@blamejs/pki 0.8.52 → 0.8.53

package/lib/cms-verify.js

@@ -232,23 +232,22 @@ function _hashAlgOid(seq) {
   return o;
 }
 
+/** @internal The parameter fields come from `cms.taggedParameterFields`, which holds the DER rule
+ *  for a SEQUENCE of tagged OPTIONAL and DEFAULT fields: one element per tag, ascending, no repeat,
+ *  exactly one value each. The comparison that reads these same fields for their defaults walks the
+ *  same reader, so the verifier and the comparison cannot disagree about what a field is. */
 function _resolvePss(paramsBytes) {
   if (!paramsBytes) return null;
-  var n;
-  try {
-    n = asn1.decode(paramsBytes);
-  } catch (_e) { return null; }
-  if (n.tagClass !== "universal" || n.tagNumber !== asn1.TAGS.SEQUENCE || !n.children) return null;
-  var hash = null, saltLen = null, mgfNode = null, trailer = 1n, last = -1;
-  for (var i = 0; i < n.children.length; i++) {
-    var f = n.children[i];
-    if (f.tagClass !== "context" || f.tagNumber > 3 || f.tagNumber <= last || !f.children || f.children.length !== 1) return null;
-    last = f.tagNumber;
+  var fields = cms.taggedParameterFields(paramsBytes, 3);
+  if (fields === null) return null;
+  var hash = null, saltLen = null, mgfNode = null, trailer = 1n;
+  for (var i = 0; i < fields.length; i++) {
+    var f = fields[i];
     try {
-      if (f.tagNumber === 0) { hash = PSS_HASH[_hashAlgOid(f.children[0])]; if (!hash) return null; }
-      else if (f.tagNumber === 1) { mgfNode = f.children[0]; }
-      else if (f.tagNumber === 2) { saltLen = asn1.read.integer(f.children[0]); }
-      else { trailer = asn1.read.integer(f.children[0]); }
+      if (f.tag === 0) { hash = PSS_HASH[_hashAlgOid(f.node)]; if (!hash) return null; }
+      else if (f.tag === 1) { mgfNode = f.node; }
+      else if (f.tag === 2) { saltLen = asn1.read.integer(f.node); }
+      else { trailer = asn1.read.integer(f.node); }
     } catch (_e3) { return null; }
   }
   if (hash === null || mgfNode === null) return null;
@@ -464,6 +463,54 @@ function _surfaceSignedAttrs(si) {
   });
 }
 
+/** @internal What the RFC 6211 algorithm protection attribute says about the structure carrying it,
+ *  read ONCE per signer and used for both the verdict and the comparison, so the row an operator
+ *  reads and the decision the verdict rests on cannot disagree.
+ *
+ *  The attribute is a copy of the algorithm identifiers the structure already names, placed where
+ *  the signature covers them. Sec. 3.1 makes both comparisons mandatory for a validator that
+ *  supports the attribute, and support is claimed the moment this runs: "If the fields are not the
+ *  same (modulo encoding), then signature validation MUST fail."
+ *
+ *  Both arms compare modulo encoding, in the two ways sec. 3 names. A field with a default compares
+ *  the same written out as omitted, which the clause makes a MUST and says a binary compare cannot
+ *  satisfy; RSASSA-PSS is where that arises, since RFC 4055 clause 3.1 defaults all four of its
+ *  parameter fields. Absent and DER NULL parameters read as one algorithm on the digest arm, because
+ *  RFC 3370 clause 2.1 and RFC 5754 clause 2 require both encodings to be ACCEPTED; sec. 3 leaves
+ *  that case to the implementer. Anything else in a parameter field is read as written: that is
+ *  where RSASSA-PSS puts its hash, mask generator, salt length and trailer field, which the
+ *  signature itself does not cover, so collapsing two values there would admit the substitution the
+ *  attribute exists to refuse.
+ *
+ *  A `[2]` MAC arm inside `signedAttrs` is a mismatch rather than an absent signature arm: sec. 2
+ *  populates that arm "only if the attribute is placed in an AuthenticatedData.authAttrs sequence",
+ *  so the attribute is making a claim about a structure this is not. */
+function _algorithmProtectionReport(si, armName, armIdentifier) {
+  return cms.algorithmProtectionReport(si.signedAttrs || si.authAttrs || [],
+    si.digestAlgorithm, armName, armIdentifier);
+}
+
+/** @internal The report applied to a verdict. A mismatch fails the signer, and the option that
+ *  requires the attribute fails an absent one; a verdict that already failed keeps its own code,
+ *  since the signature's verdict is the stronger statement and masking it would tell an operator the
+ *  wrong thing about why the message was refused. */
+function _applyAlgorithmProtection(verdict, report, required) {
+  var fields = { algorithmProtection: guard.verdict.of(report) };
+  if (verdict.ok !== true) return guard.verdict.of(verdict, fields);
+  if (report.mismatch !== null) {
+    return guard.verdict.of(verdict, intrinsic.assign(fields,
+      { ok: false, code: report.mismatch.code, message: report.mismatch.message }));
+  }
+  if (required && !report.present) {
+    return guard.verdict.of(verdict, intrinsic.assign(fields, { ok: false,
+      code: "cms/missing-algorithm-protection",
+      message: "this signature carries no RFC 6211 algorithm protection attribute, which " +
+        "opts.requireAlgorithmProtection asks for; RFC 8933 sec. 4.1 makes including it a SHOULD, " +
+        "so a message without one is not malformed" }));
+  }
+  return guard.verdict.of(verdict, fields);
+}
+
 /** @internal The CAdES baseline requirements this verb decides from one SignerInfo's own signed
  *  attributes, reported beside the signature verdict rather than folded into it: a signature can be
  *  cryptographically sound and still not be a CAdES signature, and the two answers are separate.
@@ -784,7 +831,7 @@ function _signerNotAfter(verdict) {
   catch (_e) { return null; }
 }
 
