@freedomofpress/sigstore-browser 0.1.2 → 0.1.4

package/src/sigstore.ts

@@ -36,6 +36,37 @@ import { verifyTLogBody } from "./tlog/body.js";
 import { verifyBundleTimestamp } from "./timestamp/tsa.js";
 import { TrustedRootProvider } from "./trust/tuf.js";
 
+const MEDIA_TYPE_BASE = "application/vnd.dev.sigstore.bundle";
+
+/**
+ * Extract bundle version from mediaType string
+ * Reference: https://github.com/sigstore/sigstore-go/blob/main/pkg/bundle/bundle.go#L159-L177
+ */
+function getBundleVersion(mediaType: string): string {
+  switch (mediaType) {
+    case `${MEDIA_TYPE_BASE}+json;version=0.1`:
+      return "0.1";
+    case `${MEDIA_TYPE_BASE}+json;version=0.2`:
+      return "0.2";
+    case `${MEDIA_TYPE_BASE}+json;version=0.3`:
+      return "0.3";
+  }
+
+  // New format: "application/vnd.dev.sigstore.bundle.v0.3+json"
+  if (mediaType.startsWith(`${MEDIA_TYPE_BASE}.v`) && mediaType.endsWith("+json")) {
+    const version = mediaType
+      .replace(`${MEDIA_TYPE_BASE}.v`, "")
+      .replace("+json", "");
+    // Basic semver validation (major.minor or major.minor.patch)
+    if (/^\d+\.\d+(\.\d+)?$/.test(version)) {
+      return version;
+    }
+  }
+
+  // Default to 0.1 for unknown formats
+  return "0.1";
+}
+
 export interface SigstoreVerifierOptions {
   tlogThreshold?: number;
   ctlogThreshold?: number;
@@ -244,8 +275,7 @@ export class SigstoreVerifier {
 
   // Adapted from https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/key/sct.ts
   // Key differences:
-  // - Adds duplicate SCT detection
-  // - Adds SCT timestamp validity checking
+  // - Adds duplicate SCT detection (not in reference)
   // - Inline CT log filtering by logID and validity period (reference uses filterTLogAuthorities)
   // - Returns array of verified SCT logIDs for threshold checking (matches reference behavior)
   async verifySCT(
@@ -312,42 +342,39 @@ export class SigstoreVerifier {
     preCert.appendUint24(tbs.length);
     preCert.appendView(tbs);
 
-    // Collect all verified SCTs to check against threshold
+    // Calculate and return the verification results for each SCT
+    // Unlike sigstore-go which counts verified SCTs and checks threshold at the end,
+    // sigstore-js throws immediately if any SCT fails verification
     const verifiedSCTs: Uint8Array[] = [];
 
     for (const sct of extSCT.signedCertificateTimestamps) {
-      // SCT should be within certificate validity period
-      if (sct.datetime < cert.notBefore || sct.datetime > cert.notAfter) {
-        continue; // Skip invalid SCT timestamp, don't fail yet
-      }
-
       // Find the CT log that matches this SCT's log ID and is valid for the SCT datetime
       const validCTLogs = ctlogs.filter((log) => {
         // Check if log IDs match
-        if (log.logID.length !== sct.logID.length) return false;
-        for (let i = 0; i < log.logID.length; i++) {
-          if (log.logID[i] !== sct.logID[i]) return false;
-        }
+        if (!uint8ArrayEqual(log.logID, sct.logID)) return false;
         // Check that the SCT datetime is within the log's validity period
         return log.validFor.start <= sct.datetime && sct.datetime <= log.validFor.end;
       });
 
