@blamejs/pki 0.8.52 → 0.8.54

package/lib/cms-sign.js

@@ -40,13 +40,14 @@ function O(name) { return oid.byName(name); }
 
 var KNOWN_SIGN_OPTS = intrinsic.assign(intrinsic.create(null), {
   signedAttributes: 1, signingTime: 1, additionalSignedAttributes: 1, unsignedAttributes: 1,
+  algorithmProtection: 1,
   sid: 1, eContentType: 1, detached: 1, certificates: 1, pem: 1,
 });
 var KNOWN_SIGNER_CERT_KEYS = intrinsic.assign(intrinsic.create(null), { cert: 1, key: 1, pss: 1, digestAlgorithm: 1, combinedRsaSig: 1 });
 var KNOWN_SIGNER_KEY_ONLY_KEYS = intrinsic.assign(intrinsic.create(null), { spki: 1, keyIdentifier: 1, key: 1, pss: 1, digestAlgorithm: 1, combinedRsaSig: 1 });
 var KNOWN_COUNTERSIGN_OPTS = intrinsic.assign(intrinsic.create(null), {
   signerIndex: 1, countersignatureOf: 1, signingTime: 1, certificates: 1, pem: 1,
-  signedAttributes: 1, additionalSignedAttributes: 1, sid: 1,
+  signedAttributes: 1, additionalSignedAttributes: 1, sid: 1, algorithmProtection: 1,
 });
 var NS = pkix.makeNS("cms", CmsError, oid);
 var _b = pkiBuild.makeBuilder({
@@ -118,6 +119,12 @@ var UNSIGNED_FORBIDDEN = intrinsic.create(null);
 UNSIGNED_FORBIDDEN[O("contentType")] = "content-type";
 UNSIGNED_FORBIDDEN[O("messageDigest")] = "message-digest";
 UNSIGNED_FORBIDDEN[O("signingTime")] = "signing-time";
+/** @internal RFC 6211 sec. 2: the algorithm protection attribute "MUST NOT be an unsigned
+ *  attribute", and sec. 5 adds that one placed there "does not provide any additional security".
+ *  Both identifiers, since the two spell one attribute. The parser refuses the placement, so without
+ *  the door here this verb would emit a message its own verifier rejects. */
+UNSIGNED_FORBIDDEN[O("cmsAlgorithmProtection")] = "algorithm protection";
+UNSIGNED_FORBIDDEN[O("cmsAlgorithmProtect")] = "algorithm protection";
 
 function _buildUnsignedAttrs(list) {
   if (list == null) return null;
@@ -141,6 +148,49 @@ function _buildUnsignedAttrs(list) {
   return wire;
 }
 