-async function _verifyCountersignatures(si, parsedCerts, allowWeakDigests) {
+async function _verifyCountersignatures(si, parsedCerts, allowWeakDigests, requireProtection) {
   var targetSig = _toBuf(si.signature, "the countersigned signature");
   var values = [];
   intrinsic.forEach(si.unsignedAttrs || [], function (a) {
@@ -792,17 +839,24 @@ async function _verifyCountersignatures(si, parsedCerts, allowWeakDigests) {
     intrinsic.forEach(a.values, function (v) { guard.list.append(values, v && v.bytes ? v.bytes : v); });
   });
   var out = [];
-  for (var _cp = 0; _cp < values.length; _cp++) guard.list.append(out, await _verifyOneCountersig(values[_cp], targetSig, parsedCerts, allowWeakDigests));
+  for (var _cp = 0; _cp < values.length; _cp++) guard.list.append(out, await _verifyOneCountersig(values[_cp], targetSig, parsedCerts, allowWeakDigests, requireProtection));
   return out;
 }
 
-async function _verifyOneCountersig(vDer, targetSig, parsedCerts, allowWeakDigests) {
+async function _verifyOneCountersig(vDer, targetSig, parsedCerts, allowWeakDigests, requireProtection) {
   var csSi;
   try { csSi = cms.walkCountersignature(asn1.decode(intrinsic.isBuffer(vDer) ? vDer : intrinsic.bufferFrom(vDer))); }
   catch (e) { return _row({ ok: false, code: (e instanceof CmsError ? e.code : "cms/bad-countersignature"), message: e && e.message }); }
-  var verdict = await _verifyOne(csSi, targetSig, null, parsedCerts, targetSig, undefined, allowWeakDigests);
-  var nested = await _verifyCountersignatures(csSi, parsedCerts, allowWeakDigests);
-  var head = { ok: verdict.ok, sid: verdict.sid, cert: verdict.cert, digestAlgorithm: csSi.digestAlgorithm.name };
+  /** @internal A countersignature is its own SignerInfo with its own algorithm identifiers, so the
+   *  attribute inside it protects those and is compared against them rather than against the
+   *  signature it countersigns. */
+  var apReport = _algorithmProtectionReport(csSi, "signatureAlgorithm", csSi.signatureAlgorithm);
+  var verdict = _applyAlgorithmProtection(
+    await _verifyOne(csSi, targetSig, null, parsedCerts, targetSig, undefined, allowWeakDigests),
+    apReport, requireProtection === true);
+  var nested = await _verifyCountersignatures(csSi, parsedCerts, allowWeakDigests, requireProtection);
+  var head = { ok: verdict.ok, sid: verdict.sid, cert: verdict.cert, digestAlgorithm: csSi.digestAlgorithm.name,
+    algorithmProtection: verdict.algorithmProtection };
   return guard.verdict.of(
     verdict.code ? guard.verdict.of(head, { code: verdict.code }) : head,
     { unsignedAttrs: _surfaceUnsignedAttrs(csSi), countersignatures: nested });
@@ -822,7 +876,7 @@ async function _verifyOneCountersig(vDer, targetSig, parsedCerts, allowWeakDiges
  * Verify a CMS SignedData signature (RFC 5652 sec. 5). `input` is a PEM string, a DER
  * `Buffer`, or a parsed `pki.schema.cms` object. Returns `{ valid, trusted, eContentType, eContent, signers }`
  * (`eContent` the encapsulated content when present, else null) where each `signers[i]` is
- * `{ ok, sid, cert, trusted, signedAttributesPresent, signedAttributes, unsignedAttrs, digestAlgorithm, countersignatures, signatureTimeStamps, cadesBaseline }`
+ * `{ ok, sid, cert, trusted, signedAttributesPresent, signedAttributes, unsignedAttrs, digestAlgorithm, countersignatures, signatureTimeStamps, cadesBaseline, algorithmProtection }`
  * (`cert` the matched signer certificate DER) or carries a `code` on a structural failure; `valid` is true when
  * there is at least one signer and every signer verified.
  *
@@ -873,6 +927,15 @@ async function _verifyOneCountersig(vDer, targetSig, parsedCerts, allowWeakDiges
  * content, and a token over it answers for either. `pki.cms.attachTimestamp` adds such an attribute to an
  * existing message and `pki.cms.timestampImprint` produces the imprint a TSA signs.
  *
+ * `algorithmProtection` reports the RFC 6211 attribute, `{ present, oid, compared, mismatch }`. The
+ * attribute is a copy of the digest and signature algorithm identifiers this signer names, placed
+ * where the signature covers them, and `compared` lists the identifiers checked against it. A
+ * disagreement fails the signer with `cms/algorithm-protection-mismatch`, which sec. 3.1 requires of
+ * any validator that supports the attribute: the identifiers the attribute protects are otherwise
+ * covered by nothing, and RFC 8933 sec. 6 names RSASSA-PSS as the case where the signature itself
+ * pins no digest. An absent attribute is not a failure unless `requireAlgorithmProtection` asks for
+ * one, and `present: false` says so rather than looking like a comparison that passed.
+ *
  * `cadesBaseline` is a third claim, `{ conformant, signingCertificateAttribute, findings,
  * requirementsChecked }`: a signature can be sound and still not be a CAdES signature.
  * `requirementsChecked` lists the EN 319 122-1 requirements decided here, each unmet one carrying a
@@ -908,6 +971,14 @@ async function _verifyOneCountersig(vDer, targetSig, parsedCerts, allowWeakDiges
  *                 trust decision from the signer: an operator may anchor one and not the other.
  * @opts  timestampRevocationChecker  A revocation checker for the TSA chain, as `pki.path.validate`
  *                 takes one. Each row reports what it established in `revocationChecked`.
+ * @opts  requireAlgorithmProtection  Fail a signer that carries no RFC 6211
+ *                 `CMSAlgorithmProtection` attribute, with `cms/missing-algorithm-protection`. Off
+ *                 by default: RFC 6211 says nothing about absence and RFC 8933 sec. 4.1 makes
+ *                 including it a SHOULD, so a message without one is not malformed and most CMS in
+ *                 the field carries none. A signer that DOES carry one is always held to it, with no
+ *                 option, because sec. 3.1's comparisons are MUSTs once a validator supports the
+ *                 attribute. The option is the boolean it documents: `false`, `null` and an absent
+ *                 option are the off forms, and any other value is refused `cms/bad-input`.
  * @example
  *   var pair = await pki.key.generate("Ed25519");
  *   var key = await pki.key.export(pair.privateKey);
@@ -950,7 +1021,8 @@ var _VERIFY_OPTS = intrinsic.assign(intrinsic.create(null), { certs: 1, content:
    *  authority is a different trust decision from the signer's: an operator may anchor the TSA while
    *  leaving the signer unanchored, or the reverse, and one `trustAnchors` for both would make those
    *  two answers one. */
-  timestampCerts: 1, timestampTrustAnchors: 1, timestampRevocationChecker: 1 });
+  timestampCerts: 1, timestampTrustAnchors: 1, timestampRevocationChecker: 1,
+  requireAlgorithmProtection: 1 });
 
