provared 0.4.0 → 0.6.0

package/src/service.js

@@ -79,7 +79,7 @@ export function validateTermsContent(c) {
  * @param {{unit: string, value: number}} [fields.amount]
  * @param {string} fields.reason one of REFUSAL_REASONS
  * @param {number|Date} [fields.when] defaults to now
- * @param {CryptoKey[]} privateKeys the service's private keys: Ed25519, then ML-DSA-87
+ * @param {any[]} privateKeys the service's private keys, or signers: Ed25519, then ML-DSA-87. A signer must hold the keys "by" names
  * @returns {Promise<{record: object, fingerprint: string}>}
  */
 export async function writeRefusal(fields, privateKeys) {
@@ -94,7 +94,7 @@ export async function writeRefusal(fields, privateKeys) {
   };
   if (fields.amount) content.amount = fields.amount;
   validateRefusalContent(content);
-  return signWithKeySet('refusal', content, privateKeys);
+  return signWithKeySet('refusal', content, privateKeys, content.by.keys);
 }
 
 /**
@@ -106,7 +106,7 @@ export async function writeRefusal(fields, privateKeys) {
  * @param {string[]} [fields.never] kinds of action and rules of conduct the service asks agents to keep
  * @param {string} fields.validFrom
  * @param {string} fields.validUntil
- * @param {CryptoKey[]} privateKeys the service's private keys: Ed25519, then ML-DSA-87
+ * @param {any[]} privateKeys the service's private keys, or signers: Ed25519, then ML-DSA-87. A signer must hold the keys "by" names
  * @returns {Promise<{record: object, fingerprint: string}>}
  */
 export async function writeTerms(fields, privateKeys) {
@@ -120,5 +120,5 @@ export async function writeTerms(fields, privateKeys) {
     validUntil: fields.validUntil,
   };
   validateTermsContent(content);
-  return signWithKeySet('terms', content, privateKeys);
+  return signWithKeySet('terms', content, privateKeys, content.by.keys);
 }

package/src/signatures.js

@@ -13,7 +13,8 @@
 // this file still loads in a browser. In a browser the method is reported as
 // not built in, which is never a pass.
 
-import { importPublicKey, weakEd25519 } from './keys.js';
+import { Refusal } from './encoding.js';
+import { badEd25519Signature, checkKey, importPublicKey, thumbprint } from './keys.js';
 
 const SLH = 'SLH-DSA-SHA2-256s';
 
@@ -98,10 +99,11 @@ export async function verifySignature(jwk, signature, data, without = []) {
   if (!Object.hasOwn(VERIFY_PARAMS, jwk.alg)) return 'invalid';
   const params = VERIFY_PARAMS[jwk.alg];
   if (without.includes(jwk.alg) || !(await methodAvailable(jwk.alg))) return 'unavailable';
-  // An Ed25519 signature whose first half is a point of small order is
-  // refused here, whatever the device's own library would say: libraries
-  // differ on it (format description, section 3.8).
-  if (jwk.alg === 'Ed25519' && (signature.length !== 64 || weakEd25519(signature.subarray(0, 32)))) return 'invalid';
+  // An Ed25519 signature whose first half is a point of small order, or
+  // whose second half, the number S, is not below the order L, is refused
+  // here, whatever the device's own library would say: libraries differ on
+  // both (format description, section 3.8).
+  if (jwk.alg === 'Ed25519' && badEd25519Signature(signature)) return 'invalid';
   try {
     const key = await importPublicKey(jwk);
     return (await globalThis.crypto.subtle.verify(params, key, signature, data)) ? 'valid' : 'invalid';
@@ -122,6 +124,280 @@ export async function sign(alg, privateKey, data) {
   return new Uint8Array(await globalThis.crypto.subtle.sign({ name: alg }, privateKey, data));
 }
 
