@blamejs/pki 0.8.51 → 0.8.53

package/lib/schema-smime.js

@@ -22,6 +22,9 @@
  *   (raw), the hash algorithm (decoded for v2, or the implied SHA-1 for v1), and
  *   the optional `issuerSerial` (issuer `GeneralNames` validated + surfaced raw,
  *   serial as a BigInt + hex)) plus the optional certificate policies.
+ *   `buildSigningCertificateV2` encodes the v2 attribute value a signer attaches:
+ *   one `ESSCertIDv2` per certificate, the SHA-256 form with the DEFAULT algorithm
+ *   omitted and SHA-384 / SHA-512 with an absent parameters field.
  *   `parseSmimeCapabilities` decodes the ordered `SMIMECapabilities` list (each a
  *   capability OID + raw parameters). `decodeAttribute` takes a CMS-shaped
  *   `{ type, values }` attribute, enforces the single-`AttributeValue` rule
@@ -46,9 +49,14 @@ var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
 var oid = require("./oid");
 var frameworkError = require("./framework-error");
+var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
+var constants = require("./constants");
+var x509 = require("./schema-x509");
 
 var SmimeError = frameworkError.SmimeError;
 var PemError = frameworkError.PemError;
+var b = asn1.build;
 
 var NS = pkix.makeNS("smime", SmimeError, oid);
 var TAGS = asn1.TAGS;
@@ -61,6 +69,12 @@ var OID_SIGNING_CERTIFICATE = oid.byName("signingCertificate");
 var OID_SIGNING_CERTIFICATE_V2 = oid.byName("signingCertificateV2");
 var OID_SMIME_CAPABILITIES = oid.byName("smimeCapabilities");
 
+/** @internal The digests this module will BIND a certificate with. RFC 5035 sec. 4 leaves
+ *  `hashAlgorithm` open, and the two readers that consume the field disagree on the set they admit,
+ *  so the builder emits only what the strictest consumer accepts: SHA-1 is excluded because a
+ *  binding is an identity claim, and an identifier a verifier refuses is a token nobody can use. */
+var BIND_DIGESTS = intrinsic.assign(intrinsic.create(null), { sha256: 1, sha384: 1, sha512: 1 });
+
 var GENERAL_NAME_DIRECTORY = 4;
 var ISSUER_SERIAL = schema.seq([
   schema.field("issuer", pkix.generalNames(NS, { code: "smime/bad-general-names" })),
@@ -71,7 +85,7 @@ var ISSUER_SERIAL = schema.seq([
     return {
       issuer: m.fields.issuer.value.result,
       serialNumber: m.fields.serialNumber.value,
-      serialNumberHex: m.fields.serialNumber.node.content.toString("hex"),
+      serialNumberHex: intrinsic.bufToString(m.fields.serialNumber.node.content, "hex"),
     };
   },
 });
@@ -105,7 +119,7 @@ var POLICY_INFORMATION = schema.seq([
 });
 var POLICIES = schema.seqOf(POLICY_INFORMATION, {
   assert: "sequence", min: 0, code: "smime/bad-policies", what: "policies",
-  build: function (m) { return m.items.map(function (it) { return it.value.result; }); },
+  build: function (m) { return intrinsic.map(m.items, function (it) { return it.value.result; }); },
 });
 
 var ESS_CERT_ID = schema.seq([
@@ -155,7 +169,7 @@ function signingCertificateSchema(essCertId, code, what) {
   ], {
     assert: "sequence", code: code, what: what,
     build: function (m, ctx) {
-      var certs = m.fields.certs.value.items.map(function (it) { return it.value.result; });
+      var certs = intrinsic.map(m.fields.certs.value.items, function (it) { return it.value.result; });
       assertSignerIssuerIsDirectoryName(certs, function (msg) { throw ctx.E("smime/bad-issuer-serial", msg); });
       return {
         certs: certs,
@@ -182,7 +196,7 @@ var SMIME_CAPABILITY = schema.seq([
 });
 var SMIME_CAPABILITIES = schema.seqOf(SMIME_CAPABILITY, {
   assert: "sequence", min: 0, code: "smime/bad-capabilities", what: "SMIMECapabilities",
-  build: function (m) { return { capabilities: m.items.map(function (it) { return it.value.result; }) }; },
+  build: function (m) { return { capabilities: intrinsic.map(m.items, function (it) { return it.value.result; }) }; },
 });
 