 function verify(input, opts) {
   return guard.async.deferred(function () { return _verify(input, opts); });
@@ -959,12 +1031,19 @@ function verify(input, opts) {
 async function _verify(input, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "cms/bad-input", "pki.cms.verify options");
   guard.identifier.assertKnownKeys(opts, _VERIFY_OPTS, _err, "cms/bad-input", "pki.cms.verify has an unknown option ");
+  /** @internal The two policy switches are taken FIRST, ahead of everything below that can run the
+   *  caller's own code. Deriving the message runs accessors on a parsed input, copying the trust
+   *  material runs them on each anchor, and a streamed detached content runs the generator while
+   *  this verb is pending; any of those can write to an options object the caller still holds, so a
+   *  switch read after them is read from whatever they left behind rather than from the call. */
+  var allowWeakDigests = opts.allowWeakDigests === true;
+  var requireProtection = guard.identifier.booleanOption(opts.requireAlgorithmProtection, _err,
+    "cms/bad-input", "pki.cms.verify opts.requireAlgorithmProtection");
   var parsed = guard.parsed.acceptDerived(input, "cms", function (bytes) {
     return cms.parse(_snapshotIfBytes(bytes, "pki.cms.verify"));
   }, _err, "cms/bad-input", "the SignedData");
   if (!Array.isArray(parsed.signerInfos)) throw _err("cms/bad-input", "input is not a CMS SignedData");
   var trustCfg = _snapshotTrust(opts);
-  var allowWeakDigests = opts.allowWeakDigests === true;
   var tsTrustCfg = _snapshotTimestampTrust(opts, allowWeakDigests);
   var parsedCerts = [];
   (parsed.certificates || []).forEach(function (c) { _addCert(parsedCerts, c && c.bytes ? c.bytes : c); });
@@ -991,8 +1070,13 @@ async function _verify(input, opts) {
   var signers = [];
   for (var _sp = 0; _sp < parsed.signerInfos.length; _sp++) {
     var siOne = parsed.signerInfos[_sp];
+    /** @internal Read once, before the signature is checked, and used for both the verdict row and
+     *  the decision: the attribute is an independent requirement on the same signer, the way trust
+     *  is, so it composes onto the verdict rather than being folded into the signature check. */
+    var apReport = _algorithmProtectionReport(siOne, "signatureAlgorithm", siOne.signatureAlgorithm);
     var verdict = await _verifyOne(siOne, content, eContentType, parsedCerts, null, digestByName, allowWeakDigests);
-    var counters = await _verifyCountersignatures(siOne, parsedCerts, allowWeakDigests);
+    verdict = _applyAlgorithmProtection(verdict, apReport, requireProtection);
+    var counters = await _verifyCountersignatures(siOne, parsedCerts, allowWeakDigests, requireProtection);
     /** @internal The timestamp rows are built from the same `signature` octets the signature verdict
      *  above was computed over, which is why they are here and not in a verb of their own. The
      *  signer's own certificate supplies the expiry half of EN 319 122-1 clause 6.3 requirement m. */
@@ -1204,6 +1288,17 @@ function _addCert(out, der) {
  *                          (`timeStampToken`); content-type / message-digest / signing-time are
  *                          rejected here (RFC 5652 sec. 11). Use `pki.cms.countersign` for a
  *                          countersignature specifically.
+ * @opts  algorithmProtection  Emit the RFC 6211 `CMSAlgorithmProtection` signed attribute, a copy of
+ *                          this signer's digest and signature algorithm identifiers placed where the
+ *                          signature covers them. RFC 8933 sec. 4.1 makes including it a SHOULD, and
+ *                          RFC 9882 sec. 4 and RFC 9814 sec. 5 repeat that for ML-DSA and SLH-DSA,
+ *                          which carry no digest identifier inside the signature. Off by default,
+ *                          because turning it on changes the bytes of every signature. `true` emits
+ *                          the identifier RFC 6211 sec. 2 states, which OpenSSL and Bouncy Castle
+ *                          use; `"registry"` emits the S/MIME arc value the IANA registry and
+ *                          draft-ietf-lamps-rfc6211-update give it. A verifier here reads both.
+ *                          `false`, `null` and an absent option emit none, and any other value is
+ *                          refused `cms/bad-input`.
  * @example
  *   var pair = await pki.key.generate("Ed25519");
  *   var signerKeyPkcs8 = await pki.key.export(pair.privateKey);
@@ -1246,6 +1341,10 @@ var sign = cmsSign.sign;
  *                              is rejected, RFC 5652 sec. 11.4).
