@typedstandards/verify-core 0.2.0 → 0.3.1

package/dist/asn1.d.ts

@@ -0,0 +1,36 @@
+export declare class Asn1Error extends Error {
+}
+export interface DerNode {
+    /** The identifier octet (e.g. 0x30 SEQUENCE, 0x02 INTEGER, 0xa0 [0]). */
+    tag: number;
+    constructed: boolean;
+    /** Offset of the identifier octet. */
+    start: number;
+    /** Offset where content begins (just past the length octets). */
+    contentStart: number;
+    /** Offset one past the last content octet. */
+    contentEnd: number;
+    /** Offset one past the whole TLV (= contentEnd). */
+    end: number;
+}
+/** Parse a single TLV at `pos`, with strict-DER bounds checks. */
+export declare function readNode(buf: Uint8Array, pos: number): DerNode;
+/** Parse every child TLV of a constructed node; require they exactly tile it. */
+export declare function children(buf: Uint8Array, node: DerNode): DerNode[];
+/** The content octets of a node (a view — copy before mutating). */
+export declare function content(buf: Uint8Array, node: DerNode): Uint8Array;
+/** The whole TLV (identifier + length + content) of a node (a view). */
+export declare function rawTlv(buf: Uint8Array, node: DerNode): Uint8Array;
+/** Assert a node's tag, returning it (for fluent parsing). */
+export declare function expectTag(node: DerNode, tag: number, label?: string): DerNode;
+/** Decode an OBJECT IDENTIFIER (tag 0x06) to its dotted-decimal string. */
+export declare function oidToString(buf: Uint8Array, node: DerNode): string;
+/**
+ * Decode a UTCTime (0x17) or GeneralizedTime (0x18) to epoch milliseconds. Only
+ * the `Z` (UTC) forms RFC 5280 / RFC 3161 mandate are accepted; local-time and
+ * offset forms are rejected. UTCTime two-digit years use the RFC 5280 1950–2049
+ * window.
+ */
+export declare function readTime(buf: Uint8Array, node: DerNode): number;
+/** First child whose tag matches, or undefined. */
+export declare function findChild(buf: Uint8Array, node: DerNode, tag: number): DerNode | undefined;

