@simplewebauthn/server 14.0.0 → 14.0.2

package/esm/helpers/validateCertificatePath.js

@@ -1,5 +1,7 @@
+import 'reflect-metadata';
 import { X509Certificate, X509ChainBuilder } from '@peculiar/x509';
 import { isCertRevoked } from './isCertRevoked.js';
+import { SimpleWebAuthnError } from '../errors/index.js';
 /**
  * Traverse an array of PEM certificates and ensure they form a proper chain
  * @param x5cCertsPEM Typically the result of `x5c.map(convertASN1toPEM)`
@@ -10,48 +12,25 @@ export async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = [])
         // We have no trust anchors to chain back to, so skip path validation
         return true;
     }
-    // Prepare to work with x5c certs
-    const x5cCertsParsed = x5cCertsPEM.map((certPEM) => new X509Certificate(certPEM));
-    // Check for any expired or temporally invalid certs in x5c
-    for (let i = 0; i < x5cCertsParsed.length; i++) {
-        const cert = x5cCertsParsed[i];
-        const certPEM = x5cCertsPEM[i];
-        try {
-            await assertCertNotRevoked(cert);
-        }
-        catch (_err) {
-            throw new Error(`Found revoked certificate in x5c:\n${certPEM}`);
-        }
-        try {
-            assertCertIsWithinValidTimeWindow(cert.notBefore, cert.notAfter);
-        }
-        catch (_err) {
-            throw new Error(`Found certificate out of validity period in x5c:\n${certPEM}`);
-        }
-    }
     // Prepare to work with trust anchor certs
     const trustAnchorsParsed = trustAnchorsPEM.map((certPEM) => {
         try {
             return new X509Certificate(certPEM);
         }
         catch (err) {
-            const _err = err;
-            throw new Error(`Could not parse trust anchor certificate:\n${certPEM}`, { cause: _err });
+            throw new SimpleWebAuthnError({
+                message: `Could not parse trust anchor certificate:\n${certPEM}`,
+                code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+                cause: err,
+            });
         }
     });
-    // Filter out any expired or temporally invalid trust anchors certs
+    // Filter out any temporally invalid trust anchors certs
     const validTrustAnchors = [];
     for (let i = 0; i < trustAnchorsParsed.length; i++) {
         const cert = trustAnchorsParsed[i];
         try {
-            await assertCertNotRevoked(cert);
-        }
-        catch (_err) {
-            // Continue processing the other certs
-            continue;
-        }
-        try {
-            assertCertIsWithinValidTimeWindow(cert.notBefore, cert.notAfter);
+            assertCertIsWithinValidTimeWindow(cert);
         }
         catch (_err) {
             // Continue processing the other certs
@@ -60,22 +39,31 @@ export async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = [])
         validTrustAnchors.push(cert);
     }
     if (validTrustAnchors.length === 0) {
-        throw new Error('No specified trust anchor was valid for verifying x5c');
+        throw new SimpleWebAuthnError({
+            message: 'No specified trust anchor was valid for verifying x5c',
+            code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+        });
+    }
+    // Prepare to work with x5c certs
+    const x5cCertsParsed = x5cCertsPEM.map((certPEM) => new X509Certificate(certPEM));
+    // Break apart x5c into leaf + intermediates
+    const x5cLeafCert = x5cCertsParsed[0];
+    let x5cIntermediates = [];
+    if (x5cCertsParsed.length > 1) {
+        x5cIntermediates = x5cCertsParsed.slice(1);
     }
     // Try to verify x5c with each valid trust anchor
     let invalidCertificateChain = true;
+    let validatedChain = undefined;
     for (const anchor of validTrustAnchors) {
         try {
             const x5cWithTrustAnchor = x5cCertsParsed.concat([anchor]);
             const numUniqueCerts = new Set(x5cWithTrustAnchor.map((cert) => cert.toString('pem'))).size;
             if (numUniqueCerts !== x5cWithTrustAnchor.length) {
-                throw new Error('Invalid certificate path: found duplicate certificates');
-            }
-            // Break apart x5c to try and build a valid cert chain
-            const x5cLeafCert = x5cCertsParsed[0];
-            let x5cIntermediates = [];
-            if (x5cCertsParsed.length > 1) {
-                x5cIntermediates = x5cCertsParsed.slice(1);
+                throw new SimpleWebAuthnError({
+                    message: 'Invalid certificate path: found duplicate certificates',
+                    code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+                });
             }
             // Order of certs doesn't matter here but for readability
             const chainBuilder = new X509ChainBuilder({ certificates: [...x5cIntermediates, anchor] });