  * @opts  sid                   `"issuerAndSerial"` (default) or `"ski"`.
  * @opts  certificates          Embed the countersigner certificate(s) in the SignedData. Default true.
+ * @opts  algorithmProtection   Emit the RFC 6211 `CMSAlgorithmProtection` attribute on the
+ *                              countersignature, copying ITS own digest and signature algorithm
+ *                              identifiers rather than the countersigned signature's. Off by
+ *                              default; `"registry"` selects the IANA registry identifier.
  * @opts  pem                   Return a PEM string instead of a DER Buffer.
  * @example
  *   var pair = await pki.key.generate("Ed25519");
@@ -1341,6 +1440,18 @@ var encrypt = cmsEncrypt.encrypt;
  * @opts keyIdentifier `"issuerAndSerial"` (default) or `"subjectKeyIdentifier"`.
  * @opts oaepHash The RSAES-OAEP hash for ktri recipients wrapping the MAC key: `"sha256"` (default) / `"sha384"` / `"sha512"`.
  * @opts ukm User keying material (a Buffer) for kari / kemri recipients.
+ * @opts algorithmProtection Emit the RFC 6211 `CMSAlgorithmProtection` authenticated attribute, a
+ *       copy of the digest and MAC algorithm identifiers this structure names. It matters more here
+ *       than on a signature: RFC 5652 sec. 9.2 makes the MAC input the DER encoding of `authAttrs`
+ *       alone, so `digestAlgorithm` and `macAlgorithm` are covered by nothing, and rewriting the
+ *       digest algorithm leaves the MAC verifying while the recipient recomputes the content digest
+ *       under the attacker's choice, no key required. `true` emits the identifier RFC 6211 sec. 2
+ *       states, `"registry"` the IANA registry value. Off by default, because it changes the bytes
+ *       of every message. `false`, `null` and an absent option emit none, and any other value is
+ *       refused `cms/bad-input`. With `authenticatedAttributes: false` the MAC covers the content
+ *       octets directly and no attribute set is built, so asking for the attribute there is refused
+ *       while the off forms are still accepted. `pki.cms.decrypt` reads both identifiers and
+ *       compares the copies it finds.
  * @opts pem Return a PEM string (`-----BEGIN CMS-----`) instead of a DER Buffer.
  * @example
  *   // authenticate a message to an RSA recipient, then verify the MAC via decrypt
@@ -1403,6 +1514,19 @@ var authenticate = cmsEncrypt.authenticate;
  * @opts maxIterations  Lower the PBKDF2 iteration cap (a DoS bound; downward only).
  * @opts stream         Return `content` as an async iterable of plaintext `Buffer` chunks instead of a single `Buffer`.
  * @opts allowUnauthenticatedRsa15  Read a message that uses RSAES-PKCS1-v1_5 key transport over a content with no integrity tag, such as AES-CBC. Refused by default with `cms/unauthenticated-rsa-v15`: the content padding is that combination's only integrity check, so decrypting it either returns the plaintext of a substituted key or tells an attacker submitting chosen ciphertexts that theirs decoded (RFC 8017 sec. 7.2). `openssl cms -encrypt` emits exactly this combination when no algorithm is named, so reading one of its messages needs this option. An AEAD content or an RSAES-OAEP recipient needs none.
+ * @opts requireAlgorithmProtection  For an AuthenticatedData, refuse one that carries no RFC 6211
+ *       `CMSAlgorithmProtection` authenticated attribute, with `cms/missing-algorithm-protection`.
+ *       Off by default, since RFC 8933 sec. 4.1 makes including it a SHOULD. A message that DOES
+ *       carry one is always held to it, with no option: its `digestAlgorithm` and `macAlgorithm`
+ *       copies are compared against the fields of the `AuthenticatedData` itself, and a disagreement
+ *       is `cms/algorithm-protection-mismatch`. That comparison runs before the MAC, because a
+ *       mismatch is a statement about the message rather than about the key. The result's
+ *       `algorithmProtection` field reports what was compared. The option is the boolean it
+ *       documents: `false`, `null` and an absent option are the off forms, and any other value is
+ *       refused `cms/bad-input`. Asking for it while decrypting any other content type is refused
+ *       the same way: RFC 8933 sec. 6 gives the attribute a place in an `AuthenticatedData` alone,
+ *       so an `EnvelopedData`, `AuthEnvelopedData` or `EncryptedData` cannot satisfy the
+ *       requirement and returning its plaintext would answer neither question.
  * @example
  *   var rsa = { name: "RSA-OAEP", modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" };
  *   var pair = await pki.key.generate(rsa);

