@blamejs/pki 0.8.0 → 0.8.1

package/CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.1 — 2026-09-19
+
+CMS gains its last RFC 5652 content type, and the OID registry names every curve a certificate can declare.
+
+### Added
+
+- `pki.cms.digest(content, opts)` builds an RFC 5652 DigestedData under SHA-256, SHA-384 or SHA-512, attached or detached, and returns DER or PEM. `pki.cms.verifyDigest(message, opts)` recomputes the digest and compares it in constant time, returning `{ valid, digestAlgorithm, content, contentType }` with `code` set to `cms/digest-mismatch` when the content does not match. The verdict carries no signer and no trusted field: a DigestedData establishes that content matches a digest and nothing about who produced either, so its worth is the worth of the channel the two traveled over. Use `pki.cms.sign` to establish origin, or `pki.cms.authenticate` to establish it under a shared key.
+- `pki.schema.cms.parse` decodes a DigestedData ContentInfo instead of reporting it unparsed, and enforces the RFC 5652 section 7 version rule across fields: version 0 when the encapsulated content type is id-data, version 2 otherwise. A version that disagrees with the content type is `cms/bad-version`.
+- The OID registry names thirty-three elliptic curves, covering RFC 5480 section 2.1.1.1, RFC 5639 section 4.1 and secp256k1. `pki.oid.name` and `pki.oid.byName` resolve each in both directions, under the name `node:crypto` knows the curve by.
+
+### Changed
+
+- A `lint/cabf-tls/weak-key` finding raised against a non-approved elliptic curve names that curve in its context; the field was null for every curve outside the approved three. `pki.inspect.certificate` prints an `ASN1 OID:` line for those curves as well. Neither changes what the crypto engine accepts: importing a key on a curve the engine does not carry still fails with `webcrypto/not-supported`.
+
+### Fixed
+
+- A digest AlgorithmIdentifier carrying parameters that are neither absent nor DER NULL is refused with `cms/unsupported-algorithm` on the two paths that read one without checking it: the `digestAlgorithm` of a DigestedData, and the `digestAlgorithm` beside the `macAlgorithm` of an AuthenticatedData, which `pki.cms.decrypt` reads to check the message-digest attribute. RFC 5754 section 2 allows only those two forms, so a parameter value that is neither does not name the algorithm the message claims; both paths would otherwise have reported the content verified or authenticated under it. The `macAlgorithm` beside it, and every SignerInfo digest, were already held to the rule.
+
+### Documentation
+
+- `pki.path.validate` documents `opts.verifier`, which replaces the built-in signature check with `verifier.verify({ cert, workingPublicKey, workingPublicKeyAlgorithm, workingPublicKeyParameters })`. It is how a chain on a curve the engine does not carry, such as a brainpool one, is validated. It replaces the signature step alone: the RSA key-strength floor and every other RFC 5280 check still apply.
+- `pki.hpke` is described as carrying the three ML-KEM suites alongside the four DHKEM suites, which is what shipped.
+- The reference site at pkijs.com renders all 256 documented primitives; 46 of them reached no page. A page is identified by its URL, and a page built from two source files kept only one of them, so `pki.x509.sign`, the seven `pki.smime` verbs, `pki.tsp.sign` and every `pki.schema.*` parser were documented in the source and absent from the site. The symbol search and the API index resolve a primitive the same way the page does, so a search result and the section it links to agree.
+- Roadmap rows that claimed capability the code does not have are corrected. RFC 6961 multi-stapling, RFC 6979 deterministic (EC)DSA and the RFC 5915 `ECPrivateKey` structure are not implemented. A distinguished name is emitted as an RFC 4514 string and is not read back from one. AES-CCM content encryption parses but is not produced. The OpenSSL interop statement names the seven algorithm arms it covers rather than claiming all of them. No registry rows are reserved for FN-DSA or HQC. The CMC rows record that RFC 5272, RFC 5273 and RFC 5274 were obsoleted by RFC 10002, RFC 10003 and RFC 10004 in July 2026, which the shipped surface predates. The CVE-2022-0778 row states that a named curve is required when a key is imported to verify with, not when a certificate is parsed, since parsing stays deliberately permissive so a non-conforming certificate can be inspected and linted.
+
 ## v0.8.0 — 2026-09-19
 
