@blamejs/pki 0.8.51 → 0.8.53

package/lib/cms-verify.js

@@ -31,6 +31,7 @@ var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
 var cms = require("./schema-cms");
+var smime = require("./schema-smime");
 var webcrypto = require("./webcrypto");
 var subtle = webcrypto.webcrypto.subtle;
 var edwardsPoint = require("./edwards-point");
@@ -46,6 +47,7 @@ var validator = require("./validator-all");
 var compositeSig = require("./composite-sig");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+var constants = require("./constants");
 var frameworkError = require("./framework-error");
 var pkix = require("./schema-pkix");
 
@@ -69,6 +71,15 @@ function _row(o) { return guard.verdict.of(o); }
 var OID_MESSAGE_DIGEST = oid.byName("messageDigest");
 var OID_CONTENT_TYPE = oid.byName("contentType");
 var OID_COUNTERSIGNATURE = oid.byName("countersignature");
+/** @internal `id-aa-signatureTimeStampToken`, which the registry already carries under the S/MIME
+ *  authenticated-attribute arc as `timeStampToken`: `oid.byName("timeStampToken")` is
+ *  `1.2.840.113549.1.9.16.2.14`, the OID RFC 5126 clause 6.1.1 assigns. A second name for one OID
+ *  would give `oid.name()` two answers, so the existing name is used rather than a CAdES alias. */
+var OID_TIMESTAMP_TOKEN = oid.byName("timeStampToken");
+var OID_ID_DATA = oid.byName("data");
+var OID_SIGNING_CERTIFICATE = oid.byName("signingCertificate");
+var OID_SIGNING_CERTIFICATE_V2 = oid.byName("signingCertificateV2");
+var OID_SIGNING_TIME = oid.byName("signingTime");
 
 var DIGEST_HASH = intrinsic.assign(intrinsic.create(null), {
   sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512",
@@ -83,9 +94,16 @@ function _digestOidTable(named) {
   });
   return t;
 }
-var WEAK_DIGEST_OIDS = _digestOidTable([["sha1", "SHA-1"]]);
+/** @internal Both tables read the one membership list in `C.NAMES.WEAK_DIGESTS`, keyed the two ways
+ *  the two checks ask the question: by the digest OID a SignerInfo declares, and by the WebCrypto
+ *  hash name a signature algorithm resolves to. A digest added to that list reaches both. */
+var _WEAK_DIGEST_NAMES = intrinsic.map(intrinsic.keys(constants.NAMES.WEAK_DIGESTS), function (n) {
+  return [n, constants.NAMES.WEAK_DIGESTS[n]];
+});
+var WEAK_DIGEST_OIDS = _digestOidTable(_WEAK_DIGEST_NAMES);
 var UNVERIFIABLE_DIGEST_OIDS = _digestOidTable([["md5", "MD5"], ["md4", "MD4"], ["md2", "MD2"]]);
-var WEAK_SIGNATURE_HASHES = intrinsic.assign(intrinsic.create(null), { "SHA-1": 1 });
+var WEAK_SIGNATURE_HASHES = intrinsic.create(null);
+intrinsic.forEach(_WEAK_DIGEST_NAMES, function (pair) { WEAK_SIGNATURE_HASHES[pair[1]] = 1; });
 function _supportedDigest(name) { return intrinsic.hasOwn(DIGEST_HASH, name) && !!DIGEST_HASH[name]; }
 async function _computeDigest(name, content) {
   return intrinsic.bufferFrom(await subtle.digest(DIGEST_HASH[name], content));
@@ -155,6 +173,35 @@ async function _verifyAgainstCandidates(scheme, sigHash, sigBytes, signedBytes,
     : { ok: false, sid: sid, cert: candidates[0].der });
 }
 
+/** @internal Where a signer identifier matches several certificates, the signing-certificate
+ *  attribute is what says which of them made the signature, so one it names is tried first. A
+ *  subjectKeyIdentifier names a KEY: two certificates holding that key verify the same signature
+ *  equally, and without this the one reported as `signers[i].cert` would be whichever candidate came
+ *  first, taking with it every decision keyed to that certificate, its validity window, its key
+ *  usage, and the chain built from it. RFC 5035 clause 5.4 makes the first identifier "the
+ *  certificate used to verify the signature", which is exactly this question.
+ *
+ *  Order is all that changes: a candidate the attribute names still has to verify the signature, and
+ *  where none is named or none matches, the list is returned as it came. */
+function _preferBoundCandidate(si, candidates) {
+  if (candidates.length < 2) return candidates;
+  /** @internal The attribute is read ONCE and each candidate compared against what it read. Reading
+   *  it per candidate would multiply its size by the candidate count, and both are attacker-chosen:
+   *  a message can embed many certificates carrying one subject key identifier and a long
+   *  certificate list inside the attribute, so the work would be their product, spent before the
+   *  signature is checked. */
+  var claims = smime.certBindingClaims(si.signedAttrs || []);
+  if (!claims.present) return candidates;
+  var bound = [];
+  var rest = [];
+  intrinsic.forEach(candidates, function (c) {
+    var entry = smime.certBindingAgainst(claims.chosen, c.der);
+    var names = entry.matches === true && entry.issuerSerialMatches !== false;
+    guard.list.append(names ? bound : rest, c);
+  });
+  return bound.length ? intrinsic.concat(bound, rest) : candidates;
+}
+
 function _certSki(cert) {
   var ext = (cert.extensions || []).filter(function (e) { return e.oid === oid.byName("subjectKeyIdentifier"); })[0];
   if (!ext) return null;
@@ -185,23 +232,22 @@ function _hashAlgOid(seq) {
   return o;
 }
 
+/** @internal The parameter fields come from `cms.taggedParameterFields`, which holds the DER rule
+ *  for a SEQUENCE of tagged OPTIONAL and DEFAULT fields: one element per tag, ascending, no repeat,
+ *  exactly one value each. The comparison that reads these same fields for their defaults walks the
+ *  same reader, so the verifier and the comparison cannot disagree about what a field is. */
 function _resolvePss(paramsBytes) {
   if (!paramsBytes) return null;
-  var n;
-  try {
-    n = asn1.decode(paramsBytes);
-  } catch (_e) { return null; }
-  if (n.tagClass !== "universal" || n.tagNumber !== asn1.TAGS.SEQUENCE || !n.children) return null;
-  var hash = null, saltLen = null, mgfNode = null, trailer = 1n, last = -1;
-  for (var i = 0; i < n.children.length; i++) {
-    var f = n.children[i];
-    if (f.tagClass !== "context" || f.tagNumber > 3 || f.tagNumber <= last || !f.children || f.children.length !== 1) return null;
-    last = f.tagNumber;
+  var fields = cms.taggedParameterFields(paramsBytes, 3);
+  if (fields === null) return null;
+  var hash = null, saltLen = null, mgfNode = null, trailer = 1n;
+  for (var i = 0; i < fields.length; i++) {
+    var f = fields[i];
     try {
-      if (f.tagNumber === 0) { hash = PSS_HASH[_hashAlgOid(f.children[0])]; if (!hash) return null; }
-      else if (f.tagNumber === 1) { mgfNode = f.children[0]; }
-      else if (f.tagNumber === 2) { saltLen = asn1.read.integer(f.children[0]); }
-      else { trailer = asn1.read.integer(f.children[0]); }
+      if (f.tag === 0) { hash = PSS_HASH[_hashAlgOid(f.node)]; if (!hash) return null; }
+      else if (f.tag === 1) { mgfNode = f.node; }
+      else if (f.tag === 2) { saltLen = asn1.read.integer(f.node); }
+      else { trailer = asn1.read.integer(f.node); }