package/lib/ct.js

@@ -2177,7 +2177,7 @@ function _b64Array(obj, name, code, label, exactLen, maxCount) {
  * @opts headers OPTIONAL extra request headers (the request-framing headers are stripped; the verb owns the GET method).
  * @opts timeout OPTIONAL ms budget, default 30s (cap-validated).
  * @opts maxResponseBytes OPTIONAL per-GET size cap, default 4 MiB, tightenable DOWNWARD only.
- * @opts requireJsonContentType OPTIONAL boolean (default false) -- opt in to a strict `ct/bad-content-type` gate on the JSON GET.
+ * @opts requireJsonContentType OPTIONAL boolean (default false) -- opt in to a strict `ct/bad-content-type` gate on the JSON GET. A value other than `true`, `false`, `null` or an absent option is refused `ct/bad-input` before the request goes out.
  * @example
  *   // a live distributor uses the default pki.transport.https; here an injected transport returns the pair
  *   var r = await pki.ct.fetchLogList({ url: "https://ct.example/log_list.json", signerKey: googleSignerSpki,
@@ -2241,7 +2241,8 @@ async function fetchLogList(opts) {
   var req = { headers: headers, tls: fetchTls, timeout: timeout, maxResponseBytes: maxResponseBytes };
   /** @internal Read before the request goes out, so the option that decides the check is the one the call
    *  was made with rather than whatever it says once the response is back. */
-  var requireJsonContentType = opts.requireJsonContentType === true;
+  var requireJsonContentType = guard.identifier.booleanOption(opts.requireJsonContentType, _ctErr,
+    "ct/bad-input", "fetchLogList opts.requireJsonContentType");
   var jsonRes = await _fetchBody(transport, jsonUrl, req, "CT log-list JSON");
   if (requireJsonContentType && jsonRes.contentType !== "application/json") throw _ctErr("ct/bad-content-type", "the CT log-list JSON GET returned content-type " + JSON.stringify(jsonRes.contentType || null) + " (opts.requireJsonContentType is set)");
   var sigRes = await _fetchBody(transport, sigUrl, req, "CT log-list signature");

package/lib/guard-der.js

@@ -96,6 +96,31 @@ function paramsAbsentOrNull(params) {
   return params === null || params === undefined || isNull(params);
 }
 
