@blamejs/pki 0.8.52 → 0.8.53

package/lib/schema-cms.js

@@ -60,6 +60,11 @@ var NS = pkix.makeNS("cms", CmsError, oid);
 
 var ALGORITHM_IDENTIFIER = pkix.algorithmIdentifier(NS);
 var ATTRIBUTE = pkix.attribute(NS);
+/** @internal The two arms of a CMSAlgorithmProtection, each an AlgorithmIdentifier under its own
+ *  IMPLICIT tag. The Appendix A module is `DEFINITIONS IMPLICIT TAGS`, so the tag replaces the
+ *  SEQUENCE tag rather than wrapping it, which is what the shared factory asserts. */
+var ALGORITHM_IDENTIFIER_1 = pkix.algorithmIdentifier(NS, { implicitTag: 1 });
+var ALGORITHM_IDENTIFIER_2 = pkix.algorithmIdentifier(NS, { implicitTag: 2 });
 
 var SIGNED_DATA_VERSION = pkix.versionReader(NS, { "1": 1, "3": 3, "4": 4, "5": 5 });
 var SIGNER_VERSION = pkix.versionReader(NS, { "1": 1, "3": 3 });
@@ -106,30 +111,116 @@ var OID_MESSAGE_DIGEST = oid.byName("messageDigest");
 var OID_SIGNING_TIME = oid.byName("signingTime");
 var OID_COUNTERSIGNATURE = oid.byName("countersignature");
 
+/** @internal The two identifiers RFC 6211's own documents give the algorithm protection attribute.
+ *  Sec. 2 and Appendix A state the PKCS 9 leaf; sec. 4's "All identifiers are assigned out of the
+ *  S/MIME OID arc", the IANA registry, errata 9144 and 9145, and
+ *  draft-ietf-lamps-rfc6211-update-03 state the S/MIME attribute arc. Both are read, because an
+ *  implementation that recognizes one spelling and not the other checks nothing on a message using
+ *  the other, which is the interop failure the update draft sec. 1 records between two shipped
+ *  implementations of this attribute. */
+var OID_ALG_PROTECTION = oid.byName("cmsAlgorithmProtection");
+var OID_ALG_PROTECTION_AA = oid.byName("cmsAlgorithmProtect");
+function _isAlgProtection(type) {
+  return type === OID_ALG_PROTECTION || type === OID_ALG_PROTECTION_AA;
+}
+/** @internal Whether a dotted OID is one of the two the algorithm protection attribute is assigned,
+ *  exported so a verb policing its own emission asks the module that owns the attribute rather than
+ *  keeping a second copy of the pair.
+ *
+ * @internal
+ */
+function isAlgorithmProtectionType(type) { return _isAlgProtection(type); }
+
+/** @internal The identifier an emitting verb writes, resolved from the option that chose it, or
+ *  `null` when the option asks for no attribute. Only the four values are accepted. Any other
+ *  truthy value read as the default would emit the PKCS 9 identifier to a caller who asked for the
+ *  registry one, and a mismatched identifier is equivalent to no protection at all
+ *  (draft-ietf-lamps-rfc6211-update sec. 5), so a misspelling would silently produce a message the
+ *  reader it was meant for does not check. Any other falsy value read as absence would emit nothing
+ *  for a caller who asked for the attribute, which is the same silence from the other direction.
