@blamejs/pki 0.8.30 → 0.8.48

package/lib/cms-decrypt.js

@@ -19,6 +19,9 @@ var compositeKem = require("./composite-kem");
 var C = require("./constants");
 var b = asn1.build;
 var subtle = webcrypto.webcrypto.subtle;
+/** @internal The verify operation, captured at load. It checks the AuthenticatedData MAC, and one
+ * answering true accepts content nothing authenticated while returning it as plaintext. */
+var _subtleVerify = intrinsic.uncurry(subtle.verify);
 var CmsError = frameworkError.CmsError;
 var WRAP_KEK_LENGTHS = schemaCms.WRAP_KEK_LENGTHS;
 var KEM_CT_LENGTHS = schemaCms.KEM_CT_LENGTHS;
@@ -61,6 +64,7 @@ async function decryptEnvelopedData(parsed, keyMaterial, opts, contentTypeName)
   for (var ci = 0; ci < candidates.length; ci++) {
     try {
       _assertSupported(candidates[ci].ri, keyMaterial);
+      _assertAuthenticatedOrOptedIn(candidates[ci].ri, eci, opts);
       var cek = await _acquireCek(candidates[ci].ri, keyMaterial, opts);
       try {
         var streamMode = opts.stream === true ? (candidates.length > 1 ? "eager" : "lazy") : null;
@@ -144,7 +148,10 @@ function _ridEq(rid, cert) {
     try { return guard.name.dnEqual(cert.issuer.rdns, rid.issuer.rdns, _err, "cms/bad-input", "recipient issuer") && cert.serialNumber === rid.serialNumber; }
     catch (_e) { return false; }
   }
-  if (rid.subjectKeyIdentifier) { var ski = _skiOf(cert); return !!ski && Buffer.compare(ski, rid.subjectKeyIdentifier) === 0; }
+  /** @internal Through the captured comparator: this answers WHICH recipient a certificate is, and the
+   *  plaintext a caller receives is the one that recipient's key unwraps, so a replacement answering
+   *  zero picks the recipient. */
+  if (rid.subjectKeyIdentifier) { var ski = _skiOf(cert); return !!ski && intrinsic.compare(ski, rid.subjectKeyIdentifier) === 0; }
   return false;
 }
 function _skiOf(cert) {
@@ -157,7 +164,7 @@ function _skiOf(cert) {
 function _kekIdMatches(ri, kekId) {
   var id = ri.kekid && ri.kekid.keyIdentifier;
   if (!id) return false;
-  return Buffer.compare(id, guard.bytes.view(kekId, CmsError, "cms/bad-input", "kekId")) === 0;
+  return intrinsic.compare(id, guard.bytes.view(kekId, CmsError, "cms/bad-input", "kekId")) === 0;
 }
 
 var _passThrough = intrinsic.assign(intrinsic.create(null), { "cms/unsupported-algorithm": 1, "cms/unsupported-recipient-type": 1, "cms/bad-input": 1, "cms/iteration-limit": 1, "cms/missing-key-derivation": 1, "cms/no-encrypted-content": 1, "cms/too-many-recipient-keys": 1 });
@@ -176,6 +183,35 @@ async function _acquireCek(ri, km, opts) {
   throw _err("cms/unsupported-recipient-type", "unsupported recipient type " + ri.type);
 }
 
+/** @internal RSAES-PKCS1-v1_5 key transport over a content with no integrity tag is refused unless the
+ *  caller opts in, and the refusal comes BEFORE the unwrap so no decision depends on whether the unwrap
+ *  conformed. The combination cannot be made both correct and indistinguishable: the CBC padding check is
+ *  the only integrity signal the content offers, so either a failed unwrap is accepted and the verb can
+ *  return the plaintext of a substituted key, or it is refused and acceptance then tells an attacker that
+ *  their chosen ciphertext decoded. MEASURED, 512 chosen ciphertexts per arm against a one-block
+ *  AES-256-CBC content: 2 accepted where the unwrap conformed and 0 where it did not, which is the
+ *  Bleichenbacher distinction at the padding check's own rate of about one in 256.
+ *  THE OPT-IN EXISTS BECAUSE THIS IS WHAT OPENSSL PRODUCES BY DEFAULT. `openssl cms -encrypt` with no
+ *  algorithm named emits exactly `rsaEncryption` with `aes-256-cbc`, decrypts it, and reports
+ *  `ossl_cipher_unpadblock: bad decrypt` on a wrong key, so it leaks the same signal and names the step.
+ *  Refusing outright would make those messages unreadable here, so the default is the safe one and the
+ *  operator who must read them says so. An AEAD content needs no opt-in: the tag rejects a wrong key
+ *  before any plaintext is released, which is why AES-GCM is the encrypt default. RSAES-OAEP needs none
+ *  either, its own padding check being the integrity signal RFC 8017 sec. 7.1 gives it. */
+function _assertAuthenticatedOrOptedIn(ri, eci, opts) {
+  if (opts.allowUnauthenticatedRsa15 === true) return;
+  if (ri.type !== "ktri") return;
+  if (ri.keyEncryptionAlgorithm.oid !== O("rsaEncryption")) return;
+  if (intrinsic.hasOwn(AEAD_ALGS, eci.contentEncryptionAlgorithm.oid)) return;
+  throw _err("cms/unauthenticated-rsa-v15",
+    "this message uses RSAES-PKCS1-v1_5 key transport over a content with no integrity tag (" +
+    (eci.contentEncryptionAlgorithm.name || eci.contentEncryptionAlgorithm.oid) + "), a combination whose " +
+    "only integrity check is the content padding: decrypting it either returns the plaintext of a " +
+    "substituted key or tells an attacker submitting chosen ciphertexts that theirs decoded. Pass " +
+    "allowUnauthenticatedRsa15 to read it anyway, which is what reading an `openssl cms -encrypt` default " +
+    "message needs, or re-encrypt to an AEAD content such as aes-256-gcm");
+}
+
 async function _ktriCek(ri, km) {
   var kea = ri.keyEncryptionAlgorithm;
   var k = _normKeyDer(km.key);
@@ -187,7 +223,7 @@ async function _ktriCek(ri, km) {
     }
     if (kea.oid === O("rsaEncryption")) {
       var keyObj = nodeCrypto.createPrivateKey({ key: k.der, format: "der", type: "pkcs8" });
-      try { return nodeCrypto.privateDecrypt({ key: keyObj, padding: nodeCrypto.constants.RSA_PKCS1_PADDING }, ri.encryptedKey); }
+      try { return nodeCrypto.privateDecrypt({ key: keyObj, padding: guard.crypto.padding.RSA_PKCS1 }, ri.encryptedKey); }
       catch (_e) {
         return null;
       }
@@ -349,6 +385,18 @@ function _assertContentCipherMode(eci, ct) {
   throw _err("cms/unsupported-algorithm", "contentEncryptionAlgorithm " + oidStr + " is an authenticated encryption algorithm, which belongs in an authEnvelopedData rather than a " + ct + " (RFC 5083 sec. 2)");
 }
 