+/** @internal The RFC 6211 attribute built from the very TLVs the structure's own fields are built
+ *  from. Sec. 2 says the attribute "contains a copy of the SignerInfo.digestAlgorithm field ...
+ *  including any parameters associated with it", so the copy is made from the value in hand rather
+ *  than re-derived from a registry row: a re-derivation can differ from the field it claims to copy,
+ *  and the parameters are the substitution target the attribute exists to pin.
+ *
+ *  `armTag` is 1 for a `SignerInfo` signature algorithm and 2 for an `AuthenticatedData` MAC
+ *  algorithm, which sec. 2 makes exclusive to their own placements. `attrOid` is the identifier the
+ *  caller's option resolved to, taken at the door so the pair carries the one that was asked for. */
+function _algorithmProtectionPair(attrOid, digestAlgId, armAlgId, armTag) {
+  return { type: attrOid, values: [b.sequence([digestAlgId, b.implicit(armTag, armAlgId)])] };
+}
+
+/** @internal An asked-for protection that cannot be placed is a refusal rather than a message that
+ *  silently lacks it. The attribute rides in the signed attributes, so with none there is nowhere to
+ *  put it, which is why RFC 8933 sec. 4.1 conditions its SHOULD on their presence. A caller who
+ *  names both options is asking for two things that cannot both hold.
+ *
+ *  The option is resolved FIRST, on every route, and the placement question asked second. Resolving
+ *  it inside the placement test would only read it on the route that cannot place it: a streamed
+ *  content is consumed and hashed before the attributes are built, so a misspelled value would be
+ *  refused after the stream had been read, which for a stream that cannot be replayed is a refusal
+ *  the caller cannot act on, and for one that never ends is no refusal at all.
+ *
+ *  The emitter below reads the same option again, which is sound because the options door refuses
+ *  one supplied through an accessor, own or inherited, before any value is read: two reads of a
+ *  plain field are one answer. */
+function _assertProtectionPlaceable(opts) {
+  var wanted = cms.algorithmProtectionOid(opts.algorithmProtection, _err);
+  if (opts.signedAttributes === false && wanted) {
+    throw _err("cms/bad-input", "algorithmProtection needs signed attributes to ride in, and " +
+      "signedAttributes: false signs the content directly (RFC 6211 sec. 2 places the attribute in " +
+      "SignerInfo.signedAttrs); drop one of the two");
+  }
+}
+
+/** @internal The producer door, applied to this verb's attribute records. The policy itself lives in
+ *  `schema-cms`, so the signing verbs and the authenticate verb enforce one rule rather than three
+ *  copies of it. */
+function _assertAlgorithmProtectionPairs(pairs, digestAlgId, armAlgId, armTag) {
+  cms.assertAlgorithmProtectionEmission(pairs, b.sequence([digestAlgId, b.implicit(armTag, armAlgId)]), _err);
+}
+
 function _resolveSignerContext(signer, opts) {
   var so = signer || {};
   var keyOnly = so.cert == null && so.spki != null;
@@ -166,7 +216,13 @@ async function _finishSignerInfo(rc, md, content, eContentType, opts) {
       { type: O("messageDigest"), values: [b.octetString(md)] },
     ];
     if (opts.signingTime !== false) intrinsic.push(pairs, { type: O("signingTime"), values: [_timeValue(opts.signingTime)] });
+    var apOid = cms.algorithmProtectionOid(opts.algorithmProtection, _err);
+    if (apOid) {
+      intrinsic.push(pairs, _algorithmProtectionPair(apOid,
+        rc.scheme.digestAlgId, rc.scheme.sigAlgId, 1));
+    }
     pairs = intrinsic.concat(pairs, _resolveAttrPairs(opts.additionalSignedAttributes, "a signed attribute value"));
+    _assertAlgorithmProtectionPairs(pairs, rc.scheme.digestAlgId, rc.scheme.sigAlgId, 1);
     toSign = _buildSignedAttrs(pairs);
   }
   var signedBytes = toSign.setOf ? toSign.setOf : toSign;
@@ -290,6 +346,7 @@ function _signDispatch(content, signers, opts) {
 async function _signStream(stream, signers, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "cms/bad-input", "pki.cms.sign options");
   guard.identifier.assertKnownKeys(opts, KNOWN_SIGN_OPTS, _err, "cms/bad-input", "unknown opts field ");
+  _assertProtectionPlaceable(opts);
   if (opts.detached !== true) {
     throw _err("cms/bad-input", "a streaming (async-iterable) content requires opts.detached: true; an attached " +
       "SignedData embeds the content as a definite-length OCTET STRING, which cannot be produced without buffering it");
@@ -329,6 +386,7 @@ async function _signStream(stream, signers, opts) {
 function _sign(content, signers, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "cms/bad-input", "pki.cms.sign options");
   guard.identifier.assertKnownKeys(opts, KNOWN_SIGN_OPTS, _err, "cms/bad-input", "unknown opts field ");
+  _assertProtectionPlaceable(opts);
   var contentBuf = _toBuf(content, "content");
   var list = Array.isArray(signers) ? _b.reqDenseArray(signers, "the signer list") : [signers];
   if (!list.length) throw _err("cms/bad-input", "pki.cms.sign requires at least one signer");
@@ -465,9 +523,15 @@ function _buildCountersignature(targetSigOctets, countersigner, opts) {
     return _digest(scheme.digest, targetSigOctets).then(function (md) {
       var pairs = [{ type: O("messageDigest"), values: [b.octetString(md)] }];
       if (opts.signingTime !== false) pairs.push({ type: O("signingTime"), values: [_timeValue(opts.signingTime)] });
+      var csApOid = cms.algorithmProtectionOid(opts.algorithmProtection, _err);
+      if (csApOid) {
+        intrinsic.push(pairs, _algorithmProtectionPair(csApOid, scheme.digestAlgId, scheme.sigAlgId, 1));
+      }
       var extra = _resolveAttrPairs(opts.additionalSignedAttributes, "a countersignature signed attribute value");
       extra.forEach(function (p) { if (p.type === O("contentType")) throw _err("cms/bad-input", "a countersignature must not carry a content-type attribute (RFC 5652 sec. 11.4)"); });
-      return _buildSignedAttrs(pairs.concat(extra));
+      var all = intrinsic.concat(pairs, extra);
+      _assertAlgorithmProtectionPairs(all, scheme.digestAlgId, scheme.sigAlgId, 1);
+      return _buildSignedAttrs(all);
     });
   }).then(function (attrs) {
     var preimage = attrs ? attrs.setOf : targetSigOctets;
@@ -559,6 +623,7 @@ function countersign(cmsInput, signers, opts) {
 function _countersign(cmsInput, signers, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "cms/bad-input", "pki.cms.countersign options");
   guard.identifier.assertKnownKeys(opts, KNOWN_COUNTERSIGN_OPTS, _err, "cms/bad-input", "unknown opts field ");
+  _assertProtectionPlaceable(opts);
   var list = Array.isArray(signers) ? signers : [signers];
   if (!list.length) throw _err("cms/bad-input", "pki.cms.countersign requires at least one countersigner");
   if (opts.signingTime != null && opts.signingTime !== false) guard.time.assertEncodable(opts.signingTime, _err, "cms/bad-input", "signingTime");