+ *
+ * @internal
+ */
+function algorithmProtectionOid(choice, E) {
+  if (choice === true) return OID_ALG_PROTECTION;
+  if (choice === "registry") return OID_ALG_PROTECTION_AA;
+  if (choice === undefined || choice === null || choice === false) return null;
+  throw E("cms/bad-input", "algorithmProtection is true for the identifier RFC 6211 sec. 2 states, " +
+    "or \"registry\" for the one the IANA registry gives it; got " + guard.text.showValue(choice));
+}
+
 var ATTR_FORBIDDEN_IN = Object.create(null);
 ATTR_FORBIDDEN_IN[OID_CONTENT_TYPE] = { unsigned: true, unauth: true, unprotected: true };
 ATTR_FORBIDDEN_IN[OID_MESSAGE_DIGEST] = { unsigned: true, unauth: true, unprotected: true };
 ATTR_FORBIDDEN_IN[OID_SIGNING_TIME] = { unsigned: true, unauth: true, unprotected: true };
 ATTR_FORBIDDEN_IN[OID_COUNTERSIGNATURE] = { signed: true, auth: true, unauth: true, unprotected: true };
+/** @internal RFC 6211 sec. 2: the attribute "MUST be a signed attribute or an authenticated
+ *  attribute; it MUST NOT be an unsigned attribute, an unauthenticated attribute, or an unprotected
+ *  attribute", and sec. 5 adds that an instance in such a place "does not provide any additional
+ *  security". Refused at parse under both spellings. */
+ATTR_FORBIDDEN_IN[OID_ALG_PROTECTION] = { unsigned: true, unauth: true, unprotected: true, authEnveloped: true };
+ATTR_FORBIDDEN_IN[OID_ALG_PROTECTION_AA] = { unsigned: true, unauth: true, unprotected: true, authEnveloped: true };
+/** @internal An `AuthEnvelopedData`'s authenticated attributes are their own place, distinct from an
+ *  `AuthenticatedData`'s, because one attribute belongs in the second and in no other: RFC 6211
+ *  sec. 2 populates the `macAlgorithm` arm "only if the attribute is placed in an
+ *  AuthenticatedData.authAttrs sequence", and RFC 8933 sec. 6 says the attribute protects nothing in
+ *  an `AuthEnvelopedData`, which carries no digest or MAC algorithm field for a copy to name. Every
+ *  other attribute's row names neither place, so only this one is told apart. */
 var ATTR_PLACE_LABELS = Object.assign(Object.create(null), {
   signed: "a signed attribute", unsigned: "an unsigned attribute", auth: "an authenticated attribute",
   unauth: "an unauthenticated attribute", unprotected: "an unprotected attribute",
+  authEnveloped: "an authenticated attribute of an AuthEnvelopedData",
 });
 
-function _checkAttrPlacement(attrs, place) {
+/** @internal `places` is every name this set answers to, because a set can be more than one thing:
+ *  an `AuthEnvelopedData`'s is an authenticated-attribute set AND that content type's own, so it
+ *  carries every restriction the first names plus the one the second adds. Naming only the narrower
+ *  place would drop the rest, which is how a set that refused a countersignature stopped refusing
+ *  it. A name a row does not mention restricts nothing, so adding one can only add refusals. */
+function _checkAttrPlacement(attrs, places) {
+  var names = typeof places === "string" ? [places] : places;
   for (var i = 0; i < attrs.length; i++) {
     var row = ATTR_FORBIDDEN_IN[attrs[i].type];
-    if (row && row[place]) {
+    if (!row) continue;
+    for (var p = 0; p < names.length; p++) {
+      if (!row[names[p]]) continue;
       throw NS.E("cms/misplaced-attr", "the " + (oid.name(attrs[i].type) || attrs[i].type) +