     } catch (_e3) { return null; }
   }
   if (hash === null || mgfNode === null) return null;
@@ -295,7 +341,7 @@ async function _verifyOne(si, content, eContentType, parsedCerts, csTarget, dige
   if ((scheme.kind !== "eddsa" && scheme.kind !== "mldsa" && scheme.kind !== "slhdsa" && !sigHash) || (si.signedAttrsBytes && !_supportedDigest(si.digestAlgorithm.name))) return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "unsupported digest algorithm " + JSON.stringify(si.digestAlgorithm.name) });
   if (scheme.kind === "mldsa" && si.signedAttrsBytes && !_mldsaDigestSuitable(scheme.name, si.digestAlgorithm.name)) return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the " + si.digestAlgorithm.name + " message digest is below the security strength of " + scheme.name + " (RFC 9882 sec. 3.3)" });
   if (scheme.kind === "slhdsa" && si.signedAttrsBytes && si.digestAlgorithm.name !== scheme.digest) return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "SLH-DSA " + scheme.name + " requires the " + scheme.digest + " message digest (RFC 9814 sec. 4)" });
-  var signers = _findSignerCerts(si.sid, parsedCerts);
+  var signers = _preferBoundCandidate(si, _findSignerCerts(si.sid, parsedCerts));
   if (!signers.length) return _pResolve({ ok: false, code: "cms/signer-cert-not-found", sid: si.sid, message: "no certificate matches this SignerInfo's signer identifier" });
   var sigBytes = _toBuf(si.signature, "the SignerInfo signature");
 
@@ -381,7 +427,7 @@ async function _verifyComposite(si, comp, content, eContentType, parsedCerts, cs
   if (si.digestAlgorithm.name !== comp.phCms) {
     return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the SignerInfo digestAlgorithm " + JSON.stringify(si.digestAlgorithm.name) + " is not the composite " + comp.name + " pre-hash " + JSON.stringify(comp.phCms) + " (draft-ietf-lamps-cms-composite-sigs sec. 3.4)" });
   }
-  var signers = _findSignerCerts(si.sid, parsedCerts);
+  var signers = _preferBoundCandidate(si, _findSignerCerts(si.sid, parsedCerts));
   if (!signers.length) return _pResolve({ ok: false, code: "cms/signer-cert-not-found", sid: si.sid, message: "no certificate matches this SignerInfo's signer identifier" });
   var sigBytes = _toBuf(si.signature, "the SignerInfo signature");
   var signedBytes = await (csTarget != null ? _computeCountersigBytes(si, csTarget) : _computeSignedBytes(si, content, eContentType, digestByName));
@@ -417,7 +463,375 @@ function _surfaceSignedAttrs(si) {
   });
 }
 
-async function _verifyCountersignatures(si, parsedCerts, allowWeakDigests) {
+/** @internal What the RFC 6211 algorithm protection attribute says about the structure carrying it,
+ *  read ONCE per signer and used for both the verdict and the comparison, so the row an operator
+ *  reads and the decision the verdict rests on cannot disagree.
+ *
+ *  The attribute is a copy of the algorithm identifiers the structure already names, placed where
+ *  the signature covers them. Sec. 3.1 makes both comparisons mandatory for a validator that
+ *  supports the attribute, and support is claimed the moment this runs: "If the fields are not the
+ *  same (modulo encoding), then signature validation MUST fail."
+ *
+ *  Both arms compare modulo encoding, in the two ways sec. 3 names. A field with a default compares
+ *  the same written out as omitted, which the clause makes a MUST and says a binary compare cannot
+ *  satisfy; RSASSA-PSS is where that arises, since RFC 4055 clause 3.1 defaults all four of its
+ *  parameter fields. Absent and DER NULL parameters read as one algorithm on the digest arm, because
+ *  RFC 3370 clause 2.1 and RFC 5754 clause 2 require both encodings to be ACCEPTED; sec. 3 leaves
+ *  that case to the implementer. Anything else in a parameter field is read as written: that is
+ *  where RSASSA-PSS puts its hash, mask generator, salt length and trailer field, which the
+ *  signature itself does not cover, so collapsing two values there would admit the substitution the
+ *  attribute exists to refuse.
+ *
+ *  A `[2]` MAC arm inside `signedAttrs` is a mismatch rather than an absent signature arm: sec. 2
+ *  populates that arm "only if the attribute is placed in an AuthenticatedData.authAttrs sequence",
+ *  so the attribute is making a claim about a structure this is not. */
+function _algorithmProtectionReport(si, armName, armIdentifier) {
+  return cms.algorithmProtectionReport(si.signedAttrs || si.authAttrs || [],
+    si.digestAlgorithm, armName, armIdentifier);
+}
+
+/** @internal The report applied to a verdict. A mismatch fails the signer, and the option that
+ *  requires the attribute fails an absent one; a verdict that already failed keeps its own code,
+ *  since the signature's verdict is the stronger statement and masking it would tell an operator the
+ *  wrong thing about why the message was refused. */
+function _applyAlgorithmProtection(verdict, report, required) {
+  var fields = { algorithmProtection: guard.verdict.of(report) };
+  if (verdict.ok !== true) return guard.verdict.of(verdict, fields);
+  if (report.mismatch !== null) {
+    return guard.verdict.of(verdict, intrinsic.assign(fields,
+      { ok: false, code: report.mismatch.code, message: report.mismatch.message }));
+  }
+  if (required && !report.present) {
+    return guard.verdict.of(verdict, intrinsic.assign(fields, { ok: false,
+      code: "cms/missing-algorithm-protection",
+      message: "this signature carries no RFC 6211 algorithm protection attribute, which " +
+        "opts.requireAlgorithmProtection asks for; RFC 8933 sec. 4.1 makes including it a SHOULD, " +
+        "so a message without one is not malformed" }));
+  }
+  return guard.verdict.of(verdict, fields);
+}
+
+/** @internal The CAdES baseline requirements this verb decides from one SignerInfo's own signed
+ *  attributes, reported beside the signature verdict rather than folded into it: a signature can be
+ *  cryptographically sound and still not be a CAdES signature, and the two answers are separate.
+ *
+ *  `requirementsChecked` names the scope in the data, so a caller reads which requirements were
+ *  evaluated instead of taking `conformant` for a full ETSI EN 319 122-1 clause 6.3 audit. Each
+ *  finding carries the `level` of the requirement it is against, and `conformant` answers for the
+ *  shall-level ones alone, so a SHOULD the document states as guidance is reported without being
+ *  reported as non-conformance.
+ *
+ *  - requirement f, shall: "The content-type attribute shall have value id-data".
+ *  - clauses 5.2.2.2 and 5.2.2.3, shall: the signing certificate is protected by a
+ *    `signing-certificate` or `signing-certificate-v2` attribute, and the identifier it carries
+ *    names the certificate the signature resolved to. Clause 5.2.2.2 NOTE 2: "the binding
+ *    information is the digest of the certificate".