@@ -109,27 +97,87 @@ export async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = [])
                 // Invalid cert chain, try the next trust anchor
                 continue;
             }
-            // If we successfully validated a path then there's no need to continue. Reset any existing
-            // errors that were thrown by earlier trust anchors
+            if (certBeforeLastSignedByAnchor) {
+                /**
+                 * Swap out the last cert in the chain with the anchor that we've already verified
+                 * chains to the second-to-last certificate. This makes it easier to verify the chain
+                 * as a standard certificate chain.
+                 */
+                chain[chain.length - 1] = anchor;
+            }
+            // We successfully validated a chain so there's no need to continue
             invalidCertificateChain = false;
+            validatedChain = chain;
             break;
         }
         catch (err) {
-            throw new Error('Unexpected error while validating certificate path', { cause: err });
+            throw new SimpleWebAuthnError({
+                message: 'Unexpected error while validating certificate path',
+                code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+                cause: err,
+            });
         }
     }
+    if (validatedChain) {
+        // Check for any temporally invalid or expired certs in the chain
+        for (let i = 0; i < validatedChain.length; i++) {
+            const cert = validatedChain[i];
+            try {
+                assertCertIsWithinValidTimeWindow(cert);
+            }
+            catch (_err) {
+                throw new SimpleWebAuthnError({
+                    message: `Found certificate out of validity period:\n${cert.toString()}`,
+                    code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+                });
+            }
+            /**
+             * Checking revocation is very expensive so do it only at the end when we're certain a cert
+             * is otherwise valid
+             */
+            let issuerCert = undefined;
+            if (i < validatedChain.length - 1) {
+                // Issuer cert is simply the next cert in the chain
+                issuerCert = validatedChain[i + 1];
+            }
+            else {
+                // `cert` is the anchor. Only try to verify its revocation status if it's a root certificate
+                if (await cert.isSelfSigned()) {
+                    issuerCert = cert;
+                }
+            }
+            try {
+                await assertCertNotRevoked(cert, issuerCert);
+            }
+            catch (err) {
+                throw new SimpleWebAuthnError({
+                    message: `The following certificate failed revocation status check\n${cert.toString()}`,
+                    code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+                    cause: err,
+                });
+            }
+        }
+    }
+    else {
+        invalidCertificateChain = true;
+    }
     // We tried multiple trust anchors and none of them worked
     if (invalidCertificateChain) {
-        throw new InvalidCertificatePath();
+        throw new SimpleWebAuthnError({
+            message: 'x5c could not be chained to any specified trust anchor',
+            code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+        });
     }
     return true;
 }
 /**
  * Check if the certificate is revoked or not. If it is, raise an error
+ *
+ * @throws Error - Wrap this in a SimpleWebAuthnError so RPs can identify issues here
  */
-async function assertCertNotRevoked(certificate) {
+async function assertCertNotRevoked(certificate, issuerCert) {
     // Check for certificate revocation
-    const subjectCertRevoked = await isCertRevoked(certificate);
+    const subjectCertRevoked = await isCertRevoked(certificate, issuerCert);
     if (subjectCertRevoked) {
         throw new Error('Found revoked certificate in certificate path');
     }
@@ -137,16 +185,10 @@ async function assertCertNotRevoked(certificate) {
 /**
  * Require the cert to be within its notBefore and notAfter time window
  */
-function assertCertIsWithinValidTimeWindow(certNotBefore, certNotAfter) {
+function assertCertIsWithinValidTimeWindow(certificate) {
+    const { notBefore: certNotBefore, notAfter: certNotAfter } = certificate;
     const now = new Date(Date.now());
     if (certNotBefore > now || certNotAfter < now) {
         throw new Error('Certificate is not yet valid or expired');
     }
 }
-class InvalidCertificatePath extends Error {
-    constructor() {
-        const message = 'x5c could not be chained to any specified trust anchor';
-        super(message);
-        this.name = 'InvalidX5CChain';
-    }
-}