-        " attribute must not be " + ATTR_PLACE_LABELS[place] + " (RFC 5652 sec. 11)");
+        " attribute must not be " + ATTR_PLACE_LABELS[names[p]] + " (RFC 5652 sec. 11)");
     }
   }
 }
 
 function _checkContentBindingAttrs(attrs, mode, ctx) {
-  var ct = 0, md = 0, seen = Object.create(null);
+  var ct = 0, md = 0, ap = 0, seen = Object.create(null);
   for (var i = 0; i < attrs.length; i++) {
     var a = attrs[i];
+    /** @internal Counted across BOTH identifiers rather than by type, because the two spell one
+     *  attribute: "The SignedAttributes in a signerInfo MUST include only one instance of the
+     *  algorithm protection attribute" (RFC 6211 sec. 2), and a set carrying one under each
+     *  spelling carries two instances of it. The per-type `seen` map below cannot see that. */
+    if (_isAlgProtection(a.type)) {
+      ap += 1;
+      if (ap > 1) {
+        throw NS.E("cms/duplicate-signed-attr", "the attribute set must include only one instance " +
+          "of the algorithm protection attribute (RFC 6211 sec. 2), counting both identifiers it " +
+          "is assigned");
+      }
+      if (a.values.length !== 1) {
+        throw NS.E("cms/bad-algorithm-protection-attr", "the algorithm protection attribute MUST " +
+          "have a single attribute value, and there MUST NOT be zero or multiple instances of " +
+          "AttributeValue present (RFC 6211 sec. 2), got " + a.values.length);
+      }
+      /** @internal Decoded during the walk, so a malformed value is a parse refusal rather than
+       *  something a verify path meets later: the attribute is a statement about the structure it
+       *  rides in, and a structure carrying one that does not decode is malformed. */
+      /** @internal WHICH arm the value carries is not decided here. RFC 6211 sec. 2 says which arm
+       *  a producer fills, and sec. 3.1 and 3.2 give the consequence to the validator: an attribute
+       *  holding the other arm makes a claim about a structure this is not, and the comparison in
+       *  `algorithmProtectionReport` fails the signer or the message for it. Refusing the whole
+       *  message here instead would leave an operator unable to parse one in order to see that. */
+      schema.walk(ALG_PROTECTION,
+        pkix.decodeNested(a.values[0], ctx, "an algorithm protection attribute value"), ctx);
+    }
     if (seen[a.type]) {
       if (a.type === OID_CONTENT_TYPE) throw NS.E("cms/duplicate-content-type", "the attribute set must not repeat the content-type attribute");
       if (a.type === OID_MESSAGE_DIGEST) throw NS.E("cms/duplicate-message-digest", "the attribute set must not repeat the message-digest attribute");
@@ -336,6 +427,153 @@ var SIGNER_IDENTIFIER = schema.choice([
   { when: { tagClass: "context", tagNumber: 0 }, schema: schema.implicitOctetString(0) },
 ], { code: "cms/bad-signer-identifier", what: "SignerIdentifier" });
 
+/** @internal `CMSAlgorithmProtection ::= SEQUENCE { digestAlgorithm DigestAlgorithmIdentifier,
+ *  signatureAlgorithm [1] SignatureAlgorithmIdentifier OPTIONAL, macAlgorithm [2]
+ *  MessageAuthenticationCodeAlgorithm OPTIONAL }` with the RFC 6211 sec. 2 constraint "Exactly one
+ *  of signatureAlgorithm or macAlgorithm SHALL be present", which the ASN.1 states as a
+ *  `WITH COMPONENTS` pair and which no decoder generator enforces.