+// --- signers ---
+//
+// Wherever a writer takes "privateKeys", each item may be a private key of
+// the platform (a Web Crypto CryptoKey, or a Node.js KeyObject), used as it
+// always was, or a signer: an object with "key", the public key as a JSON
+// Web Key in one of the shapes of the format description, section 3.8, and
+// "sign(data)", which gives the signature over exactly those bytes. A
+// signer lets a key live elsewhere: in a key service, or a hardware module.
+// It changes where a signature is made, not how: the record is the same.
+//
+// A signer is not taken on trust. Its two members are read once. Its key
+// must be of the method of its place in the list, a method this device can
+// check, and, where the writer knows the key the record must be signed
+// with, that key. All of this is settled before any signer is asked to
+// sign. Every signature it gives is checked against its key before it is
+// used. A signer that fails in any way leaves no record, and the error
+// names the method and the key. Signers earlier in the list may have
+// signed by then: a key service's own log may hold signatures that match
+// no record.
+
+/**
+ * Whether an item of "privateKeys" is a private key of the platform for the
+ * method of its place: a private Web Crypto CryptoKey of that method that
+ * may sign, or for SLH-DSA a private Node.js KeyObject of that kind. What
+ * only looks like one (an object made from CryptoKey's own prototype, a
+ * public key, a key of another method) is not one.
+ * @param {any} item
+ * @param {string} alg
+ * @returns {boolean}
+ */
+function platformKey(item, alg) {
+  try {
+    if (alg === SLH) return Boolean(nodeCrypto) && item instanceof nodeCrypto.KeyObject && item.type === 'private' && item.asymmetricKeyType === 'slh-dsa-sha2-256s';
+    return typeof globalThis.CryptoKey === 'function' && item instanceof globalThis.CryptoKey && item.type === 'private' && item.algorithm.name === alg && item.usages.includes('sign');
+  } catch {
+    return false; // a value that cannot even be looked into (a revoked Proxy), or one that only looks like a key
+  }
+}
+
+// What a place in "privateKeys" must hold.
+const signerShape = (alg) =>
+  `must be a private key for ${alg} (${alg === SLH ? 'a Node.js KeyObject, or what Node.js reads as one: PEM text, DER bytes with their format, or a JSON Web Key with its format' : 'a Web Crypto CryptoKey'}), or a signer: an object with "key", the public key, and "sign", a function that gives the signature bytes.`;
+
+/**
+ * In the SLH-DSA place, the seal writer has always handed the key to
+ * Node.js's own signing call, which also reads a key written out: PEM text,
+ * DER bytes with their format, or a JSON Web Key with its format. Such a
+ * key is still taken: it is read exactly as that call read it (with
+ * crypto.createPrivateKey, which the call itself uses), and then it must be
+ * a private SLH-DSA-SHA2-256s key, as a KeyObject must.
+ * @param {any} item
+ * @param {string} where
+ * @returns {any} the key, as a KeyObject
+ */
+function writtenSlhKey(item, where) {
+  let made;
+  try {
+    made = nodeCrypto.createPrivateKey(item);
+  } catch {
+    made = null; // not a private key Node.js can read, or no Node.js here
+  }
+  if (!platformKey(made, SLH)) throw new Refusal('bad-field', `${where}: ${signerShape(SLH)}`);
+  return made;
+}
+
+// A signer that gave no answer in the time the stub writer gives it.
+class NoAnswer extends Error {
+  constructor(ms) {
+    super(`no answer within ${ms} milliseconds`);
+    this.ms = ms;
+  }
+}
+
+// Two public keys that have passed checkKey: the same key, member for member.
+function sameKey(a, b) {
+  const names = Object.keys(b);
+  return Object.keys(a).length === names.length && names.every((n) => a[n] === b[n]);
+}
+
+// The signature bytes a signer gave, copied, or null where it gave anything
+// else. Bytes are a Uint8Array (a Node.js Buffer is one) or an ArrayBuffer,
+// which is what Web Crypto's own "sign" gives.
+function bytesOf(given) {
+  try {
+    if (given instanceof Uint8Array) return new Uint8Array(given);