package/dist/asn1.js

@@ -0,0 +1,154 @@
+// Minimal, bounds-checked DER reader (civic-ai-tools-website#119 P2) — browser-safe.
+//
+// Just enough ASN.1/DER to parse RFC 3161 timestamp tokens (PKCS#7/CMS + TSTInfo)
+// and, later, X.509 certs — NOT a general ASN.1 library. A hand-rolled parser over
+// attacker-supplied bytes is itself an attack surface, so every read is bounds- and
+// shape-checked and the encoding is STRICT DER:
+//   - definite lengths only (indefinite `0x80` is rejected — it has no place in DER);
+//   - minimal length encoding (no `0x81 0x05`, no leading-zero padding);
+//   - lengths may not exceed the buffer; children must exactly tile their parent
+//     (no trailing garbage);
+//   - high-tag-number form is rejected (none of our structures use it).
+// Malformed input throws `Asn1Error` rather than reading out of bounds or looping.
+// Pure byte logic — no `node:*`, no `Buffer` (browser-safety guard covers this).
+export class Asn1Error extends Error {
+}
+// DER tag classes / numbers we accept in the length/tag header. Context tags used
+// by CMS/X.509 ([0], [1], …) are low-tag-number (0xa0, 0xa1, 0x80, …) so the
+// high-tag-number guard never rejects a well-formed token.
+const HIGH_TAG_NUMBER_MASK = 0x1f;
+const CONSTRUCTED_BIT = 0x20;
+const LONG_FORM_BIT = 0x80;
+/** Parse a single TLV at `pos`, with strict-DER bounds checks. */
+export function readNode(buf, pos) {
+    if (pos < 0 || pos + 1 > buf.length)
+        throw new Asn1Error('readNode past end of buffer');
+    const tag = buf[pos];
+    if ((tag & HIGH_TAG_NUMBER_MASK) === HIGH_TAG_NUMBER_MASK) {
+        throw new Asn1Error('high-tag-number form unsupported');
+    }
+    let i = pos + 1;
+    if (i >= buf.length)
+        throw new Asn1Error('truncated: missing length octet');
+    let len = buf[i++];
+    if (len & LONG_FORM_BIT) {
+        const n = len & 0x7f;
+        if (n === 0)
+            throw new Asn1Error('indefinite length not allowed in DER');
+        if (n > 4)
+            throw new Asn1Error('length octet count too large');
+        if (i + n > buf.length)
+            throw new Asn1Error('truncated long-form length');
+        if (buf[i] === 0x00)
+            throw new Asn1Error('non-minimal length (leading zero)');
+        len = 0;
+        for (let k = 0; k < n; k++)
+            len = len * 256 + buf[i++]; // *256 avoids 32-bit overflow
+        if (len < 0x80)
+            throw new Asn1Error('non-minimal length (should be short form)');
+    }
+    const contentStart = i;
+    const contentEnd = i + len;
+    if (contentEnd > buf.length)
+        throw new Asn1Error('content length exceeds buffer');
+    return {
+        tag,
+        constructed: (tag & CONSTRUCTED_BIT) !== 0,
+        start: pos,
+        contentStart,
+        contentEnd,
+        end: contentEnd,
+    };
+}
+/** Parse every child TLV of a constructed node; require they exactly tile it. */
+export function children(buf, node) {
+    if (!node.constructed)
+        throw new Asn1Error('children() on a primitive node');
+    const out = [];
+    let p = node.contentStart;
+    while (p < node.contentEnd) {
+        const child = readNode(buf, p);