+ *
+ *  The exclusive-or is decided in the build, where both fields are in hand, and each failure gets
+ *  its own message: a value carrying neither arm protects one of the two identifiers it exists to
+ *  protect, and one carrying both claims to be in two places at once. A trailing third element is
+ *  refused by the engine, which consumes no element a field did not claim, so the SEQUENCE is the
+ *  two elements Bouncy Castle's own size check requires. */
+var ALG_PROTECTION = schema.seq([
+  schema.field("digestAlgorithm", ALGORITHM_IDENTIFIER),
+  schema.optional("signatureAlgorithm", ALGORITHM_IDENTIFIER_1, { tag: 1 }),
+  schema.optional("macAlgorithm", ALGORITHM_IDENTIFIER_2, { tag: 2 }),
+], {
+  assert: "sequence", code: "cms/bad-algorithm-protection-attr", what: "CMSAlgorithmProtection",
+  build: function (m, ctx) {
+    /** @internal The two arms hold ALGORITHM IDENTIFIERS, not a signature and not a MAC, and the
+     *  tests below are presence tests on a decoded record. The names say which, since `sig` and
+     *  `mac` read as the values those words usually name and a comparison against one of those
+     *  would owe a constant-time one. */
+    var sigAlgId = m.fields.signatureAlgorithm.present ? m.fields.signatureAlgorithm.value.result : null;
+    var macAlgId = m.fields.macAlgorithm.present ? m.fields.macAlgorithm.value.result : null;
+    if (sigAlgId !== null && macAlgId !== null) {
+      throw ctx.E("cms/bad-algorithm-protection-attr", "a CMSAlgorithmProtection carries exactly " +
+        "one of signatureAlgorithm [1] or macAlgorithm [2] (RFC 6211 sec. 2), and this one carries both");
+    }
+    if (sigAlgId === null && macAlgId === null) {
+      throw ctx.E("cms/bad-algorithm-protection-attr", "a CMSAlgorithmProtection carries exactly " +
+        "one of signatureAlgorithm [1] or macAlgorithm [2] (RFC 6211 sec. 2), and this one carries neither");
+    }
+    return {
+      digestAlgorithm: m.fields.digestAlgorithm.value.result,
+      signatureAlgorithm: sigAlgId,
+      macAlgorithm: macAlgId,
+    };
+  },
+});
+
+/** @internal What the RFC 6211 attribute in `attrs` says about the structure carrying it, as a
+ *  report rather than a verdict: `{ present, oid, compared, mismatch }`. Read ONCE per structure by
+ *  each consumer, so the row an operator reads and the decision a verdict rests on cannot disagree.
+ *
+ *  Sec. 3.1 and sec. 3.2 make both comparisons mandatory for a validator that supports the
+ *  attribute, and support is claimed the moment this runs: "If the fields are not the same (modulo
+ *  encoding), then signature validation MUST fail."
+ *
+ *  Both arms compare modulo encoding, in the two ways sec. 3 names. A field with a default compares
+ *  the same written out as omitted, which is the clause's own MUST and which it says a binary
+ *  compare cannot satisfy; RSASSA-PSS is where that arises, since RFC 4055 clause 3.1 defaults all
+ *  four of its parameter fields. Absent and DER NULL parameters read as one algorithm on the digest
+ *  arm, because RFC 3370 clause 2.1 and RFC 5754 clause 2 require both encodings to be ACCEPTED, so
+ *  both legitimately appear on either side; sec. 3 leaves that case to the implementer. Anything
+ *  else in a parameter field is read as written: that is where RSASSA-PSS puts its hash, mask
+ *  generator, salt length and trailer field, which the signature itself does not cover, so
+ *  collapsing two values there would admit the substitution the attribute exists to refuse.
+ *
+ *  An arm belonging to the other placement is a mismatch rather than an absent one: sec. 2 populates
+ *  `signatureAlgorithm` "only if the attribute is placed in a SignerInfo.signedAttrs sequence" and
+ *  `macAlgorithm` only in an `AuthenticatedData.authAttrs`, so an attribute carrying the wrong arm is
+ *  making a claim about a structure this is not.