+/** @internal A candidate whose key unwrap did not produce a content key of the right length has FAILED,
+ *  and the decrypt under a substitute runs only so that the failure costs the same work and the same time
+ *  as a success: a recipient whose RSA v1.5 unwrap is implicitly rejected must not be distinguishable from
+ *  one whose key simply does not match. Its result is therefore never a result. Without this the content
+ *  decrypt decided it, and a random substitute key leaves a final CBC block that is valid PKCS#7 padding
+ *  about one time in 256, so a known-bad candidate won that often and the verb returned WRONG PLAINTEXT
+ *  for it while reporting that recipient as the one it used. An AEAD content algorithm rejected it on the
+ *  tag already; this closes the non-AEAD modes, where padding is the only check the content offers. */
+function _assertNotSubstituted(substitute) {
+  if (substitute !== null) throw _fail();
+}
+
 async function _openContent(parsed, eci, cek, ct, streamMode) {
   var alg = eci.contentEncryptionAlgorithm;
   var keyBits = intrinsic.hasOwn(CONTENT_KEYBITS, alg.oid) ? CONTENT_KEYBITS[alg.oid] : 0;
@@ -365,13 +413,32 @@ async function _openContent(parsed, eci, cek, ct, streamMode) {
     if (ct === "authEnvelopedData") {
       var aad = parsed.authAttrsBytes != null ? _explicitSetOf(parsed.authAttrsBytes) : Buffer.alloc(0);
       var pt = _gcmOpen(cek, parsed.aead.nonce, eci.encryptedContent, parsed.mac, aad, keyBits, parsed.aead.icvLen);
+      _assertNotSubstituted(substitute);
       return streamMode ? _bufferChunks(pt) : pt;
     }
     var iv = asn1.read.octetString(asn1.decode(alg.parameters));
     if (iv.length !== 16) throw _fail();
-    if (streamMode === "lazy") return _cbcStream(cek, iv, eci.encryptedContent, keyBits);
-    if (streamMode === "eager") return _bufferChunks(pbes2.cbcDecrypt(cek, iv, eci.encryptedContent, keyBits, CmsError, "cms/decrypt-failed"));
-    return pbes2.cbcDecrypt(cek, iv, eci.encryptedContent, keyBits, CmsError, "cms/decrypt-failed");
+    if (streamMode === "lazy") {
+      var lazy = _cbcStream(cek, iv, eci.encryptedContent, keyBits);
+      /** @internal A substituted candidate streams exactly as any other wrong key does and then fails,
+       *  and all three of those words are load-bearing. On this path a key of the RIGHT length but the
+       *  wrong value yields its garbage chunks and only then fails the padding check, so a substituted
+       *  one that refused at the call, or that yielded nothing, would say which of the two happened, and
+       *  whether the v1.5 padding was valid is exactly what the substitute exists to hide: the stage, the
+       *  chunks and the code all have to match, not just the code. So the decrypt runs, its chunks are
+       *  delivered, and the verdict is a refusal whether or not the padding happened to pass, which is
+       *  what keeps a lucky substitute from becoming an answer. Chunks from a CBC stream are unverified
+       *  until it completes either way, which is why the verdict carries `authenticated: false`. */
+      return substitute !== null ? _streamThenRefuse(lazy) : lazy;
+    }
+    if (streamMode === "eager") {
+      var eager = _bufferChunks(pbes2.cbcDecrypt(cek, iv, eci.encryptedContent, keyBits, CmsError, "cms/decrypt-failed"));
+      _assertNotSubstituted(substitute);
+      return eager;
+    }
+    var buffered = pbes2.cbcDecrypt(cek, iv, eci.encryptedContent, keyBits, CmsError, "cms/decrypt-failed");
+    _assertNotSubstituted(substitute);
+    return buffered;
   } catch (e) {
     if (e instanceof CmsError && e.code !== "cms/decrypt-failed") throw e;
     throw _fail();
@@ -401,6 +468,34 @@ async function* _translateCbcStream(engineIter) {
   try { for await (var chunk of engineIter) yield chunk; }
   catch (_e) { throw _fail(); }
 }
+/** @internal Everything the inner stream yields, then a refusal, for a candidate the implicit rejection
+ *  substituted for on the lazy path. The chunks and the stage are then the ones any other wrong key on
+ *  that path produces, and the refusal does not wait on the padding check to decide, so a substitute
+ *  whose final block happens to be valid padding is still refused. */
+async function* _streamThenRefuse(inner) {
+  /** @internal One chunk of lookahead, so the chunk COUNTS match too and not merely the code and the
+   *  stage. An ordinary wrong key's stream yields the padded content less its final block and then
+   *  refuses, the final block never arriving because the padding check is what rejects it. A substitute
+   *  whose final block happens to be valid padding, about one time in 256, instead COMPLETES and yields
+   *  that last stripped chunk, which is a chunk no wrong key ever emits: forwarding it would say the
+   *  substitute was lucky, and a one-in-256 signal is still a signal. So the last chunk is held back, and
+   *  released only on the path where a wrong key would also have produced everything it produced. */
+  /** @internal The held chunk lives in a list of at most one, so releasing it is `yield*` and needs no
+   *  test: an empty list yields nothing. The branch a test would need is reachable, the inner stream
+   *  rejecting on its first read when the content length is not a block multiple, so the test would be
+   *  load-bearing rather than defensive; expressing the absence as an empty list removes the question. */
+  var held = [];
+  try {
+    for await (var chunk of inner) {
+      yield* held;
+      held = [chunk];
+    }
+  } catch (_e) {
+    yield* held;
+    throw _fail();
+  }
+  throw _fail();
+}
 