-      // Try to verify with any valid CT log
-      let verified = false;
-      for (const log of validCTLogs) {
-        try {
-          if (await sct.verify(preCert.buffer, log.publicKey)) {
-            verified = true;
-            break; // Found a valid log for this SCT
+      // See if the SCT is valid for any of the CT logs
+      const verified = await (async () => {
+        for (const log of validCTLogs) {
+          try {
+            if (await sct.verify(preCert.buffer, log.publicKey)) {
+              return true;
+            }
+          } catch {
+            // Continue trying other logs
           }
-        } catch (e) {
-          // Continue trying other logs
         }
-      }
+        return false;
+      })();
 
-      if (verified) {
-        verifiedSCTs.push(sct.logID);
+      if (!verified) {
+        throw new Error("SCT verification failed");
       }
+
+      verifiedSCTs.push(sct.logID);
     }
 
     return verifiedSCTs;
@@ -360,9 +387,10 @@ export class SigstoreVerifier {
   ): Promise<boolean> {
     const entries = bundle.verificationMaterial.tlogEntries;
 
-    if (entries.length < 1) {
+    // Check that bundle has enough tlog entries to meet threshold
+    if (entries.length < this.options.tlogThreshold) {
       throw new Error(
-        "Failed to find a transparency log entry in the provided bundle.",
+        `Not enough tlog entries: ${entries.length} < ${this.options.tlogThreshold}`,
       );
     }
 
@@ -390,9 +418,8 @@ export class SigstoreVerifier {
     const entry = entries[0];
 
     // Extract bundle version from mediaType
-    // e.g., "application/vnd.dev.sigstore.bundle+json;version=0.2"
-    const versionMatch = bundle.mediaType.match(/version=(\d+\.\d+)/);
-    const bundleVersion = versionMatch ? versionMatch[1] : "0.1";
+    // Reference: https://github.com/sigstore/sigstore-go/blob/main/pkg/bundle/bundle.go#L159-L177
+    const bundleVersion = getBundleVersion(bundle.mediaType);
     const isV02OrLater = parseFloat(bundleVersion) >= 0.2;
 
     // Bundle v0.2+ requires an inclusion proof
@@ -512,14 +539,31 @@ export class SigstoreVerifier {
         }
       }
     } else if (bodyJson.kind === "dsse") {
-      // DSSE entries store signatures differently
-      // The certificate is verified through the bundle's verification material
-      // No additional check needed here
+      // DSSE v0.0.1: certificate is in spec.signatures[0].verifier (base64-encoded PEM)
+      // https://github.com/sigstore/sigstore-go/blob/main/pkg/tlog/entry.go#L356-L357
+      const verifierContent = bodyJson.spec.signatures?.[0]?.verifier;
+      if (verifierContent) {
+        const pemString = Uint8ArrayToString(base64ToUint8Array(verifierContent));
+        const loggedCert = X509Certificate.parse(pemString);
+        if (!cert.equals(loggedCert)) {
+          throw new Error(
+            "Certificate in DSSE tlog entry does not match the signing certificate.",
+          );
+        }
+      }
     } else if (bodyJson.kind === "intoto") {
-      // Intoto entries are DSSE-based and don't store certificates in the tlog entry
-      // The certificate is part of the bundle's verification material which has already
-      // been verified against the CA root. The intoto verification in tlog/intoto.ts
-      // verifies the signature and payload hash match between the tlog and bundle.
+      // intoto v0.0.2: certificate is in spec.content.envelope.signatures[0].publicKey (base64-encoded PEM)
+      // https://github.com/sigstore/sigstore-go/blob/main/pkg/tlog/entry.go#L360-L361
+      const publicKeyContent = bodyJson.spec.content?.envelope?.signatures?.[0]?.publicKey;
+      if (publicKeyContent) {
+        const pemString = Uint8ArrayToString(base64ToUint8Array(publicKeyContent));
+        const loggedCert = X509Certificate.parse(pemString);
+        if (!cert.equals(loggedCert)) {
+          throw new Error(
+            "Certificate in intoto tlog entry does not match the signing certificate.",
+          );
+        }
+      }
     } else {
       // Unknown entry type - this should not happen with standard Sigstore bundles
       throw new Error(`Unsupported tlog entry kind: ${bodyJson.kind}`);
@@ -537,15 +581,17 @@ export class SigstoreVerifier {
       throw new Error("No transparency log entries found in bundle");
     }
 