 Verification is held to the rules signing already applied.

package/index.js

@@ -99,6 +99,7 @@ module.exports = {
   // and exporting the module wholesale would put it on the public surface.
   cms:       { verify: cms.verify, sign: cms.sign, countersign: cms.countersign, encrypt: cms.encrypt,
     authenticate: cms.authenticate, decrypt: cms.decrypt, compress: cms.compress, decompress: cms.decompress,
+    digest: cms.digest, verifyDigest: cms.verifyDigest,
     certsOnly: cms.certsOnly, parseCertsOnly: cms.parseCertsOnly, isCertsOnly: cms.isCertsOnly },
   smime:     smime,
   // `cmc` interprets an RFC 5272 Full PKI Response into one terminal verdict;
@@ -160,7 +161,8 @@ module.exports = {
   shbs:      shbs,
   // `hpke` is RFC 9180 Hybrid Public Key Encryption -- the KEM + HKDF key
   // schedule + AEAD context construction behind TLS ECH / MLS / OHTTP. Pure
-  // composition over node:crypto; the classical DHKEM suites, all four modes.
+  // composition over node:crypto; the four DHKEM suites and the three ML-KEM
+  // suites, all four modes.
   hpke:      hpke,
   // `kem` is composite ML-KEM key establishment (draft-ietf-lamps-pq-composite-kem):
   // pki.kem.encapsulate / decapsulate over a post-quantum ML-KEM hybridized with a

package/lib/cmc-build.js

@@ -199,8 +199,7 @@ async function _assertTcrPops(requests, popProvenRequest) {
 /** @internal The parameters an algorithm identifier carries, which for these four are absent or NULL. */
 function _assertNoAlgorithmParameters(algId, what) {
   var params = algId.parameters;
-  if (params == null) return;
-  if (params.length === 2 && params[0] === 0x05 && params[1] === 0x00) return;
+  if (guard.der.paramsAbsentOrNull(params)) return;
   throw E("cmc/bad-pop-challenge",
     "the challenge's " + what + " carries a parameter value, and the algorithms RFC 5274 sec. 4.2 " +
     "names take none: they are encoded with the parameters absent or NULL");

package/lib/cms-decrypt.js

@@ -569,7 +569,7 @@ function _explicitSetOf(implicitBytes) {
 var MAC_HASH = intrinsic.assign(intrinsic.create(null), { hmacWithSHA256: "SHA-256", hmacWithSHA384: "SHA-384", hmacWithSHA512: "SHA-512" });
 var DIGEST_WC = intrinsic.assign(intrinsic.create(null), { sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" });
 var MAC_KEY_MIN_OCTETS = 16;
-function _isDerNull(p) { return Buffer.isBuffer(p) && p.length === 2 && p[0] === 0x05 && p[1] === 0x00; }
+function _isDerNull(p) { return guard.der.isNull(p); }
 
 async function _verifyAuthenticatedData(parsed, km, opts) {
   var macAlg = parsed.macAlgorithm;
@@ -583,6 +583,8 @@ async function _verifyAuthenticatedData(parsed, km, opts) {
   if (parsed.authAttrsBytes) {
     var dHash = DIGEST_WC[parsed.digestAlgorithm && parsed.digestAlgorithm.name];
     if (!dHash) throw _err("cms/unsupported-algorithm", "unsupported digestAlgorithm " + JSON.stringify(parsed.digestAlgorithm && parsed.digestAlgorithm.name));
+    guard.der.assertParams(parsed.digestAlgorithm.parameters, "absentOrNull", _err,
+      "cms/unsupported-algorithm", parsed.digestAlgorithm.name + " digestAlgorithm (RFC 5754 sec. 2)");
     preimage = _explicitSetOf(parsed.authAttrsBytes);
     var mdAttr = (parsed.authAttrs || []).filter(function (a) { return a.type === O("messageDigest"); })[0];
     mdCheck = { hash: dHash, declared: asn1.read.octetString(asn1.decode(mdAttr.values[0])) };