package/esm/index.d.ts

@@ -6,4 +6,5 @@ export * from './services/metadataService.js';
 export * from './services/settingsService.js';
 export * from './metadata/mdsTypes.js';
 export * from './types/index.js';
+export * from './errors/index.js';
 //# sourceMappingURL=index.d.ts.map

package/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,+CAA+C,CAAC;AAC9D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,+CAA+C,CAAC;AAC9D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC"}

package/esm/index.js

@@ -6,3 +6,4 @@ export * from './services/metadataService.js';
 export * from './services/settingsService.js';
 export * from './metadata/mdsTypes.js';
 export * from './types/index.js';
+export * from './errors/index.js';

package/esm/metadata/verifyAttestationWithMetadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyAttestationWithMetadata.d.ts","sourceRoot":"","sources":["../../src/metadata/verifyAttestationWithMetadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAIhE,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,OAAO,EAEZ,OAAO,EAER,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;GAGG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,SAAS,EACT,mBAAmB,EACnB,GAAG,EACH,uBAAuB,GACxB,EAAE;IACD,SAAS,EAAE,iBAAiB,CAAC;IAC7B,mBAAmB,EAAE,WAAW,CAAC;IACjC,GAAG,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAAC;IACvC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC,GAAG,OAAO,CAAC,OAAO,CAAC,CAoJnB;AAED,KAAK,QAAQ,GAAG;IACd,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE;KAAG,GAAG,IAAI,OAAO,GAAG,QAAQ;CAe9D,CAAC"}
+{"version":3,"file":"verifyAttestationWithMetadata.d.ts","sourceRoot":"","sources":["../../src/metadata/verifyAttestationWithMetadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAIhE,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,OAAO,EAEZ,OAAO,EAER,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;GAGG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,SAAS,EACT,mBAAmB,EACnB,GAAG,EACH,uBAAuB,GACxB,EAAE;IACD,SAAS,EAAE,iBAAiB,CAAC;IAC7B,mBAAmB,EAAE,WAAW,CAAC;IACjC,GAAG,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAAC;IACvC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC,GAAG,OAAO,CAAC,OAAO,CAAC,CA6InB;AAED,KAAK,QAAQ,GAAG;IACd,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE;KAAG,GAAG,IAAI,OAAO,GAAG,QAAQ;CAe9D,CAAC"}

package/esm/metadata/verifyAttestationWithMetadata.js

@@ -106,13 +106,7 @@ export async function verifyAttestationWithMetadata({ statement, credentialPubli
         authenticatorIsSelfReferencing = true;
     }
     if (!authenticatorIsSelfReferencing) {
-        try {
-            await validateCertificatePath(authenticatorCerts, statementRootCerts);
-        }
-        catch (err) {
-            const _err = err;
-            throw new Error(`Could not validate certificate path with any metadata root certificates: ${_err.message}`);
-        }
+        await validateCertificatePath(authenticatorCerts, statementRootCerts);
     }
     return true;
 }

package/esm/registration/verifications/verifyAttestationPacked.js

@@ -91,7 +91,7 @@ export async function verifyAttestationPacked(options) {
             }
             catch (err) {
                 const _err = err;
-                throw new Error(`${_err.message} (Packed|Full)`);
+                throw new Error(`${_err.message} (Packed|Full)`, { cause: _err });
             }
         }
         verified = await verifySignature({

package/esm/registration/verifyRegistrationResponse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyRegistrationResponse.d.ts","sourceRoot":"","sources":["../../src/registration/verifyRegistrationResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAE1B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAoBhH;;GAEG;AACH,MAAM,MAAM,8BAA8B,GAAG,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9F;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE;IACP,QAAQ,EAAE,wBAAwB,CAAC;IACnC,iBAAiB,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,mCAAmC,CAAC,EAAE,OAAO,CAAC;CAC/C,GACA,OAAO,CAAC,4BAA4B,CAAC,CAqPvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,KAAK,CAAC;IAChB,gBAAgB,CAAC,EAAE,KAAK,CAAC;CAC1B,GAAG;IACF,QAAQ,EAAE,IAAI,CAAC;IACf,gBAAgB,EAAE;QAChB,GAAG,EAAE,iBAAiB,CAAC;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,kBAAkB,CAAC;QAC/B,cAAc,EAAE,YAAY,CAAC;QAC7B,iBAAiB,EAAE,WAAW,CAAC;QAC/B,YAAY,EAAE,OAAO,CAAC;QACtB,oBAAoB,EAAE,oBAAoB,CAAC;QAC3C,kBAAkB,EAAE,OAAO,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,6BAA6B,CAAC,EAAE,4CAA4C,CAAC;KAC9E,CAAC;CACH,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,QAAQ,EAAE,WAAW,CAAC;IACtB,cAAc,EAAE,WAAW,CAAC;IAC5B,YAAY,EAAE,WAAW,CAAC;IAC1B,mBAAmB,EAAE,WAAW,CAAC;IACjC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,WAAW,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,mCAAmC,CAAC,EAAE,OAAO,CAAC;CAC/C,CAAC"}
+{"version":3,"file":"verifyRegistrationResponse.d.ts","sourceRoot":"","sources":["../../src/registration/verifyRegistrationResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAE1B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAoBhH;;GAEG;AACH,MAAM,MAAM,8BAA8B,GAAG,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9F;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE;IACP,QAAQ,EAAE,wBAAwB,CAAC;IACnC,iBAAiB,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,mCAAmC,CAAC,EAAE,OAAO,CAAC;CAC/C,GACA,OAAO,CAAC,4BAA4B,CAAC,CA8PvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,KAAK,CAAC;IAChB,gBAAgB,CAAC,EAAE,KAAK,CAAC;CAC1B,GAAG;IACF,QAAQ,EAAE,IAAI,CAAC;IACf,gBAAgB,EAAE;QAChB,GAAG,EAAE,iBAAiB,CAAC;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,kBAAkB,CAAC;QAC/B,cAAc,EAAE,YAAY,CAAC;QAC7B,iBAAiB,EAAE,WAAW,CAAC;QAC/B,YAAY,EAAE,OAAO,CAAC;QACtB,oBAAoB,EAAE,oBAAoB,CAAC;QAC3C,kBAAkB,EAAE,OAAO,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,6BAA6B,CAAC,EAAE,4CAA4C,CAAC;KAC9E,CAAC;CACH,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,QAAQ,EAAE,WAAW,CAAC;IACtB,cAAc,EAAE,WAAW,CAAC;IAC5B,YAAY,EAAE,WAAW,CAAC;IAC1B,mBAAmB,EAAE,WAAW,CAAC;IACjC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,WAAW,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,mCAAmC,CAAC,EAAE,OAAO,CAAC;CAC/C,CAAC"}