-    const entry = bundle.verificationMaterial.tlogEntries[0];
+    // Verify inclusion proof for ALL entries, not just the first one
+    // Reference: https://github.com/sigstore/sigstore-go/blob/main/pkg/verify/tlog.go#L74-L127
+    for (const entry of bundle.verificationMaterial.tlogEntries) {
+      // Only verify if there's an inclusion proof (v0.3/rekor2 bundles)
+      // v0.1 bundles use inclusion promises instead, verified in verifyInclusionPromise
+      if (entry.inclusionProof) {
+        await verifyMerkleInclusion(entry);
 
-    // Only verify if there's an inclusion proof (v0.3/rekor2 bundles)
-    // v0.1 bundles use inclusion promises instead, verified in verifyInclusionPromise
-    if (entry.inclusionProof) {
-      await verifyMerkleInclusion(entry);
-
-      if (entry.inclusionProof.checkpoint) {
-        await verifyCheckpoint(entry, this.rawRoot.tlogs);
+        if (entry.inclusionProof.checkpoint) {
+          await verifyCheckpoint(entry, this.rawRoot.tlogs);
+        }
       }
     }
   }
@@ -629,26 +675,29 @@ export class SigstoreVerifier {
     // # 5 Rekor inclusion proof (Merkle tree verification)
     await this.verifyInclusionProof(bundle);
 
-    // # 5.1 Rekor body verification
-    if (bundle.verificationMaterial.tlogEntries.length > 0) {
-      await verifyTLogBody(
-        bundle.verificationMaterial.tlogEntries[0],
-        bundle
-      );
+    // # 5.1 Rekor body verification - verify ALL entries (matches sigstore-js verifier.ts:147)
+    for (const entry of bundle.verificationMaterial.tlogEntries) {
+      await verifyTLogBody(entry, bundle);
     }
 
-    // # 6 TSA Timestamp Verification (if present)
-    let verifiedTimestamp: Date | undefined;
-    if (bundle.verificationMaterial.timestampVerificationData) {
-      // Verify TSA timestamps if present
-      verifiedTimestamp = await verifyBundleTimestamp(
-        bundle.verificationMaterial.timestampVerificationData,
-        signature,
-        this.rawRoot?.timestampAuthorities || []
+    // # 6 TSA Timestamp Verification
+    // Verify all timestamps and enforce threshold
+    // Reference: https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/verifier.ts#L101-L106
+    const verifiedTimestamps = await verifyBundleTimestamp(
+      bundle.verificationMaterial.timestampVerificationData,
+      signature,
+      this.rawRoot?.timestampAuthorities || []
+    );
+
+    if (verifiedTimestamps.length < this.options.tsaThreshold) {
+      throw new Error(
+        `Not enough verified TSA timestamps: ${verifiedTimestamps.length} < ${this.options.tsaThreshold}`
       );
+    }
 
-      // If we have a verified timestamp, check certificate validity at that time
-      if (verifiedTimestamp && !signingCert.validForDate(verifiedTimestamp)) {
+    // If we have verified timestamps, check certificate validity at each timestamp time
+    for (const verifiedTimestamp of verifiedTimestamps) {
+      if (!signingCert.validForDate(verifiedTimestamp)) {
         throw new Error(
           "Certificate was not valid at the time of timestamping"
         );