package/lib/cms-digest.js

@@ -0,0 +1,191 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * @module     pki.cms
+ * @nav        Messaging
+ * @title      CMS DigestedData
+ * @order      95
+ * @slug       cms-digest
+ *
+ * @intro
+ *   RFC 5652 sec. 7 DigestedData, the integrity-only CMS content type. It carries the
+ *   content, the digest algorithm, and the digest over the content octets. There is no
+ *   signer and no key, so it establishes that content matches a digest and nothing about
+ *   who produced either: its worth is the worth of the channel the message and the digest
+ *   traveled over. `pki.cms.sign` establishes origin, `pki.cms.authenticate` establishes
+ *   origin under a shared key.
+ *
+ *   The version follows the encapsulated type, 0 for `id-data` and 2 for anything else.
+ *   The verifying half recomputes the digest and compares it in constant time, and its
+ *   verdict carries no signer and no trust field, so it cannot be read as a signature.
+ *
+ * @spec RFC 5652 sec. 7
+ * @card
+ *   Build and verify RFC 5652 DigestedData: SHA-256/384/512 over the content octets,
+ *   attached or detached, constant-time comparison, fail-closed.
+ */
+
+var nodeCrypto = require("node:crypto");
+var oid = require("./oid");
+var schemaCms = require("./schema-cms");
+var frameworkError = require("./framework-error");
+var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
+var asn1 = require("./asn1-der");
+var b = asn1.build;
+
+var CmsError = frameworkError.CmsError;
+function _err(code, message, cause) { return new CmsError(code, message, cause); }
+function O(name) { return oid.byName(name); }
+
+var OID_DATA = O("data");
+var OID_DIGESTED_DATA = O("digestedData");
+
+var NODE_DIGEST = intrinsic.assign(intrinsic.create(null), {
+  sha256: "sha256", sha384: "sha384", sha512: "sha512",
+});
+
+var _DIGEST_OPTS = intrinsic.assign(intrinsic.create(null), {
+  digestAlgorithm: 1, contentType: 1, detached: 1, pem: 1,
+});
+var _VERIFY_DIGEST_OPTS = intrinsic.assign(intrinsic.create(null), { content: 1 });
+
+function _digestName(opts) {
+  var name = opts.digestAlgorithm === undefined ? "sha256" : opts.digestAlgorithm;
+  var key = guard.text.keyOf(name);
+  if (!NODE_DIGEST[key]) {
+    throw _err("cms/unsupported-algorithm", "unsupported digest algorithm " + guard.text.showValue(name) +
+      " (sha256 / sha384 / sha512)");
+  }
+  return key;
+}
+
+/**
+ * @primitive  pki.cms.digest
+ * @signature  pki.cms.digest(content, opts?) -> Promise<Buffer|string>
+ * @since      0.8.1
+ * @status     stable
+ * @spec       RFC 5652 sec. 7
+ * @related    pki.cms.verifyDigest, pki.cms.sign, pki.cms.authenticate
+ *
+ * Build an RFC 5652 `DigestedData`: the content, the digest algorithm, and the digest over
+ * the content octets. It carries no signer and no key, so it establishes that content
+ * matches a digest and nothing about who produced either. Use `pki.cms.sign` for origin,
+ * or `pki.cms.authenticate` for origin under a shared key.
+ *
+ * The version follows the encapsulated type, 0 for `id-data` and 2 for anything else.
+ *
+ * @opts
+ *   - `digestAlgorithm` (string) -- `sha256` (default), `sha384` or `sha512`.
+ *   - `contentType` (string) -- the encapsulated content type by OID name, default `data`.
+ *   - `detached` (boolean) -- omit the content, leaving the digest to travel alone.
+ *   - `pem` (boolean) -- return a PEM `CMS` block instead of DER.
+ * @example
+ *   var der = await pki.cms.digest(Buffer.from("hello"));
+ *   (await pki.cms.verifyDigest(der)).valid;   // -> true
+ */
+function digest(content, opts) {
+  return guard.bytes.fixedCall(CmsError, "cms/bad-input", [
+    [content, "content"], [opts, "pki.cms.digest options"],
+  ], _digest);
+}
+
+async function _digest(content, opts) {
+  opts = guard.identifier.optionsObject(opts, _err, "cms/bad-input", "pki.cms.digest options");
+  guard.identifier.assertKnownKeys(opts, _DIGEST_OPTS, _err, "cms/bad-input",
+    "pki.cms.digest has an unknown option ");
+  var raw = guard.bytes.source(content, CmsError, "cms/bad-input", "content");
+  var alg = _digestName(opts);
+  var ctName = opts.contentType === undefined ? "data" : opts.contentType;
+  var ctOid = O(ctName);