 /**
@@ -266,6 +280,197 @@ var parseSigningCertificateV2 = pkix.makeParser({ pemLabel: null, PemError: PemE
  */
 var parseSmimeCapabilities = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorClass: SmimeError, prefix: "smime", what: "SMIMECapabilities", topSchema: SMIME_CAPABILITIES, ns: NS });
 
+function _err(code, message) { return new SmimeError(code, message); }
+
+/** @internal The digests a signing-certificate identifier may BIND a certificate with, on the
+ *  reading side. It is the set the builder emits, and it is narrower than the set the ESS decoder
+ *  will decode: an identifier is an identity claim, so admitting a digest nobody should bind with
+ *  would let the claim be satisfied by a certificate other than the one that signed. SHA-1 is not
+ *  here and is reported as weak by its own flag, because the v1 attribute has no algorithm field
+ *  and is SHA-1 by definition (RFC 2634), so a reader must be able to tell "weak" from "unknown". */
+var BIND_VERIFY_DIGESTS = intrinsic.assign(intrinsic.create(null), { sha256: 1, sha384: 1, sha512: 1 });
+var GENERAL_NAME = pkix.generalName(NS, { decodeValue: true, code: "smime/bad-general-names" });
+
+/** @internal What ONE signing-certificate attribute claims about `certDer`, as facts rather than a
+ *  verdict. Each claim is read and compared here so there is one implementation of "does this
+ *  identifier name that certificate", and the two consumers apply their own policy to the result:
+ *  `pki.tsp.verify` refuses a token, and `pki.cms.verify` reports a CAdES conformance finding.
+ *
+ *  An ESSCertID states the signer in two independent ways, and both are compared: the hash under
+ *  the identifier's own digest, and the issuer and serial where it carries them (RFC 5035 clause 5,
+ *  RFC 2634 clause 5.4). A hash that agrees beside an issuer and serial naming another certificate
+ *  is a contradiction, not a match. Identifiers after the first are not read: RFC 2634 clause 5.4
+ *  makes the first the signing certificate and leaves the rest as the chain. */
+function _bindingClaim(attr) {
+  var out = { form: attr.type === OID_SIGNING_CERTIFICATE_V2 ? "v2" : "v1", readable: false,
+    digestName: null, supported: false, weak: false, certHash: null, issuerSerial: null };
+  var decoded;
+  try { decoded = decodeAttribute(attr); }
+  catch (_e) { return out; }
+  var ess = decoded.certs && decoded.certs[0];
+  if (!ess) return out;
+  /** @internal The digest identifier is held to its own encoding before its NAME is read. A SHA-2
+   *  identifier carries absent or NULL parameters and nothing else (RFC 5754 clause 2, "MUST accept
+   *  SHA2 AlgorithmIdentifiers with absent parameters ... with NULL parameters"), and the same two
+   *  forms are what RFC 3370 clause 2.1 states for SHA-1. The ANY parameters field is carried
+   *  through the parse unvalidated, so an identifier naming a digest this build computes while
+   *  carrying arbitrary bytes beside it would otherwise be hashed as a well-formed binding. */
+  if (!guard.der.paramsAbsentOrNull(ess.hashAlgorithm == null ? null : ess.hashAlgorithm.parameters)) return out;
+  out.readable = true;
+  out.digestName = ess.hashAlgorithm == null ? "sha1" : ess.hashAlgorithm.name;
+  out.weak = intrinsic.hasOwn(constants.NAMES.WEAK_DIGESTS, out.digestName);
+  out.supported = out.weak || intrinsic.hasOwn(BIND_VERIFY_DIGESTS, out.digestName);
+  out.certHash = ess.certHash;
+  out.issuerSerial = ess.issuerSerial || null;
+  return out;
+}
+
+/** @internal One claim compared against one certificate. The claim is read ONCE, by
+ *  `certBindingClaims`, and this is what runs per certificate: a signer identifier can match many
+ *  candidates, and re-reading the attribute for each would multiply the attribute's size by the
+ *  candidate count before any signature is checked. Only the first identifier is ever compared, so
+ *  only it is kept.
+ *
+ * @internal
+ */
+function certBindingAgainst(claim, certDer) {
+  var out = { form: claim.form, readable: claim.readable, digestName: claim.digestName,
+    supported: claim.supported, weak: claim.weak, matches: null, certUnreadable: false,