package/esm/registration/verifyRegistrationResponse.js

@@ -1,9 +1,10 @@
+import { PQCNotSupportedError } from '../errors/index.js';
 import { decodeAttestationObject, } from '../helpers/decodeAttestationObject.js';
 import { decodeClientDataJSON } from '../helpers/decodeClientDataJSON.js';
 import { parseAuthenticatorData } from '../helpers/parseAuthenticatorData.js';
 import { toHash } from '../helpers/toHash.js';
 import { decodeCredentialPublicKey } from '../helpers/decodeCredentialPublicKey.js';
-import { COSEKEYS } from '../helpers/cose.js';
+import { COSEKEYS, isPQCCOSEAlg } from '../helpers/cose.js';
 import { convertAAGUIDToString } from '../helpers/convertAAGUIDToString.js';
 import { parseBackupFlags } from '../helpers/parseBackupFlags.js';
 import { matchExpectedRPID } from '../helpers/matchExpectedRPID.js';
@@ -128,19 +129,29 @@ export async function verifyRegistrationResponse(options) {
         throw new Error('No AAGUID was present during registration');
     }
     const decodedPublicKey = decodeCredentialPublicKey(credentialPublicKey);
-    const alg = decodedPublicKey.get(COSEKEYS.alg);
-    if (typeof alg !== 'number') {
+    const pubKeyAlg = decodedPublicKey.get(COSEKEYS.alg);
+    if (typeof pubKeyAlg !== 'number') {
         throw new Error('Credential public key was missing numeric alg');
     }
     // Make sure the key algorithm is one we specified within the registration options
-    if (!supportedAlgorithmIDs.includes(alg)) {
+    if (!supportedAlgorithmIDs.includes(pubKeyAlg)) {
         const supported = supportedAlgorithmIDs.join(', ');
-        throw new Error(`Unexpected public key alg "${alg}", expected one of "${supported}"`);
+        throw new Error(`Unexpected public key alg "${pubKeyAlg}", expected one of "${supported}"`);
+    }
+    /**
+     * If the runtime doesn't support PQC passkeys then terminate here at the first sign of a PQC
+     * algorithm so that downstream issues that arise due to lack of PQC support won't get masked as
+     * unexpected behavior.
+     *
+     * I'm choosing to raise here even if attestation is "none" because it feels weird to allow an RP
+     * to parse a registration response w/o attestation only to encounter failure when trying to auth
+     * with the PQC passkey and the runtime doesn't support PQC.
+     */
+    if (isPQCCOSEAlg(pubKeyAlg) && !SettingsService.runtimeSupportsPQC()) {
+        throw new PQCNotSupportedError(pubKeyAlg);
     }
     const clientDataHash = await toHash(isoBase64URL.toBuffer(attestationResponse.clientDataJSON));
-    const rootCertificates = SettingsService.getRootCertificates({
-        identifier: fmt,
-    });
+    const rootCertificates = SettingsService.getRootCertificates({ identifier: fmt });
     // Prepare arguments to pass to the relevant verification method
     const verifierOpts = {
         aaguid,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simplewebauthn/server",
-  "version": "14.0.0",
+  "version": "14.0.2",
   "description": "SimpleWebAuthn for Servers",
   "keywords": [
     "typescript",
@@ -56,7 +56,9 @@
     "@peculiar/asn1-rsa": "^2.6.1",
     "@peculiar/asn1-schema": "^2.6.0",
     "@peculiar/asn1-x509": "^2.6.1",
-    "@peculiar/x509": "^1.14.3"
+    "@peculiar/asn1-x509-post-quantum": "^2.9.4",
+    "@peculiar/x509": "^2.1.0",
+    "reflect-metadata": "^0.2.2"
   },
   "devDependencies": {
     "@types/node": "^20.9.0"