+    if (given instanceof ArrayBuffer) return new Uint8Array(given.slice(0));
+  } catch {
+    // fall through: not bytes that can be read
+  }
+  return null;
+}
+
+/**
+ * Read one item of "privateKeys" for the method of its place.
+ * @param {any} item
+ * @param {string} alg
+ * @param {string} where its place, for messages
+ * @param {object} [expected] the public key the record must be signed with, where the writer knows it
+ * @returns {Promise<{platform: boolean, item: any, key?: object, call?: (data: Uint8Array) => any, sign: (data: Uint8Array) => Promise<Uint8Array>}>}
+ */
+async function takeItem(item, alg, where, expected) {
+  const platform = (privateKey) => ({ platform: true, item: privateKey, sign: (data) => sign(alg, privateKey, data) });
+  if (platformKey(item, alg)) return platform(item);
+  let key;
+  let fn;
+  if (item !== null && (typeof item === 'object' || typeof item === 'function')) {
+    try {
+      key = item.key;
+      fn = item.sign;
+    } catch {
+      throw new Refusal('bad-field', `${where}: could not be read.`);
+    }
+  }
+  if (typeof fn !== 'function') {
+    // Not a signer: in the SLH-DSA place, perhaps a key written out.
+    if (alg === SLH && item !== null && item !== undefined) return platform(writtenSlhKey(item, where));
+    throw new Refusal('bad-field', `${where}: ${signerShape(alg)}`);
+  }
+  if (key === undefined || key === null) throw new Refusal('bad-field', `${where}: ${signerShape(alg)}`);
+  let copy;
+  try {
+    copy = structuredClone(key);
+  } catch {
+    throw new Refusal('bad-key', `${where}.key: must be a public key, as plain data.`);
+  }
+  checkKey(copy, [alg], `${where}.key`);
+  Object.freeze(copy);
+  const label = `the ${alg} key ${await thumbprint(copy)}`;
+  if (expected && !sameKey(copy, expected)) {
+    throw new Refusal('bad-key', `${where}: the signer holds ${label}, which is not the key this record must be signed with (${await thumbprint(expected)}).`);
+  }
+  // Nothing is signed that this device cannot check: so a signer for a
+  // method it does not have built in is refused before any signer is asked.
+  if (!(await methodAvailable(alg))) {
+    throw new Refusal('bad-key', `${where}: this device does not have ${alg} built in, so it cannot check a signature from the signer for ${label}. No record was made.`);
+  }
+  const call = (data) => fn.call(item, data);
+  return { platform: false, item, key: copy, call, sign: (data) => signerSignature(call, copy, alg, label, where, data) };
+}
+
+// One signature from a signer, checked before it is used.
+async function signerSignature(call, key, alg, label, where, data) {
+  const failed = (why, cause) => {
+    const e = new Refusal('signature-invalid', `${where}: the signer for ${label} ${why} No record was made.`);
+    if (cause !== undefined) e.cause = cause;
+    return e;
+  };
+  let given;
+  try {
+    // The signer is handed a copy: nothing it does to it changes what is checked.
+    given = await call(data.slice());
+  } catch (e) {
+    if (e instanceof NoAnswer) throw failed(`gave no answer within ${e.ms} milliseconds.`);
+    throw failed('failed with an error.', e);
+  }
+  const signature = bytesOf(given);
+  if (signature === null) throw failed('gave something other than bytes.');
+  if (Object.hasOwn(SIGNATURE_BYTES, alg) && signature.length !== SIGNATURE_BYTES[alg]) {
+    throw failed(`gave a signature of ${signature.length} bytes, where an ${alg} signature is ${SIGNATURE_BYTES[alg]}.`);
+  }
+  // Whether the method is built in was settled before any signer was asked;
+  // a signature that cannot be checked even so is not used.
+  const state = await verifySignature(key, signature, data);
+  if (state !== 'valid') throw failed('gave a signature that does not check against its key: it holds another key, or signed other bytes.');
+  return signature;
+}
+
+/**
+ * Read every item of "privateKeys", one for each method, before anything is
+ * signed.
+ * @param {any} privateKeys
+ * @param {string[]} methods
+ * @param {object[]} [expected] the public keys the record must be signed with, where the writer knows them