+    issuerSerialPresent: claim.issuerSerial !== null, issuerSerialMatches: null };
+  if (!claim.readable || !claim.supported) return out;
+  /** @internal Through the captured digest and the constant-time comparison: this IS the binding
+   *  between a signature and the certificate its attribute names, so neither what the digest covers
+   *  nor how the result is compared is the caller's to choose. */
+  out.matches = guard.crypto.constantTimeEqual(guard.crypto.digest(claim.digestName, certDer), claim.certHash);
+  if (claim.issuerSerial === null) return out;
+  /** @internal A certificate that does not parse is its own fact, kept apart from an attribute that
+   *  does not decode: one says the identifier is malformed and the other says the thing it would be
+   *  compared against is, and a consumer orders the two itself. Folding them into one flag moved a
+   *  refusal from "this identifier names another certificate" to "this attribute is unreadable". */
+  var cert;
+  try { cert = x509.parse(certDer); }
+  catch (_e2) { out.certUnreadable = true; return out; }
+  if (claim.issuerSerial.serialNumber !== cert.serialNumber) { out.issuerSerialMatches = false; return out; }
+  var names = claim.issuerSerial.issuer.names || [];
+  var gn = null;
+  try {
+    if (names.length === 1) {
+      gn = schema.embeddedDer(GENERAL_NAME, names[0].bytes, NS,
+        { code: "smime/bad-general-names", what: "GeneralName" });
+    }
+  } catch (_e3) { gn = null; }
+  out.issuerSerialMatches = !!gn && gn.tagNumber === GENERAL_NAME_DIRECTORY && !!gn.value &&
+    guard.name.dnEqual(gn.value.rdns, cert.issuer.rdns, _err, "smime/bad-issuer-serial",
+      "the ESSCertID issuer");
+  return out;
+}
+
+/** @internal Every signing-certificate attribute in `signedAttrs`, read against `certDer`.
+ *  `chosen` is the v2 attribute where there is one, which supersedes v1 (RFC 5035); `superseded`
+ *  holds the rest, which a consumer still holds to the same claim, because one structure making two
+ *  incompatible statements about one fact is a contradiction rather than something to resolve in
+ *  favor of whichever attribute a reader prefers. EVERY attribute is collected rather than the first
+ *  of each type: `signedAttrs` is a DER SET OF, so which of two comes first is a function of their
+ *  encodings and a hostile producer picks it.
+ *
+ * @internal
+ */
+function certBindingClaims(signedAttrs) {
+  var found = [];
+  intrinsic.forEach(signedAttrs || [], function (a) {
+    if (a && (a.type === OID_SIGNING_CERTIFICATE || a.type === OID_SIGNING_CERTIFICATE_V2)) {
+      guard.list.append(found, a);
+    }
+  });
+  if (!found.length) return { present: false, chosen: null, superseded: [] };
+  var chosenAt = 0;
+  for (var i = 0; i < found.length; i++) {
+    if (found[i].type === OID_SIGNING_CERTIFICATE_V2) { chosenAt = i; break; }
+  }
+  var superseded = [];
+  for (var j = 0; j < found.length; j++) {
+    if (j !== chosenAt) guard.list.append(superseded, _bindingClaim(found[j]));
+  }
+  return { present: true, chosen: _bindingClaim(found[chosenAt]), superseded: superseded };
+}
+
+/** @internal The claims read and compared in one call, for a consumer holding a single certificate.
+ *  A consumer with several reads the claims once and calls `certBindingAgainst` per certificate.
+ *
+ * @internal
+ */
+function certBindingFacts(signedAttrs, certDer) {
+  var claims = certBindingClaims(signedAttrs);
+  if (!claims.present) return { present: false, chosen: null, superseded: [] };
+  return {
+    present: true,
+    chosen: certBindingAgainst(claims.chosen, certDer),
+    superseded: intrinsic.map(claims.superseded, function (c) { return certBindingAgainst(c, certDer); }),
+  };
+}
+
+var _BUILD_V2_OPTS = intrinsic.assign(intrinsic.create(null), { hashAlgorithm: 1 });
+
+/**
+ * @primitive  pki.schema.smime.buildSigningCertificateV2
+ * @signature  pki.schema.smime.buildSigningCertificateV2(certs, opts?) -> Buffer
+ * @since      0.8.52
+ * @status     stable
+ * @spec       RFC 5035, RFC 5754
+ * @related    pki.schema.smime.parseSigningCertificateV2, pki.cms.sign, pki.tsp.sign