package/src/timestamp/tsa.ts

@@ -152,53 +152,60 @@ async function verifyTimestampForCA(
 }
 
 /**
- * Extracts the verified timestamp from a bundle's timestamp verification data
+ * Verifies all timestamps in a bundle's timestamp verification data
  *
- * New functionality for Sigstore bundle integration (not in sigstore-js reference)
+ * Matches sigstore-js behavior: all timestamps must successfully verify.
+ * Reference: https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/verifier.ts#L64-L108
  *
  * @param timestampData - The timestamp verification data from the bundle
  * @param signature - The signature being verified
  * @param timestampAuthorities - List of trusted timestamp authorities
- * @returns The verified signing time, or undefined if no timestamp
+ * @returns Array of verified signing times (empty if no timestamps present)
+ * @throws Error if any timestamp fails verification or duplicates are found
  */
 export async function verifyBundleTimestamp(
   timestampData: any,
   signature: Uint8Array,
   timestampAuthorities: RawTimestampAuthority[]
-): Promise<Date | undefined> {
+): Promise<Date[]> {
   if (!timestampData?.rfc3161Timestamps?.length) {
-    return undefined;
+    return [];
   }
 
-  // Check for duplicate timestamps
-  const seenTimestamps = new Set<string>();
+  // Verify ALL timestamps - each must succeed (matches sigstore-js behavior)
+  // Collect verification results for duplicate checking after verification
+  // Reference: https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/verifier.ts#L86-L92
+  const verifiedResults: Array<{ signingTime: Date; signerSerialNumber: string }> = [];
+
   for (const tsData of timestampData.rfc3161Timestamps) {
-    if (seenTimestamps.has(tsData.signedTimestamp)) {
-      throw new Error("Duplicate TSA timestamp detected");
-    }
-    seenTimestamps.add(tsData.signedTimestamp);
+    // Decode the base64-encoded timestamp
+    const timestampBytes = base64ToUint8Array(tsData.signedTimestamp);
+    const timestamp = RFC3161Timestamp.parse(timestampBytes);
+
+    const signingTime = await verifyRFC3161Timestamp(
+      timestamp,
+      signature,
+      timestampAuthorities
+    );
+
+    verifiedResults.push({
+      signingTime,
+      signerSerialNumber: Array.from(timestamp.signerSerialNumber).join(','),
+    });
   }
 
-  // Process each RFC3161 timestamp
-  const errors: string[] = [];
-  for (const tsData of timestampData.rfc3161Timestamps) {
-    try {
-      // Decode the base64-encoded timestamp
-      const timestampBytes = base64ToUint8Array(tsData.signedTimestamp);
-      const timestamp = RFC3161Timestamp.parse(timestampBytes);
-
-      const signingTime = await verifyRFC3161Timestamp(
-        timestamp,
-        signature,
-        timestampAuthorities
-      );
-      return signingTime;
-    } catch (e) {
-      // Continue to next timestamp if this one fails
-      errors.push(e instanceof Error ? e.message : String(e));
-      continue;
+  // Check for duplicate timestamps using deep equality on parsed values
+  // sigstore-js uses isDeepStrictEqual on {type, logID, timestamp} objects
+  for (let i = 0; i < verifiedResults.length; i++) {
+    for (let j = i + 1; j < verifiedResults.length; j++) {
+      if (
+        verifiedResults[i].signingTime.getTime() === verifiedResults[j].signingTime.getTime() &&
+        verifiedResults[i].signerSerialNumber === verifiedResults[j].signerSerialNumber
+      ) {
+        throw new Error("Duplicate TSA timestamp detected");
+      }
     }
   }
 
-  throw new Error(`No valid RFC3161 timestamps found. Errors: ${errors.join(', ')}`);
+  return verifiedResults.map(r => r.signingTime);
 }

package/src/tlog/dsse.ts

@@ -12,7 +12,7 @@
  */
 
 import { base64ToUint8Array, hexToUint8Array, uint8ArrayEqual } from "@freedomofpress/crypto-browser";
-import { HashAlgorithms } from "../interfaces.js";
+import { getHashAlgorithm } from "../interfaces.js";
 import type { SigstoreBundle } from "../bundle.js";
 import type { RekorEntry } from "./body.js";
 
