn1.read.enumerated(asn1.decode(ext.value));
       if (!_hasOwn(CRL_REASONS, reason.toString())) throw new Error("undefined CRLReason " + reason.toString());
       value = Number(reason);
-    } else if (ext.oid === OID_INVALIDITY_DATE) {
+    } else if (ext.oid === OID_INVALIDITY_DATE && atEntry) {
       var n = asn1.decode(ext.value);
       if (n.tagClass !== "universal" || n.tagNumber !== TAGS.GENERALIZED_TIME) {
         throw new Error("invalidityDate must be a GeneralizedTime");
@@ -85,7 +87,9 @@ var REVOKED_ENTRY = schema.seq([
       serialNumber: m.fields.userCertificate.value,
       serialNumberHex: m.fields.userCertificate.node.content.toString("hex"),
       revocationDate: m.fields.revocationDate.value,
-      crlEntryExtensions: m.fields.crlEntryExtensions.present ? m.fields.crlEntryExtensions.value.result.map(decodeExt) : [],
+      crlEntryExtensions: m.fields.crlEntryExtensions.present
+        ? m.fields.crlEntryExtensions.value.result.map(function (e) { return decodeExt(e, "entry"); })
+        : [],
     };
   },
 });
@@ -114,7 +118,9 @@ var TBS_CERTLIST = schema.seq([
       thisUpdate: m.fields.thisUpdate.value,
       nextUpdate: m.fields.nextUpdate.present ? m.fields.nextUpdate.value : null,
       revokedCertificates: m.fields.revokedCertificates.present ? m.fields.revokedCertificates.value.result : [],
-      crlExtensions: m.fields.crlExtensions.present ? m.fields.crlExtensions.value.result.map(decodeExt) : [],
+      crlExtensions: m.fields.crlExtensions.present
+        ? m.fields.crlExtensions.value.result.map(function (e) { return decodeExt(e, "crl"); })
+        : [],
       crlExtensionsPresent: m.fields.crlExtensions.present,
     };
   },

package/lib/schema-pkix.js

@@ -280,10 +280,10 @@ function pbkdf2Params(ns) {
       var keyLength = guard.range.positiveInt31(m.fields.keyLength.value, ctx.E, ctx.prefix + "/bad-mac-data", "PBKDF2 keyLength");
       var prf = m.fields.prf.present ? m.fields.prf.value.result : null;
       var pp = prf ? prf.parameters : null;
-      if (prf && prf.oid === hmacSha1 && pp !== null && pp.length === 2 && pp[0] === 0x05 && pp[1] === 0x00) {
+      if (prf && prf.oid === hmacSha1 && pp !== null && guard.der.isNull(pp)) {
         throw ctx.E(ctx.prefix + "/bad-mac-data", "a PBKDF2 prf equal to its DEFAULT algid-hmacWithSHA1 must be omitted (X.690 sec. 11.5, RFC 8018 sec. 5.2)");
       }
-      if (prf && pp !== null && !(pp.length === 2 && pp[0] === 0x05 && pp[1] === 0x00)) {
+      if (prf && pp !== null && !guard.der.isNull(pp)) {
         throw ctx.E(ctx.prefix + "/bad-mac-data", "the PBKDF2 prf parameters must be absent or NULL (RFC 8018 App. B.1)");
       }
       return {
@@ -313,7 +313,7 @@ function pbmac1Params(ns) {
       }
       var scheme = m.fields.messageAuthScheme.value.result;
       var sp = scheme.parameters;
-      if (sp !== null && !(sp.length === 2 && sp[0] === 0x05 && sp[1] === 0x00)) {
+      if (sp !== null && !guard.der.isNull(sp)) {
         throw ctx.E(ctx.prefix + "/bad-mac-data", "the PBMAC1 messageAuthScheme parameters must be absent or NULL (RFC 8018 App. B.1)");
       }
       return {

package/lib/smime.js

@@ -56,7 +56,7 @@ var SIGN_OPTS = Object.assign(Object.create(null), {
 });
 var VERIFY_OPTS = Object.assign(Object.create(null), {
   certs: 1, trustAnchors: 1, time: 1, requiredEku: 1, checkPurpose: 1, strictMicalg: 1,
-  legacyHeaderProtection: 1, expectedSender: 1,
+  legacyHeaderProtection: 1, expectedSender: 1, allowWeakDigests: 1,
 });
 var ENCRYPT_OPTS = Object.assign(Object.create(null), {
   entity: 1, contentType: 1, protectHeaders: 1, headers: 1, hcp: 1,
@@ -758,6 +758,7 @@ async function verify(message, opts) {
     vOpts.checkPurpose = opts.checkPurpose != null ? opts.checkPurpose : "emailProtection";
   }
   if (opts.time !== undefined) vOpts.time = opts.time;
+  if (opts.allowWeakDigests === true) vOpts.allowWeakDigests = true;
   if (_isPkcs7(ct.type, "mime")) {
     if (ct.params["smime-type"] && ct.params["smime-type"] !== "signed-data") throw _err("smime/unsupported-type", "unsupported smime-type " + JSON.stringify(ct.params["smime-type"]) + " (only signed-data)");
     var p7m = _decodeCms(ent);