+        if (child.end > node.contentEnd)
+            throw new Asn1Error('child overruns parent');
+        out.push(child);
+        p = child.end;
+    }
+    if (p !== node.contentEnd)
+        throw new Asn1Error('trailing bytes in constructed value');
+    return out;
+}
+/** The content octets of a node (a view — copy before mutating). */
+export function content(buf, node) {
+    return buf.subarray(node.contentStart, node.contentEnd);
+}
+/** The whole TLV (identifier + length + content) of a node (a view). */
+export function rawTlv(buf, node) {
+    return buf.subarray(node.start, node.end);
+}
+/** Assert a node's tag, returning it (for fluent parsing). */
+export function expectTag(node, tag, label = 'node') {
+    if (node.tag !== tag) {
+        throw new Asn1Error(`expected ${label} tag 0x${tag.toString(16)}, got 0x${node.tag.toString(16)}`);
+    }
+    return node;
+}
+/** Decode an OBJECT IDENTIFIER (tag 0x06) to its dotted-decimal string. */
+export function oidToString(buf, node) {
+    expectTag(node, 0x06, 'OID');
+    const b = content(buf, node);
+    if (b.length === 0)
+        throw new Asn1Error('empty OID');
+    if (b[b.length - 1] & 0x80)
+        throw new Asn1Error('truncated OID subidentifier');
+    const subids = [];
+    let acc = 0;
+    for (const byte of b) {
+        acc = acc * 128 + (byte & 0x7f);
+        if ((byte & 0x80) === 0) {
+            subids.push(acc);
+            acc = 0;
+        }
+    }
+    const first = subids[0];
+    const arc0 = Math.min(2, Math.floor(first / 40));
+    const arcs = [arc0, first - arc0 * 40, ...subids.slice(1)];
+    return arcs.join('.');
+}
+function asciiOf(bytes) {
+    let s = '';
+    for (const c of bytes) {
+        if (c < 0x20 || c > 0x7e)
+            throw new Asn1Error('non-ASCII byte in time string');
+        s += String.fromCharCode(c);
+    }
+    return s;
+}
+/**
+ * Decode a UTCTime (0x17) or GeneralizedTime (0x18) to epoch milliseconds. Only
+ * the `Z` (UTC) forms RFC 5280 / RFC 3161 mandate are accepted; local-time and
+ * offset forms are rejected. UTCTime two-digit years use the RFC 5280 1950–2049
+ * window.
+ */
+export function readTime(buf, node) {
+    const s = asciiOf(content(buf, node));
+    if (node.tag === 0x18) {
+        const m = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\.\d+)?Z$/.exec(s);
+        if (!m)
+            throw new Asn1Error('malformed GeneralizedTime');
+        const ms = m[7] ? Math.round(parseFloat('0' + m[7]) * 1000) : 0;
+        return Date.UTC(+m[1], +m[2] - 1, +m[3], +m[4], +m[5], +m[6], ms);
+    }
+    if (node.tag === 0x17) {
+        const m = /^(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})Z$/.exec(s);
+        if (!m)
+            throw new Asn1Error('malformed UTCTime');
+        const yy = +m[1];
+        const year = yy < 50 ? 2000 + yy : 1900 + yy;
+        return Date.UTC(year, +m[2] - 1, +m[3], +m[4], +m[5], +m[6]);
+    }
+    throw new Asn1Error(`not a time tag: 0x${node.tag.toString(16)}`);
+}
+/** First child whose tag matches, or undefined. */
+export function findChild(buf, node, tag) {
+    return children(buf, node).find((c) => c.tag === tag);
+}