package/script/authentication/verifyAuthenticationResponse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyAuthenticationResponse.d.ts","sourceRoot":"","sources":["../../src/authentication/verifyAuthenticationResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,eAAe,EACf,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAM3B,OAAO,KAAK,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAIhH;;GAEG;AACH,MAAM,MAAM,gCAAgC,GAAG,UAAU,CAAC,OAAO,4BAA4B,CAAC,CAAC,CAAC,CAAC,CAAC;AAElG;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE;IACP,QAAQ,EAAE,0BAA0B,CAAC;IACrC,iBAAiB,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAChC,UAAU,EAAE,kBAAkB,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,kBAAkB,CAAC,EAAE;QACnB,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;KAChD,CAAC;CACH,GACA,OAAO,CAAC,8BAA8B,CAAC,CAgQzC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE;QAClB,YAAY,EAAE,eAAe,CAAC;QAC9B,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,OAAO,CAAC;QACtB,oBAAoB,EAAE,oBAAoB,CAAC;QAC3C,kBAAkB,EAAE,OAAO,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,6BAA6B,CAAC,EAAE,4CAA4C,CAAC;KAC9E,CAAC;CACH,CAAC"}
+{"version":3,"file":"verifyAuthenticationResponse.d.ts","sourceRoot":"","sources":["../../src/authentication/verifyAuthenticationResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,eAAe,EACf,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAM3B,OAAO,KAAK,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAQhH;;GAEG;AACH,MAAM,MAAM,gCAAgC,GAAG,UAAU,CAAC,OAAO,4BAA4B,CAAC,CAAC,CAAC,CAAC,CAAC;AAElG;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE;IACP,QAAQ,EAAE,0BAA0B,CAAC;IACrC,iBAAiB,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAChC,UAAU,EAAE,kBAAkB,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,kBAAkB,CAAC,EAAE;QACnB,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;KAChD,CAAC;CACH,GACA,OAAO,CAAC,8BAA8B,CAAC,CA6QzC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE;QAClB,YAAY,EAAE,eAAe,CAAC;QAC9B,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,OAAO,CAAC;QACtB,oBAAoB,EAAE,oBAAoB,CAAC;QAC3C,kBAAkB,EAAE,OAAO,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,6BAA6B,CAAC,EAAE,4CAA4C,CAAC;KAC9E,CAAC;CACH,CAAC"}

package/script/authentication/verifyAuthenticationResponse.js

@@ -8,6 +8,10 @@ const parseAuthenticatorData_js_1 = require("../helpers/parseAuthenticatorData.j
 const parseBackupFlags_js_1 = require("../helpers/parseBackupFlags.js");
 const matchExpectedRPID_js_1 = require("../helpers/matchExpectedRPID.js");
 const index_js_1 = require("../helpers/iso/index.js");
+const decodeCredentialPublicKey_js_1 = require("../helpers/decodeCredentialPublicKey.js");
+const cose_js_1 = require("../helpers/cose.js");
+const settingsService_js_1 = require("../services/settingsService.js");
+const index_js_2 = require("../errors/index.js");
 /**
  * Verify that the user has legitimately completed the authentication process
  *
@@ -190,6 +194,14 @@ async function verifyAuthenticationResponse(options) {
         // on the device without going through this site
         throw new Error(`Response counter value ${counter} was lower than expected ${credential.counter}`);
     }
+    const decodedPublicKey = (0, decodeCredentialPublicKey_js_1.decodeCredentialPublicKey)(credential.publicKey);
+    const pubKeyAlg = decodedPublicKey.get(cose_js_1.COSEKEYS.alg);
+    if (typeof pubKeyAlg !== 'number') {
+        throw new Error('Credential public key was missing numeric alg');
+    }
+    if ((0, cose_js_1.isPQCCOSEAlg)(pubKeyAlg) && !settingsService_js_1.SettingsService.runtimeSupportsPQC()) {
+        throw new index_js_2.PQCNotSupportedError(pubKeyAlg);
+    }
     const { credentialDeviceType, credentialBackedUp } = (0, parseBackupFlags_js_1.parseBackupFlags)(flags);
     const toReturn = {
         verified: await (0, verifySignature_js_1.verifySignature)({

package/script/errors/index.d.ts

@@ -0,0 +1,17 @@
+import type { COSEALG } from '../helpers/cose.js';
+/**
+ * Base error class that helps disambiguate SimpleWebAuthn library errors from other library errors
+ */
+export declare class SimpleWebAuthnError extends Error {
+    code: SimpleWebAuthnErrorCode;
+    constructor({ message, code, cause }: {
+        message: string;
+        code: SimpleWebAuthnErrorCode;
+        cause?: Error;
+    });
+}
+export declare class PQCNotSupportedError extends SimpleWebAuthnError {
+    constructor(alg: COSEALG);
+}
+export type SimpleWebAuthnErrorCode = 'RUNTIME_NO_PQC_SUPPORT' | 'CERTIFICATE_PATH_VERIFICATION_FAILED';
+//# sourceMappingURL=index.d.ts.map