+  if (!ctOid) throw _err("cms/bad-input", "opts.contentType is not a known OID name: " + guard.text.showValue(ctName));
+
+  var value = nodeCrypto.createHash(NODE_DIGEST[alg]).update(raw).digest();
+  var eciChildren = opts.detached === true
+    ? [b.oid(ctOid)]
+    : [b.oid(ctOid), b.explicit(0, b.octetString(raw))];
+  var dd = b.sequence([
+    b.integer(ctOid === OID_DATA ? 0 : 2),
+    b.sequence([b.oid(O(alg))]),
+    b.sequence(eciChildren),
+    b.octetString(value),
+  ]);
+  var ci = b.sequence([b.oid(OID_DIGESTED_DATA), b.explicit(0, dd)]);
+  return opts.pem === true ? schemaCms.pemEncode(ci, "CMS") : ci;
+}
+
+/**
+ * @primitive  pki.cms.verifyDigest
+ * @signature  pki.cms.verifyDigest(input, opts?) -> Promise<verdict>
+ * @since      0.8.1
+ * @status     stable
+ * @spec       RFC 5652 sec. 7
+ * @related    pki.cms.digest, pki.cms.verify
+ *
+ * Recompute the digest of a `DigestedData`'s content and compare it with the digest the
+ * message carries, in constant time. Returns `{ valid, digestAlgorithm, content, contentType }`,
+ * with `code` set to `cms/digest-mismatch` when the content does not match.
+ *
+ * A DigestedData proves neither origin nor authority. A caller that needs either verifies a
+ * `SignedData` instead; this verdict carries no signer and no trust field, so it cannot be
+ * mistaken for one.
+ *
+ * @opts
+ *   - `content` (BufferSource) -- the detached content the digest covers. Required when the
+ *     message omits its own content, refused as redundant when it carries it.
+ * @example
+ *   var der = await pki.cms.digest(Buffer.from("hello"));
+ *   var v = await pki.cms.verifyDigest(der);
+ *   v.valid;             // -> true
+ *   v.digestAlgorithm;   // -> "sha256"
+ */
+function verifyDigest(input, opts) {
+  return guard.bytes.fixedCall(CmsError, "cms/bad-input", [
+    [input, "the CMS message"], [opts, "pki.cms.verifyDigest options"],
+  ], _verifyDigest);
+}
+
+async function _verifyDigest(input, opts) {
+  opts = guard.identifier.optionsObject(opts, _err, "cms/bad-input", "pki.cms.verifyDigest options");
+  guard.identifier.assertKnownKeys(opts, _VERIFY_DIGEST_OPTS, _err, "cms/bad-input",
+    "pki.cms.verifyDigest has an unknown option ");
+  var parsed = guard.parsed.acceptDerived(input, "cms", function (bytes) {
+    return schemaCms.parse(bytes);
+  }, _err, "cms/bad-input", "the DigestedData");
+  if (parsed.contentType !== OID_DIGESTED_DATA) {
+    throw _err("cms/not-a-digested-data", "pki.cms.verifyDigest reads a DigestedData (RFC 5652 sec. 7) and this is " +
+      (oid.name(parsed.contentType) || parsed.contentType));
+  }
+  var alg = guard.text.keyOf(parsed.digestAlgorithm.name || "");
+  if (!NODE_DIGEST[alg]) {
+    throw _err("cms/unsupported-algorithm", "unsupported digest algorithm " +
+      guard.text.showValue(parsed.digestAlgorithm.name || parsed.digestAlgorithm.oid));
+  }
+  guard.der.assertParams(parsed.digestAlgorithm.parameters, "absentOrNull", _err,
+    "cms/unsupported-algorithm", parsed.digestAlgorithm.name + " digest algorithm (RFC 5754 sec. 2)");
+  var embedded = parsed.encapContentInfo.eContent;
+  var supplied = opts.content === undefined ? null
+    : guard.bytes.snapshotSource(opts.content, CmsError, "cms/bad-input", "opts.content");
+  if (embedded != null && supplied != null) {
+    throw _err("cms/bad-input", "the DigestedData carries its own content, so opts.content is redundant");
+  }
+  if (embedded == null && supplied == null) {
+    throw _err("cms/bad-input", "the DigestedData is detached, so opts.content must supply the content it covers");
+  }
+  var covered = embedded != null
+    ? guard.bytes.snapshotSource(embedded, CmsError, "cms/bad-input", "the encapsulated content")
+    : supplied;
+  var recomputed = nodeCrypto.createHash(NODE_DIGEST[alg]).update(covered).digest();
+  var matched = guard.crypto.constantTimeEqual(recomputed, parsed.digest);
+  return guard.verdict.of({
+    valid: matched,
+    code: matched ? undefined : "cms/digest-mismatch",
+    digestAlgorithm: alg,
+    contentType: parsed.encapContentInfo.eContentType,
+    contentTypeName: oid.name(parsed.encapContentInfo.eContentType) || null,
+    content: covered,
+  });
+}
+
+module.exports = { digest: digest, verifyDigest: verifyDigest };