package/dist/index.d.ts

@@ -10,4 +10,6 @@ export * from './checks.ts';
 export * from './lifecycle.ts';
 export * from './rekor.ts';
 export * from './rekor-inclusion.ts';
+export * from './asn1.ts';
+export * from './rfc3161.ts';
 export * from './verify.ts';

package/dist/index.js

@@ -24,4 +24,6 @@ export * from "./checks.js";
 export * from "./lifecycle.js";
 export * from "./rekor.js";
 export * from "./rekor-inclusion.js";
+export * from "./asn1.js";
+export * from "./rfc3161.js";
 export * from "./verify.js";

package/dist/rekor-inclusion.js

@@ -190,7 +190,13 @@ export function verifyCheckpointSignature(checkpoint, anchors) {
             continue;
         try {
             const point = extractP256Point(anchor.publicKeyDer);
-            if (p256.verify(sig.sig, checkpoint.signedBody, point, { format: 'der' })) {
+            // `lowS: false`: the log signer may emit a high-S checkpoint signature; low-S
+            // is a signing-side malleability convention, not a verification rule, so a
+            // verifier must accept both S and n−S (see the rfc3161.ts note — a real high-S
+            // TSA token exposed this default). We only ask "did this log key sign this
+            // checkpoint". (`@noble` prehashes with the curve hash by default, so the note
+            // body is passed as the message.)
+            if (p256.verify(sig.sig, checkpoint.signedBody, point, { format: 'der', lowS: false })) {
                 return { verified: true, origin: anchor.origin, keyHint: hint };
             }
         }

package/dist/rfc3161.d.ts

@@ -0,0 +1,41 @@
+/**
+ * A pinned TSA signing key — the OFFLINE trust anchor for check #7 (spec §10.3).
+ * Pinning the SIGNING key (not the long-lived root) is the P2a "acceptable v1":
+ * it must be re-pinned if FreeTSA rotates the signing cert. P2b anchors to the RSA
+ * root via the token's embedded chain, which removes the re-pin.
+ */
+export interface TsaAnchor {
+    name: string;
+    /** EC P-384 signing public key, base64 SPKI DER. */
+    signingKeyDer: string;
+    /** Signing cert validity window (ISO 8601, UTC). genTime must fall inside it. */
+    notBefore: string;
+    notAfter: string;
+}
+export declare const FREETSA_TSA_ANCHORS: readonly TsaAnchor[];
+export type Rfc3161FailReason = 'parse_error' | 'not_granted' | 'unexpected_content_type' | 'unexpected_algorithm' | 'no_message_digest' | 'content_not_bound' | 'no_anchor' | 'signature_invalid' | 'imprint_mismatch' | 'genTime_outside_validity';
+export interface Rfc3161VerifyResult {
+    /** All checks passed: a pinned TSA's signature binds this package hash to genTime. */
+    verified: boolean;
+    /** messageImprint.hashedMessage == the expected package hash (sha256). */
+    imprintMatches: boolean | null;
+    /** The TSA ECDSA-P384 signature over SHA-512(signedAttrs) verifies vs the anchor. */
+    signatureValid: boolean | null;
+    /** signedAttrs.messageDigest == SHA-512(TSTInfo) — the sig is bound to the TSTInfo. */
+    contentBound: boolean | null;
+    /** genTime within the pinned signing cert's validity window. */
+    withinValidity: boolean | null;
+    /** RFC 3161 genTime, epoch ms. */
+    genTime?: number;
+    /** The matched anchor name (when the signature verified). */
+    tsa?: string;
+    reason?: Rfc3161FailReason;
+}
+/**
+ * Verify an RFC 3161 timestamp token (base64) attests `expectedHashHex` (the package
+ * SHA-256), against the pinned TSA anchors. Returns a graded verdict; a parse failure
+ * or unknown anchor is reported (not thrown) so the caller can render it calmly,
+ * while a real cryptographic failure (`signature_invalid` / `imprint_mismatch` /
+ * `content_not_bound`) is the alarm signal.
+ */
+export declare function verifyRfc3161Timestamp(tokenB64: string, expectedHashHex: string, anchors?: readonly TsaAnchor[]): Rfc3161VerifyResult;