package/script/errors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAGlD;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,IAAI,EAAE,uBAAuB,CAAC;gBAElB,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACpC,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,uBAAuB,CAAC;QAC9B,KAAK,CAAC,EAAE,KAAK,CAAC;KACf;CAKF;AAED,qBAAa,oBAAqB,SAAQ,mBAAmB;gBAC/C,GAAG,EAAE,OAAO;CAKzB;AAED,MAAM,MAAM,uBAAuB,GAC/B,wBAAwB,GACxB,sCAAsC,CAAC"}

package/script/errors/index.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PQCNotSupportedError = exports.SimpleWebAuthnError = void 0;
+const mapCoseAlgToWebCryptoKeyAlgName_js_1 = require("../helpers/iso/isoCrypto/mapCoseAlgToWebCryptoKeyAlgName.js");
+/**
+ * Base error class that helps disambiguate SimpleWebAuthn library errors from other library errors
+ */
+class SimpleWebAuthnError extends Error {
+    constructor({ message, code, cause }) {
+        super(message, { cause });
+        Object.defineProperty(this, "code", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.name = 'SimpleWebAuthnError';
+        this.code = code;
+    }
+}
+exports.SimpleWebAuthnError = SimpleWebAuthnError;
+class PQCNotSupportedError extends SimpleWebAuthnError {
+    constructor(alg) {
+        const webCryptoAlg = (0, mapCoseAlgToWebCryptoKeyAlgName_js_1.mapCoseAlgToWebCryptoKeyAlgName)(alg);
+        const message = `This runtime's WebCrypto.subtle does not support use of ${webCryptoAlg}`;
+        super({ message, code: 'RUNTIME_NO_PQC_SUPPORT' });
+    }
+}
+exports.PQCNotSupportedError = PQCNotSupportedError;

package/script/helpers/convertX509PublicKeyToCOSE.d.ts

@@ -1,4 +1,4 @@
-import { COSEPublicKey } from './cose.js';
+import { type COSEPublicKey } from './cose.js';
 import type { Uint8Array_ } from '../types/index.js';
 export declare function convertX509PublicKeyToCOSE(x509Certificate: Uint8Array_): COSEPublicKey;
 //# sourceMappingURL=convertX509PublicKeyToCOSE.d.ts.map

package/script/helpers/convertX509PublicKeyToCOSE.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"convertX509PublicKeyToCOSE.d.ts","sourceRoot":"","sources":["../../src/helpers/convertX509PublicKeyToCOSE.ts"],"names":[],"mappings":"AAKA,OAAO,EAIL,aAAa,EAGd,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,wBAAgB,0BAA0B,CACxC,eAAe,EAAE,WAAW,GAC3B,aAAa,CA+Ff"}
+{"version":3,"file":"convertX509PublicKeyToCOSE.d.ts","sourceRoot":"","sources":["../../src/helpers/convertX509PublicKeyToCOSE.ts"],"names":[],"mappings":"AAMA,OAAO,EAKL,KAAK,aAAa,EAInB,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,wBAAgB,0BAA0B,CACxC,eAAe,EAAE,WAAW,GAC3B,aAAa,CAsGf"}