package/lib/cms-verify.js

@@ -38,6 +38,7 @@ var cmsSign = require("./cms-sign");
 var cmsEncrypt = require("./cms-encrypt");
 var cmsDecrypt = require("./cms-decrypt");
 var cmsCompress = require("./cms-compress");
+var cmsDigest = require("./cms-digest");
 var signScheme = require("./sign-scheme");
 var _mldsaDigestSuitable = signScheme.mldsaDigestSuitable;
 var SLHDSA_BY_OID = signScheme.SLHDSA_BY_OID;
@@ -105,7 +106,7 @@ var SIG_SCHEME = intrinsic.assign(intrinsic.create(null), {
 ["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
  "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
 ].forEach(function (s) { SIG_SCHEME["id-slh-dsa-" + s] = { kind: "slhdsa", name: "SLH-DSA-" + s.toUpperCase(), params: "absent", sameKeyOid: true, digest: SLHDSA_BY_OID[oid.byName("id-slh-dsa-" + s)].digest }; });
-function _isDerNull(p) { return Buffer.isBuffer(p) && p.length === 2 && p[0] === 0x05 && p[1] === 0x00; }
+function _isDerNull(p) { return guard.der.isNull(p); }
 function _algParamsOk(shape, p) { return shape === "null" ? _isDerNull(p) : (p === null || p === undefined); }
 var EC_CURVE = intrinsic.create(null);
 EC_CURVE[oid.byName("prime256v1")] = { curve: "P-256", coordLen: 32 };
@@ -1120,4 +1121,4 @@ function isCertsOnly(input) {
 }
 