@@ -81,16 +81,16 @@ async function verifyDSSE001Body(
     throw new Error("DSSE signature mismatch between TLog entry and bundle");
   }
 
-  const tlogHash = entry.spec.payloadHash?.value || "";
-  if (!tlogHash) {
-    throw new Error("DSSE entry missing payloadHash");
+  if (!entry.spec.payloadHash?.value || !entry.spec.payloadHash?.algorithm) {
+    throw new Error("DSSE entry missing payloadHash or algorithm");
   }
 
-  const tlogHashBytes = hexToUint8Array(tlogHash);
+  const hashAlg = getHashAlgorithm(entry.spec.payloadHash.algorithm);
+  const tlogHashBytes = hexToUint8Array(entry.spec.payloadHash.value);
 
   const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
   const bundleHashBytes = new Uint8Array(
-    await crypto.subtle.digest(HashAlgorithms.SHA256, payloadBytes as Uint8Array<ArrayBuffer>)
+    await crypto.subtle.digest(hashAlg, payloadBytes as Uint8Array<ArrayBuffer>)
   );
 
   if (!uint8ArrayEqual(tlogHashBytes, bundleHashBytes)) {
@@ -129,16 +129,16 @@ async function verifyDSSE002Body(
     throw new Error("DSSE signature mismatch between TLog entry and bundle (v0.0.2)");
   }
 
-  const tlogHash = spec.payloadHash?.digest || "";
-  if (!tlogHash) {
-    throw new Error("DSSE v0.0.2 entry missing payloadHash");
+  if (!spec.payloadHash?.digest || !spec.payloadHash?.algorithm) {
+    throw new Error("DSSE v0.0.2 entry missing payloadHash or algorithm");
   }
 
-  const tlogHashBytes = base64ToUint8Array(tlogHash);
+  const hashAlg = getHashAlgorithm(spec.payloadHash.algorithm);
+  const tlogHashBytes = base64ToUint8Array(spec.payloadHash.digest);
 
   const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
   const bundleHashBytes = new Uint8Array(
-    await crypto.subtle.digest(HashAlgorithms.SHA256, payloadBytes as Uint8Array<ArrayBuffer>)
+    await crypto.subtle.digest(hashAlg, payloadBytes as Uint8Array<ArrayBuffer>)
   );
 
   if (!uint8ArrayEqual(tlogHashBytes, bundleHashBytes)) {

package/src/tlog/intoto.ts

@@ -11,7 +11,7 @@
  */
 
 import { base64Decode, base64ToUint8Array, hexToUint8Array, uint8ArrayEqual } from "@freedomofpress/crypto-browser";
-import { HashAlgorithms } from "../interfaces.js";
+import { getHashAlgorithm } from "../interfaces.js";
 import type { SigstoreBundle } from "../bundle.js";
 import type { RekorEntry } from "./body.js";
 
@@ -87,12 +87,16 @@ export async function verifyIntotoBody(
   }
 
   if (intotoEntry.spec.content.payloadHash) {
-    const tlogHash = intotoEntry.spec.content.payloadHash.value;
-    const tlogHashBytes = hexToUint8Array(tlogHash);
+    if (!intotoEntry.spec.content.payloadHash.algorithm) {
+      throw new Error("Intoto entry missing payloadHash algorithm");
+    }
+
+    const hashAlg = getHashAlgorithm(intotoEntry.spec.content.payloadHash.algorithm);
+    const tlogHashBytes = hexToUint8Array(intotoEntry.spec.content.payloadHash.value);
 
     const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
     const bundleHashBytes = new Uint8Array(
-      await crypto.subtle.digest(HashAlgorithms.SHA256, payloadBytes as Uint8Array<ArrayBuffer>)
+      await crypto.subtle.digest(hashAlg, payloadBytes as Uint8Array<ArrayBuffer>)
     );
 