package/script/helpers/convertX509PublicKeyToCOSE.js

@@ -4,6 +4,7 @@ exports.convertX509PublicKeyToCOSE = convertX509PublicKeyToCOSE;
 const asn1_schema_1 = require("@peculiar/asn1-schema");
 const asn1_x509_1 = require("@peculiar/asn1-x509");
 const asn1_ecc_1 = require("@peculiar/asn1-ecc");
+const asn1_x509_post_quantum_1 = require("@peculiar/asn1-x509-post-quantum");
 const asn1_rsa_1 = require("@peculiar/asn1-rsa");
 const cose_js_1 = require("./cose.js");
 const mapX509SignatureAlgToCOSEAlg_js_1 = require("./mapX509SignatureAlgToCOSEAlg.js");
@@ -14,8 +15,7 @@ function convertX509PublicKeyToCOSE(x509Certificate) {
      */
     const x509 = asn1_schema_1.AsnParser.parse(x509Certificate, asn1_x509_1.Certificate);
     const { tbsCertificate } = x509;
-    const { subjectPublicKeyInfo, signature: _tbsSignature } = tbsCertificate;
-    const signatureAlgorithm = _tbsSignature.algorithm;
+    const { subjectPublicKeyInfo } = tbsCertificate;
     const publicKeyAlgorithmID = subjectPublicKeyInfo.algorithm.algorithm;
     if (publicKeyAlgorithmID === asn1_ecc_1.id_ecPublicKey) {
         /**
@@ -25,12 +25,15 @@ function convertX509PublicKeyToCOSE(x509Certificate) {
             throw new Error('Certificate public key was missing parameters (EC2)');
         }
         const ecParameters = asn1_schema_1.AsnParser.parse(new Uint8Array(subjectPublicKeyInfo.algorithm.parameters), asn1_ecc_1.ECParameters);
-        let crv = -999;
+        let alg;
+        let crv;
         const { namedCurve } = ecParameters;
         if (namedCurve === asn1_ecc_1.id_secp256r1) {
+            alg = cose_js_1.COSEALG.ES256;
             crv = cose_js_1.COSECRV.P256;
         }
         else if (namedCurve === asn1_ecc_1.id_secp384r1) {
+            alg = cose_js_1.COSEALG.ES384;
             crv = cose_js_1.COSECRV.P384;
         }
         else {
@@ -51,7 +54,7 @@ function convertX509PublicKeyToCOSE(x509Certificate) {
         }
         const coseEC2PubKey = new Map();
         coseEC2PubKey.set(cose_js_1.COSEKEYS.kty, cose_js_1.COSEKTY.EC2);
-        coseEC2PubKey.set(cose_js_1.COSEKEYS.alg, (0, mapX509SignatureAlgToCOSEAlg_js_1.mapX509SignatureAlgToCOSEAlg)(signatureAlgorithm));
+        coseEC2PubKey.set(cose_js_1.COSEKEYS.alg, alg);
         coseEC2PubKey.set(cose_js_1.COSEKEYS.crv, crv);
         coseEC2PubKey.set(cose_js_1.COSEKEYS.x, x);
         coseEC2PubKey.set(cose_js_1.COSEKEYS.y, y);
@@ -64,11 +67,24 @@ function convertX509PublicKeyToCOSE(x509Certificate) {
         const rsaPublicKey = asn1_schema_1.AsnParser.parse(subjectPublicKeyInfo.subjectPublicKey, asn1_rsa_1.RSAPublicKey);
         const coseRSAPubKey = new Map();
         coseRSAPubKey.set(cose_js_1.COSEKEYS.kty, cose_js_1.COSEKTY.RSA);
-        coseRSAPubKey.set(cose_js_1.COSEKEYS.alg, (0, mapX509SignatureAlgToCOSEAlg_js_1.mapX509SignatureAlgToCOSEAlg)(signatureAlgorithm));
+        /**
+         * The algorithm ID is too ambiguous to know what this alg should really be. But practically
+         * speaking `shaHashOverride` is always specified when verifying signatures with RSA public keys
+         * which ultimately overrides this sensible default. Using RS256 also gets the correct WebCrypto
+         * alg name later on in verifyRSA.ts
+         */
+        coseRSAPubKey.set(cose_js_1.COSEKEYS.alg, cose_js_1.COSEALG.RS256);
         coseRSAPubKey.set(cose_js_1.COSEKEYS.n, new Uint8Array(rsaPublicKey.modulus));
         coseRSAPubKey.set(cose_js_1.COSEKEYS.e, new Uint8Array(rsaPublicKey.publicExponent));
         cosePublicKey = coseRSAPubKey;
     }
+    else if ([asn1_x509_post_quantum_1.id_ml_dsa_44, asn1_x509_post_quantum_1.id_ml_dsa_65, asn1_x509_post_quantum_1.id_ml_dsa_87].indexOf(publicKeyAlgorithmID) >= 0) {
+        const coseAKPPubKey = new Map();
+        coseAKPPubKey.set(cose_js_1.COSEKEYS.kty, cose_js_1.COSEKTY.AKP);
+        coseAKPPubKey.set(cose_js_1.COSEKEYS.alg, (0, mapX509SignatureAlgToCOSEAlg_js_1.mapX509SignatureAlgToCOSEAlg)(publicKeyAlgorithmID));
+        coseAKPPubKey.set(cose_js_1.COSEKEYS.pub, new Uint8Array(subjectPublicKeyInfo.subjectPublicKey));
+        cosePublicKey = coseAKPPubKey;
+    }
     else {
         throw new Error(`Certificate public key contained unexpected algorithm ID ${publicKeyAlgorithmID}`);
     }

package/script/helpers/cose.d.ts

@@ -135,4 +135,5 @@ export declare enum COSEALG {
     RS1 = -65535
 }
 export declare function isCOSEAlg(alg: number | undefined): alg is COSEALG;
+export declare function isPQCCOSEAlg(alg: COSEALG): boolean;
 //# sourceMappingURL=cose.d.ts.map