package/lib/cms-verify.js

@@ -232,23 +232,22 @@ function _hashAlgOid(seq) {
   return o;
 }
 
+/** @internal The parameter fields come from `cms.taggedParameterFields`, which holds the DER rule
+ *  for a SEQUENCE of tagged OPTIONAL and DEFAULT fields: one element per tag, ascending, no repeat,
+ *  exactly one value each. The comparison that reads these same fields for their defaults walks the
+ *  same reader, so the verifier and the comparison cannot disagree about what a field is. */
 function _resolvePss(paramsBytes) {
   if (!paramsBytes) return null;
-  var n;
-  try {
-    n = asn1.decode(paramsBytes);
-  } catch (_e) { return null; }
-  if (n.tagClass !== "universal" || n.tagNumber !== asn1.TAGS.SEQUENCE || !n.children) return null;
-  var hash = null, saltLen = null, mgfNode = null, trailer = 1n, last = -1;
-  for (var i = 0; i < n.children.length; i++) {
-    var f = n.children[i];
-    if (f.tagClass !== "context" || f.tagNumber > 3 || f.tagNumber <= last || !f.children || f.children.length !== 1) return null;
-    last = f.tagNumber;
+  var fields = cms.taggedParameterFields(paramsBytes, 3);
+  if (fields === null) return null;
+  var hash = null, saltLen = null, mgfNode = null, trailer = 1n;
+  for (var i = 0; i < fields.length; i++) {
+    var f = fields[i];
     try {
-      if (f.tagNumber === 0) { hash = PSS_HASH[_hashAlgOid(f.children[0])]; if (!hash) return null; }
-      else if (f.tagNumber === 1) { mgfNode = f.children[0]; }
-      else if (f.tagNumber === 2) { saltLen = asn1.read.integer(f.children[0]); }
-      else { trailer = asn1.read.integer(f.children[0]); }
+      if (f.tag === 0) { hash = PSS_HASH[_hashAlgOid(f.node)]; if (!hash) return null; }
+      else if (f.tag === 1) { mgfNode = f.node; }
+      else if (f.tag === 2) { saltLen = asn1.read.integer(f.node); }
+      else { trailer = asn1.read.integer(f.node); }
     } catch (_e3) { return null; }
   }
   if (hash === null || mgfNode === null) return null;
@@ -464,6 +463,54 @@ function _surfaceSignedAttrs(si) {
   });
 }
 