+ *
+ * @internal
+ */
+function algorithmProtectionReport(attrs, digestAlgorithm, armName, armIdentifier) {
+  var out = { present: false, oid: null, compared: [], mismatch: null };
+  var found = null;
+  for (var i = 0; i < attrs.length; i++) {
+    if (found === null && _isAlgProtection(attrs[i].type)) found = attrs[i];
+  }
+  if (found === null) return out;
+  out.present = true;
+  out.oid = found.type;
+  var value;
+  try { value = parseAlgorithmProtection(found.values[0]); }
+  catch (e) {
+    out.mismatch = { code: (e && e.code) || "cms/bad-algorithm-protection-attr", message: e && e.message };
+    return out;
+  }
+  if (!sameDigestAlgorithm(digestAlgorithm, value.digestAlgorithm)) {
+    out.mismatch = { code: "cms/algorithm-protection-mismatch",
+      message: "the algorithm protection attribute names the digest algorithm " +
+        (value.digestAlgorithm.name || value.digestAlgorithm.oid) + " and the structure it protects " +
+        "names " + ((digestAlgorithm && (digestAlgorithm.name || digestAlgorithm.oid)) || "none") +
+        " (RFC 6211 sec. 3)" };
+    return out;
+  }
+  out.compared.push("digestAlgorithm");
+  var wantsMacArm = armName === "macAlgorithm";
+  var arm = wantsMacArm ? value.macAlgorithm : value.signatureAlgorithm;
+  var other = wantsMacArm ? value.signatureAlgorithm : value.macAlgorithm;
+  if (arm === null || other !== null) {
+    out.mismatch = { code: "cms/algorithm-protection-mismatch",
+      message: "the algorithm protection attribute carries " + (arm === null
+        ? "no " + armName + " to compare against the one this structure names"
+        : "the arm belonging to the other placement") + ", and RFC 6211 sec. 2 populates each arm " +
+        "only in the placement it belongs to" };
+    return out;
+  }
+  if (!sameAlgorithmModuloDefaults(armIdentifier, arm)) {
+    out.mismatch = { code: "cms/algorithm-protection-mismatch",
+      message: "the algorithm protection attribute names the " + armName + " " +
+        (arm.name || arm.oid) + " and the structure it protects names " +
+        ((armIdentifier && (armIdentifier.name || armIdentifier.oid)) || "none") +
+        ", or their parameters differ (RFC 6211 sec. 3)" };
+    return out;
+  }
+  out.compared.push(armName);
+  return out;
+}
+
+/** @internal The producer door for the RFC 6211 attribute, shared by every verb that emits one. A
+ *  caller-supplied copy cannot contradict the identifiers being emitted, and cannot be a second
+ *  instance beside the one a verb emitted: caller attributes reach the wire without being read, so
+ *  without this a message could carry a protection attribute naming algorithms its own structure
+ *  does not use, which every verifier that reads the attribute then refuses. The comparison is
+ *  against the very value the emitter would build, so it is the emitter's own answer rather than a
+ *  second derivation of it.
+ *
+ *  `attrs` are `{ type, values }` records. The signing verbs hold their attributes in that shape
+ *  already; the authenticate verb holds DER TLVs and adapts them, so the POLICY lives here once
+ *  rather than in a loop per verb.
+ *
+ * @internal
+ */
+function assertAlgorithmProtectionEmission(attrs, wantValue, E) {
+  var found = 0;
+  for (var i = 0; i < attrs.length; i++) {
+    if (!_isAlgProtection(attrs[i].type)) continue;
+    found += 1;
+    if (found > 1) {
+      throw E("cms/bad-input", "only one algorithm protection attribute may be emitted (RFC 6211 " +