package/script/helpers/cose.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cose.d.ts","sourceRoot":"","sources":["../../src/helpers/cose.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;;;GAUG;AAEH;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAE1B,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,OAAO,GAAG,SAAS,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,OAAO,GAAG,SAAS,CAAC;IAE5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,WAAW,GAAG,SAAS,CAAC;IAEhD,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAClD,CAAC;AAEF;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;;;;GAKG;AACH,oBAAY,QAAQ;IAClB,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,KAAK;IACR,CAAC,KAAK;IACN,CAAC,KAAK;IACN,CAAC,KAAK;IACN,CAAC,KAAK;IACN,GAAG,KAAK;CACT;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,IAAI;CACR;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,IAAI,IAAI;IACR,IAAI,IAAI;IACR,IAAI,IAAI;IACR,OAAO,IAAI;IACX,SAAS,IAAI;CACd;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,KAAK,KAAK;IACV,KAAK,KAAK;IACV,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,MAAM,MAAM;IACZ,SAAS,MAAM;IACf,SAAS,MAAM;IACf,SAAS,MAAM;IACf,KAAK,OAAO;IACZ,KAAK,OAAO;IACZ,KAAK,OAAO;IACZ,GAAG,SAAS;CACb;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE"}
+{"version":3,"file":"cose.d.ts","sourceRoot":"","sources":["../../src/helpers/cose.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;;;GAUG;AAEH;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAE1B,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,OAAO,GAAG,SAAS,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,OAAO,GAAG,SAAS,CAAC;IAE5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,WAAW,GAAG,SAAS,CAAC;IAEhD,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAClD,CAAC;AAEF;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;;;;GAKG;AACH,oBAAY,QAAQ;IAClB,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,KAAK;IACR,CAAC,KAAK;IACN,CAAC,KAAK;IACN,CAAC,KAAK;IACN,CAAC,KAAK;IACN,GAAG,KAAK;CACT;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,IAAI;CACR;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,IAAI,IAAI;IACR,IAAI,IAAI;IACR,IAAI,IAAI;IACR,OAAO,IAAI;IACX,SAAS,IAAI;CACd;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,KAAK,KAAK;IACV,KAAK,KAAK;IACV,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,MAAM,MAAM;IACZ,SAAS,MAAM;IACf,SAAS,MAAM;IACf,SAAS,MAAM;IACf,KAAK,OAAO;IACZ,KAAK,OAAO;IACZ,KAAK,OAAO;IACZ,GAAG,SAAS;CACb;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAElD"}

package/script/helpers/cose.js

@@ -8,6 +8,7 @@ exports.isCOSEPublicKeyAKP = isCOSEPublicKeyAKP;
 exports.isCOSEKty = isCOSEKty;
 exports.isCOSECrv = isCOSECrv;
 exports.isCOSEAlg = isCOSEAlg;
+exports.isPQCCOSEAlg = isPQCCOSEAlg;
 /**
  * A type guard for determining if a COSE public key is an OKP key pair
  */
@@ -110,3 +111,6 @@ var COSEALG;
 function isCOSEAlg(alg) {
     return Object.values(COSEALG).indexOf(alg) >= 0;
 }
+function isPQCCOSEAlg(alg) {
+    return [COSEALG.ML_DSA_44, COSEALG.ML_DSA_65, COSEALG.ML_DSA_87].indexOf(alg) >= 0;
+}

package/script/helpers/isCertRevoked.d.ts

@@ -1,3 +1,4 @@
+import 'reflect-metadata';
 import { type X509Certificate } from '@peculiar/x509';
 /**
  * A method to pull a CRL from a certificate and compare its serial number to the list of revoked
@@ -5,5 +6,5 @@ import { type X509Certificate } from '@peculiar/x509';
  *
  * CRL certificate structure referenced from https://tools.ietf.org/html/rfc5280#page-117
  */
-export declare function isCertRevoked(cert: X509Certificate): Promise<boolean>;
+export declare function isCertRevoked(certificate: X509Certificate, issuer?: X509Certificate): Promise<boolean>;
 //# sourceMappingURL=isCertRevoked.d.ts.map

package/script/helpers/isCertRevoked.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"isCertRevoked.d.ts","sourceRoot":"","sources":["../../src/helpers/isCertRevoked.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,eAAe,EAErB,MAAM,gBAAgB,CAAC;AAexB;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAkG3E"}
+{"version":3,"file":"isCertRevoked.d.ts","sourceRoot":"","sources":["../../src/helpers/isCertRevoked.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAIL,KAAK,eAAe,EAErB,MAAM,gBAAgB,CAAC;AAexB;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,WAAW,EAAE,eAAe,EAC5B,MAAM,CAAC,EAAE,eAAe,GACvB,OAAO,CAAC,OAAO,CAAC,CA0HlB"}