     if (!uint8ArrayEqual(tlogHashBytes, bundleHashBytes)) {

package/src/x509/cert.ts

@@ -22,7 +22,7 @@ import {
   verifySignature,
 } from "@freedomofpress/crypto-browser";
 import { KeyTypes } from "../interfaces.js";
-import { ECDSA_CURVE_NAMES, ECDSA_SIGNATURE_ALGOS, RSA_SIGNATURE_ALGOS } from "../oid.js";
+import { DEFAULT_HASH_ALGORITHM, ECDSA_CURVE_NAMES, ECDSA_SIGNATURE_ALGOS, OID_RSASSA_PSS, RSA_SIGNATURE_ALGOS, SHA2_HASH_ALGOS } from "../oid.js";
 import {
   X509AuthorityKeyIDExtension,
   X509BasicConstraintsExtension,
@@ -96,27 +96,33 @@ export class X509Certificate {
   }
 
   /**
-   * Import the public key with a specific hash algorithm for RSA keys
-   * For ECDSA keys, the hash parameter is ignored
+   * Import the public key with a specific hash algorithm and signature scheme for RSA keys.
+   * For ECDSA keys, both parameters are ignored.
+   * @param hashAlg - Hash algorithm (e.g., "sha384") for RSA keys
+   * @param usePss - If true, import as RSA-PSS key; if false, import as PKCS#1 v1.5
    */
-  public async getPublicKeyObj(hashAlg?: string): Promise<CryptoKey> {
+  public async getPublicKeyObj(hashAlg?: string, usePss?: boolean): Promise<CryptoKey> {
     const publicKey = this.subjectPublicKeyInfoObj.toDER();
     const spki = ASN1Obj.parseBuffer(publicKey);
     const algorithmOID = spki.subs[0].subs[0].toOID();
 
-    // Check if it's an RSA key (OID 1.2.840.113549.1.1.1)
-    if (algorithmOID === "1.2.840.113549.1.1.1") {
-      // RSA key - use provided hash or default to SHA-256
-      const hash = hashAlg || "sha256";
-      let scheme: string;
-      if (hash.includes("384")) {
-        scheme = "SHA384";
-      } else if (hash.includes("512")) {
-        scheme = "SHA512";
-      } else {
-        scheme = "SHA256";
-      }
-      return importKey(KeyTypes.RSA, `RSA_PKCS1V5_${scheme}`, Uint8ArrayToBase64(publicKey));
+    // RSA key (OID 1.2.840.113549.1.1.1) or RSA-PSS key (OID 1.2.840.113549.1.1.10)
+    const isRsaKey = algorithmOID === "1.2.840.113549.1.1.1";
+    const isRsaPssKey = algorithmOID === OID_RSASSA_PSS;
+
+    if (isRsaPssKey) {
+      // WebCrypto doesn't support importing keys with id-RSASSA-PSS OID, only rsaEncryption
+      throw new Error(
+        "RSA-PSS public keys (id-RSASSA-PSS OID) are not supported by WebCrypto. " +
+        "Only certificates with standard RSA keys (rsaEncryption OID) signed using RSA-PSS are supported."
+      );
+    }
+
+    if (isRsaKey) {
+      const hash = hashAlg || DEFAULT_HASH_ALGORITHM;
+      // crypto-browser extracts hash from scheme and uses PSS unless "PKCS1" is present
+      const scheme = usePss ? hash : `PKCS1_${hash}`;
+      return importKey(KeyTypes.RSA, scheme, Uint8ArrayToBase64(publicKey));
     } else {
       // ECDSA key - the curve OID is in the second element
       const curveOID = spki.subs[0].subs[1]?.toOID();
@@ -134,7 +140,41 @@ export class X509Certificate {
 