 // @internal
-module.exports = { verify: verify, sign: sign, countersign: countersign, encrypt: encrypt, authenticate: authenticate, decrypt: decrypt, compress: compress, decompress: decompress, certsOnly: certsOnly, parseCertsOnly: parseCertsOnly, isCertsOnly: isCertsOnly, setEngine: setEngine };
+module.exports = { verify: verify, sign: sign, countersign: countersign, encrypt: encrypt, authenticate: authenticate, decrypt: decrypt, compress: compress, decompress: decompress, digest: cmsDigest.digest, verifyDigest: cmsDigest.verifyDigest, certsOnly: certsOnly, parseCertsOnly: parseCertsOnly, isCertsOnly: isCertsOnly, setEngine: setEngine };

package/lib/guard-der.js

@@ -7,6 +7,7 @@ var _freeze = require("./guard-intrinsic").freeze;
 var _forEach = require("./guard-intrinsic").forEach;
 var _sizeOf = require("./guard-intrinsic").sizeOf;
 var _create = require("./guard-intrinsic").create;
+var _isBuffer = require("./guard-intrinsic").isBuffer;
 
 var asn1 = null;
 function _asn1() { if (asn1 === null) asn1 = require("./asn1-der"); return asn1; }
@@ -84,4 +85,28 @@ function tlv(content, E, code, label) {
   return content;
 }
 
-module.exports = _freeze({ element: element, tlv: tlv });
+// @enforced-by guard-shape-reinlined
+// @guard-shape \[0\] === 0x05
+function isNull(params) {
+  return _isBuffer(params) && _sizeOf(params) === 2 && params[0] === 0x05 && params[1] === 0x00;
+}
+
+// @enforced-by behavioral -- absence has no rename-proof shape; the RED vector per verb is the guard
+function paramsAbsentOrNull(params) {
+  return params === null || params === undefined || isNull(params);
+}
+
+// @enforced-by behavioral -- see paramsAbsentOrNull.
+function assertParams(params, shape, E, code, label) {
+  var ok = shape === "null" ? isNull(params) : (shape === "absent"
+    ? (params === null || params === undefined)
+    : paramsAbsentOrNull(params));
+  if (ok) return params;
+  throw E(code, "the " + label + " parameters must be " + (shape === "null"
+    ? "DER NULL" : (shape === "absent" ? "absent" : "absent or DER NULL")));
+}
+
+module.exports = _freeze({
+  element: element, tlv: tlv,
+  isNull: isNull, paramsAbsentOrNull: paramsAbsentOrNull, assertParams: assertParams,
+});

package/lib/oid.js

@@ -265,12 +265,19 @@ var FAMILIES = Object.assign(Object.create(null), {
     asymmDecryptKeyID: 54, certificationRequestInfoTemplate: 61, extensionReqTemplate: 62 } },
 
   ansiX962: { base: [1, 2, 840, 10045], of: {
-    ecPublicKey: [2, 1], prime256v1: [3, 1, 7],
+    ecPublicKey: [2, 1], prime192v1: [3, 1, 1], prime256v1: [3, 1, 7],
     ecdsaWithSHA256: [4, 3, 2], ecdsaWithSHA384: [4, 3, 3], ecdsaWithSHA512: [4, 3, 4] } },
 
-  secg: { base: [1, 3, 132, 0], of: { secp384r1: 34, secp521r1: 35 } },
+  secg: { base: [1, 3, 132, 0], of: {
+    sect163k1: 1, sect163r1: 2, secp256k1: 10, sect163r2: 15, sect283k1: 16, sect283r1: 17,
+    sect233k1: 26, sect233r1: 27, secp192k1: 31, secp224k1: 32, secp224r1: 33,
+    secp384r1: 34, secp521r1: 35, sect409k1: 36, sect409r1: 37, sect571k1: 38, sect571r1: 39 } },
 