+ * @returns {Promise<Awaited<ReturnType<typeof takeItem>>[]>}
+ */
+async function takeItems(privateKeys, methods, expected) {
+  let list;
+  try {
+    list = Array.isArray(privateKeys);
+  } catch {
+    list = false; // a revoked Proxy
+  }
+  if (!list) throw new Refusal('bad-field', `privateKeys: must be a list, one private key or signer for each of ${methods.join(', ')}.`);
+  const taken = [];
+  for (let i = 0; i < methods.length; i++) {
+    let item;
+    try {
+      item = privateKeys[i];
+    } catch {
+      throw new Refusal('bad-field', `privateKeys[${i}]: could not be read.`);
+    }
+    taken.push(await takeItem(item, methods[i], `privateKeys[${i}]`, expected ? expected[i] : undefined));
+  }
+  return taken;
+}
+
+/**
+ * The functions that sign, one for each method, for a writer that signs
+ * now. Keys of the platform sign as they always did; each signer is read
+ * and checked as set out above.
+ * @param {any} privateKeys
+ * @param {string[]} methods
+ * @param {object[]} [expected]
+ * @returns {Promise<((data: Uint8Array) => Promise<Uint8Array>)[]>}
+ */
+export async function signingKeys(privateKeys, methods, expected) {
+  return (await takeItems(privateKeys, methods, expected)).map((t) => t.sign);
+}
+
+/**
+ * For a writer that holds its keys, such as the stub writer: the list to
+ * use in place of "privateKeys". Keys of the platform are kept as they
+ * are. Each signer is read once, here, and checked against the key the
+ * records must be signed with where that is known; in its place stands a
+ * signer that waits "ms" milliseconds at most for each signature, through
+ * "run". A late answer is not used.
+ * @param {any} privateKeys
+ * @param {string[]} methods
+ * @param {object[]|undefined} expected
+ * @param {number} ms
+ * @param {(work: () => Promise<any>) => Promise<any>} [run]
+ * @returns {Promise<any[]>}
+ */
+export async function holdSigningKeys(privateKeys, methods, expected, ms, run = (work) => work()) {
+  return (await takeItems(privateKeys, methods, expected)).map((t) => {
+    if (t.platform) return t.item;
+    const waited = (data) =>
+      new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new NoAnswer(ms)), ms);
+        let answer;
+        try {
+          answer = Promise.resolve(t.call(data));
+        } catch (e) {
+          clearTimeout(timer);
+          reject(e);
+          return;
+        }
+        answer.then(
+          (value) => {
+            clearTimeout(timer);
+            resolve(value);
+          },
+          (e) => {
+            clearTimeout(timer);
+            reject(e);
+          },
+        );
+      });
+    return Object.freeze({ key: t.key, sign: (data) => run(() => waited(data)) });
+  });
+}
+
+/**
+ * Wrap a private key held in memory as a signer, so that a key in memory
+ * and a key held elsewhere take one path.
+ * @param {string} alg 'Ed25519', 'ML-DSA-87' or 'SLH-DSA-SHA2-256s'
+ * @param {any} privateKey a Web Crypto CryptoKey, or for SLH-DSA a Node.js KeyObject
+ * @param {object} publicJwk its public key, in one of the shapes of the format description, section 3.8
+ * @returns {{key: object, sign: (data: Uint8Array) => Promise<Uint8Array>}}
+ */
+export function signerFromKey(alg, privateKey, publicJwk) {
+  if (alg !== 'Ed25519' && alg !== 'ML-DSA-87' && alg !== SLH) throw new Refusal('bad-field', `alg: must be Ed25519, ML-DSA-87 or ${SLH}.`);
+  // Web Crypto holds the first two methods; Node.js's own module the third.
+  if (!platformKey(privateKey, alg)) throw new Refusal('bad-field', `privateKey: must be a private key for ${alg}: ${alg === SLH ? 'a Node.js KeyObject' : 'a Web Crypto CryptoKey'}.`);
+  let key;
+  try {
+    key = structuredClone(publicJwk);
+  } catch {
+    throw new Refusal('bad-key', 'key: must be a public key, as plain data.');
+  }
+  checkKey(key, [alg], 'key');
+  return Object.freeze({ key: Object.freeze(key), sign: (data) => sign(alg, privateKey, data) });
+}
+
 /**
  * Make a new key set for a recorder, which signs seals: an Ed25519 key, an
  * ML-DSA-87 key and an SLH-DSA-SHA2-256s key. It needs Node.js: no browser