+/** @internal What the RFC 6211 algorithm protection attribute says about the structure carrying it,
+ *  read ONCE per signer and used for both the verdict and the comparison, so the row an operator
+ *  reads and the decision the verdict rests on cannot disagree.
+ *
+ *  The attribute is a copy of the algorithm identifiers the structure already names, placed where
+ *  the signature covers them. Sec. 3.1 makes both comparisons mandatory for a validator that
+ *  supports the attribute, and support is claimed the moment this runs: "If the fields are not the
+ *  same (modulo encoding), then signature validation MUST fail."
+ *
+ *  Both arms compare modulo encoding, in the two ways sec. 3 names. A field with a default compares
+ *  the same written out as omitted, which the clause makes a MUST and says a binary compare cannot
+ *  satisfy; RSASSA-PSS is where that arises, since RFC 4055 clause 3.1 defaults all four of its
+ *  parameter fields. Absent and DER NULL parameters read as one algorithm on the digest arm, because
+ *  RFC 3370 clause 2.1 and RFC 5754 clause 2 require both encodings to be ACCEPTED; sec. 3 leaves
+ *  that case to the implementer. Anything else in a parameter field is read as written: that is
+ *  where RSASSA-PSS puts its hash, mask generator, salt length and trailer field, which the
+ *  signature itself does not cover, so collapsing two values there would admit the substitution the
+ *  attribute exists to refuse.
+ *
+ *  A `[2]` MAC arm inside `signedAttrs` is a mismatch rather than an absent signature arm: sec. 2
+ *  populates that arm "only if the attribute is placed in an AuthenticatedData.authAttrs sequence",
+ *  so the attribute is making a claim about a structure this is not. */
+function _algorithmProtectionReport(si, armName, armIdentifier) {
+  return cms.algorithmProtectionReport(si.signedAttrs || si.authAttrs || [],
+    si.digestAlgorithm, armName, armIdentifier);
+}
+
+/** @internal The report applied to a verdict. A mismatch fails the signer, and the option that
+ *  requires the attribute fails an absent one; a verdict that already failed keeps its own code,
+ *  since the signature's verdict is the stronger statement and masking it would tell an operator the
+ *  wrong thing about why the message was refused. */
+function _applyAlgorithmProtection(verdict, report, required) {
+  var fields = { algorithmProtection: guard.verdict.of(report) };
+  if (verdict.ok !== true) return guard.verdict.of(verdict, fields);
+  if (report.mismatch !== null) {
+    return guard.verdict.of(verdict, intrinsic.assign(fields,
+      { ok: false, code: report.mismatch.code, message: report.mismatch.message }));
+  }
+  if (required && !report.present) {
+    return guard.verdict.of(verdict, intrinsic.assign(fields, { ok: false,
+      code: "cms/missing-algorithm-protection",
+      message: "this signature carries no RFC 6211 algorithm protection attribute, which " +
+        "opts.requireAlgorithmProtection asks for; RFC 8933 sec. 4.1 makes including it a SHOULD, " +
+        "so a message without one is not malformed" }));
+  }
+  return guard.verdict.of(verdict, fields);
+}
+
 /** @internal The CAdES baseline requirements this verb decides from one SignerInfo's own signed
  *  attributes, reported beside the signature verdict rather than folded into it: a signature can be
  *  cryptographically sound and still not be a CAdES signature, and the two answers are separate.
@@ -784,7 +831,7 @@ function _signerNotAfter(verdict) {
   catch (_e) { return null; }
 }
 
-async function _verifyCountersignatures(si, parsedCerts, allowWeakDigests) {
+async function _verifyCountersignatures(si, parsedCerts, allowWeakDigests, requireProtection) {
   var targetSig = _toBuf(si.signature, "the countersigned signature");
   var values = [];
   intrinsic.forEach(si.unsignedAttrs || [], function (a) {
@@ -792,17 +839,24 @@ async function _verifyCountersignatures(si, parsedCerts, allowWeakDigests) {
     intrinsic.forEach(a.values, function (v) { guard.list.append(values, v && v.bytes ? v.bytes : v); });
   });
   var out = [];
-  for (var _cp = 0; _cp < values.length; _cp++) guard.list.append(out, await _verifyOneCountersig(values[_cp], targetSig, parsedCerts, allowWeakDigests));
+  for (var _cp = 0; _cp < values.length; _cp++) guard.list.append(out, await _verifyOneCountersig(values[_cp], targetSig, parsedCerts, allowWeakDigests, requireProtection));
   return out;
 }
 