+/** Whether two decoded `AlgorithmIdentifier` records name the same algorithm with the same
+ *  parameters, comparing the parameters AS THEY ARE: absent equals absent, and an explicit DER NULL
+ *  is a different identifier from one with no parameters field.
+ *
+ *  This is the comparison for an identifier whose parameters carry meaning. A digest identifier has
+ *  the opposite rule, because RFC 3370 clause 2.1 and RFC 5754 clause 2 require an implementation to
+ *  accept both spellings of the same digest, and `schema-cms.sameDigestAlgorithm` grants that. A
+ *  signature identifier does not: RFC 4055 requires the `*WithRSAEncryption` identifiers to carry a
+ *  NULL, RFC 5758 and RFC 8410 require the `ecdsaWith*` and the Edwards and post-quantum ones to omit
+ *  the field, and RSASSA-PSS carries its hash, mask generator, salt length and trailer field there
+ *  under RFC 4056 clause 2.2. Collapsing the two spellings for one of those is admitting a different
+ *  algorithm, which is why the grant does not travel.
+ *
+ * @enforced-by behavioral -- an equality that is too permissive has no rename-proof shape; the RED
+ * vector is an identifier pair differing only in an explicit NULL, which must compare unequal here
+ * and equal through the digest helper.
+ */
+function sameAlgorithmExactly(a, c) {
+  if (!a || !c || a.oid !== c.oid) return false;
+  var ap = a.parameters === undefined ? null : a.parameters;
+  var cp = c.parameters === undefined ? null : c.parameters;
+  if (ap === null || cp === null) return ap === cp;
+  return _isBuffer(ap) && _isBuffer(cp) && _sizeOf(ap) === _sizeOf(cp) && _compare(ap, cp) === 0;
+}
+
 // @enforced-by behavioral -- see paramsAbsentOrNull.
 function assertParams(params, shape, E, code, label) {
   var ok = shape === "null" ? isNull(params) : (shape === "absent"
@@ -109,4 +134,5 @@ function assertParams(params, shape, E, code, label) {
 module.exports = _freeze({
   element: element, tlv: tlv,
   isNull: isNull, paramsAbsentOrNull: paramsAbsentOrNull, assertParams: assertParams,
+  sameAlgorithmExactly: sameAlgorithmExactly,
 });

package/lib/guard-identifier.js

@@ -600,6 +600,32 @@ function assertCallableOption(opts, key, E, code, label, shape) {
   return assertCallable(opts[key], E, code, label, shape);
 }
 
+/** @internal How a switch is read: as the boolean it documents, with an absent value standing for
+ * off and every other value refused. A switch that turns a requirement on is the case that decides
+ * the shape. `requireRevocation: "true"` out of a config file is truthy to JavaScript and unequal
+ * to `true`, so a boundary testing `=== true` runs without the requirement and says nothing, while
+ * one testing truthiness turns the requirement on for `0` and `""` as well. The value is rendered
+ * from its own type rather than coerced, so a caller value with a throwing `toString` reports the
+ * typed refusal. A boundary that reads `null` as a value its caller supplied keeps its own check:
+ * this one reads it as absence. */
+// @enforced-by behavioral -- reading a caller switch has no rename-proof code shape; `=== true` is
+// @enforced-by behavioral -- the correct read for a switch that turns a control OFF, so a lexical
+// @enforced-by behavioral -- rule would flag the safe direction. The per-verb vectors are the
+// @enforced-by behavioral -- guard: each drives the shipped verb with a non-boolean and asserts the
+// @enforced-by behavioral -- typed refusal, and with false and absence to pin the two off forms.
+function booleanOption(value, E, code, label) {
+  if (value === undefined || value === null) return false;
+  if (value === true || value === false) return value;
+  throw E(code, label + " must be true or false, got " + _showSwitch(value));
+}
+
+/** @internal The value's own type, for the message above. Nothing here calls into the value. */
+function _showSwitch(value) {
+  if (typeof value === "string") return _stringify(value);
+  if (typeof value === "number" || typeof value === "bigint") return _String(value);
+  return typeof value;
+}
+
 /** @internal Whether a caller's object says something about itself, as opposed to inheriting the
  * answer. A declaration is a promise the author of that object made, so it has to sit on the object
  * they wrote: reading the flag through the object finds a value on `Function.prototype` that every
@@ -619,6 +645,7 @@ function declaresOwn(obj, name) {
 
 module.exports = intrinsic.freeze({
   assertCallable: assertCallable,
+  booleanOption: booleanOption,
   declaresOwn: declaresOwn,
   assertCallableOption: assertCallableOption,
   assertCanonicalOid: assertCanonicalOid,

package/lib/lint.js

@@ -4929,12 +4929,21 @@ var ALL_CRL_RULES = RFC5280_CRL_RULES.concat(CNSA2_CRL_RULES);
  *  for YY >= 50 and 20YY otherwise, so every UTCTime names a year inside 1950..2049 and only the
  *  GeneralizedTime direction of that clause can be broken. */
 var OID_SIGNING_TIME = oid.byName("signingTime");
+/** @internal The two identifiers RFC 6211's attribute is assigned, both read: the body's PKCS 9 leaf
+ *  and the S/MIME attribute arc value the IANA registry and the update draft give it. */
+var OID_ALG_PROTECTION = oid.byName("cmsAlgorithmProtection");
+var OID_ALG_PROTECTION_AA = oid.byName("cmsAlgorithmProtect");
 var OID_SIGNED_DATA = oid.byName("signedData");
 