 async function _decryptEncryptedData(parsed, km, opts) {
   var eci = parsed.encryptedContentInfo;
@@ -607,7 +702,7 @@ async function _verifyAuthenticatedData(parsed, km, opts) {
       if (macKey == null || macKey.length < MAC_KEY_MIN_OCTETS) macSubstitute = nodeCrypto.randomBytes(MAC_KEY_MIN_OCTETS);
       try {
         var key = await subtle.importKey("raw", macSubstitute || macKey, { name: "HMAC", hash: hash }, false, ["verify"]);
-        if (!(await subtle.verify({ name: "HMAC" }, key, Buffer.from(parsed.mac), preimage))) throw _fail();
+        if (!(await _subtleVerify(subtle, { name: "HMAC" }, key, Buffer.from(parsed.mac), preimage))) throw _fail();
         if (mdCheck) {
           var actual = Buffer.from(await subtle.digest(mdCheck.hash, content));
           if (!actual.equals(mdCheck.declared)) throw _fail();

package/lib/cms-encrypt.js

@@ -374,12 +374,28 @@ var _AUTHENTICATE_OPTS_BARE = intrinsic.assign(intrinsic.create(null), {
   keyIdentifier: 1, oaepHash: 1, ukm: 1, pem: 1,
 });
 
+/** @internal A byte content is fixed first, ahead of the recipients and the options. Copying either of
+ *  those reads the caller's own objects, so a property on one of them is caller code that runs before
+ *  the content would otherwise have been read, and over a view it could replace what gets encrypted
+ *  after this verb had accepted the content it was handed. The discriminator is a type test, which reads
+ *  no property and so cannot be that accessor itself. A streamed content has no fixed form here: it is
+ *  read through its iterator, which `_encryptImpl` probes only after the options have been copied, and
+ *  is held to the same rule where it is consumed. */
 function encrypt(content, recipients, opts) {
-  return guard.bytes.fixedCall(CmsError, "cms/bad-input", [
-    [recipients, "recipients"], [opts, "pki.cms.encrypt options"],
-  ], function (recipientsCopy, optsCopy) {
-    return _encryptImpl(content, recipientsCopy, optsCopy);
-  });
+  if (!guard.bytes.isByteSource(content)) {
+    return guard.bytes.fixedCall(CmsError, "cms/bad-input",
+      [[recipients, "recipients"], [opts, "pki.cms.encrypt options"]],
+      function (recipientsCopy, optsCopy) { return _encryptImpl(content, recipientsCopy, optsCopy); });
+  }
+  /** @internal The argument list is written out rather than assembled from a shorter one. Built with
+   *  `Array.prototype.concat`, the list a fixed call fixes was chosen by that method: a replacement
+   *  could keep the caller's recipients and options and put OTHER bytes in the content slot, and this
+   *  verb then encrypted those. A literal is not a dispatch, so there is nothing to replace. */
+  return guard.bytes.fixedCall(CmsError, "cms/bad-input",
+    [[content, "content"], [recipients, "recipients"], [opts, "pki.cms.encrypt options"]],
+    function (contentCopy, recipientsCopy, optsCopy) {
+      return _encryptImpl(contentCopy, recipientsCopy, optsCopy);
+    });
 }
 
 async function _encryptImpl(content, recipients, opts) {
@@ -395,6 +411,9 @@ async function _encryptImpl(content, recipients, opts) {
           : "");
     });
   var contentStream = guard.bytes.asyncStreamOf(content);
+  /** @internal A view is enough here: `encrypt` fixed a byte content at the door, ahead of the recipient
+   *  and option copies, so these bytes are already this module's own and no caller accessor reaches
+   *  them. */
   var contentBytes = contentStream ? null : guard.bytes.view(content, CmsError, "cms/bad-input", "content");
   var contentType = opts.contentType || "data";
   var cek = nodeCrypto.randomBytes(ca.keyBits / 8);
@@ -565,7 +584,32 @@ var MAC_ALGS = intrinsic.assign(intrinsic.create(null), {
 var MAC_KEY_OCTETS = 32;
 var SUPPORTED_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: 1, sha384: 1, sha512: 1 });
 