-async function _verifyOneCountersig(vDer, targetSig, parsedCerts, allowWeakDigests) {
+async function _verifyOneCountersig(vDer, targetSig, parsedCerts, allowWeakDigests, requireProtection) {
   var csSi;
   try { csSi = cms.walkCountersignature(asn1.decode(intrinsic.isBuffer(vDer) ? vDer : intrinsic.bufferFrom(vDer))); }
   catch (e) { return _row({ ok: false, code: (e instanceof CmsError ? e.code : "cms/bad-countersignature"), message: e && e.message }); }
-  var verdict = await _verifyOne(csSi, targetSig, null, parsedCerts, targetSig, undefined, allowWeakDigests);
-  var nested = await _verifyCountersignatures(csSi, parsedCerts, allowWeakDigests);
-  var head = { ok: verdict.ok, sid: verdict.sid, cert: verdict.cert, digestAlgorithm: csSi.digestAlgorithm.name };
+  /** @internal A countersignature is its own SignerInfo with its own algorithm identifiers, so the
+   *  attribute inside it protects those and is compared against them rather than against the
+   *  signature it countersigns. */
+  var apReport = _algorithmProtectionReport(csSi, "signatureAlgorithm", csSi.signatureAlgorithm);
+  var verdict = _applyAlgorithmProtection(
+    await _verifyOne(csSi, targetSig, null, parsedCerts, targetSig, undefined, allowWeakDigests),
+    apReport, requireProtection === true);
+  var nested = await _verifyCountersignatures(csSi, parsedCerts, allowWeakDigests, requireProtection);
+  var head = { ok: verdict.ok, sid: verdict.sid, cert: verdict.cert, digestAlgorithm: csSi.digestAlgorithm.name,
+    algorithmProtection: verdict.algorithmProtection };
   return guard.verdict.of(
     verdict.code ? guard.verdict.of(head, { code: verdict.code }) : head,
     { unsignedAttrs: _surfaceUnsignedAttrs(csSi), countersignatures: nested });
@@ -822,7 +876,7 @@ async function _verifyOneCountersig(vDer, targetSig, parsedCerts, allowWeakDiges
  * Verify a CMS SignedData signature (RFC 5652 sec. 5). `input` is a PEM string, a DER
  * `Buffer`, or a parsed `pki.schema.cms` object. Returns `{ valid, trusted, eContentType, eContent, signers }`
  * (`eContent` the encapsulated content when present, else null) where each `signers[i]` is
- * `{ ok, sid, cert, trusted, signedAttributesPresent, signedAttributes, unsignedAttrs, digestAlgorithm, countersignatures, signatureTimeStamps, cadesBaseline }`
+ * `{ ok, sid, cert, trusted, signedAttributesPresent, signedAttributes, unsignedAttrs, digestAlgorithm, countersignatures, signatureTimeStamps, cadesBaseline, algorithmProtection }`
  * (`cert` the matched signer certificate DER) or carries a `code` on a structural failure; `valid` is true when
  * there is at least one signer and every signer verified.
  *
@@ -873,6 +927,15 @@ async function _verifyOneCountersig(vDer, targetSig, parsedCerts, allowWeakDiges
  * content, and a token over it answers for either. `pki.cms.attachTimestamp` adds such an attribute to an
  * existing message and `pki.cms.timestampImprint` produces the imprint a TSA signs.
  *
+ * `algorithmProtection` reports the RFC 6211 attribute, `{ present, oid, compared, mismatch }`. The
+ * attribute is a copy of the digest and signature algorithm identifiers this signer names, placed
+ * where the signature covers them, and `compared` lists the identifiers checked against it. A
+ * disagreement fails the signer with `cms/algorithm-protection-mismatch`, which sec. 3.1 requires of
+ * any validator that supports the attribute: the identifiers the attribute protects are otherwise
+ * covered by nothing, and RFC 8933 sec. 6 names RSASSA-PSS as the case where the signature itself
+ * pins no digest. An absent attribute is not a failure unless `requireAlgorithmProtection` asks for
+ * one, and `present: false` says so rather than looking like a comparison that passed.
+ *
  * `cadesBaseline` is a third claim, `{ conformant, signingCertificateAttribute, findings,
  * requirementsChecked }`: a signature can be sound and still not be a CAdES signature.
  * `requirementsChecked` lists the EN 319 122-1 requirements decided here, each unmet one carrying a
@@ -908,6 +971,14 @@ async function _verifyOneCountersig(vDer, targetSig, parsedCerts, allowWeakDiges
  *                 trust decision from the signer: an operator may anchor one and not the other.
  * @opts  timestampRevocationChecker  A revocation checker for the TSA chain, as `pki.path.validate`
  *                 takes one. Each row reports what it established in `revocationChecked`.
+ * @opts  requireAlgorithmProtection  Fail a signer that carries no RFC 6211
+ *                 `CMSAlgorithmProtection` attribute, with `cms/missing-algorithm-protection`. Off
+ *                 by default: RFC 6211 says nothing about absence and RFC 8933 sec. 4.1 makes
+ *                 including it a SHOULD, so a message without one is not malformed and most CMS in
+ *                 the field carries none. A signer that DOES carry one is always held to it, with no
+ *                 option, because sec. 3.1's comparisons are MUSTs once a validator supports the
+ *                 attribute. The option is the boolean it documents: `false`, `null` and an absent
+ *                 option are the off forms, and any other value is refused `cms/bad-input`.
  * @example
  *   var pair = await pki.key.generate("Ed25519");
  *   var key = await pki.key.export(pair.privateKey);
@@ -950,7 +1021,8 @@ var _VERIFY_OPTS = intrinsic.assign(intrinsic.create(null), { certs: 1, content:
    *  authority is a different trust decision from the signer's: an operator may anchor the TSA while
    *  leaving the signer unanchored, or the reverse, and one `trustAnchors` for both would make those
    *  two answers one. */
-  timestampCerts: 1, timestampTrustAnchors: 1, timestampRevocationChecker: 1 });
+  timestampCerts: 1, timestampTrustAnchors: 1, timestampRevocationChecker: 1,
+  requireAlgorithmProtection: 1 });
 