+        "sec. 2), counting both identifiers it is assigned and any copy supplied by the caller");
+    }
+    if (attrs[i].values.length !== 1) {
+      throw E("cms/bad-input", "an algorithm protection attribute carries exactly one value " +
+        "(RFC 6211 sec. 2), got " + attrs[i].values.length);
+    }
+    if (guard.bytes.compare(attrs[i].values[0], wantValue) !== 0) {
+      throw E("cms/bad-input", "the algorithm protection attribute supplied does not copy the " +
+        "algorithm identifiers this structure uses (RFC 6211 sec. 2), so every verifier that reads " +
+        "it would refuse the result; omit it and pass algorithmProtection: true to have it built");
+    }
+  }
+}
+
 function makeSignerInfo(mode) {
   return schema.seq([
     schema.field("version", SIGNER_VERSION),
@@ -780,7 +1018,7 @@ var AUTHENTICATED_DATA = schema.seq([
       _assertDerEncodedAttrs(m.fields.authAttrs.node, "cms/bad-auth-attrs", ctx);
       authAttrs = m.fields.authAttrs.value.items.map(function (it) { return it.value.result; });
       _checkAttrPlacement(authAttrs, "auth");
-      _checkContentBindingAttrs(authAttrs, "content", ctx);
+      _checkContentBindingAttrs(authAttrs, "auth", ctx);
       _assertContentTypeMatchesAttrs(authAttrs, encapContentInfo.eContentType, ctx);
       authAttrsBytes = m.fields.authAttrs.node.bytes;
     }
@@ -827,7 +1065,12 @@ var AUTH_ENVELOPED_DATA = schema.seq([
     if (hasAuthAttrs) {
       _assertDerEncodedAttrs(m.fields.authAttrs.node, "cms/bad-auth-attrs", ctx);
       authAttrs = m.fields.authAttrs.value.items.map(function (it) { return it.value.result; });
-      _checkAttrPlacement(authAttrs, "auth");
+      /** @internal Both names: this is an authenticated-attribute set, and it is also this content
+       *  type's own set, which refuses one attribute more. The algorithm protection attribute
+       *  belongs in an `AuthenticatedData` and in no other, and the verbs that emit attributes
+       *  refuse it here, so the parser refuses it here too rather than reading a message this
+       *  package would not write. */
+      _checkAttrPlacement(authAttrs, ["auth", "authEnveloped"]);
       _checkNoDuplicateAttrs(authAttrs);
       _assertContentTypeMatchesAttrs(authAttrs, encryptedContentInfo.contentType, ctx);
       authAttrsBytes = m.fields.authAttrs.node.bytes;
@@ -968,6 +1211,40 @@ var CONTENT_INFO = schema.seq([
  */
 var parse = pkix.makeRecordingParser({ pemLabel: "CMS", PemError: PemError, ErrorClass: CmsError, prefix: "cms", what: "CMS ContentInfo", topSchema: CONTENT_INFO, ns: NS }, "cms");
 
+/**
+ * @primitive  pki.schema.cms.parseAlgorithmProtection
+ * @signature  pki.schema.cms.parseAlgorithmProtection(der) -> { digestAlgorithm, signatureAlgorithm, macAlgorithm }
+ * @since      0.8.53
+ * @status     stable
+ * @spec       RFC 6211
+ * @related    pki.cms.verify, pki.cms.sign, pki.schema.cms.parse
+ *
+ * Decode a `CMSAlgorithmProtection` attribute value (RFC 6211 sec. 2): a copy of the digest
+ * algorithm identifier the structure names, plus exactly one of the signature algorithm identifier
+ * (the `[1]` arm, for a `SignerInfo`) or the message authentication code algorithm identifier (the
+ * `[2]` arm, for an `AuthenticatedData`). The arm that is absent reads as `null`. Each identifier is
+ * surfaced whole, `{ oid, name, parameters }`, because the parameters are what the attribute exists
+ * to pin: a signature algorithm's parameters are not covered by the signature.