-async function authenticate(content, recipients, opts) {
+/** @internal The same door `encrypt` has, and for the same reason. This verb reads the caller's options
+ *  before anything else, to decide whether authenticated attributes are built, so an accessor there is
+ *  caller code that runs before the content would otherwise have been read; a getter on a recipient runs
+ *  later, while the RecipientInfos are built. Over a view of the content either one could replace what
+ *  the message authenticates and carries, after this verb had accepted the content it was handed, so a
+ *  byte content is fixed first and the recipients and options are copies from there on. Closing one of
+ *  those two routes and not the other leaves the rule holding for the argument that was looked at. The
+ *  discriminator is a type test, which reads no property and so cannot be the accessor itself; a content
+ *  that is not a byte source is passed through and refused where it is read, as before. */
+function authenticate(content, recipients, opts) {
+  if (!guard.bytes.isByteSource(content)) {
+    return guard.bytes.fixedCall(CmsError, "cms/bad-input",
+      [[recipients, "recipients"], [opts, "pki.cms.authenticate options"]],
+      function (recipientsCopy, optsCopy) { return _authenticateImpl(content, recipientsCopy, optsCopy); });
+  }
+  /** @internal Written out for the reason `encrypt` above gives: a list assembled by a live
+   *  `Array.prototype.concat` is a list that method chooses, and here it decides which bytes the MAC
+   *  is computed over. */
+  return guard.bytes.fixedCall(CmsError, "cms/bad-input",
+    [[content, "content"], [recipients, "recipients"], [opts, "pki.cms.authenticate options"]],
+    function (contentCopy, recipientsCopy, optsCopy) {
+      return _authenticateImpl(contentCopy, recipientsCopy, optsCopy);
+    });
+}
+
+async function _authenticateImpl(content, recipients, opts) {
   opts = opts || {};
   var withAttrs = opts.authenticatedAttributes !== false;
   guard.identifier.assertKnownKeys(opts, withAttrs ? _AUTHENTICATE_OPTS_ATTRS : _AUTHENTICATE_OPTS_BARE,
@@ -575,6 +619,9 @@ async function authenticate(content, recipients, opts) {
           ? " with authenticatedAttributes: false; the MAC then covers the content octets directly and no attribute set is built"
           : "");
     });
+  /** @internal A view is enough here: `authenticate` fixed a byte content at the door, ahead of the
+   *  recipient and option copies, so these bytes are already this module's own and no caller accessor
+   *  reaches them. */
   var contentBytes = guard.bytes.view(content, CmsError, "cms/bad-input", "content");
   var macName = opts.macAlgorithm || "hmac-sha256";
   var mac = MAC_ALGS[guard.text.keyOf(macName)];
@@ -595,7 +642,12 @@ async function authenticate(content, recipients, opts) {
     if (withAttrs) {
       var digestName = opts.digestAlgorithm || mac.node;
       if (!SUPPORTED_DIGEST[guard.text.keyOf(digestName)]) throw _err("cms/bad-input", "unsupported digestAlgorithm " + guard.text.showValue(digestName) + " (sha256/384/512)");
-      var mdDigest = nodeCrypto.createHash(digestName).update(contentBytes).digest();
+      /** @internal Through the captured operations: `update` and `digest` are ordinary writable
+       *  properties of the hash prototype, so a replacement decided what this digest was OVER, and the
+       *  MAC below covers the attribute set carrying it. Measured, a replaced `update` put the digest
+       *  of other bytes into the messageDigest attribute and the message no longer verified against
+       *  the content it carries. */
+      var mdDigest = guard.crypto.digest(digestName, contentBytes);
       var pairs = [
         b.sequence([b.oid(O("contentType")), b.setOf([b.oid(O(contentType))])]),
         b.sequence([b.oid(O("messageDigest")), b.setOf([b.octetString(mdDigest)])]),

package/lib/cms-sign.js

@@ -15,6 +15,14 @@ var webcrypto = require("./webcrypto");
 var signScheme = require("./sign-scheme");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+/** @internal `resolve` and `all` build their promise from the RECEIVER, so reading the global binding
+ *  at the call hands the construction to whatever that binding holds. Each signer's digest and
+ *  signature are awaited through one of these, and a replacement that settles without awaiting emits a
+ *  SignedData whose SignerInfos were never completed. The constructor and both operations are taken at
+ *  load. */
+var _Promise = intrinsic.Promise;
+var _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
+var _promiseAll = intrinsic.uncurry(intrinsic.promiseAll);
 var pkiBuild = require("./pki-build");
 var cms = require("./schema-cms");
 
@@ -72,10 +80,16 @@ function _buildSid(cert, useSki) {
   return { sid: sid, version: useSki ? 3 : 1 };
 }
 