+ *  - requirement h, shall: "The ESS signing-certificate attribute shall be used if the SHA-1 hash
+ *    algorithm is used". The two attributes are defined BY their hash algorithm, clause 5.2.2.2 as
+ *    "a signing certificate attribute using the SHA-1 hash algorithm" and clause 5.2.2.3 as one
+ *    "using a hash algorithm different from SHA-1", so what the requirement reads is the digest the
+ *    identifier binds with and not the digest the signature was computed under. Its sibling
+ *    requirement i, the v2 form "when another hash algorithm than SHA-1 is used", has no verifiable
+ *    counterexample: a v1 ESSCertID carries no algorithm field, so a non-SHA-1 binding cannot be
+ *    expressed in one, and it is not claimed as checked.
+ *  - requirement g, should: "The issuerSerial field should not be included in the encoding of the
+ *    ESSCertID, ESSCertIDv2 or OtherCertID type".
+ *  - requirement j, should: "The generator should migrate to the use of ESS signing-certificate-v2
+ *    in preference to ESS signing-certificate in line with the guidance regarding limited lifetime
+ *    for the use of SHA-1", which is what a SHA-1 binding is reported against.
+ */
+var CADES_BASELINE_CHECKED = intrinsic.freeze([
+  "ETSI EN 319 122-1 clause 6.3 requirement f",
+  "ETSI EN 319 122-1 clauses 5.2.2.2 and 5.2.2.3",
+  "ETSI EN 319 122-1 clause 6.3 requirement g",
+  "ETSI EN 319 122-1 clause 6.3 requirement h",
+  "ETSI EN 319 122-1 clause 6.3 requirement j",
+]);
+
+function _cadesBaseline(si, signerCert) {
+  var attrs = si.signedAttrs || [];
+  var findings = [];
+  var contentType = null;
+  intrinsic.forEach(attrs, function (a) {
+    if (a.type !== OID_CONTENT_TYPE || contentType !== null || !a.values || a.values.length !== 1) return;
+    try { contentType = asn1.read.oid(asn1.decode(a.values[0])); }
+    // allow:swallow-unverified a content-type that does not read is reported as the unmet requirement below
+    catch (_e) { contentType = null; }
+  });
+  if (contentType !== OID_ID_DATA) {
+    guard.list.append(findings, {
+      code: "cms/cades-content-type", level: "shall",
+      message: "the content-type attribute shall have value id-data (ETSI EN 319 122-1 clause 6.3 " +
+        "requirement f), and this signature carries " +
+        (contentType === null ? "no readable content-type attribute" : (oid.name(contentType) || contentType)),
+    });
+  }
+  var v1 = null;
+  var v2 = null;
+  intrinsic.forEach(attrs, function (a) {
+    if (a.type === OID_SIGNING_CERTIFICATE && v1 === null && a.values && a.values.length === 1) v1 = a.values[0];
+    if (a.type === OID_SIGNING_CERTIFICATE_V2 && v2 === null && a.values && a.values.length === 1) v2 = a.values[0];
+  });
+  if (v1 === null && v2 === null) {
+    guard.list.append(findings, {
+      code: "cms/cades-no-signing-certificate", level: "shall",
+      message: "the signing certificate shall be protected by a signing-certificate or " +
+        "signing-certificate-v2 signed attribute (ETSI EN 319 122-1 clauses 5.2.2.2 and 5.2.2.3)",
+    });
+  } else {
+    intrinsic.forEach(_bindingFindings(attrs, signerCert), function (f) {
+      guard.list.append(findings, f);
+    });
+  }
+  return guard.verdict.of({
+    conformant: guard.list.allMatch(findings, function (f) { return f.level !== "shall"; }),
+    signingCertificateAttribute: v2 !== null ? "v2" : (v1 !== null ? "v1" : null),
+    findings: findings,
+    requirementsChecked: CADES_BASELINE_CHECKED,
+  });
+}
+
+/** @internal What the signing-certificate attribute claims, checked against the certificate this
+ *  SignerInfo selected. The requirement is that the certificate IS protected, so the attribute's
+ *  presence is not the answer: an identifier naming other bytes binds the signature to a certificate
+ *  nobody resolved it to, which is the substitution the attribute exists to prevent (RFC 5035
+ *  clause 5.4: "The first certificate identified in the sequence of certificate identifiers MUST be
+ *  the certificate used to verify the signature").
+ *
+ *  The claims are read by `pki.schema.smime.certBindingFacts`, the one implementation of "does this
+ *  identifier name that certificate", which `pki.tsp.verify` holds a timestamp token to. What differs
+ *  is the policy over the facts, not the facts: that verb refuses a token on the first failing claim,
+ *  and this one reports every claim that failed, because a conformance verdict is read to find out
+ *  what is wrong rather than to decide one thing. A superseded v1 attribute is held to the same claim
+ *  as the v2 that supersedes it, so a structure naming one certificate in each is reported rather
+ *  than resolved in favor of whichever a reader prefers. An identifier this build cannot recompute,
+ *  and a signature whose certificate was never matched, are reported as the undecided claims they
+ *  are rather than passed over. */
+function _bindingFindings(attrs, signerCert) {
+  if (signerCert == null) {
+    return [{ code: "cms/cades-signing-certificate-unverifiable", level: "shall",
+      message: "no certificate was matched for this signer, so what the signing-certificate " +
+        "attribute binds cannot be checked" }];
+  }
+  var facts = smime.certBindingFacts(attrs, signerCert);
+  var out = [];
+  var entries = [facts.chosen];
+  intrinsic.forEach(facts.superseded, function (s) { guard.list.append(entries, s); });
+  intrinsic.forEach(entries, function (e) {
+    var which = e.form === "v2" ? "signing-certificate-v2" : "signing-certificate";
+    if (!e.readable) {
+      guard.list.append(out, { code: "cms/cades-signing-certificate-unreadable", level: "shall",
+        message: "the " + which + " attribute value does not decode, so what it binds cannot be checked" });
+      return;
+    }
+    if (!e.supported) {
+      guard.list.append(out, { code: "cms/cades-signing-certificate-unreadable", level: "shall",
+        message: "the " + which + " identifier names the digest " + e.digestName +
+          ", which this build does not bind a certificate with, so what it binds cannot be checked" });
+      return;
+    }
+    /** @internal The form is held to the digest it binds with, which is what defines each of the two
+     *  attributes: a v2 identifier naming SHA-1 is the case requirement h sends to the v1 attribute.