package/lib/tsp-sign.js

@@ -603,7 +603,7 @@ function _buildTsaChains(leaf, pool) {
  *   res.valid;     // boolean; pass opts.trustAnchors to also chain the TSA cert to a root
  *   res.genTime;   // Date, read from the verified eContent
  */
-var _VERIFY_OPTS = intrinsic.assign(intrinsic.create(null), { certs: 1, trustAnchors: 1, nonce: 1, reqPolicy: 1, revocationChecker: 1 });
+var _VERIFY_OPTS = intrinsic.assign(intrinsic.create(null), { certs: 1, trustAnchors: 1, nonce: 1, reqPolicy: 1, revocationChecker: 1, allowWeakDigests: 1 });
 
 function _anyCritical(extensions) {
   return guard.list.anyMatches(extensions, function (e) { return !!e && !!e.critical; });
@@ -631,7 +631,7 @@ async function verify(token, data, opts) {
   function fail(code, reason) {
     return guard.verdict.of({ valid: false, trusted: false, revocationChecked: revocationChecked, anchorConstraints: anchorConstraints, code: code, reason: reason || null, genTime: tst.genTime, accuracy: tst.accuracy, serialNumber: tst.serialNumber, serialNumberHex: tst.serialNumberHex, policy: tst.policy, policyName: tst.policyName, nonce: tst.nonce, tsa: tst.tsa, tstInfo: tst, signer: null });
   }
-  var cmsRes = await cmsVerify.verify(tokenDer, { certs: opts.certs });
+  var cmsRes = await cmsVerify.verify(tokenDer, { certs: opts.certs, allowWeakDigests: opts.allowWeakDigests === true });
   var signer = cmsRes.signers[0];
   if (!cmsRes.valid) return fail("tsp/bad-signature", signer && (signer.code || signer.message));
   var tsaCertDer = signer && signer.cert;

package/lib/webcrypto.js

@@ -907,6 +907,19 @@ function _preValidatePkcs8(p8, name) {
   validate(innerBytes);
 }
 
+function _preValidateSpki(spki, name) {
+  if (name !== "ECDSA" && name !== "ECDH") return;
+  var params;
+  try {
+    var alg = asn1.decode(spki).children[0];
+    params = alg.children.length > 1 ? alg.children[1] : null;
+  } catch (e) { throw new WebCryptoError("webcrypto/data", "importKey spki: the SubjectPublicKeyInfo is not well-formed", e); }
+  if (params && params.tagClass === "universal" && !params.constructed && params.tagNumber === asn1.TAGS.OBJECT_IDENTIFIER) return;
+  throw new WebCryptoError("webcrypto/data",
+    "importKey spki: an " + name + " key must name its curve as a namedCurve OBJECT IDENTIFIER, " +
+    "and this SubjectPublicKeyInfo carries " + (params ? "explicit domain parameters" : "none") + " (RFC 5480 sec. 2.1.1)");
+}
+
 SubtleCrypto.prototype.importKey = async function importKey(format, keyData, algorithm, extractable, keyUsages) {
   var alg = _normalizeAlg(algorithm, "importKey");
   var usages = keyUsages || [];
@@ -929,6 +942,7 @@ SubtleCrypto.prototype.importKey = async function importKey(format, keyData, alg
 
   if (format === "spki") {
     var spkiBuf = _toBuf(keyData, "importKey spki");
+    _preValidateSpki(spkiBuf, name);
     var pub = _nodeKey(function () { return nodeCrypto.createPublicKey({ key: spkiBuf, format: "der", type: "spki" }); }, "importKey spki");
     return new CryptoKey("public", true, _algFromImport(name, alg, pub), usages, pub);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.7.45",
+  "version": "0.8.1",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:c95b91b1-2249-469b-b641-900d56a9cf3d",
+  "serialNumber": "urn:uuid:e0552083-e17a-4a74-b1fc-ea82fcb57a1e",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-13T00:41:14.691Z",
+    "timestamp": "2026-09-19T23:58:45.411Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.7.45",
+      "bom-ref": "@blamejs/pki@0.8.1",
       "type": "application",
       "name": "pki",
-      "version": "0.7.45",
+      "version": "0.8.1",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.7.45",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.1",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.7.45",
+      "ref": "@blamejs/pki@0.8.1",
       "dependsOn": []
     }
   ]