+/** @internal The signed side keeps its blanket refusal of a repeated type, and the citation is what
+ *  changes. RFC 5652 clause 5.3 does not state that rule: what it states is per type, "The
+ *  SignedAttributes in a signerInfo MUST include only one instance of the message-digest attribute".
+ *  Refusing every repeat is this builder's posture, stricter than the RFC and in the safe direction for
+ *  something being emitted, so it stands; naming a clause that does not say it did not. The unsigned
+ *  side had the same misattribution and could not keep the rule, a repeat being ordinary there. */
 function _buildSignedAttrs(pairs) {
   var seenTypes = intrinsic.create(null);
   var attrs = intrinsic.map(pairs, function (p) {
-    if (intrinsic.hasOwn(seenTypes, p.type)) throw _err("cms/bad-input", "signedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + p.type);
+    if (intrinsic.hasOwn(seenTypes, p.type)) throw _err("cms/bad-input", "this builder emits one instance of each signed attribute type, and " + p.type + " is repeated; RFC 5652 sec. 11.2 requires it of the message-digest attribute and this build asks it of all of them");
     seenTypes[p.type] = 1;
     return b.sequence([b.oid(p.type), b.set(p.values)]);
   });
@@ -105,11 +119,17 @@ function _buildUnsignedAttrs(list) {
   if (!intrinsic.isArray(list)) throw _err("cms/bad-input", "opts.unsignedAttributes must be an array of { type, values }");
   if (!list.length) return null;
   var pairs = _resolveAttrPairs(list, "an unsigned attribute value");
-  var seen = intrinsic.create(null);
+  /** @internal A TYPE MAY REPEAT HERE, and the RFC is the authority for that rather than against it.
+   *  `UnsignedAttributes ::= SET SIZE (1..MAX) OF Attribute` imposes no per-type uniqueness; clause 5.3
+   *  says of the field only that it "is a collection of attributes that are not signed. The field is
+   *  optional"; and the uniqueness rules the RFC does state are per type, "The SignedAttributes in a
+   *  signerInfo MUST include only one instance of the message-digest attribute", while clause 11.4's
+   *  countersignature type "specifies one or more signatures". A blanket refusal citing clause 5.3
+   *  therefore denied a conforming message, and the shape it denied is the ordinary one: a signature
+   *  re-timestamped by several authorities carries one timeStampToken attribute per authority. The
+   *  per-type rules below are kept, and they are the ones with a clause behind them. */
   intrinsic.forEach(pairs, function (p) {
     if (intrinsic.hasOwn(UNSIGNED_FORBIDDEN, p.type)) throw _err("cms/bad-input", "the " + UNSIGNED_FORBIDDEN[p.type] + " attribute must not appear as an unsigned attribute (RFC 5652 sec. 11)");
-    if (intrinsic.hasOwn(seen, p.type)) throw _err("cms/bad-input", "unsignedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + p.type);
-    seen[p.type] = 1;
   });
   var setOf = b.set(intrinsic.map(pairs, function (p) { return b.sequence([b.oid(p.type), b.set(p.values)]); }));
   var wire = intrinsic.bufferFrom(setOf); wire[0] = 0xA1;
@@ -157,7 +177,7 @@ async function _finishSignerInfo(rc, md, content, eContentType, opts) {
 
 function _buildSignerInfo(signer, content, eContentType, opts) {
   var rc = _resolveSignerContext(signer, opts);
-  var mdP = opts.signedAttributes === false ? Promise.resolve(null) : _digest(rc.scheme.digest, content);
+  var mdP = opts.signedAttributes === false ? _promiseResolve(_Promise, null) : _digest(rc.scheme.digest, content);
   return mdP.then(function (md) { return _finishSignerInfo(rc, md, content, eContentType, opts); });
 }
 
@@ -323,7 +343,7 @@ function _sign(content, signers, opts) {
   }
   if (opts.signingTime != null && opts.signingTime !== false) guard.time.assertEncodable(opts.signingTime, _err, "cms/bad-input", "signingTime");
 
-  return Promise.all(list.map(function (s) { return _buildSignerInfo(s, contentBuf, eContentType, opts); }))
+  return _promiseAll(_Promise, list.map(function (s) { return _buildSignerInfo(s, contentBuf, eContentType, opts); }))
     .then(function (built) { return _assembleSignedData(built, eContentType, opts, contentBuf); });
 }
 
@@ -435,7 +455,7 @@ function _buildCountersignature(targetSigOctets, countersigner, opts) {
   var scheme = signScheme.resolveSignScheme(cert, so, opts.signedAttributes === false, _signE);
   var sidv = _buildSid(cert, opts.sid === "ski");
   var soKey = so.key;
-  return Promise.resolve().then(function () {
+  return _promiseResolve(_Promise, undefined).then(function () {
     if (opts.signedAttributes === false) return null;
     return _digest(scheme.digest, targetSigOctets).then(function (md) {
       var pairs = [{ type: O("messageDigest"), values: [b.octetString(md)] }];
@@ -551,7 +571,7 @@ function _countersign(cmsInput, signers, opts) {
     var preimage = _targetPreimage(siSet.children[t], opts);
     list.forEach(function (cs) { jobs.push({ t: t, p: _buildCountersignature(preimage, cs, opts) }); });
   });
-  return Promise.all(jobs.map(function (j) { return j.p; })).then(function (built) {
+  return _promiseAll(_Promise, jobs.map(function (j) { return j.p; })).then(function (built) {
     var byTarget = intrinsic.create(null), certDers = [], csDigestAlgs = [];
     intrinsic.forEach(built, function (res, i) {
       var slot = byTarget[jobs[i].t] || (byTarget[jobs[i].t] = []);
@@ -573,7 +593,9 @@ function _countersign(cmsInput, signers, opts) {
     var existing = [];
     if (certsNode) certsNode.children.forEach(function (c) { existing.push(c.bytes); });
     if (opts.certificates !== false) certDers.forEach(function (d) { existing.push(d); });
-    var allCerts = _dedupe(existing).sort(Buffer.compare);
+    /** @internal The DER SET ordering through the captured copy, sort AND comparator: read off its own
+     * home, any of the three decides which certificate lands where in the set this message carries. */
+    var allCerts = guard.list.sortedCopy(_dedupe(existing), intrinsic.compare);
 