package/src/standing.js

@@ -122,7 +122,7 @@ export function assembleCancellation(prepared, assertion) {
  * @param {string} fields.cancellation the fingerprint of the cancellation
  * @param {string} [fields.pass] for a helper agent: the fingerprint of the pass it acts under
  * @param {number|Date} [fields.when] when the cancellation was handed over; defaults to now
- * @param {CryptoKey[]} privateKeys the agent's private keys: Ed25519, then ML-DSA-87
+ * @param {any[]} privateKeys the agent's private keys, or signers: Ed25519, then ML-DSA-87
  * @returns {Promise<{record: object, fingerprint: string}>}
  */
 export async function writeAcknowledgement(fields, privateKeys) {
@@ -148,7 +148,7 @@ export async function writeAcknowledgement(fields, privateKeys) {
  * @param {string} fields.validFrom
  * @param {string} fields.validUntil
  * @param {number|Date} [fields.when] defaults to now
- * @param {CryptoKey[]} privateKeys the organisation's private keys: Ed25519, then ML-DSA-87
+ * @param {any[]} privateKeys the organisation's private keys, or signers: Ed25519, then ML-DSA-87. A signer must hold the keys "by" names
  * @returns {Promise<{record: object, fingerprint: string}>}
  */
 export async function writeVouching(fields, privateKeys) {
@@ -162,7 +162,7 @@ export async function writeVouching(fields, privateKeys) {
     when: formatTime(fields.when ?? Date.now()),
   };
   validateVouchingContent(content);
-  return signWithKeySet('vouching', content, privateKeys);
+  return signWithKeySet('vouching', content, privateKeys, content.by.keys);
 }
 
 /**
@@ -171,7 +171,7 @@ export async function writeVouching(fields, privateKeys) {
  * @param {object} fields
  * @param {string} fields.vouching the fingerprint of the vouching record
  * @param {number|Date} [fields.when] defaults to now
- * @param {CryptoKey[]} privateKeys the private keys of the organisation that made the vouching record
+ * @param {any[]} privateKeys the private keys of the organisation that made the vouching record, or signers
  * @returns {Promise<{record: object, fingerprint: string}>}
  */
 export async function writeWithdrawal(fields, privateKeys) {

package/src/stub.js

@@ -1,11 +1,12 @@
 // The Stub (the receipt for one action) and the countersignature.
 // Format description, sections 5 and 6.
 
+import { DOCUMENT_NAMES, REPEATABLE_DOCUMENT_NAMES, isUnknownReservedDocument } from './documents.js';
 import { fingerprint, formatTime, randomId, toBase64url } from './encoding.js';
 import * as f from './fields.js';
 import { encodeContent, parseRecord, protectedHeaders, signingInput, withinSize, KINDS } from './jws.js';
 import { KEY_SET_METHODS } from './keys.js';
-import { sign } from './signatures.js';
+import { signingKeys } from './signatures.js';
 
 /**
  * Confirm every member of a stub's content (format description, section 5.1).
@@ -48,9 +49,17 @@ export function validateRequest(c) {
   if (Object.hasOwn(c, 'with')) f.shortName(c.with, 'with');
   if (Object.hasOwn(c, 'details')) {
     f.list(c.details, 1, 32, 'details');
+    const once = new Set();
     c.details.forEach((d, i) => {
       f.members(d, ['name', 'sha256'], [], `details[${i}]`);
       f.label(d.name, `details[${i}].name`);
+      if (isUnknownReservedDocument(d.name)) throw f.fail(`details[${i}].name`, 'names that begin "provared." are reserved, and this one is not on the list of document names.');
+      if (Object.hasOwn(DOCUMENT_NAMES, d.name) && !REPEATABLE_DOCUMENT_NAMES.includes(d.name)) {
+        if (once.has(d.name)) {
+          throw f.fail(`details[${i}].name`, 'this reserved name is named twice. Only provared.trace-id, provared.request-id and provared.event-id may be named more than once.');
+        }
+        once.add(d.name);
+      }
       f.fingerprintText(d.sha256, `details[${i}].sha256`);
     });
   }
@@ -71,12 +80,16 @@ export function validateCountersignatureContent(c) {
 