+ *
+ * Encode an ESS `SigningCertificateV2` attribute value (RFC 5035 sec. 5.4.1), the signed attribute
+ * that binds a signature to the certificate that made it. `certs` is the signer's certificate DER,
+ * or a list of certificate DERs whose first entry is the signer's (RFC 5035 sec. 5.4); each entry
+ * becomes an `ESSCertIDv2` carrying that certificate's hash. The result is the single
+ * `AttributeValue` of a `signingCertificateV2` signed attribute, which is what CAdES requires a
+ * signature to carry (ETSI EN 319 122-1 clauses 5.2.2.2 and 5.2.2.3).
+ *
+ * `opts.hashAlgorithm` names the binding digest: `sha256` (the default), `sha384` or `sha512`. The
+ * SHA-256 form omits the `hashAlgorithm` field, which is the RFC 5035 sec. 4 DEFAULT and so must be
+ * absent (X.690 sec. 11.5); the other two emit an `AlgorithmIdentifier` with the parameters field
+ * absent, which RFC 5754 sec. 2 requires an implementation to generate. SHA-1 is refused
+ * `smime/unsupported-algorithm`: a binding is an identity claim, and `pki.tsp.verify` refuses a
+ * SHA-1 one as a weak binding.
+ *
+ * The OPTIONAL `issuerSerial` and `policies` fields are not emitted; CAdES has the issuer serial
+ * omitted (ETSI EN 319 122-1 clause 6.3 requirement g). A caller that needs either field builds the
+ * value with `pki.asn1.build`, and `parseSigningCertificateV2` reads both back.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey);
+ *   var signerCertDer = await pki.x509.sign({ subject: "Signer", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
+ *   var av = pki.schema.smime.buildSigningCertificateV2(signerCertDer);
+ *   var msg = await pki.cms.sign(Buffer.from("hello"), { cert: signerCertDer, key: key },
+ *     { additionalSignedAttributes: [{ type: "signingCertificateV2", values: [av] }] });
+ *   (await pki.cms.verify(msg, { certs: [signerCertDer] })).signers[0].cadesBaseline.conformant;   // true
+ */
+function buildSigningCertificateV2(certs, opts) {
+  guard.identifier.assertKnownKeys(opts, _BUILD_V2_OPTS, _err, "smime/bad-input",
+    "pki.schema.smime.buildSigningCertificateV2 has an unknown option ");
+  var settings = guard.identifier.pickSettings(opts, ["hashAlgorithm"]);
+  var hashName = settings.hashAlgorithm === undefined || settings.hashAlgorithm === null ? "sha256" : settings.hashAlgorithm;
+  if (typeof hashName !== "string" || !BIND_DIGESTS[guard.text.keyOf(hashName)]) {
+    throw _err("smime/unsupported-algorithm", "the ESSCertIDv2 binding digest must be sha256, sha384 or sha512, got " +
+      guard.text.showValue(hashName));
+  }
+  var list = guard.list.snapshot(intrinsic.isArray(certs) ? certs : [certs]);
+  if (!list.length) {
+    throw _err("smime/bad-input", "a SigningCertificateV2 needs at least one certificate, the signer's first (RFC 5035 sec. 5.4)");
+  }
+  var ids = [];
+  for (var i = 0; i < list.length; i++) {
+    var der = guard.bytes.view(list[i], SmimeError, "smime/bad-input", "the certificate at certs[" + i + "]");
+    var certHash = b.octetString(guard.crypto.digest(hashName, der));
+    guard.list.append(ids, hashName === "sha256"
+      ? b.sequence([certHash])
+      : b.sequence([b.sequence([b.oid(oid.byName(hashName))]), certHash]));
+  }
+  return b.sequence([b.sequence(ids)]);
+}
+
 /**
  * @primitive  pki.schema.smime.decodeAttribute
  * @signature  pki.schema.smime.decodeAttribute(attr) -> { kind, ... }
@@ -292,7 +497,7 @@ var parseSmimeCapabilities = pkix.makeParser({ pemLabel: null, PemError: PemErro
  *   got.kind;    // "signingCertificateV2"
  */
 function decodeAttribute(attr) {
-  if (!attr || typeof attr !== "object" || typeof attr.type !== "string" || !Array.isArray(attr.values)) {
+  if (!attr || typeof attr !== "object" || typeof attr.type !== "string" || !intrinsic.isArray(attr.values)) {
     throw new SmimeError("smime/bad-input", "decodeAttribute expects a CMS attribute { type, values }");
   }
   if (attr.type === OID_SIGNING_CERTIFICATE || attr.type === OID_SIGNING_CERTIFICATE_V2 || attr.type === OID_SMIME_CAPABILITIES) {
@@ -313,6 +518,11 @@ function decodeAttribute(attr) {
 }
 