     /** @internal RFC 5652 sec. 5.1 has this collection list "the message digest algorithms employed
      * by all of the signers", and sec. 11.4 makes a countersignature a SignerInfo, so sec. 5.3's

package/lib/cms-verify.js

@@ -49,9 +49,14 @@ var intrinsic = require("./guard-intrinsic");
 var frameworkError = require("./framework-error");
 var pkix = require("./schema-pkix");
 
+/** @internal The verify operation, captured at load. The object was held and its METHOD fetched per
+ * call, which leaves it replaceable: one answering true accepts a SignerInfo no signer signed, which
+ * is the whole verdict this module reports. `path-validate` and `ct` hold it the same way. */
+var _subtleVerify = intrinsic.uncurry(subtle.verify);
+
 var CmsError = frameworkError.CmsError;
 function _err(code, message, cause) { return new CmsError(code, message, cause); }
-var _Promise = Promise, _promiseResolveRaw = Promise.resolve;
+var _Promise = intrinsic.Promise, _promiseResolveRaw = intrinsic.promiseResolve;
 /**
  * @internal Every value resolved here is a signer row, and resolving a promise reads `then` off the
  * value. Building the row through the verdict guard ends that lookup on the row itself, so an
@@ -214,26 +219,26 @@ function _resolvePss(paramsBytes) {
 async function _verifySignature(scheme, hashName, sigBytes, spki, signedBytes, curveOid, pssSalt) {
   if (scheme.kind === "rsa") {
     var kRsa = await subtle.importKey("spki", spki, { name: "RSASSA-PKCS1-v1_5", hash: hashName }, false, ["verify"]);
-    return subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, kRsa, sigBytes, signedBytes);
+    return _subtleVerify(subtle, { name: "RSASSA-PKCS1-v1_5" }, kRsa, sigBytes, signedBytes);
   }
   if (scheme.kind === "rsapss") {
     var kPss = await subtle.importKey("spki", spki, { name: "RSA-PSS", hash: hashName }, false, ["verify"]);
-    return subtle.verify({ name: "RSA-PSS", saltLength: pssSalt }, kPss, sigBytes, signedBytes);
+    return _subtleVerify(subtle, { name: "RSA-PSS", saltLength: pssSalt }, kPss, sigBytes, signedBytes);
   }
   if (scheme.kind === "ec") {
     var ec = EC_CURVE[curveOid];
     if (!ec) throw _err("cms/unsupported-algorithm", "the signer key is on an unsupported EC curve");
     var raw = validator.sig.ecdsaDerToP1363(sigBytes, ec.curve, CmsError, "cms/bad-signature");
     var kEc = await subtle.importKey("spki", spki, { name: "ECDSA", namedCurve: ec.curve }, false, ["verify"]);
-    return subtle.verify({ name: "ECDSA", hash: hashName }, kEc, raw, signedBytes);
+    return _subtleVerify(subtle, { name: "ECDSA", hash: hashName }, kEc, raw, signedBytes);
   }
   if (scheme.kind === "mldsa" || scheme.kind === "slhdsa") {
     var kPq = await subtle.importKey("spki", spki, { name: scheme.name }, false, ["verify"]);
-    return subtle.verify({ name: scheme.name }, kPq, sigBytes, signedBytes);
+    return _subtleVerify(subtle, { name: scheme.name }, kPq, sigBytes, signedBytes);
   }
   _requireValidEdPoint(spki, scheme.name);
   var kEd = await subtle.importKey("spki", spki, { name: scheme.name }, false, ["verify"]);
-  return subtle.verify({ name: scheme.name }, kEd, sigBytes, signedBytes);
+  return _subtleVerify(subtle, { name: scheme.name }, kEd, sigBytes, signedBytes);
 }
 
 function _requireValidEdPoint(spkiBytes, name) {
@@ -562,7 +567,11 @@ async function _verify(input, opts) {
       content = _toBuf(_snapshotIfBytes(opts.content, "opts.content"), "opts.content");
     }
   } else if (opts.content != null) {
-    if (Buffer.compare(_toBuf(opts.content, "opts.content"), Buffer.from(content)) !== 0) {
+    /** @internal The comparison goes through the captured operation. Read off `Buffer`, it decides
+     * whether the content a caller supplied is the content this message carries, so a replacement
+     * answering zero would have this verb accept a detached content that disagrees with the embedded
+     * one and then report a verdict about whichever of the two it went on to digest. */
+    if (intrinsic.compare(_toBuf(opts.content, "opts.content"), Buffer.from(content)) !== 0) {
       throw _err("cms/content-conflict", "opts.content disagrees with this SignedData's own encapsulated content (a detached signature must omit eContent)");
     }
   }
@@ -631,21 +640,15 @@ function _snapshotTrust(opts) {
   };
 }
 