+     *  A v1 identifier carries no algorithm field, so it is SHA-1 by the type and can never be the
+     *  wrong form for its own digest; what it draws is requirement j's migration guidance. */
+    if (e.weak && e.form === "v2") {
+      guard.list.append(out, { code: "cms/cades-signing-certificate-form", level: "shall",
+        message: "the signing-certificate attribute shall be used if the SHA-1 hash algorithm is " +
+          "used (ETSI EN 319 122-1 clause 6.3 requirement h), and this signature carries a " +
+          "signing-certificate-v2 identifier binding with " + e.digestName });
+    } else if (e.weak) {
+      guard.list.append(out, { code: "cms/cades-weak-certificate-binding", level: "should",
+        message: "the " + which + " identifier binds the certificate with " + e.digestName +
+          ", and a generator should migrate to signing-certificate-v2 in preference to " +
+          "signing-certificate given the limited lifetime for the use of SHA-1 (ETSI EN 319 122-1 " +
+          "clause 6.3 requirement j)" });
+    }
+    if (e.issuerSerialPresent) {
+      guard.list.append(out, { code: "cms/cades-issuer-serial-included", level: "should",
+        message: "the issuerSerial field should not be included in the encoding of the " +
+          (e.form === "v2" ? "ESSCertIDv2" : "ESSCertID") + " type (ETSI EN 319 122-1 clause 6.3 " +
+          "requirement g); clause 5.2.2.2 NOTE 2 has it as a hint, the binding being the digest of " +
+          "the certificate" });
+    }
+    if (e.certUnreadable) {
+      guard.list.append(out, { code: "cms/cades-signing-certificate-unverifiable", level: "shall",
+        message: "the " + which + " identifier states an issuer and serial, and the certificate " +
+          "this signer resolved to does not parse, so that claim cannot be checked" });
+    }
+    if (e.matches !== true || e.issuerSerialMatches === false) {
+      guard.list.append(out, { code: "cms/cades-signing-certificate-mismatch", level: "shall",
+        message: "the first " + which + " identifier does not name the certificate this signature " +
+          "was resolved to: " + (e.matches !== true ? "the certificate hash disagrees"
+            : "the hash agrees but the issuer and serial name another certificate") +
+          " (RFC 5035 clause 5.4), so the signing certificate is not protected (ETSI EN 319 122-1 " +
+          "clauses 5.2.2.2 and 5.2.2.3)" });
+    }
+  });
+  return out;
+}
+
+/** @internal The CAdES signature timestamps on one SignerInfo, each as its own row.
+ *
+ * `id-aa-signatureTimeStampToken` is `{ 1 2 840 113549 1 9 16 2 14 }` (RFC 5126 clause 6.1.1; ETSI
+ * EN 319 122-1 clause 5.3 and Annex D) and its imprint is "the hash value of the signature field
+ * (without the ASN.1 tag and length) within SignerInfo for which the signature-time-stamp attribute
+ * is created" (EN 319 122-1 clause 5.3).
+ *
+ * Read HERE, in the loop that already holds `targetSig`, rather than in a verb of its own. The
+ * imprint preimage is the same octets the countersignature row covers, and a separate verb would
+ * re-derive it from its own parse: two derivations of one preimage that can disagree is a silent
+ * fail-open, since the one that disagrees is the one that accepts.
+ *
+ * Plurality is the opposite of countersignature: EN 319 122-1 clause 5.3 has "exactly one component
+ * of AttributeValue type" per attribute, and RFC 5126 clause 6.1.1 allows "several instances of this
+ * attribute ... from different TSAs", so each instance is one row and an instance carrying two values
+ * is refused rather than read as two timestamps.
+ *
+ * Every failure is a ROW verdict and never a throw: a signature whose timestamp cannot be read still
+ * has its own signature verdict, and collapsing the two would lose it.
+ *
+ * `0.4.0.1733.2.4`, the archive timestamp, is NOT read here. EN 319 122-1 clause 5.5.3 contains the
+ * sentence "The archive-time-stamp-v3 attribute shall be identified by the
+ * id-aa-signatureTimeStampToken OID" and then defines `id-aa-ets-archiveTimestampV3` under the ETSI
+ * arc, as does Annex D. The ASN.1 is followed: the two attributes hash different preimages, and
+ * clause 5.5.3 step 3 has the archive timestamp cover six SignerInfo fields "including the tag,
+ * length and value octets" where this one excludes the tag and length of one of them, so a dispatcher
+ * following that sentence would hash the wrong octets for every B-T signature. */
+async function _verifySignatureTimestamps(si, targetSig, opts) {
+  var rows = [];
+  var attrs = [];
+  intrinsic.forEach(si.unsignedAttrs || [], function (a) { if (a.type === OID_TIMESTAMP_TOKEN) guard.list.append(attrs, a); });
+  if (!attrs.length) return rows;
+  /** @internal The signer's own claimed signing time and certificate window, read once here and
+   *  passed to every row, so each row answers the coherence questions against the same values. */
+  var claimed = _signingTimeOf(si);
+  for (var i = 0; i < attrs.length; i++) {
+    guard.list.append(rows, await _verifyOneTimestamp(attrs[i], targetSig, claimed, opts));
+  }
+  return rows;
+}
+
+/** @internal The signer's `signing-time` attribute as a Date, or null where it carries none. It is the
+ *  signer's own assertion and is not evidence of the real time, but it sits inside the signature, so a
+ *  timestamp that precedes it is a contradiction within one signature. */
+function _signingTimeOf(si) {
+  var found = null;
+  intrinsic.forEach(si.signedAttrs || [], function (a) {
+    if (a.type !== OID_SIGNING_TIME || found !== null || !a.values || !a.values.length) return;
+    /** @internal Read without a guard around it: `pki.schema.cms.parse` holds a signing-time
+     *  attribute's value to a Time through this same reader before any of this runs, so a value
+     *  that reaches here reads. A parser that stopped checking would surface the failure rather
+     *  than have this quietly report no claimed time. */
+    found = asn1.read.time(asn1.decode(a.values[0]));
+  });
+  return found;
+}
+
+/** @internal The instant a Date names, or null where the value is absent or names no instant. Every
+ *  ordering rule below reads its operands through this, so "no value" and "a value that cannot be
+ *  ordered" reach the comparison as the same absence rather than as a comparison that is false both
+ *  ways. */
+function _instantOrNull(value) {
+  if (!guard.time.isDate(value)) return null;
+  var at = guard.time.instantOf(value);
+  return intrinsic.numberIsNaN(at) ? null : at;
+}
+
+async function _verifyOneTimestamp(attr, targetSig, claimedSigningTime, opts) {
+  if (!attr.values || attr.values.length !== 1) {
+    return guard.verdict.of({ valid: false, trusted: false, genTime: null,
+      code: "cms/timestamp-multi-valued",
+      message: "a signature-time-stamp attribute shall contain exactly one component of AttributeValue " +
+        "type (ETSI EN 319 122-1 clause 5.3), got " + ((attr.values && attr.values.length) || 0) });
+  }
+  var tokenDer = attr.values[0];
+  tokenDer = tokenDer && tokenDer.bytes ? tokenDer.bytes : tokenDer;
+  var res;
+  try {
+    /** @internal Reached inside the function rather than at the top of the file: `tsp-sign` requires
+     *  THIS module to verify a token's own CMS signature, so a top-level require here is a cycle and
+     *  one of the two would see a half-built export object. */
+    var tspVerify = require("./tsp-sign");   // allow:inline-require -- circular load: tsp-sign requires this module
+    res = await tspVerify.verify(tokenDer, targetSig, {
+      certs: opts.timestampCerts,
+      trustAnchors: opts.timestampTrustAnchors,
+      revocationChecker: opts.timestampRevocationChecker,
+      allowWeakDigests: opts.allowWeakDigests === true,
+    });
+  } catch (e) {
+    return guard.verdict.of({ valid: false, trusted: false, genTime: null,
+      code: (e && e.code) || "cms/bad-timestamp", message: e && e.message });
+  }
+  if (res.valid !== true) {
+    return guard.verdict.of({ valid: false, trusted: res.trusted === true, genTime: res.genTime || null,
+      code: res.code === "tsp/imprint-mismatch" ? "cms/timestamp-imprint-mismatch" : res.code,
+      message: res.reason || null });
+  }
+  /** @internal Two coherence rules the token alone cannot answer, each against a value read from the
+   *  signature this attribute hangs on. The first is the signer's claimed time; the second is
+   *  EN 319 122-1 clause 6.3 requirement m, "the tokens ... shall be created before the signing
+   *  certificate has been revoked or has expired", whose expiry half is decidable from the signer
+   *  certificate alone and whose revocation half needs status this verb does not fetch.