 module.exports = {
+  buildSigningCertificateV2: buildSigningCertificateV2,
+  certBindingFacts: certBindingFacts,   // @internal
+  certBindingClaims: certBindingClaims,   // @internal
+  certBindingAgainst: certBindingAgainst,   // @internal
+
   parseSigningCertificate: parseSigningCertificate,
   parseSigningCertificateV2: parseSigningCertificateV2,
   parseSmimeCapabilities: parseSmimeCapabilities,

package/lib/tsp-sign.js

@@ -25,7 +25,6 @@ var smime = require("./schema-smime");
 var schemaTsp = require("./schema-tsp");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
-var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var _compare = intrinsic.compare;
 var _pop = intrinsic.pop;
 var _reverse = intrinsic.reverse;
@@ -44,10 +43,6 @@ var _EXT_DECODERS = pkix.certExtensionDecoders(_NS).byOid;
 var b = asn1.build;
 function _err(code, message, cause) { return new TspError(code, message, cause); }
 
-function _hasNonZeroDigit(s) {
-  for (var i = 0; i < s.length; i++) { var c = _charCodeAt(s, i); if (c >= 49 && c <= 57) return true; }
-  return false;
-}
 function O(name) { return oid.byName(name); }
 
 var _b = pkiBuild.makeBuilder({
@@ -67,9 +62,15 @@ function _moreEstablished(candidate, current) {
   return _rankRevocation(candidate) > _rankRevocation(current);
 }
 
+/** @internal The message imprint's algorithm identifier, emitted with the parameters field ABSENT.
+ *  RFC 5754 sec. 2: "Implementations MUST generate SHA2 AlgorithmIdentifiers with absent
+ *  parameters", and it is a SHA-2 digest here because that is the whole set this verb signs under.
+ *  Both forms are still read: a request or token from elsewhere carrying NULL parameters verifies,
+ *  and nothing compares the identifier's bytes, since an imprint is matched by the algorithm it
+ *  names and the digest it carries. */
 function _hashAlgId(name) {
   if (!NODE_DIGEST[guard.text.keyOf(name)]) throw _err("tsp/unsupported-algorithm", "unsupported hash algorithm " + guard.text.showValue(name));
-  return b.sequence([b.oid(O(name)), b.nullValue()]);
+  return b.sequence([b.oid(O(name))]);
 }
 function _policy(p) {
   if (typeof p !== "string") throw _err("tsp/bad-input", "the timestamp policy must be an OID name or dotted string");
@@ -88,12 +89,12 @@ function _certDer(c) {
   return der;
 }
 
+/** @internal The sec. 2.4.2 binding, encoded by the one builder that owns the ESS domain. A second
+ *  encoder here would be a second answer to "which bytes bind this certificate", and the two can
+ *  drift: the SHA-384 and SHA-512 algorithm identifiers are generated with the parameters field
+ *  absent (RFC 5754 sec. 2), and the SHA-256 field omitted as the RFC 5035 sec. 4 DEFAULT. */
 function _signingCertV2(certDer, hashName) {
-  var certHash = guard.crypto.digest(NODE_DIGEST[hashName], certDer);
-  var essCertId = hashName === "sha256"
-    ? b.sequence([b.octetString(certHash)])
-    : b.sequence([_hashAlgId(hashName), b.octetString(certHash)]);
-  return b.sequence([b.sequence([essCertId])]);
+  return smime.buildSigningCertificateV2(certDer, { hashAlgorithm: hashName });
 }
 
 /**
@@ -432,17 +433,21 @@ function response(token, opts) {
 function parseResponse(input) { return schemaTsp.parse(input); }
 
 
-var _VERIFY_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: "sha256", sha384: "sha384", sha512: "sha512", sha1: "sha1" });
+var _VERIFY_DIGEST = constants.NAMES.TIMESTAMP_IMPRINT_DIGESTS;
 var _VERIFY_DIGEST_LEN = constants.NAMES.DIGEST_OCTETS;
-var _BIND_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: "sha256", sha384: "sha384", sha512: "sha512" });
 /** @internal The digests admitted for an imprint that are not collision resistant, so a token under one
  *  binds nothing an attacker with a collision cannot move. They verify only under `allowWeakDigests`. */
-var _WEAK_IMPRINT_DIGEST = intrinsic.assign(intrinsic.create(null), { sha1: 1 });
+var _WEAK_IMPRINT_DIGEST = constants.NAMES.WEAK_DIGESTS;
 