-var _CERT_EXT_DECODERS = pkix.certExtensionDecoders(pkix.makeNS("cms", CmsError, oid)).byOid;
+/** @internal A signature over content is authorized by digitalSignature, contentCommitment or
+ *  nonRepudiation alike; the shared helper carries the rest of the rule. */
+var _permitsSigning = pkix.keyUsagePermits(pkix.makeNS("cms", CmsError, oid),
+  ["digitalSignature", "contentCommitment", "nonRepudiation"]);
 
 function _keyUsagePermitsSigning(parsedCerts, der) {
   var entry = intrinsic.filter(parsedCerts, function (c) { return intrinsic.bufferEquals(c.der, der); })[0];
   if (!entry) return true;
-  var kuOid = oid.byName("keyUsage");
-  var exts = entry.cert.extensions || [];
-  for (var i = 0; i < exts.length; i++) {
-    if (exts[i].oid !== kuOid) continue;
-    var ku;
-    try { ku = _CERT_EXT_DECODERS[kuOid](exts[i].value); }
-    catch (_e) { return false; }
-    return ku.digitalSignature === true || ku.contentCommitment === true || ku.nonRepudiation === true;
-  }
-  return true;
+  return _permitsSigning(entry.cert);
 }
 
 function _allTrusted(signers) {
@@ -951,6 +954,7 @@ var authenticate = cmsEncrypt.authenticate;
  * @opts recipientIndex Explicitly select the recipient by index (overrides key-material matching).
  * @opts maxIterations  Lower the PBKDF2 iteration cap (a DoS bound; downward only).
  * @opts stream         Return `content` as an async iterable of plaintext `Buffer` chunks instead of a single `Buffer`.
+ * @opts allowUnauthenticatedRsa15  Read a message that uses RSAES-PKCS1-v1_5 key transport over a content with no integrity tag, such as AES-CBC. Refused by default with `cms/unauthenticated-rsa-v15`: the content padding is that combination's only integrity check, so decrypting it either returns the plaintext of a substituted key or tells an attacker submitting chosen ciphertexts that theirs decoded (RFC 8017 sec. 7.2). `openssl cms -encrypt` emits exactly this combination when no algorithm is named, so reading one of its messages needs this option. An AEAD content or an RSAES-OAEP recipient needs none.
  * @example
  *   var rsa = { name: "RSA-OAEP", modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" };
  *   var pair = await pki.key.generate(rsa);

package/lib/composite-kem.js

@@ -26,6 +26,18 @@ var webcrypto = require("./webcrypto");
 var nodeCrypto = require("node:crypto");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
+/** @internal `resolve`, `reject` and `allSettled` build their promise from the RECEIVER, so reading the
+ *  global binding at the call hands the construction to whatever that binding holds. Two things here
+ *  turn on that. Each component refusal is returned as a rejected promise, so a replacement whose
+ *  `reject` resolves turns a `kem/bad-key` or `kem/decapsulation-failed` refusal into a pass. And the
+ *  pair of component results is settled through `allSettled` before either shared secret is used or
+ *  wiped, so a replacement reporting both fulfilled with values of its own both skips the wipe and
+ *  hands the combiner material it chose, which is the hybrid's whole premise. Taken at load. */
+var _Promise = intrinsic.Promise;
+var _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
+var _promiseReject = intrinsic.uncurry(intrinsic.promiseReject);
+var _promiseAllSettled = intrinsic.uncurry(intrinsic.promiseAllSettled);
 var pkix = require("./schema-pkix");
 var schemaPkcs8 = require("./schema-pkcs8");
 var subtle = webcrypto.webcrypto.subtle;
@@ -125,16 +137,16 @@ function _tradEncaps(d, tradPK) {
     try {
       asn1.decode(tradPK);
       pub = nodeCrypto.createPublicKey({ key: tradPK, format: "der", type: "pkcs1" });
-    } catch (e) { return Promise.reject(_err("kem/bad-key", "the RSA component public key is not a valid RSAPublicKey", e)); }
-    if (pub.asymmetricKeyDetails.modulusLength !== trad.bits) return Promise.reject(_err("kem/bad-key", "the RSA component modulus is not " + trad.bits + " bits (draft sec. 6)"));
+    } catch (e) { return _promiseReject(_Promise, _err("kem/bad-key", "the RSA component public key is not a valid RSAPublicKey", e)); }
+    if (pub.asymmetricKeyDetails.modulusLength !== trad.bits) return _promiseReject(_Promise, _err("kem/bad-key", "the RSA component modulus is not " + trad.bits + " bits (draft sec. 6)"));
     var ss = Buffer.from(nodeCrypto.randomBytes(RSA_SS));
     var ct;
-    try { ct = Buffer.from(nodeCrypto.publicEncrypt({ key: pub, padding: nodeCrypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha256" }, ss)); }
+    try { ct = Buffer.from(nodeCrypto.publicEncrypt({ key: pub, padding: guard.crypto.padding.RSA_PKCS1_OAEP, oaepHash: "sha256" }, ss)); }
     catch (e) {
       guard.secret.zeroize(ss, KemError, "kem/bad-input", "the RSA-OAEP component secret");
-      return Promise.reject(_err("kem/bad-key", "the RSA-OAEP component encryption failed", e));
+      return _promiseReject(_Promise, _err("kem/bad-key", "the RSA-OAEP component encryption failed", e));
     }
-    return Promise.resolve({ ss: ss, ct: ct });
+    return _promiseResolve(_Promise, { ss: ss, ct: ct });
   }
   var dh, dhCt;
   try {
@@ -142,8 +154,8 @@ function _tradEncaps(d, tradPK) {
     var eph = trad.kind === "ec" ? nodeCrypto.generateKeyPairSync("ec", { namedCurve: trad.node }) : nodeCrypto.generateKeyPairSync(trad.curve.toLowerCase());
     dh = Buffer.from(nodeCrypto.diffieHellman({ privateKey: eph.privateKey, publicKey: recip }));
     dhCt = _rawPubOf(eph.publicKey);
-  } catch (e) { return Promise.reject(_err("kem/bad-key", "the " + trad.curve + " public key is invalid", e)); }
-  return Promise.resolve({ ss: dh, ct: dhCt });
+  } catch (e) { return _promiseReject(_Promise, _err("kem/bad-key", "the " + trad.curve + " public key is invalid", e)); }
+  return _promiseResolve(_Promise, { ss: dh, ct: dhCt });
 }
 