 function verify(input, opts) {
   return guard.async.deferred(function () { return _verify(input, opts); });
@@ -959,12 +1031,19 @@ function verify(input, opts) {
 async function _verify(input, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "cms/bad-input", "pki.cms.verify options");
   guard.identifier.assertKnownKeys(opts, _VERIFY_OPTS, _err, "cms/bad-input", "pki.cms.verify has an unknown option ");
+  /** @internal The two policy switches are taken FIRST, ahead of everything below that can run the
+   *  caller's own code. Deriving the message runs accessors on a parsed input, copying the trust
+   *  material runs them on each anchor, and a streamed detached content runs the generator while
+   *  this verb is pending; any of those can write to an options object the caller still holds, so a
+   *  switch read after them is read from whatever they left behind rather than from the call. */
+  var allowWeakDigests = opts.allowWeakDigests === true;
+  var requireProtection = guard.identifier.booleanOption(opts.requireAlgorithmProtection, _err,
+    "cms/bad-input", "pki.cms.verify opts.requireAlgorithmProtection");
   var parsed = guard.parsed.acceptDerived(input, "cms", function (bytes) {
     return cms.parse(_snapshotIfBytes(bytes, "pki.cms.verify"));
   }, _err, "cms/bad-input", "the SignedData");
   if (!Array.isArray(parsed.signerInfos)) throw _err("cms/bad-input", "input is not a CMS SignedData");
   var trustCfg = _snapshotTrust(opts);
-  var allowWeakDigests = opts.allowWeakDigests === true;
   var tsTrustCfg = _snapshotTimestampTrust(opts, allowWeakDigests);
   var parsedCerts = [];
   (parsed.certificates || []).forEach(function (c) { _addCert(parsedCerts, c && c.bytes ? c.bytes : c); });
@@ -991,8 +1070,13 @@ async function _verify(input, opts) {
   var signers = [];
   for (var _sp = 0; _sp < parsed.signerInfos.length; _sp++) {
     var siOne = parsed.signerInfos[_sp];
+    /** @internal Read once, before the signature is checked, and used for both the verdict row and
+     *  the decision: the attribute is an independent requirement on the same signer, the way trust
+     *  is, so it composes onto the verdict rather than being folded into the signature check. */
+    var apReport = _algorithmProtectionReport(siOne, "signatureAlgorithm", siOne.signatureAlgorithm);
     var verdict = await _verifyOne(siOne, content, eContentType, parsedCerts, null, digestByName, allowWeakDigests);
-    var counters = await _verifyCountersignatures(siOne, parsedCerts, allowWeakDigests);
+    verdict = _applyAlgorithmProtection(verdict, apReport, requireProtection);
+    var counters = await _verifyCountersignatures(siOne, parsedCerts, allowWeakDigests, requireProtection);
     /** @internal The timestamp rows are built from the same `signature` octets the signature verdict
      *  above was computed over, which is why they are here and not in a verb of their own. The
      *  signer's own certificate supplies the expiry half of EN 319 122-1 clause 6.3 requirement m. */
@@ -1204,6 +1288,17 @@ function _addCert(out, der) {
  *                          (`timeStampToken`); content-type / message-digest / signing-time are
  *                          rejected here (RFC 5652 sec. 11). Use `pki.cms.countersign` for a
  *                          countersignature specifically.
+ * @opts  algorithmProtection  Emit the RFC 6211 `CMSAlgorithmProtection` signed attribute, a copy of
+ *                          this signer's digest and signature algorithm identifiers placed where the
+ *                          signature covers them. RFC 8933 sec. 4.1 makes including it a SHOULD, and
+ *                          RFC 9882 sec. 4 and RFC 9814 sec. 5 repeat that for ML-DSA and SLH-DSA,
+ *                          which carry no digest identifier inside the signature. Off by default,
+ *                          because turning it on changes the bytes of every signature. `true` emits
+ *                          the identifier RFC 6211 sec. 2 states, which OpenSSL and Bouncy Castle
+ *                          use; `"registry"` emits the S/MIME arc value the IANA registry and
+ *                          draft-ietf-lamps-rfc6211-update give it. A verifier here reads both.
+ *                          `false`, `null` and an absent option emit none, and any other value is
+ *                          refused `cms/bad-input`.
  * @example
  *   var pair = await pki.key.generate("Ed25519");
  *   var signerKeyPkcs8 = await pki.key.export(pair.privateKey);
@@ -1246,6 +1341,10 @@ var sign = cmsSign.sign;
  *                              is rejected, RFC 5652 sec. 11.4).