   get signatureAlgorithm(): string {
     const oid: string = this.signatureAlgorithmObj.subs[0].toOID();
-    return ECDSA_SIGNATURE_ALGOS[oid];
+    return ECDSA_SIGNATURE_ALGOS[oid] || RSA_SIGNATURE_ALGOS[oid] || this.parseRsaPssHashAlgorithm();
+  }
+
+  get signatureAlgorithmOid(): string {
+    return this.signatureAlgorithmObj.subs[0].toOID();
+  }
+
+  /**
+   * Parse hash algorithm from RSA-PSS signature algorithm parameters.
+   * RSA-PSS parameters are: SEQUENCE { hashAlgorithm, maskGenAlgorithm, saltLength, trailerField }
+   */
+  private parseRsaPssHashAlgorithm(): string {
+    const sigAlgOid = this.signatureAlgorithmObj.subs[0].toOID();
+    if (sigAlgOid !== OID_RSASSA_PSS) {
+      return "";
+    }
+
+    // RSA-PSS has parameters in the second element of the signature algorithm sequence
+    const params = this.signatureAlgorithmObj.subs[1];
+    if (!params || params.subs.length === 0) {
+      return DEFAULT_HASH_ALGORITHM;
+    }
+
+    // First element is hashAlgorithm [0] EXPLICIT
+    const hashAlgWrapper = params.subs[0];
+    if (hashAlgWrapper && hashAlgWrapper.subs.length > 0) {
+      // The wrapper contains a SEQUENCE with the hash algorithm OID
+      const hashAlgSeq = hashAlgWrapper.subs[0];
+      if (hashAlgSeq && hashAlgSeq.subs.length > 0) {
+        const hashOid = hashAlgSeq.subs[0].toOID();
+        return SHA2_HASH_ALGOS[hashOid] || DEFAULT_HASH_ALGORITHM;
+      }
+    }
+
+    return DEFAULT_HASH_ALGORITHM;
   }
 
   get signatureValue(): Uint8Array {
@@ -214,15 +254,19 @@ export class X509Certificate {
 
   public async verify(issuerCertificate?: X509Certificate): Promise<boolean> {
     // Extract the hash algorithm from this certificate's signature algorithm
-    // (not the issuer's own signature algorithm)
-    const sigAlgOID = this.signatureAlgorithmObj.subs[0].toOID();
-    const hashAlg = RSA_SIGNATURE_ALGOS[sigAlgOID] || ECDSA_SIGNATURE_ALGOS[sigAlgOID];
+    const sigAlgOID = this.signatureAlgorithmOid;
+    const isRsaPss = sigAlgOID === OID_RSASSA_PSS;
+
+    // Get hash algorithm - for RSA-PSS, parse from parameters; otherwise lookup in tables
+    const hashAlg = isRsaPss
+      ? this.parseRsaPssHashAlgorithm()
+      : (RSA_SIGNATURE_ALGOS[sigAlgOID] || ECDSA_SIGNATURE_ALGOS[sigAlgOID]);
 
     // Use the issuer's public key if provided, otherwise use the subject's (for self-signed certs)
-    // Import with the correct hash algorithm for this certificate's signature
+    // Import with the correct hash algorithm and key type for this certificate's signature
     const publicKeyObj = issuerCertificate
-      ? await issuerCertificate.getPublicKeyObj(hashAlg)
-      : await this.getPublicKeyObj(hashAlg);
+      ? await issuerCertificate.getPublicKeyObj(hashAlg, isRsaPss)
+      : await this.getPublicKeyObj(hashAlg, isRsaPss);
 
     return await verifySignature(
       publicKeyObj,

package/src/x509/sct.ts

@@ -112,7 +112,11 @@ export class SignedCertificateTimestamp {
     const stream = new ByteStream(buf);
 
     // Version - enum { v1(0), (255) }
+    // RFC 6962 specifies only v1(0) is valid (for now)
     const version = stream.getUint8();
+    if (version !== 0) {
+      throw new Error(`Unsupported SCT version: ${version} (expected 0 for v1)`);
+    }
 
     // Log ID  - struct { opaque key_id[32]; }
     const logID = stream.getBlock(32);