package/dist/rfc3161.js

@@ -0,0 +1,246 @@
+// RFC 3161 timestamp verification (spec §9.2 check #7, deep) — browser-safe.
+//
+// `verifyEvidence` today does PRESENCE for #7 (`!!rfc3161Timestamp`). This closes
+// the cryptographic gap for the FreeTSA profile our producer uses (#119 P2a): it
+// parses the RFC 3161 token (a PKCS#7/CMS SignedData over a TSTInfo) and verifies,
+// OFFLINE, that a trusted TSA attested the package hash at a point in time:
+//   1. messageImprint.hashedMessage == the package hash (sha256), so the token is
+//      ABOUT this package;
+//   2. signedAttrs.messageDigest == SHA-512(TSTInfo), so the signature is BOUND to
+//      that TSTInfo;
+//   3. the TSA's ECDSA-P384 signature over SHA-512(signedAttrs) verifies against the
+//      PINNED FreeTSA signing key (the trust anchor);
+//   4. genTime falls within that signing cert's validity window.
+//
+// SCOPE (P2a): FreeTSA uses an EC P-384 signing cert and `ecdsa-with-SHA512`, so the
+// TSA-signature check is pure `@noble` ECDSA — no WebCrypto/RSA. The anchor is the
+// PINNED signing-cert public key (re-pin on rotation — documented below). P2b adds
+// full embedded-cert chain validation to FreeTSA's RSA root (which removes the
+// re-pin), and generalizes EKU/validity from the certs themselves. The recipe here
+// was validated byte-for-byte against a real freetsa.org token (cross-checked with
+// OpenSSL `ts -verify`) before shipping; `__fixtures__/rfc3161-token.json` is that
+// token and the tests reproduce it offline.
+import { p384 } from '@noble/curves/nist.js';
+import { sha512 } from '@noble/hashes/sha2.js';
+import { base64ToBytes, bytesToHex } from "./primitives.js";
+import { Asn1Error, readNode, children, content, rawTlv, oidToString, readTime, } from "./asn1.js";
+// --- OIDs ------------------------------------------------------------------
+const OID_SIGNED_DATA = '1.2.840.113549.1.7.2';
+const OID_CT_TSTINFO = '1.2.840.113549.1.9.16.1.4';
+const OID_SHA256 = '2.16.840.1.101.3.4.2.1';
+const OID_SHA512 = '2.16.840.1.101.3.4.2.3';
+const OID_ECDSA_SHA512 = '1.2.840.10045.4.3.4';
+const OID_ATTR_MESSAGE_DIGEST = '1.2.840.113549.1.9.4';
+// PROVENANCE (anchor pinning — spec §10.3). FreeTSA's online TSA (`freetsa.org/tsr`)
+// signs with this EC P-384 key (cert serial C2E986160DA8E9CD, OU=TSA, EKU
+// id-kp-timeStamping, valid 2026-02-15 → 2040-02-02). Captured 2026-06-07 from
+// `https://freetsa.org/files/tsa.crt`; a live token verified against it with both
+// `@noble` (here) and OpenSSL `ts -verify` against FreeTSA's published CA. The cert
+// chains to FreeTSA's self-signed RSA-4096 root (OU=Root CA) — pinning that root and
+// validating the embedded chain is P2b.
+export const FREETSA_TSA_ANCHORS = [
+    {
+        name: 'freetsa.org',
+        signingKeyDer: 'MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEohXhobLWy4cYsdKOFALpjUsB1FJTntwwb7PH2LOfNMAA1ufaKhkgsdeW6etU0pl5MC5tSVuPF52yy4sz+mbY3L7IVdx/bs9m0ud7IA14YNcC2yIQLa2gvnxwsrR3rlWr',
+        notBefore: '2026-02-15T19:44:22Z',
+        notAfter: '2040-02-02T19:44:22Z',
+    },
+];
+// EC P-384 SPKI DER is a fixed 120-byte structure: a 23-byte prefix (SEQUENCE →
+// AlgorithmIdentifier{ id-ecPublicKey, secp384r1 } → BIT STRING) then the 97-byte
+// uncompressed point (0x04 ‖ X ‖ Y).
+const EC_P384_SPKI_PREFIX = Uint8Array.from([
+    0x30, 0x76, 0x30, 0x10, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01,
+    0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x22, 0x03, 0x62, 0x00,
+]);
+const EC_P384_SPKI_LENGTH = 120;
+function extractP384Point(publicKeyB64Der) {
+    const der = base64ToBytes(publicKeyB64Der);
+    if (der.length !== EC_P384_SPKI_LENGTH) {
+        throw new Asn1Error(`Unexpected P-384 SPKI length ${der.length}`);
+    }
+    for (let i = 0; i < EC_P384_SPKI_PREFIX.length; i++) {
+        if (der[i] !== EC_P384_SPKI_PREFIX[i])
+            throw new Asn1Error('Unexpected P-384 SPKI prefix');
+    }
+    return der.slice(EC_P384_SPKI_LENGTH - 97);
+}
+/** The AlgorithmIdentifier's OID (its first child). */
+function algorithmOid(buf, alg) {