 // Sign content with a key set: two signatures side by side, Ed25519 then
 // ML-DSA-87, each over its own signing input (format description, 3.9).
-export async function signWithKeySet(kind, content, privateKeys) {
+// Each item of "privateKeys" is a key or a signer (signatures.js);
+// "expected" is the key set the record must be signed with, where the
+// writer knows it, and a signer that holds another key is refused.
+export async function signWithKeySet(kind, content, privateKeys, expected) {
   const { contentBytes, payloadB64 } = encodeContent(content);
   const headers = protectedHeaders(kind);
+  const signers = await signingKeys(privateKeys, KEY_SET_METHODS, expected);
   const signatures = [];
   for (let i = 0; i < KEY_SET_METHODS.length; i++) {
-    const signature = await sign(KEY_SET_METHODS[i], privateKeys[i], signingInput(headers[i], payloadB64));
+    const signature = await signers[i](signingInput(headers[i], payloadB64));
     signatures.push({ protected: headers[i], signature: toBase64url(signature) });
   }
   return { record: withinSize({ payload: payloadB64, signatures }), fingerprint: await fingerprint(contentBytes) };
@@ -96,7 +109,7 @@ export async function signWithKeySet(kind, content, privateKeys) {
  * @param {string} [fields.terms] the fingerprint of the service's terms for agents that the agent relied on
  * @param {string} [fields.pass] for a helper agent: the fingerprint of the pass it acts under; "after" is then the stub before it under that pass
  * @param {number|Date} [fields.when] defaults to now
- * @param {CryptoKey[]} privateKeys the agent's private keys: Ed25519, then ML-DSA-87
+ * @param {any[]} privateKeys the agent's private keys, or signers (signatures.js): Ed25519, then ML-DSA-87
  * @returns {Promise<{record: object, fingerprint: string, seq: number}>}
  */
 export async function writeStub(fields, privateKeys) {
@@ -128,7 +141,7 @@ export async function writeStub(fields, privateKeys) {
  * reads the stub's fingerprint; it does not judge the stub.
  *
  * @param {object} stubRecord the stub as the agent sent it
- * @param {CryptoKey[]} privateKeys the service's private keys: Ed25519, then ML-DSA-87
+ * @param {any[]} privateKeys the service's private keys, or signers: Ed25519, then ML-DSA-87
  * @param {number|Date} [when] defaults to now
  * @returns {Promise<object>} the countersignature record
  */

package/src/timestamp.js

@@ -9,9 +9,9 @@
 // service's certificate. It follows no chain of certificates and asks no
 // outside party: the person checking decides whom to trust.
 
-import { TAG, badStamp, children, contentOf, ecdsaToRaw, expect, hexOf, readElement, timeOf, validateDer, wholeOf } from './der.js';
+import { TAG, badStamp, children, contentOf, ecdsaToRaw, expect, hexOf, readElement, setInOrder, timeOf, validateDer, wholeOf } from './der.js';
 import { Refusal, equalBytes, formatTime, sha256, toBase64url } from './encoding.js';
-import { weakEd25519 } from './keys.js';
+import { badEd25519Signature, weakEd25519 } from './keys.js';
 
 /** The largest time-stamp, in bytes. */
 export const MAX_STAMP_BYTES = 12288;
@@ -162,6 +162,8 @@ function checkKeyEncoding(bytes, certificate, method, size) {
 // force, and its public key.
 function readCertificate(bytes, element) {
   const whole = wholeOf(bytes, expect(element, TAG.SEQUENCE, 'a certificate'));
+  // A certificate is DER (RFC 5280 section 4.1), so the order of every set inside it is held here.
+  validateDer(bytes, element);
   const tbs = expect(children(bytes, element, 3)[0], TAG.SEQUENCE, 'the body of a certificate');
   const parts = children(bytes, tbs, 12);
   // The version, in [0], is absent only in the oldest kind of certificate.
@@ -204,14 +206,17 @@ function signingCertificateOf(bytes, value, v2) {
 }
 
 const KIND_NOT_ACCEPTED = 'A time-stamp was signed with a kind of key that is not accepted: RSA, ECDSA on the curves P-256 and P-384, and Ed25519 are.';
+const ED25519_DIGEST = 'A time-stamp signed with Ed25519 names a fingerprint method other than SHA-512, or gives the method parameters, which RFC 8419 does not allow.';
+const ED25519_PARAMETERS = 'A time-stamp signed with Ed25519 gives its signing method parameters, which RFC 8419 does not allow.';
 