+   *
+   *  Each instant is taken once, through the captured read, and a genTime that is not a usable
+   *  instant is refused rather than compared: an ordering test against it answers false in both
+   *  directions, so a token carrying one would pass both rules by being uncomparable. */
+  var genAt = _instantOrNull(res.genTime);
+  if (res.genTime != null && genAt === null) {
+    return guard.verdict.of({ valid: false, trusted: res.trusted === true, genTime: null,
+      code: "cms/bad-timestamp-gentime",
+      message: "the token's genTime is not a usable instant, so the times this attribute is held " +
+        "to cannot be ordered against it" });
+  }
+  var claimedAt = _instantOrNull(claimedSigningTime);
+  if (claimedAt !== null && genAt !== null && genAt < claimedAt) {
+    return guard.verdict.of({ valid: false, trusted: res.trusted === true, genTime: res.genTime,
+      code: "cms/timestamp-before-signing-time",
+      message: "the token's genTime " + guard.time.isoOf(res.genTime) + " precedes the signing-time " +
+        "the signature itself asserts, " + guard.time.isoOf(claimedSigningTime) });
+  }
+  /** @internal The upper bound is the LATEST instant the token could have been created at, not the
+   *  instant it names. Two things widen it past a `Date`: RFC 3161 clause 2.4.2 lets genTime carry a
+   *  fraction finer than a Date holds, so a time one microsecond past a notAfter truncates to the
+   *  notAfter itself, and the accuracy the token states is a window around genTime rather than a
+   *  point, so a genTime half a second inside the window with two seconds of accuracy establishes
+   *  nothing about which side of it the token was made on. Requirement m asks that the token WAS
+   *  created before the certificate expired, so a bound that cannot establish it refuses. */
+  var notAfterAt = _instantOrNull(opts.signerNotAfter);
+  var genUpper = genAt === null ? null
+    : guard.time.latestInstantOf(res.genTime, res.tstInfo && res.tstInfo.genTimeFraction, res.accuracy || null);
+  if (notAfterAt !== null && genUpper !== null && genUpper > notAfterAt) {
+    return guard.verdict.of({ valid: false, trusted: res.trusted === true, genTime: res.genTime,
+      code: "cms/timestamp-after-signer-expiry",
+      /** @internal The message names the BOUND, not just the genTime: this verdict is reached
+       *  whenever the latest instant the token could have been created at is past the notAfter, and
+       *  with a wide accuracy or a sub-millisecond fraction that is true of tokens whose stated
+       *  genTime is inside the window. Reporting the genTime alone would give an operator a reason
+       *  they can check and find false. */
+      message: "the token's genTime " + guard.time.isoOf(res.genTime) + ", with the accuracy it " +
+        "states, puts the latest it could have been created at " +
+        guard.time.isoOf(new intrinsic.Date(genUpper)) + ", past the signing certificate's notAfter " +
+        guard.time.isoOf(opts.signerNotAfter) + ", so it does not establish that the token was " +
+        "created before that certificate expired (ETSI EN 319 122-1 clause 6.3 requirement m)" });
+  }
+  return guard.verdict.of({
+    valid: true, trusted: res.trusted === true, genTime: res.genTime,
+    accuracy: res.accuracy, serialNumber: res.serialNumber, policy: res.policy,
+    revocationChecked: res.revocationChecked, tsa: res.tsa, signer: res.signer,
+  });
+}
+
+/** @internal The signing certificate's `notAfter`, where the signer row matched one. The expiry half
+ *  of EN 319 122-1 clause 6.3 requirement m is decidable from this certificate alone; the revocation
+ *  half needs status this verb does not fetch and is not claimed. */
+function _signerNotAfter(verdict) {
+  if (!verdict || !verdict.cert) return null;
+  try { return x509.parse(verdict.cert).validity.notAfter; }
+  // allow:swallow-unverified a signer certificate that does not parse already failed its own verdict
+  catch (_e) { return null; }
+}
+
+async function _verifyCountersignatures(si, parsedCerts, allowWeakDigests, requireProtection) {
   var targetSig = _toBuf(si.signature, "the countersigned signature");
   var values = [];
   intrinsic.forEach(si.unsignedAttrs || [], function (a) {
@@ -425,17 +839,24 @@ async function _verifyCountersignatures(si, parsedCerts, allowWeakDigests) {
     intrinsic.forEach(a.values, function (v) { guard.list.append(values, v && v.bytes ? v.bytes : v); });
   });
   var out = [];
-  for (var _cp = 0; _cp < values.length; _cp++) guard.list.append(out, await _verifyOneCountersig(values[_cp], targetSig, parsedCerts, allowWeakDigests));
+  for (var _cp = 0; _cp < values.length; _cp++) guard.list.append(out, await _verifyOneCountersig(values[_cp], targetSig, parsedCerts, allowWeakDigests, requireProtection));
   return out;
 }
 
-async function _verifyOneCountersig(vDer, targetSig, parsedCerts, allowWeakDigests) {
+async function _verifyOneCountersig(vDer, targetSig, parsedCerts, allowWeakDigests, requireProtection) {
   var csSi;
   try { csSi = cms.walkCountersignature(asn1.decode(intrinsic.isBuffer(vDer) ? vDer : intrinsic.bufferFrom(vDer))); }
   catch (e) { return _row({ ok: false, code: (e instanceof CmsError ? e.code : "cms/bad-countersignature"), message: e && e.message }); }
-  var verdict = await _verifyOne(csSi, targetSig, null, parsedCerts, targetSig, undefined, allowWeakDigests);
-  var nested = await _verifyCountersignatures(csSi, parsedCerts, allowWeakDigests);
-  var head = { ok: verdict.ok, sid: verdict.sid, cert: verdict.cert, digestAlgorithm: csSi.digestAlgorithm.name };
+  /** @internal A countersignature is its own SignerInfo with its own algorithm identifiers, so the
+   *  attribute inside it protects those and is compared against them rather than against the
+   *  signature it countersigns. */
+  var apReport = _algorithmProtectionReport(csSi, "signatureAlgorithm", csSi.signatureAlgorithm);
+  var verdict = _applyAlgorithmProtection(
+    await _verifyOne(csSi, targetSig, null, parsedCerts, targetSig, undefined, allowWeakDigests),
+    apReport, requireProtection === true);
+  var nested = await _verifyCountersignatures(csSi, parsedCerts, allowWeakDigests, requireProtection);
+  var head = { ok: verdict.ok, sid: verdict.sid, cert: verdict.cert, digestAlgorithm: csSi.digestAlgorithm.name,
+    algorithmProtection: verdict.algorithmProtection };
   return guard.verdict.of(
     verdict.code ? guard.verdict.of(head, { code: verdict.code }) : head,
     { unsignedAttrs: _surfaceUnsignedAttrs(csSi), countersignatures: nested });
@@ -455,7 +876,7 @@ async function _verifyOneCountersig(vDer, targetSig, parsedCerts, allowWeakDiges
  * Verify a CMS SignedData signature (RFC 5652 sec. 5). `input` is a PEM string, a DER
  * `Buffer`, or a parsed `pki.schema.cms` object. Returns `{ valid, trusted, eContentType, eContent, signers }`
  * (`eContent` the encapsulated content when present, else null) where each `signers[i]` is
- * `{ ok, sid, cert, trusted, signedAttributesPresent, signedAttributes, unsignedAttrs, digestAlgorithm, countersignatures }`
+ * `{ ok, sid, cert, trusted, signedAttributesPresent, signedAttributes, unsignedAttrs, digestAlgorithm, countersignatures, signatureTimeStamps, cadesBaseline, algorithmProtection }`
  * (`cert` the matched signer certificate DER) or carries a `code` on a structural failure; `valid` is true when
  * there is at least one signer and every signer verified.