 function _imprintMatches(mi, data, allowWeakDigests) {
   var name = mi.hashAlgorithm && mi.hashAlgorithm.name;
   var nodeAlg = (name && intrinsic.hasOwn(_VERIFY_DIGEST, name)) ? _VERIFY_DIGEST[name] : null;
   if (!nodeAlg) return "tsp/unsupported-algorithm";
+  /** @internal The identifier is held to its own encoding as well as to its name. A digest
+   *  AlgorithmIdentifier carries absent or DER NULL parameters (RFC 5754 clause 2), and the ANY
+   *  field reaches here unvalidated from the generic PKIX decoder, so an imprint naming sha256
+   *  beside arbitrary bytes would otherwise be hashed as a well-formed one. */
+  if (!guard.der.paramsAbsentOrNull(mi.hashAlgorithm.parameters)) return "tsp/unsupported-algorithm";
   /** @internal The imprint is the ONLY thing binding a token to the data it timestamps, so the digest
    *  that computes it carries the whole binding and a collision in it substitutes the data under a
    *  genuine token. `allowWeakDigests` used to reach only the token's own signature digest, through
@@ -452,7 +457,11 @@ function _imprintMatches(mi, data, allowWeakDigests) {
    *  already does with a signature digest, and the opt-in is the same option an archived token needs. */
   if (!allowWeakDigests && intrinsic.hasOwn(_WEAK_IMPRINT_DIGEST, name)) return "tsp/weak-digest";
   var wantLen = _VERIFY_DIGEST_LEN[name];
-  if (mi.hashedMessage.length !== wantLen) return "tsp/imprint-mismatch";
+  /** @internal An imprint whose length is not the output length of the algorithm it names cannot be
+   *  a digest under that algorithm, which is a different fault from a digest that covers other
+   *  bytes, and it gets a code of its own: the first says the token is malformed, the second that it
+   *  is well formed and stamps something else (RFC 3161 sec. 2.4.2). */
+  if (mi.hashedMessage.length !== wantLen) return "tsp/imprint-length";
   var actual;
   if (guard.bytes.isByteSource(data)) {
     var dataBytes = guard.bytes.source(data, TspError, "tsp/bad-input", "data");
@@ -468,104 +477,57 @@ function _imprintMatches(mi, data, allowWeakDigests) {
   return _compare(actual, _bufferFrom(mi.hashedMessage)) === 0 ? true : "tsp/imprint-mismatch";
 }
 