 function _tradDecaps(d, tradSK, tradCT) {
@@ -153,16 +165,16 @@ function _tradDecaps(d, tradSK, tradCT) {
     try {
       asn1.decode(tradSK);
       priv = nodeCrypto.createPrivateKey({ key: tradSK, format: "der", type: "pkcs1" });
-    } catch (e) { return Promise.reject(_err("kem/bad-key", "the RSA component private key is not a valid RSAPrivateKey", e)); }
-    if (priv.asymmetricKeyDetails.modulusLength !== trad.bits) return Promise.reject(_err("kem/bad-key", "the RSA component modulus is not " + trad.bits + " bits (draft sec. 6)"));
+    } catch (e) { return _promiseReject(_Promise, _err("kem/bad-key", "the RSA component private key is not a valid RSAPrivateKey", e)); }
+    if (priv.asymmetricKeyDetails.modulusLength !== trad.bits) return _promiseReject(_Promise, _err("kem/bad-key", "the RSA component modulus is not " + trad.bits + " bits (draft sec. 6)"));
     var ss;
-    try { ss = Buffer.from(nodeCrypto.privateDecrypt({ key: priv, padding: nodeCrypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha256" }, tradCT)); }
-    catch (_e) { return Promise.reject(_err("kem/decapsulation-failed", "the RSA-OAEP component decryption failed")); }
+    try { ss = Buffer.from(nodeCrypto.privateDecrypt({ key: priv, padding: guard.crypto.padding.RSA_PKCS1_OAEP, oaepHash: "sha256" }, tradCT)); }
+    catch (_e) { return _promiseReject(_Promise, _err("kem/decapsulation-failed", "the RSA-OAEP component decryption failed")); }
     if (ss.length !== RSA_SS) {
       guard.secret.zeroize(ss, KemError, "kem/bad-input", "the RSA-OAEP component secret");
-      return Promise.reject(_err("kem/decapsulation-failed", "the RSA-OAEP component decryption failed"));
+      return _promiseReject(_Promise, _err("kem/decapsulation-failed", "the RSA-OAEP component decryption failed"));
     }
-    return Promise.resolve({ ss: ss, tradPK: Buffer.from(nodeCrypto.createPublicKey(priv).export({ format: "der", type: "pkcs1" })) });
+    return _promiseResolve(_Promise, { ss: ss, tradPK: Buffer.from(nodeCrypto.createPublicKey(priv).export({ format: "der", type: "pkcs1" })) });
   }
   var priv2, eph;
   try {
@@ -173,10 +185,10 @@ function _tradDecaps(d, tradSK, tradCT) {
       priv2 = _okpPrivFromRaw(d, tradSK);
     }
     eph = trad.kind === "ec" ? _ecPubFromPoint(d, tradCT) : _okpPubFromRaw(d, tradCT);
-  } catch (e) { return Promise.reject(_err("kem/bad-key", "the " + trad.curve + " key material is invalid", e)); }
+  } catch (e) { return _promiseReject(_Promise, _err("kem/bad-key", "the " + trad.curve + " key material is invalid", e)); }
   var dh;
   try { dh = Buffer.from(nodeCrypto.diffieHellman({ privateKey: priv2, publicKey: eph })); }
-  catch (e) { return Promise.reject(_err("kem/decapsulation-failed", "the " + trad.curve + " Diffie-Hellman failed", e)); }
+  catch (e) { return _promiseReject(_Promise, _err("kem/decapsulation-failed", "the " + trad.curve + " Diffie-Hellman failed", e)); }
   /** @internal The same canonical point the derivation states, read from the one function that spells
    * it. The combiner hashes these bytes, so a stored spelling here and a generated one there would
    * reach different secrets from the two sides of one key. */
@@ -188,9 +200,9 @@ function _tradDecaps(d, tradSK, tradCT) {
      * secret is wiped here: the caller's settle-or-wipe covers a value it was handed, and a rejected
      * promise hands it nothing. */
     guard.secret.zeroize(dh, KemError, "kem/bad-input", "the " + trad.curve + " component secret");
-    return Promise.reject(e);
+    return _promiseReject(_Promise, e);
   }
-  return Promise.resolve({ ss: dh, tradPK: tradPK });
+  return _promiseResolve(_Promise, { ss: dh, tradPK: tradPK });
 }
 
 function _combine(d, mlkemSS, tradSS, tradCT, tradPK) {
@@ -203,7 +215,7 @@ function _combine(d, mlkemSS, tradSS, tradCT, tradPK) {
 }
 
 async function _settleOrWipe(pA, pB, secA, secB) {
-  var s = await Promise.allSettled([pA, pB]);
+  var s = await _promiseAllSettled(_Promise, [pA, pB]);
   if (s[0].status === "rejected" || s[1].status === "rejected") {
     if (s[0].status === "fulfilled") guard.secret.zeroize(secA(s[0].value), KemError, "kem/bad-input", "an ML-KEM shared secret");
     if (s[1].status === "fulfilled") guard.secret.zeroize(secB(s[1].value), KemError, "kem/bad-input", "a traditional shared secret");