  *
@@ -480,12 +901,52 @@ async function _verifyOneCountersig(vDer, targetSig, parsedCerts, allowWeakDiges
  * `subjectKeyIdentifier` names a key, and several certificates can hold it with different
  * validity windows, key usage and policies; deciding from a sibling would let an expired or
  * wrong-purpose signer certificate be reported trusted because a different certificate chained.
- * Supply the certificate you want used. RSA (PKCS#1 v1.5 and RSASSA-PSS), ECDSA, EdDSA, and the post-quantum
+ * Supply the certificate you want used. Where several candidates match the identifier and the
+ * signature carries an ESS signing-certificate attribute, the candidate that attribute names is the
+ * one selected, since RFC 5035 clause 5.4 makes its first identifier "the certificate used to verify
+ * the signature"; a named candidate must still verify the signature like any other. RSA (PKCS#1 v1.5 and RSASSA-PSS), ECDSA, EdDSA, and the post-quantum
  * ML-DSA (ML-DSA-44/65/87, RFC 9882) and SLH-DSA (the twelve FIPS 205 sets, RFC 9814) signatures
  * are recognized, the post-quantum families in pure mode with an empty context, as is composite
  * ML-DSA (draft-ietf-lamps-cms-composite-sigs), which pairs ML-DSA with a traditional
  * RSA / ECDSA / EdDSA and verifies only when both components pass (never an AND-to-OR downgrade).
  *
+ * `signatureTimeStamps` is one row per `id-aa-signatureTimeStampToken` unsigned attribute (RFC 5126
+ * clause 6.1.1, ETSI EN 319 122-1 clause 5.3), each `{ valid, trusted, genTime, accuracy,
+ * serialNumber, policy, revocationChecked, tsa, signer }` or `{ valid: false, code, message }`. A
+ * token that does not verify is a row verdict and does not take the signer's own `ok` down: the
+ * signature and the time it was made at are separate claims. Each row's imprint is checked against
+ * the signature octets this verb just verified, and a row is refused when its `genTime` precedes the
+ * signer's own `signing-time` attribute or falls after the signing certificate's `notAfter`
+ * (EN 319 122-1 clause 6.3 requirement m).
+ *
+ * What a `valid: true` row establishes is that the token was issued over the signature octets THIS
+ * SignerInfo carries. It does not say that signature is sound, which is `signers[i].ok`, and rows are
+ * reported beside a failed signature rather than withheld, so a caller acting on a timestamp reads
+ * both. The imprint names signature octets rather than a signer, which is what EN 319 122-1
+ * clause 5.3 specifies: two certificates holding one key produce one signature value over one
+ * content, and a token over it answers for either. `pki.cms.attachTimestamp` adds such an attribute to an
+ * existing message and `pki.cms.timestampImprint` produces the imprint a TSA signs.
+ *
+ * `algorithmProtection` reports the RFC 6211 attribute, `{ present, oid, compared, mismatch }`. The
+ * attribute is a copy of the digest and signature algorithm identifiers this signer names, placed
+ * where the signature covers them, and `compared` lists the identifiers checked against it. A
+ * disagreement fails the signer with `cms/algorithm-protection-mismatch`, which sec. 3.1 requires of
+ * any validator that supports the attribute: the identifiers the attribute protects are otherwise
+ * covered by nothing, and RFC 8933 sec. 6 names RSASSA-PSS as the case where the signature itself
+ * pins no digest. An absent attribute is not a failure unless `requireAlgorithmProtection` asks for
+ * one, and `present: false` says so rather than looking like a comparison that passed.
+ *
+ * `cadesBaseline` is a third claim, `{ conformant, signingCertificateAttribute, findings,
+ * requirementsChecked }`: a signature can be sound and still not be a CAdES signature.
+ * `requirementsChecked` lists the EN 319 122-1 requirements decided here, each unmet one carrying a
+ * `{ code, message }` finding, so `conformant` is read against that list and not as a full
+ * clause 6.3 audit. The signing-certificate requirement is the attribute's CLAIM checked against the
+ * certificate this SignerInfo selected, the one reported as `signers[i].cert`, not the attribute's
+ * presence. Like the timestamp rows it is reported beside a failed signature rather than withheld,
+ * so `conformant: true` on a signer whose `ok` is false says the CAdES attributes are in order and
+ * nothing about the signature. `pki.cms.sign` reaches `conformant: true` with a
+ * `signingCertificateV2` attribute built by `pki.schema.smime.buildSigningCertificateV2`.
+ *
  * @opts  content  The detached content when the SignedData carries no encapsulated eContent, and
  *                 required for a detached signature. A `Buffer`, or an async iterable of byte chunks
  *                 to verify a large payload without holding it in memory. The streamed form is hashed
@@ -503,6 +964,21 @@ async function _verifyOneCountersig(vDer, targetSig, parsedCerts, allowWeakDiges
  *                 question from `requiredEku`, since a root distributed with NSS trust bits can be
  *                 marked untrusted for one purpose and good for another. Those bits and
  *                 `distrustAfter` are consulted only when this names a purpose.
+ * @opts  timestampCerts  Extra TSA certificates for the signature-timestamp rows, in addition to the
+ *                 ones each token embeds.
+ * @opts  timestampTrustAnchors  The roots a time-stamping authority must chain to for a timestamp row
+ *                 to report `trusted`. Named apart from `trustAnchors` because a TSA is a different
+ *                 trust decision from the signer: an operator may anchor one and not the other.
+ * @opts  timestampRevocationChecker  A revocation checker for the TSA chain, as `pki.path.validate`
+ *                 takes one. Each row reports what it established in `revocationChecked`.
+ * @opts  requireAlgorithmProtection  Fail a signer that carries no RFC 6211
+ *                 `CMSAlgorithmProtection` attribute, with `cms/missing-algorithm-protection`. Off
+ *                 by default: RFC 6211 says nothing about absence and RFC 8933 sec. 4.1 makes
+ *                 including it a SHOULD, so a message without one is not malformed and most CMS in
+ *                 the field carries none. A signer that DOES carry one is always held to it, with no
+ *                 option, because sec. 3.1's comparisons are MUSTs once a validator supports the
+ *                 attribute. The option is the boolean it documents: `false`, `null` and an absent
+ *                 option are the off forms, and any other value is refused `cms/bad-input`.