-  brainpool: { base: [1, 3, 36, 3, 3, 2, 8, 1, 1], of: { brainpoolP256r1: 7, brainpoolP384r1: 11 } },
+  brainpool: { base: [1, 3, 36, 3, 3, 2, 8, 1, 1], of: {
+    brainpoolP160r1: 1, brainpoolP160t1: 2, brainpoolP192r1: 3, brainpoolP192t1: 4,
+    brainpoolP224r1: 5, brainpoolP224t1: 6, brainpoolP256r1: 7, brainpoolP256t1: 8,
+    brainpoolP320r1: 9, brainpoolP320t1: 10, brainpoolP384r1: 11, brainpoolP384t1: 12,
+    brainpoolP512r1: 13, brainpoolP512t1: 14 } },
 
   edwards: { base: [1, 3, 101], of: { X25519: 110, X448: 111, Ed25519: 112, Ed448: 113 } },
 

package/lib/path-validate.js

@@ -220,7 +220,7 @@ function resolveRsaPss(paramsBytes) {
   return { verify: { name: "RSA-PSS", saltLength: saltLength }, imp: { name: "RSA-PSS", hash: hash } };
 }
 
-function isDerNull(p) { return p && p.length === 2 && p[0] === 0x05 && p[1] === 0x00; }
+function isDerNull(p) { return guard.der.isNull(p); }
 
 function resolveDescriptor(sigAlg) {
   if (sigAlg.oid === OID_RSA_PSS) return resolveRsaPss(sigAlg.parameters);
@@ -827,7 +827,7 @@ function addChild(state, parent, validPolicy, qualifiers, expectedPolicySet, che
 }
 
 function isNullOrAbsentParams(p) {
-  return p === null || p === undefined || (p.length === 2 && p[0] === 0x05 && p[1] === 0x00);
+  return guard.der.paramsAbsentOrNull(p);
 }
 
 function spliceSpkiParameters(spki, algOid, paramsBytes) {
@@ -1017,8 +1017,13 @@ function validateCriticalExtensionStructure(cert) {
  * optional `requiredEku` (key purposes the target's extendedKeyUsage must
  * assert, given as registered OID names or dotted OID strings; an absent
  * extension is unrestricted, RFC 5280 4.2.1.12), and an optional
- * `revocationChecker`. The value-carrying options (`time`, `maxPathCerts`,
- * `maxPolicyNodes`, the subtree seeds, `userInitialPolicySet`, `requiredEku`)
+ * `revocationChecker`. An optional `verifier` replaces the built-in signature
+ * check with `verifier.verify({ cert, workingPublicKey, workingPublicKeyAlgorithm,
+ * workingPublicKeyParameters })`, which is how a chain on a curve the engine does
+ * not carry, such as a brainpool one, is validated. It replaces the signature step
+ * only: the key-strength floor and every other RFC 5280 check still apply.
+ * The value-carrying options (`time`, `maxPathCerts`,
+ * `maxPolicyNodes`, `minRsaModulusBits`, the subtree seeds, `userInitialPolicySet`, `requiredEku`)
  * are validated at the entry point. A mis-shaped value throws `path/bad-input`,
  * so it cannot silently go unapplied. Returns `{ valid, revocationChecked, anchorConstraints,
  * path, results, workingPublicKey, workingPublicKeyAlgorithm,

package/lib/schema-cms.js

@@ -100,8 +100,8 @@ var AEAD_ALGS = Object.create(null);
 
 var DEFERRED = new Set([
   oid.byName("data"), oid.byName("signedAndEnvelopedData"),
-  oid.byName("digestedData"),
 ]);
+var OID_DIGESTED_DATA = oid.byName("digestedData");
 var OID_CONTENT_TYPE = oid.byName("contentType");
 var OID_MESSAGE_DIGEST = oid.byName("messageDigest");
 var OID_SIGNING_TIME = oid.byName("signingTime");
@@ -878,6 +878,32 @@ var COMPRESSED_DATA = schema.seq([
   },
 });
 