  * @opts  sid                   `"issuerAndSerial"` (default) or `"ski"`.
  * @opts  certificates          Embed the countersigner certificate(s) in the SignedData. Default true.
+ * @opts  algorithmProtection   Emit the RFC 6211 `CMSAlgorithmProtection` attribute on the
+ *                              countersignature, copying ITS own digest and signature algorithm
+ *                              identifiers rather than the countersigned signature's. Off by
+ *                              default; `"registry"` selects the IANA registry identifier.
  * @opts  pem                   Return a PEM string instead of a DER Buffer.
  * @example
  *   var pair = await pki.key.generate("Ed25519");
@@ -1341,6 +1440,18 @@ var encrypt = cmsEncrypt.encrypt;
  * @opts keyIdentifier `"issuerAndSerial"` (default) or `"subjectKeyIdentifier"`.
  * @opts oaepHash The RSAES-OAEP hash for ktri recipients wrapping the MAC key: `"sha256"` (default) / `"sha384"` / `"sha512"`.
  * @opts ukm User keying material (a Buffer) for kari / kemri recipients.
+ * @opts algorithmProtection Emit the RFC 6211 `CMSAlgorithmProtection` authenticated attribute, a
+ *       copy of the digest and MAC algorithm identifiers this structure names. It matters more here
+ *       than on a signature: RFC 5652 sec. 9.2 makes the MAC input the DER encoding of `authAttrs`
+ *       alone, so `digestAlgorithm` and `macAlgorithm` are covered by nothing, and rewriting the
+ *       digest algorithm leaves the MAC verifying while the recipient recomputes the content digest
+ *       under the attacker's choice, no key required. `true` emits the identifier RFC 6211 sec. 2
+ *       states, `"registry"` the IANA registry value. Off by default, because it changes the bytes
+ *       of every message. `false`, `null` and an absent option emit none, and any other value is
+ *       refused `cms/bad-input`. With `authenticatedAttributes: false` the MAC covers the content
+ *       octets directly and no attribute set is built, so asking for the attribute there is refused
+ *       while the off forms are still accepted. `pki.cms.decrypt` reads both identifiers and
+ *       compares the copies it finds.
  * @opts pem Return a PEM string (`-----BEGIN CMS-----`) instead of a DER Buffer.
  * @example
  *   // authenticate a message to an RSA recipient, then verify the MAC via decrypt
@@ -1403,6 +1514,19 @@ var authenticate = cmsEncrypt.authenticate;
  * @opts maxIterations  Lower the PBKDF2 iteration cap (a DoS bound; downward only).
  * @opts stream         Return `content` as an async iterable of plaintext `Buffer` chunks instead of a single `Buffer`.
  * @opts allowUnauthenticatedRsa15  Read a message that uses RSAES-PKCS1-v1_5 key transport over a content with no integrity tag, such as AES-CBC. Refused by default with `cms/unauthenticated-rsa-v15`: the content padding is that combination's only integrity check, so decrypting it either returns the plaintext of a substituted key or tells an attacker submitting chosen ciphertexts that theirs decoded (RFC 8017 sec. 7.2). `openssl cms -encrypt` emits exactly this combination when no algorithm is named, so reading one of its messages needs this option. An AEAD content or an RSAES-OAEP recipient needs none.
+ * @opts requireAlgorithmProtection  For an AuthenticatedData, refuse one that carries no RFC 6211
+ *       `CMSAlgorithmProtection` authenticated attribute, with `cms/missing-algorithm-protection`.
+ *       Off by default, since RFC 8933 sec. 4.1 makes including it a SHOULD. A message that DOES
+ *       carry one is always held to it, with no option: its `digestAlgorithm` and `macAlgorithm`
+ *       copies are compared against the fields of the `AuthenticatedData` itself, and a disagreement
+ *       is `cms/algorithm-protection-mismatch`. That comparison runs before the MAC, because a
+ *       mismatch is a statement about the message rather than about the key. The result's
+ *       `algorithmProtection` field reports what was compared. The option is the boolean it
+ *       documents: `false`, `null` and an absent option are the off forms, and any other value is
+ *       refused `cms/bad-input`. Asking for it while decrypting any other content type is refused
+ *       the same way: RFC 8933 sec. 6 gives the attribute a place in an `AuthenticatedData` alone,
+ *       so an `EnvelopedData`, `AuthEnvelopedData` or `EncryptedData` cannot satisfy the
+ *       requirement and returning its plaintext would answer neither question.
  * @example
  *   var rsa = { name: "RSA-OAEP", modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" };
  *   var pair = await pki.key.generate(rsa);