  * @example
  *   var pair = await pki.key.generate("Ed25519");
  *   var key = await pki.key.export(pair.privateKey);
@@ -540,7 +1016,13 @@ async function _resolveContentDigests(parsed, streamSource) {
   return byName;
 }
 
-var _VERIFY_OPTS = intrinsic.assign(intrinsic.create(null), { certs: 1, content: 1, trustAnchors: 1, time: 1, requiredEku: 1, checkPurpose: 1, allowWeakDigests: 1 });
+var _VERIFY_OPTS = intrinsic.assign(intrinsic.create(null), { certs: 1, content: 1, trustAnchors: 1, time: 1, requiredEku: 1, checkPurpose: 1, allowWeakDigests: 1,
+  /** @internal The timestamp inputs are named apart from the signer's own, because a time-stamping
+   *  authority is a different trust decision from the signer's: an operator may anchor the TSA while
+   *  leaving the signer unanchored, or the reverse, and one `trustAnchors` for both would make those
+   *  two answers one. */
+  timestampCerts: 1, timestampTrustAnchors: 1, timestampRevocationChecker: 1,
+  requireAlgorithmProtection: 1 });
 
 function verify(input, opts) {
   return guard.async.deferred(function () { return _verify(input, opts); });
@@ -549,12 +1031,20 @@ function verify(input, opts) {
 async function _verify(input, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "cms/bad-input", "pki.cms.verify options");
   guard.identifier.assertKnownKeys(opts, _VERIFY_OPTS, _err, "cms/bad-input", "pki.cms.verify has an unknown option ");
+  /** @internal The two policy switches are taken FIRST, ahead of everything below that can run the
+   *  caller's own code. Deriving the message runs accessors on a parsed input, copying the trust
+   *  material runs them on each anchor, and a streamed detached content runs the generator while
+   *  this verb is pending; any of those can write to an options object the caller still holds, so a
+   *  switch read after them is read from whatever they left behind rather than from the call. */
+  var allowWeakDigests = opts.allowWeakDigests === true;
+  var requireProtection = guard.identifier.booleanOption(opts.requireAlgorithmProtection, _err,
+    "cms/bad-input", "pki.cms.verify opts.requireAlgorithmProtection");
   var parsed = guard.parsed.acceptDerived(input, "cms", function (bytes) {
     return cms.parse(_snapshotIfBytes(bytes, "pki.cms.verify"));
   }, _err, "cms/bad-input", "the SignedData");
   if (!Array.isArray(parsed.signerInfos)) throw _err("cms/bad-input", "input is not a CMS SignedData");
   var trustCfg = _snapshotTrust(opts);
-  var allowWeakDigests = opts.allowWeakDigests === true;
+  var tsTrustCfg = _snapshotTimestampTrust(opts, allowWeakDigests);
   var parsedCerts = [];
   (parsed.certificates || []).forEach(function (c) { _addCert(parsedCerts, c && c.bytes ? c.bytes : c); });
   (opts.certs || []).forEach(function (c) { _addCert(parsedCerts, c); });
@@ -580,13 +1070,25 @@ async function _verify(input, opts) {
   var signers = [];
   for (var _sp = 0; _sp < parsed.signerInfos.length; _sp++) {
     var siOne = parsed.signerInfos[_sp];
+    /** @internal Read once, before the signature is checked, and used for both the verdict row and
+     *  the decision: the attribute is an independent requirement on the same signer, the way trust
+     *  is, so it composes onto the verdict rather than being folded into the signature check. */
+    var apReport = _algorithmProtectionReport(siOne, "signatureAlgorithm", siOne.signatureAlgorithm);
     var verdict = await _verifyOne(siOne, content, eContentType, parsedCerts, null, digestByName, allowWeakDigests);
-    var counters = await _verifyCountersignatures(siOne, parsedCerts, allowWeakDigests);
+    verdict = _applyAlgorithmProtection(verdict, apReport, requireProtection);
+    var counters = await _verifyCountersignatures(siOne, parsedCerts, allowWeakDigests, requireProtection);
+    /** @internal The timestamp rows are built from the same `signature` octets the signature verdict
+     *  above was computed over, which is why they are here and not in a verb of their own. The
+     *  signer's own certificate supplies the expiry half of EN 319 122-1 clause 6.3 requirement m. */
+    var stamps = await _verifySignatureTimestamps(siOne, _toBuf(siOne.signature, "the timestamped signature"),
+      intrinsic.assign(intrinsic.create(null), tsTrustCfg, { signerNotAfter: _signerNotAfter(verdict) }));
     guard.list.append(signers, guard.verdict.of(verdict, {
       countersignatures: counters,
+      signatureTimeStamps: stamps,
       unsignedAttrs: _surfaceUnsignedAttrs(siOne),
       signedAttributesPresent: !!siOne.signedAttrsBytes,
       signedAttributes: _surfaceSignedAttrs(siOne),
+      cadesBaseline: _cadesBaseline(siOne, verdict && verdict.cert ? verdict.cert : null),
       digestAlgorithm: siOne.digestAlgorithm.name,
       trusted: false,
     }));
@@ -640,6 +1142,30 @@ function _snapshotTrust(opts) {
   };
 }
 
+/** @internal The time-stamping authority's trust inputs, taken at the call like the signer's own and
+ *  for the same reason: they are first read inside the per-signer loop, after the signature and
+ *  countersignature checks have awaited, so an options object that changes between rows, or one
+ *  whose properties are accessors, would have two rows of one verdict judged against two different
+ *  authorities. The certificates are copied by value, since a caller holding the array could swap an
+ *  entry after the row that read it. The checker is a function and is captured as the one reference
+ *  every row calls. */
+function _snapshotTimestampTrust(opts, allowWeakDigests) {
+  var certs = opts.timestampCerts;
+  var anchors = opts.timestampTrustAnchors;
+  return {
+    timestampCerts: certs == null ? certs
+      : guard.list.copyMap(intrinsic.isArray(certs) ? certs : [certs], function (c) {
+        return _snapshotIfBytes(c, "opts.timestampCerts[]");
+      }),
+    timestampTrustAnchors: anchors == null ? anchors
+      : guard.list.copyMap(intrinsic.isArray(anchors) ? anchors : [anchors], function (a) {
+        return typeof a === "string" ? a : _cloneAnchorValue(a, 0);
+      }),
+    timestampRevocationChecker: opts.timestampRevocationChecker,
+    allowWeakDigests: allowWeakDigests,
+  };
+}
+
 /** @internal A signature over content is authorized by digitalSignature, contentCommitment or
  *  nonRepudiation alike; the shared helper carries the rest of the rule. */
 var _permitsSigning = pkix.keyUsagePermits(pkix.makeNS("cms", CmsError, oid),
@@ -762,6 +1288,17 @@ function _addCert(out, der) {
  *                          (`timeStampToken`); content-type / message-digest / signing-time are
  *                          rejected here (RFC 5652 sec. 11). Use `pki.cms.countersign` for a
  *                          countersignature specifically.