+ *
+ * A value carrying both arms or neither is refused `cms/bad-algorithm-protection-attr`, which is the
+ * sec. 2 rule "Exactly one of signatureAlgorithm or macAlgorithm SHALL be present". `pki.cms.parse`
+ * decodes the attribute during its own walk, so a message carrying a malformed one is refused there;
+ * this verb is for reading a value held on its own.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey);
+ *   var cert = await pki.x509.sign({ subject: "Signer", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
+ *   var signedDer = await pki.cms.sign(Buffer.from("hello"), { cert: cert, key: key }, { algorithmProtection: true });
+ *   var si = pki.schema.cms.parse(signedDer).signerInfos[0];
+ *   var attr = si.signedAttrs.filter(function (a) { return a.name === "cmsAlgorithmProtection"; })[0];
+ *   var protection = pki.schema.cms.parseAlgorithmProtection(attr.values[0]);
+ *   protection.digestAlgorithm.name;      // "sha512", the digest Ed25519 signs under here
+ *   protection.macAlgorithm;              // null, this being a SignerInfo
+ */
+var parseAlgorithmProtection = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorClass: CmsError, prefix: "cms", what: "CMSAlgorithmProtection", topSchema: ALG_PROTECTION, ns: NS });
+
 /**
  * @primitive  pki.schema.cms.pemDecode
  * @signature  pki.schema.cms.pemDecode(text, label?) -> Buffer
@@ -1101,9 +1378,103 @@ function sameDigestAlgorithm(a, c) {
     a.parameters.equals(c.parameters);
 }
 
+/** @internal The parameter fields that carry an ASN.1 DEFAULT, keyed by the algorithm that owns
+ *  them, because RFC 6211 sec. 3 says a binary compare is not enough: "A field with a default value
+ *  MUST compare as identical, independently of whether the value is defaulted or is explicitly
+ *  provided.  This implies that a binary compare of the encoded bytes is insufficient." RSASSA-PSS
+ *  is the only identifier this attribute carries whose parameters have any, and RFC 4055 sec. 3.1
+ *  gives each of its four a default: `hashAlgorithm` sha1Identifier, `maskGenAlgorithm`
+ *  mgf1SHA1Identifier, `saltLength` 20 and `trailerField` 1. A row rather than a branch, so an
+ *  algorithm that arrives later with defaulted parameters is data. */
+var SHA1_IDENTIFIER = asn1.build.sequence([asn1.build.oid(oid.byName("sha1")), asn1.build.nullValue()]);
+var PARAM_MAX_TAG = 3;
+var PARAM_DEFAULTS = Object.create(null);
+PARAM_DEFAULTS[oid.byName("rsassaPss")] = [
+  { tag: 0, value: SHA1_IDENTIFIER },
+  { tag: 1, value: asn1.build.sequence([asn1.build.oid(oid.byName("mgf1")), SHA1_IDENTIFIER]) },
+  { tag: 2, value: asn1.build.integer(20) },
+  { tag: 3, value: asn1.build.integer(1) },
+];
+
+/** @internal The tagged fields of a parameters SEQUENCE, as `[{ tag, node, bytes }]` in the order
+ *  they appear, or `null` when the bytes are not that shape. The DER rule for a SEQUENCE whose
+ *  fields are OPTIONAL or DEFAULT is one context-tagged element each, in ascending tag order with
+ *  no repeats, holding exactly one value; a producer that repeats a tag or writes them out of order
+ *  has not encoded this structure. One home for the walk, so the verifier that resolves RSASSA-PSS
+ *  parameters and the comparison that reads their defaults agree on what a field is.
+ *
+ *  `maxTag` bounds the tags a caller will act on, so a field it has no meaning for is refused here
+ *  rather than ignored below.
+ *
+ * @internal
+ */
+function taggedParameterFields(params, maxTag) {
+  if (!Buffer.isBuffer(params) || params.length === 0) return null;
+  var node;
+  // allow:bare-decode parameters of an identifier a parse door already accepted, read for a comparison outside any walk, so no parse context carries caps here.