+    return oidToString(buf, children(buf, alg)[0]);
+}
+/** Navigate TimeStampResp → ContentInfo → SignedData → { TSTInfo, signerInfo }. */
+function parseToken(buf) {
+    const resp = readNode(buf, 0);
+    const respKids = children(buf, resp);
+    // PKIStatusInfo.status: 0 granted, 1 grantedWithMods; anything else ⇒ no token.
+    const status = children(buf, respKids[0])[0];
+    const statusVal = content(buf, status);
+    if (statusVal.length !== 1 || statusVal[0] > 1)
+        throw new Asn1Error('PKIStatus not granted');
+    const contentInfo = respKids[1];
+    if (!contentInfo)
+        throw new Asn1Error('no timeStampToken');
+    const ciKids = children(buf, contentInfo);
+    if (oidToString(buf, ciKids[0]) !== OID_SIGNED_DATA)
+        throw new Asn1Error('not signedData');
+    const signedData = children(buf, ciKids[1])[0]; // [0] EXPLICIT → SignedData
+    const sd = children(buf, signedData);
+    const encap = sd.find((c) => c.tag === 0x30); // first SEQUENCE = encapContentInfo
+    const signerInfos = sd.filter((c) => c.tag === 0x31).pop(); // last SET = signerInfos
+    if (!encap || !signerInfos)
+        throw new Asn1Error('malformed SignedData');
+    const encapKids = children(buf, encap);
+    if (oidToString(buf, encapKids[0]) !== OID_CT_TSTINFO)
+        throw new Asn1Error('eContent not TSTInfo');
+    const tstOctet = children(buf, encapKids[1])[0]; // [0] EXPLICIT → OCTET STRING
+    if (tstOctet.tag !== 0x04)
+        throw new Asn1Error('TSTInfo not an OCTET STRING');
+    const tstInfo = buf.slice(tstOctet.contentStart, tstOctet.contentEnd);
+    const signerInfo = children(buf, signerInfos)[0];
+    const si = children(buf, signerInfo);
+    const signedAttrs = si.find((c) => c.tag === 0xa0);
+    const signature = si.find((c) => c.tag === 0x04);
+    if (!signedAttrs || !signature)
+        throw new Asn1Error('signerInfo missing signedAttrs/signature');
+    // SignerInfo has three SEQUENCEs: sid (issuerAndSerialNumber), digestAlgorithm,
+    // signatureAlgorithm. The digest alg is the LAST 0x30 before signedAttrs (the sid
+    // also precedes it); the signature alg is the first 0x30 after.
+    const seqs = si.filter((c) => c.tag === 0x30);
+    const digestAlg = seqs.filter((c) => c.end <= signedAttrs.start).pop();
+    const signatureAlg = seqs.find((c) => c.start >= signedAttrs.end);
+    if (!digestAlg || !signatureAlg)
+        throw new Asn1Error('signerInfo missing algorithm ids');
+    return {
+        tstInfo,
+        signedAttrs,
+        digestAlgOid: algorithmOid(buf, digestAlg),
+        signatureAlgOid: algorithmOid(buf, signatureAlg),
+        signature: content(buf, signature),
+    };
+}
+/** The OCTET STRING value of the messageDigest signed attribute. */
+function messageDigestAttr(buf, signedAttrs) {
+    for (const attr of children(buf, signedAttrs)) {
+        const kids = children(buf, attr);
+        if (oidToString(buf, kids[0]) === OID_ATTR_MESSAGE_DIGEST) {
+            const value = children(buf, kids[1])[0]; // SET OF → OCTET STRING
+            return content(buf, value);
+        }
+    }
+    return null;
+}
+/** Pull { hashedMessage, hashAlgOid, genTime } out of a TSTInfo. */
+function parseTstInfo(tst) {
+    const root = readNode(tst, 0);
+    const kids = children(tst, root); // version, policy, messageImprint, serial, genTime, …
+    const messageImprint = kids[2];
+    const miKids = children(tst, messageImprint);
+    const hashAlgOid = algorithmOid(tst, miKids[0]);
+    const hashedMessage = content(tst, miKids[1]);
+    const genTimeNode = kids.find((c) => c.tag === 0x18);
+    if (!genTimeNode)
+        throw new Asn1Error('TSTInfo missing genTime');
+    return { hashedMessage, hashAlgOid, genTime: readTime(tst, genTimeNode) };
+}
+function bytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a[i] ^ b[i];
+    return diff === 0;
+}
+/**
+ * Verify an RFC 3161 timestamp token (base64) attests `expectedHashHex` (the package
+ * SHA-256), against the pinned TSA anchors. Returns a graded verdict; a parse failure