+var DIGESTED_DATA_VERSION = pkix.versionReader(NS, { "0": 0, "2": 2 });
+
+var DIGESTED_DATA = schema.seq([
+  schema.field("version", DIGESTED_DATA_VERSION),
+  schema.field("digestAlgorithm", ALGORITHM_IDENTIFIER),
+  schema.field("encapContentInfo", ENCAP_CONTENT_INFO),
+  schema.field("digest", schema.octetString()),
+], {
+  assert: "sequence", arity: { exact: 4 }, code: "cms/bad-digested-data", what: "DigestedData",
+  build: function (m, ctx) {
+    var version = m.fields.version.value;
+    var eci = m.fields.encapContentInfo.value.result;
+    var expected = eci.eContentType === OID_DATA ? 0 : 2;
+    if (version !== expected) {
+      throw ctx.E("cms/bad-version", "a DigestedData over " + (ctx.oid.name(eci.eContentType) || eci.eContentType) +
+        " is version " + expected + " (RFC 5652 sec. 7)");
+    }
+    return {
+      version: version,
+      digestAlgorithm: m.fields.digestAlgorithm.value.result,
+      encapContentInfo: eci,
+      digest: m.fields.digest.value,
+    };
+  },
+});
+
 var CONTENT_INFO = schema.seq([
   schema.field("contentType", schema.oidLeaf()),
   schema.field("content", schema.explicit(0, schema.any(), { code: "cms/not-a-content-info" })),
@@ -892,6 +918,7 @@ var CONTENT_INFO = schema.seq([
     else if (ct === OID_AUTH_DATA) inner = AUTHENTICATED_DATA;
     else if (ct === OID_AUTH_ENVELOPED_DATA) inner = AUTH_ENVELOPED_DATA;
     else if (ct === OID_COMPRESSED_DATA) inner = COMPRESSED_DATA;
+    else if (ct === OID_DIGESTED_DATA) inner = DIGESTED_DATA;
     if (inner === null) {
       if (DEFERRED.has(ct)) {
         throw NS.E("cms/unsupported-content-type", (ctx.oid.name(ct) || ct) + " is recognized but not parsed by this build");

package/lib/schema-pkix.js

@@ -280,10 +280,10 @@ function pbkdf2Params(ns) {
       var keyLength = guard.range.positiveInt31(m.fields.keyLength.value, ctx.E, ctx.prefix + "/bad-mac-data", "PBKDF2 keyLength");
       var prf = m.fields.prf.present ? m.fields.prf.value.result : null;
       var pp = prf ? prf.parameters : null;
-      if (prf && prf.oid === hmacSha1 && pp !== null && pp.length === 2 && pp[0] === 0x05 && pp[1] === 0x00) {
+      if (prf && prf.oid === hmacSha1 && pp !== null && guard.der.isNull(pp)) {
         throw ctx.E(ctx.prefix + "/bad-mac-data", "a PBKDF2 prf equal to its DEFAULT algid-hmacWithSHA1 must be omitted (X.690 sec. 11.5, RFC 8018 sec. 5.2)");
       }
-      if (prf && pp !== null && !(pp.length === 2 && pp[0] === 0x05 && pp[1] === 0x00)) {
+      if (prf && pp !== null && !guard.der.isNull(pp)) {
         throw ctx.E(ctx.prefix + "/bad-mac-data", "the PBKDF2 prf parameters must be absent or NULL (RFC 8018 App. B.1)");
       }
       return {
@@ -313,7 +313,7 @@ function pbmac1Params(ns) {
       }
       var scheme = m.fields.messageAuthScheme.value.result;
       var sp = scheme.parameters;
-      if (sp !== null && !(sp.length === 2 && sp[0] === 0x05 && sp[1] === 0x00)) {
+      if (sp !== null && !guard.der.isNull(sp)) {
         throw ctx.E(ctx.prefix + "/bad-mac-data", "the PBMAC1 messageAuthScheme parameters must be absent or NULL (RFC 8018 App. B.1)");
       }
       return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3474a203-558f-4bf4-8d04-ca4aec66e1f7",
+  "serialNumber": "urn:uuid:e0552083-e17a-4a74-b1fc-ea82fcb57a1e",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-19T19:43:19.653Z",
+    "timestamp": "2026-09-19T23:58:45.411Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.0",
+      "bom-ref": "@blamejs/pki@0.8.1",
       "type": "application",
       "name": "pki",
-      "version": "0.8.0",
+      "version": "0.8.1",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.0",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.1",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.0",
+      "ref": "@blamejs/pki@0.8.1",
       "dependsOn": []
     }
   ]