+  try { node = asn1.decode(params); } catch (_e) { return null; } // allow:swallow-unverified measured unreachable from the verbs: an attribute whose parameters do not decode is refused as cms/bad-der by the parse door, so no message carrying one reaches a comparison; bytes that do not decode are not the defaulted shape and fall back to the exact comparison
+  if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE ||
+      !Array.isArray(node.children)) return null;
+  var out = [], last = -1;
+  for (var i = 0; i < node.children.length; i++) {
+    var f = node.children[i];
+    if (f.tagClass !== "context" || f.tagNumber <= last || f.tagNumber > maxTag ||
+        !Array.isArray(f.children) || f.children.length !== 1) return null;
+    last = f.tagNumber;
+    if (!Buffer.isBuffer(f.children[0].bytes)) return null;
+    out.push({ tag: f.tagNumber, node: f.children[0], bytes: f.children[0].bytes });
+  }
+  return out;
+}
+
+/** @internal The parameters as a comparison key with every defaulted field dropped, or `null` when
+ *  they are not the shape the defaults belong to. A field whose encoding equals its default reads
+ *  the same as one the producer omitted, which is what the clause above requires; a field holding
+ *  anything else is kept and compared, since that is where RSASSA-PSS states the hash, the mask
+ *  generator, the salt length and the trailer field. */
+function _paramKeyWithoutDefaults(params, rows) {
+  var fields = taggedParameterFields(params, PARAM_MAX_TAG);
+  if (fields === null) return null;
+  var parts = [];
+  for (var i = 0; i < fields.length; i++) {
+    var defaulted = false;
+    for (var r = 0; r < rows.length; r++) {
+      if (rows[r].tag === fields[i].tag) { defaulted = rows[r].value.equals(fields[i].bytes); break; }
+    }
+    if (defaulted) continue;
+    parts.push(String(fields[i].tag) + ":" + fields[i].bytes.toString("hex"));
+  }
+  return parts.join(",");
+}
+
+/** @internal Whether two AlgorithmIdentifiers name one algorithm under RFC 6211 sec. 3, which is
+ *  byte equality for every identifier whose parameters hold no defaulted field and field equality
+ *  for one that does. Parameters that do not decode as the defaulted shape fall back to the exact
+ *  comparison, so an unreadable value is equal only to the identical bytes. */
+function sameAlgorithmModuloDefaults(a, c) {
+  if (!a || !c || a.oid !== c.oid) return false;
+  var rows = PARAM_DEFAULTS[a.oid];
+  if (rows === undefined) return guard.der.sameAlgorithmExactly(a, c);
+  /** @internal Two copies of one identifier normally carry the same bytes, and that answer needs no
+   *  decode: the fields are read only when the copies disagree, which is the case the clause is
+   *  about and the only one worth the walk. */
+  if (guard.der.sameAlgorithmExactly(a, c)) return true;
+  var ak = _paramKeyWithoutDefaults(a.parameters, rows);
+  var ck = _paramKeyWithoutDefaults(c.parameters, rows);
+  if (ak === null || ck === null) return guard.der.sameAlgorithmExactly(a, c);
+  return ak === ck;
+}
+
 module.exports = {
   parse: parse,
+  parseAlgorithmProtection: parseAlgorithmProtection,
+  algorithmProtectionReport: algorithmProtectionReport,   // @internal
+  assertAlgorithmProtectionEmission: assertAlgorithmProtectionEmission,   // @internal
+  isAlgorithmProtectionType: isAlgorithmProtectionType,   // @internal
+  algorithmProtectionOid: algorithmProtectionOid,   // @internal
   sameDigestAlgorithm: sameDigestAlgorithm,   // @internal
+  sameAlgorithmModuloDefaults: sameAlgorithmModuloDefaults,   // @internal
+  taggedParameterFields: taggedParameterFields,   // @internal
   pemDecode: pemDecode,
   pemEncode: pemEncode,
   matches: matches,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.52",
+  "version": "0.8.53",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:4d4aadb5-0f2b-4564-b30c-638343b637e8",
+  "serialNumber": "urn:uuid:f287baca-f745-4ecd-8265-d6953251f0b6",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-05T18:37:07.808Z",
+    "timestamp": "2026-10-06T00:56:34.786Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.52",
+      "bom-ref": "@blamejs/pki@0.8.53",
       "type": "application",
       "name": "pki",
-      "version": "0.8.52",
+      "version": "0.8.53",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.52",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.53",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.52",
+      "ref": "@blamejs/pki@0.8.53",
       "dependsOn": []
     }
   ]