 /** @internal The content type decides which of these rows apply, and the parser sets `contentType`
  *  as an own property on every content it builds. A content type that carries no signers has no own
  *  `signerInfos`, so testing for that field answers from whatever the prototype chain holds. */
 function _isSignedData(cms) { return cms.contentType === OID_SIGNED_DATA; }
+var OID_AUTH_DATA = oid.byName("authData");
+/** @internal The other content type whose originator carries attributes, and the one whose algorithm
+ *  fields nothing else covers: RFC 5652 sec. 9.2 makes the MAC input the DER encoding of `authAttrs`
+ *  alone, so `digestAlgorithm` and `macAlgorithm` sit outside it. */
+function _isAuthData(cms) { return cms.contentType === OID_AUTH_DATA; }
 var OID_COUNTERSIGNATURE = oid.byName("countersignature");
 /** @internal Every SignerInfo a message carries: its own signers, and the countersignatures their
  *  unsigned attributes hold, which sec. 11.4 defines as SignerInfo values and which carry their own
@@ -4969,14 +4978,16 @@ function _cmsAllSignerInfos(cms) {
   visit(cms.signerInfos, 0, false, 0);
   return out;
 }
-function _cmsSignedAttr(signerInfo, dotted) {
-  var attrs = signerInfo.signedAttrs;
+function _cmsAttrInList(attrs, dotted) {
   if (!Array.isArray(attrs)) return null;
   for (var i = 0; i < attrs.length; i++) {
     if (attrs[i].type === dotted) return attrs[i];
   }
   return null;
 }
+function _cmsSignedAttr(signerInfo, dotted) {
+  return _cmsAttrInList(signerInfo.signedAttrs, dotted);
+}
 /** @internal Whether two DIGEST AlgorithmIdentifiers name one algorithm, under RFC 5754 sec. 2. The
  *  rule lives in the schema module because the set this row reads is also WRITTEN there, by the verb
  *  that adds a countersigner's digest to it, and a set written under one rule and read under another
@@ -5078,8 +5089,50 @@ var RFC5652_CMS_RULES = [
   },
 ];
 
-var CMS_PROFILES = Object.assign(Object.create(null), { "rfc5652": RFC5652_CMS_RULES });
-var ALL_CMS_RULES = RFC5652_CMS_RULES;
+/** @internal RFC 8933 updates RFC 5652 rather than restating it, so its rows are their own profile:
+ *  `pki.lint.cms(der, { profile: "rfc8933" })` asks only what that document added. */
+var RFC8933_CMS_RULES = [
+  {
+    id: "lint/rfc8933/algorithm-protection-absent", severity: "notice", source: "rfc8933", citation: "RFC 8933 4.1",
+    /** @internal "the originator of a signed-data content type that includes signed attributes
+     * SHOULD include the CMSAlgorithmProtection attribute [RFC6211] as one of the signed
+     * attributes.  Likewise, the originator of an authenticated-data content type that includes
+     * authenticated attributes SHOULD include the CMSAlgorithmProtection attribute [RFC6211] as one
+     * of the authenticated attributes." RFC 9882 sec. 4 and RFC 9814 sec. 5 repeat the signed-data
+     * half for ML-DSA and SLH-DSA. Both content types are read, and the authenticated-data one is
+     * where the exposure is widest: sec. 9.2 makes the MAC input `authAttrs` alone, so the two outer
+     * algorithm fields are covered by nothing. The SHOULD is conditioned on attributes being
+     * present, so an originator that signs or authenticates the content directly has nowhere to
+     * carry it and draws no finding. Both identifiers count, since the two spell one attribute. A
+     * notice rather than a warning: it is a SHOULD, and most CMS in the field carries no such
+     * attribute. */
+    message: "an originator with signed or authenticated attributes carries no CMSAlgorithmProtection attribute, which this section says it should include",
+    appliesTo: function (cms) { return _isSignedData(cms) || _isAuthData(cms); },
+    check: function (cms) {
+      var out = [];
+      if (_isAuthData(cms)) {
+        var authAttrs = cms.authAttrs;
+        if (!Array.isArray(authAttrs) || !authAttrs.length) return null;
+        if (_cmsAttrInList(authAttrs, OID_ALG_PROTECTION) ||
+            _cmsAttrInList(authAttrs, OID_ALG_PROTECTION_AA)) return null;
+        return { context: { placement: "authAttrs" } };
+      }
+      _cmsAllSignerInfos(cms).forEach(function (entry) {
+        if (!Array.isArray(entry.signerInfo.signedAttrs) || !entry.signerInfo.signedAttrs.length) return;
+        if (_cmsSignedAttr(entry.signerInfo, OID_ALG_PROTECTION) ||
+            _cmsSignedAttr(entry.signerInfo, OID_ALG_PROTECTION_AA)) return;
+        out.push({ context: { signerIndex: entry.signerIndex, countersignature: entry.countersignature } });
+      });
+      return out.length ? out : null;
+    },
+  },
+];
+
+var CMS_PROFILES = Object.assign(Object.create(null), {
+  "rfc5652": RFC5652_CMS_RULES,
+  "rfc8933": RFC8933_CMS_RULES,
+});
+var ALL_CMS_RULES = RFC5652_CMS_RULES.concat(RFC8933_CMS_RULES);
 
