@typedstandards/verify-core 0.3.0 → 0.3.1

package/dist/rekor-inclusion.js

@@ -190,7 +190,13 @@ export function verifyCheckpointSignature(checkpoint, anchors) {
             continue;
         try {
             const point = extractP256Point(anchor.publicKeyDer);
-            if (p256.verify(sig.sig, checkpoint.signedBody, point, { format: 'der' })) {
+            // `lowS: false`: the log signer may emit a high-S checkpoint signature; low-S
+            // is a signing-side malleability convention, not a verification rule, so a
+            // verifier must accept both S and n−S (see the rfc3161.ts note — a real high-S
+            // TSA token exposed this default). We only ask "did this log key sign this
+            // checkpoint". (`@noble` prehashes with the curve hash by default, so the note
+            // body is passed as the message.)
+            if (p256.verify(sig.sig, checkpoint.signedBody, point, { format: 'der', lowS: false })) {
                 return { verified: true, origin: anchor.origin, keyHint: hint };
             }
         }

package/dist/rfc3161.js

@@ -213,7 +213,13 @@ export function verifyRfc3161Timestamp(tokenB64, expectedHashHex, anchors = FREE
     for (const anchor of anchors) {
         try {
             const point = extractP384Point(anchor.signingKeyDer);
-            if (p384.verify(token.signature, digest, point, { format: 'der', prehash: false })) {
+            // `lowS: false` is REQUIRED here: low-S is a signature-malleability convention
+            // for SIGNING, not a validity rule. A TSA (like FreeTSA) legitimately emits
+            // high-S ECDSA signatures (~half of them); `@noble`'s default `lowS: true`
+            // would false-negative those (it rejected the real high-S da9246 token —
+            // regression-tested). Accepting high-S is correct: both S and n−S are valid
+            // signatures by the same key, and we only ask "did this TSA sign this hash".
+            if (p384.verify(token.signature, digest, point, { format: 'der', prehash: false, lowS: false })) {
                 matched = anchor;
                 break;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@typedstandards/verify-core",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Portable, browser-safe verification core for Typed Standards evidence packages — the §9.2 check suite, single-sourced so it verifies identically on a server and in the browser.",
   "license": "MIT",
   "author": "Nathan Storey",