package/lib/crmf-sign.js

@@ -943,7 +943,7 @@ async function _assertEnclosedKeyCorresponds(privateKeyDer, templateSpki) {
      * failing, not the input. */
     if (e && e.isPkiError === true && e.code === "key/bad-input") {
       throw _err("crmf/bad-input", "pop.privateKey could not be read as a private key to check against " +
-        "certTemplate.publicKey: " + (e.message || e), e);
+        "certTemplate.publicKey: " + guard.text.describeThrown(e), e);
     }
     throw _err("crmf/bad-popo", "the private key enclosed in the encryptedKey proof of possession could not be " +
       "exercised with certTemplate.publicKey, so it cannot be shown to be that key's private half (RFC 4211 sec. 4.2)", e);

package/lib/ct.js

@@ -2177,7 +2177,7 @@ function _b64Array(obj, name, code, label, exactLen, maxCount) {
  * @opts headers OPTIONAL extra request headers (the request-framing headers are stripped; the verb owns the GET method).
  * @opts timeout OPTIONAL ms budget, default 30s (cap-validated).
  * @opts maxResponseBytes OPTIONAL per-GET size cap, default 4 MiB, tightenable DOWNWARD only.
- * @opts requireJsonContentType OPTIONAL boolean (default false) -- opt in to a strict `ct/bad-content-type` gate on the JSON GET.
+ * @opts requireJsonContentType OPTIONAL boolean (default false) -- opt in to a strict `ct/bad-content-type` gate on the JSON GET. A value other than `true`, `false`, `null` or an absent option is refused `ct/bad-input` before the request goes out.
  * @example
  *   // a live distributor uses the default pki.transport.https; here an injected transport returns the pair
  *   var r = await pki.ct.fetchLogList({ url: "https://ct.example/log_list.json", signerKey: googleSignerSpki,
@@ -2241,7 +2241,8 @@ async function fetchLogList(opts) {
   var req = { headers: headers, tls: fetchTls, timeout: timeout, maxResponseBytes: maxResponseBytes };
   /** @internal Read before the request goes out, so the option that decides the check is the one the call
    *  was made with rather than whatever it says once the response is back. */
-  var requireJsonContentType = opts.requireJsonContentType === true;
+  var requireJsonContentType = guard.identifier.booleanOption(opts.requireJsonContentType, _ctErr,
+    "ct/bad-input", "fetchLogList opts.requireJsonContentType");
   var jsonRes = await _fetchBody(transport, jsonUrl, req, "CT log-list JSON");
   if (requireJsonContentType && jsonRes.contentType !== "application/json") throw _ctErr("ct/bad-content-type", "the CT log-list JSON GET returned content-type " + JSON.stringify(jsonRes.contentType || null) + " (opts.requireJsonContentType is set)");
   var sigRes = await _fetchBody(transport, sigUrl, req, "CT log-list signature");