+ * or unknown anchor is reported (not thrown) so the caller can render it calmly,
+ * while a real cryptographic failure (`signature_invalid` / `imprint_mismatch` /
+ * `content_not_bound`) is the alarm signal.
+ */
+export function verifyRfc3161Timestamp(tokenB64, expectedHashHex, anchors = FREETSA_TSA_ANCHORS) {
+    let buf;
+    let token;
+    let tst;
+    let mdAttr;
+    try {
+        buf = base64ToBytes(tokenB64);
+        token = parseToken(buf);
+        tst = parseTstInfo(token.tstInfo);
+        mdAttr = messageDigestAttr(buf, token.signedAttrs);
+    }
+    catch {
+        return {
+            verified: false,
+            imprintMatches: null,
+            signatureValid: null,
+            contentBound: null,
+            withinValidity: null,
+            reason: 'parse_error',
+        };
+    }
+    const base = {
+        verified: false,
+        imprintMatches: null,
+        signatureValid: null,
+        contentBound: null,
+        withinValidity: null,
+        genTime: tst.genTime,
+    };
+    // FreeTSA profile (P2a): SHA-512 digest + ECDSA-with-SHA-512 signature.
+    if (token.digestAlgOid !== OID_SHA512 || token.signatureAlgOid !== OID_ECDSA_SHA512) {
+        return { ...base, reason: 'unexpected_algorithm' };
+    }
+    // (1) message imprint is about THIS package (sha256).
+    const imprintMatches = tst.hashAlgOid === OID_SHA256 && bytesToHex(tst.hashedMessage) === expectedHashHex.toLowerCase();
+    base.imprintMatches = imprintMatches;
+    if (!imprintMatches)
+        return { ...base, reason: 'imprint_mismatch' };
+    // (2) the signature is bound to this TSTInfo via the messageDigest attribute.
+    if (!mdAttr)
+        return { ...base, reason: 'no_message_digest' };
+    const contentBound = bytesEqual(mdAttr, sha512(token.tstInfo));
+    base.contentBound = contentBound;
+    if (!contentBound)
+        return { ...base, reason: 'content_not_bound' };
+    // (3) ECDSA-P384 signature over SHA-512(signedAttrs re-tagged [0] → SET) verifies
+    // against a pinned anchor key. (`@noble` prehashes with SHA-384 by default, so we
+    // hash with SHA-512 ourselves and pass `prehash: false`.)
+    const signedBytes = Uint8Array.from(rawTlv(buf, token.signedAttrs));
+    signedBytes[0] = 0x31; // [0] IMPLICIT (0xa0) → SET OF (0x31) for the signature input
+    const digest = sha512(signedBytes);
+    let matched;
+    for (const anchor of anchors) {
+        try {
+            const point = extractP384Point(anchor.signingKeyDer);
+            // `lowS: false` is REQUIRED here: low-S is a signature-malleability convention
+            // for SIGNING, not a validity rule. A TSA (like FreeTSA) legitimately emits
+            // high-S ECDSA signatures (~half of them); `@noble`'s default `lowS: true`
+            // would false-negative those (it rejected the real high-S da9246 token —
+            // regression-tested). Accepting high-S is correct: both S and n−S are valid
+            // signatures by the same key, and we only ask "did this TSA sign this hash".
+            if (p384.verify(token.signature, digest, point, { format: 'der', prehash: false, lowS: false })) {
+                matched = anchor;
+                break;
+            }
+        }
+        catch {
+            // malformed anchor key ⇒ try the next
+        }
+    }
+    base.signatureValid = !!matched;
+    if (!matched) {
+        // Distinguish "no pinned key vouches for this token" (calm — unknown TSA) from a
+        // signature that fails under a known key. Here, none verified ⇒ no_anchor.
+        return { ...base, reason: 'no_anchor' };
+    }
+    base.tsa = matched.name;
+    // (4) genTime within the pinned signing cert's validity window.
+    const notBefore = Date.parse(matched.notBefore);
+    const notAfter = Date.parse(matched.notAfter);
+    const withinValidity = tst.genTime >= notBefore && tst.genTime <= notAfter;
+    base.withinValidity = withinValidity;
+    if (!withinValidity)
+        return { ...base, reason: 'genTime_outside_validity' };
+    return { ...base, verified: true };
+}