-/** @internal The certificate one binding attribute names, and the digest under which it names it.
- *  An ESSCertID v1 carries NO hashAlgorithm field: it is SHA-1 by definition (RFC 2634 sec. 5.4.1),
- *  and EN 319 122-1 clause 5.2.2.2 says the v1 attribute "shall be used if the SHA-1 hash algorithm is
- *  used", so these tokens exist. An absent algorithm therefore means SHA-1 rather than nothing, and
- *  reporting `tsp/unsupported-algorithm` for one named the wrong fault: the algorithm is known and the
- *  binding is deliberately weak, which is a different refusal from one this build cannot compute.
- *  ABSENT IS NOT THE SAME AS UNRECOGNIZED: a v1 ESSCertID omits the field, so absent carries the type's
- *  default of SHA-1; an ESSCertIDv2 naming an OID this build does not know carries an algorithm that
- *  genuinely cannot be computed, and that one is `tsp/unsupported-algorithm`.
- *  Returns a refusal code, or the ESSCertID with the digest resolved. SHA-1 resolves rather than
- *  refusing, because whether a weak binding is a refusal depends on what the caller is doing with it:
- *  the attribute the verdict rests on is held to it, and an attribute read only for agreement is not. */
-function _readBinding(attr) {
-  var decoded;
-  try { decoded = smime.decodeAttribute(attr); }
-  catch (_e) { return "tsp/bad-signing-certificate"; }
-  var essCert = decoded.certs && decoded.certs[0];
-  if (!essCert) return "tsp/bad-signing-certificate";
-  var name = essCert.hashAlgorithm == null ? "sha1" : essCert.hashAlgorithm.name;
-  if (name === "sha1") return { essCert: essCert, nodeDigest: "sha1", weak: true };
-  if (!name || !intrinsic.hasOwn(_BIND_DIGEST, name)) return "tsp/unsupported-algorithm";
-  return { essCert: essCert, nodeDigest: _BIND_DIGEST[name], weak: false };
-}
-
-/** @internal Whether one ESSCertID names the certificate that signed the token, by every claim it
- *  carries: the hash under its own digest, and the issuer and serial where it states them. Returns
- *  true or the refusal code. An ESSCertID states the signer in two independent ways and both are
- *  compared, because a hash that agrees beside an issuer and serial that name another certificate is
- *  the same contradiction as two attributes disagreeing. Certificate identifiers after the first are
- *  not read: RFC 2634 sec. 5.4 makes the first the signing certificate and leaves the rest as the
- *  chain, so they say nothing about the signer. */
-function _bindingNamesCert(read, tsaCertDer) {
-  /** @internal Through the captured digest: this comparison IS the binding between a token and the
-   *  certificate its signing-certificate attribute names, so what the digest covers is not the
-   *  caller's to choose. */
-  if (_compare(guard.crypto.digest(read.nodeDigest, tsaCertDer),
-    _bufferFrom(read.essCert.certHash)) !== 0) return "tsp/cert-binding-mismatch";
-  var issuerSerial = read.essCert.issuerSerial;
-  if (!issuerSerial) return true;
-  var signerCert;
-  try { signerCert = pkiX509.parse(tsaCertDer); }
-  catch (_e) { return "tsp/bad-signing-certificate"; }
-  if (issuerSerial.serialNumber !== signerCert.serialNumber) return "tsp/cert-binding-mismatch";
-  var names = issuerSerial.issuer.names || [];
-  var gn = null;
-  try { if (names.length === 1) gn = schemaTsp.decodeGeneralName(names[0].bytes); }
-  catch (_e2) { return "tsp/cert-binding-mismatch"; }
-  if (!gn || gn.tagNumber !== 4 || !gn.value || !guard.name.dnEqual(gn.value.rdns, signerCert.issuer.rdns, _err, "tsp/cert-binding-mismatch", "the ESSCertID issuer")) {
-    return "tsp/cert-binding-mismatch";
-  }
-  return true;
-}
+/** @internal An ESSCertID v1 carries NO hashAlgorithm field: it is SHA-1 by definition (RFC 2634
+ *  sec. 5.4.1), and EN 319 122-1 clause 5.2.2.2 says the v1 attribute "shall be used if the SHA-1 hash
+ *  algorithm is used", so these tokens exist. The reader therefore reports SHA-1 as WEAK rather than as
+ *  unsupported, which is a different refusal: the algorithm is known and the binding is deliberately
+ *  weak, where an ESSCertIDv2 naming an OID this build does not know carries one that genuinely cannot
+ *  be computed. Which of the two a caller refuses on is the caller's policy, applied below. */
 