+ * @opts  algorithmProtection  Emit the RFC 6211 `CMSAlgorithmProtection` signed attribute, a copy of
+ *                          this signer's digest and signature algorithm identifiers placed where the
+ *                          signature covers them. RFC 8933 sec. 4.1 makes including it a SHOULD, and
+ *                          RFC 9882 sec. 4 and RFC 9814 sec. 5 repeat that for ML-DSA and SLH-DSA,
+ *                          which carry no digest identifier inside the signature. Off by default,
+ *                          because turning it on changes the bytes of every signature. `true` emits
+ *                          the identifier RFC 6211 sec. 2 states, which OpenSSL and Bouncy Castle
+ *                          use; `"registry"` emits the S/MIME arc value the IANA registry and
+ *                          draft-ietf-lamps-rfc6211-update give it. A verifier here reads both.
+ *                          `false`, `null` and an absent option emit none, and any other value is
+ *                          refused `cms/bad-input`.
  * @example
  *   var pair = await pki.key.generate("Ed25519");
  *   var signerKeyPkcs8 = await pki.key.export(pair.privateKey);
@@ -804,6 +1341,10 @@ var sign = cmsSign.sign;
  *                              is rejected, RFC 5652 sec. 11.4).
  * @opts  sid                   `"issuerAndSerial"` (default) or `"ski"`.
  * @opts  certificates          Embed the countersigner certificate(s) in the SignedData. Default true.
+ * @opts  algorithmProtection   Emit the RFC 6211 `CMSAlgorithmProtection` attribute on the
+ *                              countersignature, copying ITS own digest and signature algorithm
+ *                              identifiers rather than the countersigned signature's. Off by
+ *                              default; `"registry"` selects the IANA registry identifier.
  * @opts  pem                   Return a PEM string instead of a DER Buffer.
  * @example
  *   var pair = await pki.key.generate("Ed25519");
@@ -817,6 +1358,12 @@ var sign = cmsSign.sign;
  */
 var countersign = cmsSign.countersign;
 
+/** @internal The two CAdES signature-timestamp verbs, re-exported here with `sign` and `countersign`
+ *  because this module is the `pki.cms` namespace's assembly point. Their documentation blocks live
+ *  with their implementations in `cms-sign.js`. */
+var timestampImprint = cmsSign.timestampImprint;
+var attachTimestamp = cmsSign.attachTimestamp;
+
 /**
  * @primitive pki.cms.encrypt
  * @signature pki.cms.encrypt(content, recipients, opts?) -> Promise<Buffer | string>
@@ -893,6 +1440,18 @@ var encrypt = cmsEncrypt.encrypt;
  * @opts keyIdentifier `"issuerAndSerial"` (default) or `"subjectKeyIdentifier"`.
  * @opts oaepHash The RSAES-OAEP hash for ktri recipients wrapping the MAC key: `"sha256"` (default) / `"sha384"` / `"sha512"`.
  * @opts ukm User keying material (a Buffer) for kari / kemri recipients.
+ * @opts algorithmProtection Emit the RFC 6211 `CMSAlgorithmProtection` authenticated attribute, a
+ *       copy of the digest and MAC algorithm identifiers this structure names. It matters more here
+ *       than on a signature: RFC 5652 sec. 9.2 makes the MAC input the DER encoding of `authAttrs`
+ *       alone, so `digestAlgorithm` and `macAlgorithm` are covered by nothing, and rewriting the
+ *       digest algorithm leaves the MAC verifying while the recipient recomputes the content digest
+ *       under the attacker's choice, no key required. `true` emits the identifier RFC 6211 sec. 2
+ *       states, `"registry"` the IANA registry value. Off by default, because it changes the bytes
+ *       of every message. `false`, `null` and an absent option emit none, and any other value is
+ *       refused `cms/bad-input`. With `authenticatedAttributes: false` the MAC covers the content
+ *       octets directly and no attribute set is built, so asking for the attribute there is refused
+ *       while the off forms are still accepted. `pki.cms.decrypt` reads both identifiers and
+ *       compares the copies it finds.
  * @opts pem Return a PEM string (`-----BEGIN CMS-----`) instead of a DER Buffer.
  * @example
  *   // authenticate a message to an RSA recipient, then verify the MAC via decrypt
@@ -955,6 +1514,19 @@ var authenticate = cmsEncrypt.authenticate;
  * @opts maxIterations  Lower the PBKDF2 iteration cap (a DoS bound; downward only).
  * @opts stream         Return `content` as an async iterable of plaintext `Buffer` chunks instead of a single `Buffer`.
  * @opts allowUnauthenticatedRsa15  Read a message that uses RSAES-PKCS1-v1_5 key transport over a content with no integrity tag, such as AES-CBC. Refused by default with `cms/unauthenticated-rsa-v15`: the content padding is that combination's only integrity check, so decrypting it either returns the plaintext of a substituted key or tells an attacker submitting chosen ciphertexts that theirs decoded (RFC 8017 sec. 7.2). `openssl cms -encrypt` emits exactly this combination when no algorithm is named, so reading one of its messages needs this option. An AEAD content or an RSAES-OAEP recipient needs none.
+ * @opts requireAlgorithmProtection  For an AuthenticatedData, refuse one that carries no RFC 6211
+ *       `CMSAlgorithmProtection` authenticated attribute, with `cms/missing-algorithm-protection`.
+ *       Off by default, since RFC 8933 sec. 4.1 makes including it a SHOULD. A message that DOES
+ *       carry one is always held to it, with no option: its `digestAlgorithm` and `macAlgorithm`
+ *       copies are compared against the fields of the `AuthenticatedData` itself, and a disagreement
+ *       is `cms/algorithm-protection-mismatch`. That comparison runs before the MAC, because a
+ *       mismatch is a statement about the message rather than about the key. The result's
+ *       `algorithmProtection` field reports what was compared. The option is the boolean it
+ *       documents: `false`, `null` and an absent option are the off forms, and any other value is
+ *       refused `cms/bad-input`. Asking for it while decrypting any other content type is refused
+ *       the same way: RFC 8933 sec. 6 gives the attribute a place in an `AuthenticatedData` alone,
+ *       so an `EnvelopedData`, `AuthEnvelopedData` or `EncryptedData` cannot satisfy the
+ *       requirement and returning its plaintext would answer neither question.
  * @example
  *   var rsa = { name: "RSA-OAEP", modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" };
  *   var pair = await pki.key.generate(rsa);
@@ -1126,4 +1698,4 @@ function isCertsOnly(input) {
 }
 
 // @internal
-module.exports = { verify: verify, sign: sign, countersign: countersign, encrypt: encrypt, authenticate: authenticate, decrypt: decrypt, compress: compress, decompress: decompress, digest: cmsDigest.digest, verifyDigest: cmsDigest.verifyDigest, certsOnly: certsOnly, parseCertsOnly: parseCertsOnly, isCertsOnly: isCertsOnly, setEngine: setEngine };
+module.exports = { verify: verify, sign: sign, countersign: countersign, encrypt: encrypt, authenticate: authenticate, decrypt: decrypt, compress: compress, decompress: decompress, digest: cmsDigest.digest, verifyDigest: cmsDigest.verifyDigest, certsOnly: certsOnly, parseCertsOnly: parseCertsOnly, isCertsOnly: isCertsOnly, setEngine: setEngine, timestampImprint: timestampImprint, attachTimestamp: attachTimestamp };