package/dist/verify.d.ts

@@ -1,4 +1,5 @@
 import { type RekorInclusionProof, type RekorInclusionResult } from './rekor-inclusion.ts';
+import { type Rfc3161VerifyResult } from './rfc3161.ts';
 import { type KeyTrustResult, type TrustRegistry } from './trust-registry.ts';
 import { type ContentCanonicalizationResolution, type ContentHashCheck, type TypeResolution, type SignerIdentityCheck, type CaptureMethodVocabCheck, type BlobRefVerification } from './checks.ts';
 import { type LifecycleResolution } from './lifecycle.ts';
@@ -90,6 +91,10 @@ export interface VerifyResult {
     rekorInclusion: RekorInclusionResult | null;
     hasRekor: boolean;
     hasTimestamp: boolean;
+    /** Cryptographic RFC 3161 TSA verdict (#119 P2a): null when no token was present,
+     *  else the graded result (signature vs pinned TSA anchor, message-imprint match,
+     *  genTime-in-validity). Additive to `hasTimestamp` (presence). */
+    rfc3161: Rfc3161VerifyResult | null;
     keyTrust: KeyTrustResult | null;
     blobRefsVerified: boolean | null;
     blobRefs: BlobRefVerification[];

package/dist/verify.js

@@ -14,17 +14,20 @@
 // sidecar (`buildCommitmentView`) so WS3 can wire sidecar → verifyEvidence with
 // no glue. The server route adapts its DB row to the same shape.
 //
-// Check depth: fully client-side for #1/#2/#3/#4/#5/#6/#9/#12/#13/#14/#15; PRESENCE
-// for #7 (RFC 3161); #8 (Rekor) is hash-PARITY AND, when an inclusion proof is
-// available (carried for offline, or on the fetched entry), cryptographic Merkle
-// inclusion against the pinned log key (civic-ai-tools-website#119 P1); lifecycle
-// STATE for #10 unless the caller supplies a deeper resolution. The remaining
-// deeper offline crypto (TSA chain #7, independent lifecycle-chain #10) is #119
-// P2 / P3.
+// Check depth: fully client-side for #1/#2/#3/#4/#5/#6/#9/#12/#13/#14/#15; #7 (RFC
+// 3161) is PRESENCE (`hasTimestamp`) AND, when a token is present, cryptographic TSA
+// verification against the pinned FreeTSA anchor (civic-ai-tools-website#119 P2a —
+// ECDSA-P384 over the signed TSTInfo, message-imprint match, genTime-in-validity);
+// #8 (Rekor) is hash-PARITY AND, when an inclusion proof is available (carried for
+// offline, or on the fetched entry), cryptographic Merkle inclusion against the
+// pinned log key (#119 P1); lifecycle STATE for #10 unless the caller supplies a
+// deeper resolution. Remaining deeper crypto: TSA full cert-chain #7 (#119 P2b),
+// independent lifecycle-chain #10 (#119 P3).
 import { recomputePackageHash } from "./checks.js";
 import { verifySignature } from "./signature.js";
 import { verifyRekorEntry } from "./rekor.js";
 import { verifyRekorInclusion, } from "./rekor-inclusion.js";
+import { verifyRfc3161Timestamp } from "./rfc3161.js";
 import { verifyKeyTrust, legacyEmbeddedKeyTrust, } from "./trust-registry.js";
 import { resolveContentCanonicalization, verifyContentHash, resolvePackageType, checkSignerIdentity, checkCaptureMethodVocab, verifyPackageBlobRefs, } from "./checks.js";
 import { resolveLifecycleFromLegacyColumns, } from "./lifecycle.js";
@@ -82,6 +85,13 @@ export async function verifyEvidence(input, deps) {
     if (input.rekorInclusionProof && input.rekorEntryBody) {
         rekorInclusion = verifyRekorInclusion(input.rekorEntryBody, input.rekorInclusionProof);
     }
+    // Step 3c — RFC 3161 timestamp (check #7, deep). Presence is `hasTimestamp`; when a
+    // token + package hash are present, cryptographically verify the TSA signature over
+    // the timestamped hash against the pinned TSA anchor (#119 P2a). Pure/offline.
+    let rfc3161 = null;
+    if (input.rfc3161Timestamp && packageHash) {
+        rfc3161 = verifyRfc3161Timestamp(input.rfc3161Timestamp, packageHash);
+    }
     // Step 3b — blob references embedded in the package (check #9).
     let blobRefs = [];
     let blobRefsVerified = null;
@@ -134,6 +144,7 @@ export async function verifyEvidence(input, deps) {
         rekorInclusion,
         hasRekor: !!input.rekorEntryId,
         hasTimestamp: !!input.rfc3161Timestamp,
+        rfc3161,
         keyTrust,
         blobRefsVerified,
         blobRefs,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@typedstandards/verify-core",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "Portable, browser-safe verification core for Typed Standards evidence packages — the §9.2 check suite, single-sourced so it verifies identically on a server and in the browser.",
   "license": "MIT",
   "author": "Nathan Storey",
@@ -9,7 +9,8 @@
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
     },
     "./package.json": "./package.json"
   },