 function _checkCertBinding(signerInfo, tsaCertDer) {
-  var attrs = (signerInfo && signerInfo.signedAttrs) || [];
-  var binding = [];
-  for (var i = 0; i < attrs.length; i++) {
-    if (attrs[i].type === O("signingCertificateV2") || attrs[i].type === O("signingCertificate")) {
-      intrinsic.push(binding, attrs[i]);
-    }
-  }
-  if (!binding.length) return "tsp/missing-signing-certificate";
+  var facts = smime.certBindingFacts((signerInfo && signerInfo.signedAttrs) || [], tsaCertDer);
+  if (!facts.present) return "tsp/missing-signing-certificate";
   /** @internal A v2 binding supersedes a v1 one (RFC 5035), and that is why the verdict rests on the v2
    *  where there is one. But the v1 attribute does not stop existing: a token carrying both used to be
    *  checked against the v2 alone, so one naming the real signer in v2 and a DIFFERENT certificate in v1
    *  verified, and a legacy verifier reading only v1 resolves a certificate this one never checked. Both
    *  sit in signedAttrs, so the TSA signed the contradiction. One structure making two incompatible
    *  claims about one fact is refused rather than resolved in favor of whichever attribute a reader
-   *  prefers.
-   *  EVERY BINDING ATTRIBUTE IS COLLECTED, not the first of each type. signedAttrs is a DER SET OF,
-   *  sorted by encoded value, so which of the two attributes comes first is a function of their lengths
-   *  and the producer of a hostile token chooses it: a scan that stopped at the v2 caught the
-   *  contradiction in one ordering and missed it in the other, and an ordering-dependent check is no
-   *  check. The same applies to a repeated instance of either type, which `pki.cms.verify` refuses
-   *  before this runs and which is not relied on here.
+   *  prefers. Which attribute is `chosen` and which is `superseded` is decided over EVERY binding
+   *  attribute rather than the first of each type, because signedAttrs is a DER SET OF and a hostile
+   *  producer picks the order through the encodings.
    *  THE SHA-1 ON A SUPERSEDED ATTRIBUTE PINS NOTHING. It detects a disagreement, while the binding the
    *  verdict rests on is the v2 one. A collision would let a disagreeing v1 pass for an agreeing one,
    *  which costs an attacker the refusal and gains them nothing: the certificate the token is held to is
    *  the one v2 names, under its own digest. */
-  var chosen = 0;
-  for (var j = 0; j < binding.length; j++) {
-    if (binding[j].type === O("signingCertificateV2")) { chosen = j; break; }
-  }
-  for (var k = 0; k < binding.length; k++) {
-    if (k === chosen) continue;
-    var alt = _readBinding(binding[k]);
-    if (typeof alt === "string") return alt;
-    var altCode = _bindingNamesCert(alt, tsaCertDer);
+  for (var k = 0; k < facts.superseded.length; k++) {
+    var altCode = _bindingClaimCode(facts.superseded[k]);
     if (altCode !== true) return altCode;
   }
-  var read = _readBinding(binding[chosen]);
-  if (typeof read === "string") return read;
+  var read = facts.chosen;
+  if (!read.readable) return "tsp/bad-signing-certificate";
+  if (!read.supported) return "tsp/unsupported-algorithm";
   /** @internal The refusal of a weak binding stands whatever `allowWeakDigests` says, because a binding
    *  is not the archived-signature case the option exists for. Whether it should follow the imprint and
    *  become an opt-in is a posture question, and the refusal was pinned deliberately, so it is left as
    *  it was. */
   if (read.weak) return "tsp/weak-digest";
-  return _bindingNamesCert(read, tsaCertDer);
+  return _bindingClaimCode(read);
+}
+
+/** @internal The refusal one binding attribute's claims earn, in the order the claims are decided:
+ *  an attribute that does not decode, then a digest this build does not bind with, then the hash,
+ *  then the certificate the issuer and serial would be read off, then those two. The hash is
+ *  compared before the certificate is parsed, because a hash that disagrees is a mismatch whatever
+ *  the certificate turns out to be. The weak-digest refusal is the caller's, since it applies to the
+ *  attribute the verdict rests on and not to one read only for agreement. */
+function _bindingClaimCode(e) {
+  if (!e.readable) return "tsp/bad-signing-certificate";
+  if (!e.supported) return "tsp/unsupported-algorithm";
+  if (e.matches !== true) return "tsp/cert-binding-mismatch";
+  if (e.certUnreadable) return "tsp/bad-signing-certificate";
+  if (e.issuerSerialMatches === false) return "tsp/cert-binding-mismatch";
+  return true;
 }
 
 function _checkTsaCertUsage(tsaCertDer) {
@@ -755,7 +717,8 @@ async function verify(token, data, opts) {
   if (opts.trustAnchors) {
     var pathRes = null;
     var floorT = tst.genTime;
-    var ceilT = (tst.genTimeFraction != null && _hasNonZeroDigit(tst.genTimeFraction.slice(3))) ? new Date(guard.time.instantOf(floorT) + 1) : floorT;
+    var ceilAt = guard.time.ceilInstantOf(floorT, tst.genTimeFraction);
+    var ceilT = ceilAt === guard.time.instantOf(floorT) ? floorT : new Date(ceilAt);
     try {
       var pool = (parsed.certificates || []).filter(function (c) { return c.tagClass === "universal"; }).map(function (c) { return pkiX509.parse(c.bytes); });
       (opts.certs || []).forEach(function (c) { guard.list.append(pool, pkiX509.parse(c)); });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.51",
+  "version": "0.8.53",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3a1ddfe7-c71b-4cb4-8bd0-256c3b6075ba",
+  "serialNumber": "urn:uuid:f287baca-f745-4ecd-8265-d6953251f0b6",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-05T13:17:14.754Z",
+    "timestamp": "2026-10-06T00:56:34.786Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.51",
+      "bom-ref": "@blamejs/pki@0.8.53",
       "type": "application",
       "name": "pki",
-      "version": "0.8.51",
+      "version": "0.8.53",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.51",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.53",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.51",
+      "ref": "@blamejs/pki@0.8.53",
       "dependsOn": []
     }
   ]