 /** @internal The RFC 3161 profile is the shortest of the three, for the reason the CMS one is
  *  short: `schema.tsp.parseToken` refuses nearly everything sec. 2.4.2 requires of a token before a
@@ -6978,9 +7031,10 @@ function _ingestCrl(input) {
  * `lint/rfc2986/extension-request-ambiguous`; every one of them is read, so nothing a later
  * attribute asks for escapes the rows below.
  *
- * @opts  profile   `"rfc2986"` for the structural rows alone, or `"cabf-tls"` to add the TLS rows
- *                  (default runs the structural rows). A certificate, CRL or OCSP profile name is
- *                  refused rather than run against a request.
+ * @opts  profile   `"rfc2986"` for the structural rows alone, `"cabf-tls"` to add the TLS rows, or
+ *                  `"rfc9883"` for the rows about a request carrying a possession statement
+ *                  (default runs the structural rows and the rfc9883 rows). A certificate, CRL
+ *                  or OCSP profile name is refused rather than run against a request.
  * @opts  severity  Suppress findings below this floor (default `"notice"`). `counts` and `worst`
  *                  always reflect the complete, unfiltered result.
  * @example
@@ -7217,8 +7271,9 @@ function _ingestCms(input) {
  * `pki.cms.verify`'s, and the certificates a message carries are linted with
  * `pki.lint.certificate`.
  *
- * @opts  profile   `"rfc5652"`, which is also what the default runs. A certificate, CRL or OCSP
- *                  profile name is refused rather than run against a message.
+ * @opts  profile   `"rfc5652"`, or `"rfc8933"` for the rows that update it (default runs both).
+ *                  A certificate, CRL or OCSP profile name is refused rather than run against a
+ *                  message.
  * @opts  severity  Suppress findings below this floor (default `"notice"`). `counts` and `worst`
  *                  always reflect the complete, unfiltered result.
  * @example
@@ -7517,10 +7572,11 @@ function rules(profile, artifact) {
  * and `"default"`, are not among them.
  * @example
  *   pki.lint.profiles();
- *   // -> ["rfc5280", "rfc9881", "rfc9909", "rfc9935", "cabf-tls", "cabf-smime", "cabf-cs",
- *   //     "etsi-qc", "mozilla-root", "chrome-root", "microsoft-root", "apple-root",
- *   //     "nist-pqc-transition", "cnsa-2.0", "rfc2986", "rfc5280-crl", "rfc6960", "rfc5019",
- *   //     "rfc5652", "rfc3161", "rfc5755"]
+ *   // -> ["rfc5280", "rfc9881", "rfc9909", "rfc9935", "rfc9763", "rfc7633", "x509-altsig",
+ *   //     "cabf-tls", "cabf-smime", "cabf-cs", "etsi-qc", "mozilla-root", "chrome-root",
+ *   //     "microsoft-root", "apple-root", "nist-pqc-transition", "cnsa-2.0", "rfc2986",
+ *   //     "rfc9883", "rfc5280-crl", "rfc6960", "rfc5019", "rfc5652", "rfc8933", "rfc3161",
+ *   //     "rfc5755"]
  */
 /** @internal `cabf-tls` names the certificate profile in this list and is not repeated for the
  *  request form: `pki.lint.csr` takes the same name and runs those rows against what a request

package/lib/oid.js

@@ -232,7 +232,14 @@ var FAMILIES = Object.assign(Object.create(null), {
   pkcs9: { base: [1, 2, 840, 113549, 1, 9], of: {
     emailAddress: 1, contentType: 3, messageDigest: 4, signingTime: 5,
     countersignature: 6, challengePassword: 7, extensionRequest: 14,
-    smimeCapabilities: 15, friendlyName: 20, localKeyId: 21 } },
+    smimeCapabilities: 15, friendlyName: 20, localKeyId: 21,
+    /** @internal RFC 6211 sec. 2 and Appendix A both state the CMS algorithm protection attribute
+     *  here, directly under PKCS 9, and that is the value OpenSSL and Bouncy Castle register. The
+     *  same document's sec. 4 says "All identifiers are assigned out of the S/MIME OID arc", which
+     *  the IANA registry, errata 9144 and 9145, and draft-ietf-lamps-rfc6211-update-03 read as
+     *  `1.2.840.113549.1.9.16.2.52`, registered beside it as `cmsAlgorithmProtect`. Both are
+     *  accepted on parse, because a mismatched identifier is equivalent to no protection. */
+    cmsAlgorithmProtection: 52 } },
 
   keyPackageContentTypes: { base: [2, 16, 840, 1, 101, 2, 1, 2, 78], of: { aKeyPackage: 5 } },
 
@@ -324,6 +331,9 @@ var FAMILIES = Object.assign(Object.create(null), {
     cmcUnsignedData: 34,
     binarySigningTime: 46,
     asymmDecryptKeyID: 54, relatedCertRequest: 60,
+    /** @internal The second value the CMS algorithm protection attribute is identified by. See
+     *  `pkcs9.cmsAlgorithmProtection` for which document states which, and why both are read. */
+    cmsAlgorithmProtect: 52,
     certificationRequestInfoTemplate: 61, extensionReqTemplate: 62 } },
 
   ansiX962: { base: [1, 2, 840, 10045], of: {