 // Check the service's signature with the public key of its certificate.
 // Returns "valid", "invalid", or "unavailable" where this device has no
 // built-in support for the method. The fingerprint method is the one the
 // signer names (RFC 5652 section 5.4); a signing method that names another
 // is refused; a key of a kind that is not accepted is refused in words that
-// say so.
-async function verifyWith(certificate, bytes, signatureOid, digestName, signature, signed, without) {
+// say so. "parameters" holds the parameters, if any, of the signing method
+// and of the signer's fingerprint method.
+async function verifyWith(certificate, bytes, signatureOid, digestName, signature, signed, without, parameters) {
   const subtle = globalThis.crypto.subtle;
   let importParams;
   let verifyParams;
@@ -237,7 +242,11 @@ async function verifyWith(certificate, bytes, signatureOid, digestName, signatur
       return 'invalid';
     }
   } else if (certificate.keyOid === OID.ed25519) {
+    // With Ed25519 the signer's fingerprint method is SHA-512 with no
+    // parameters, and the signing method carries none (RFC 8419, section 3.1).
     if (signatureOid !== OID.ed25519) return 'invalid';
+    if (digestName !== 'SHA-512' || parameters.digest !== undefined) throw invalid(ED25519_DIGEST);
+    if (parameters.signature !== undefined) throw invalid(ED25519_PARAMETERS);
     checkKeyEncoding(bytes, certificate, 'Ed25519');
     method = 'Ed25519';
     importParams = { name: 'Ed25519' };
@@ -253,8 +262,8 @@ async function verifyWith(certificate, bytes, signatureOid, digestName, signatur
     // A device with no Ed25519 says so when the key is loaded.
     return method === 'Ed25519' && e && e.name === 'NotSupportedError' ? 'unavailable' : 'invalid';
   }
-  // An Ed25519 signature whose first half is a point of small order is refused, as everywhere (format description, section 3.8).
-  if (method === 'Ed25519' && (raw.length !== 64 || weakEd25519(raw.subarray(0, 32)))) return 'invalid';
+  // An Ed25519 signature whose first half is a point of small order, or whose number S is not below L, is refused, as everywhere (format description, section 3.8).
+  if (method === 'Ed25519' && badEd25519Signature(raw)) return 'invalid';
   try {
     return (await subtle.verify(verifyParams, key, raw, signed)) ? 'valid' : 'invalid';
   } catch {
@@ -275,7 +284,8 @@ async function verifyWith(certificate, bytes, signatureOid, digestName, signatur
  *   soundly, by a service the checker did not name. "unavailable": this
  *   device cannot check the service's signing method; no time is given.
  *   "authority" is the fingerprint of the certificate that signed. "when"
- *   is the stated time, to the second, rounded down.
+ *   is the stated time, to the second, rounded down; "time" is it in
+ *   milliseconds, a fraction of a second kept to the millisecond.
  * @throws {Refusal} "stamp-bad-data", "stamp-wrong-data" or "stamp-invalid"
  */
 export async function checkStamp(token, fingerprintBytes, options) {
@@ -287,10 +297,18 @@ export async function checkStamp(token, fingerprintBytes, options) {
   if (!(fingerprintBytes instanceof Uint8Array)) throw badStamp('there is no fingerprint to compare it with.');
 
   // The outer wrapper, and the signed data inside it (RFC 5652 sections 3
-  // and 5.1). Every part is read, and must be strict DER.
+  // and 5.1). Every part the reader can tell apart is read, and must be
+  // strict DER, except that the order of a set is held only where a standard
+  // requires DER: the signed attributes (RFC 5652 section 5.3), the statement
+  // (RFC 3161 section 2.4.2) and each certificate (RFC 5280 section 4.1),
+  // each walked again below with the order held. The signed data's own sets
+  // (the fingerprint methods, the certificates, the withdrawn certificates,
+  // the signers) and the rest of the signer may be in any order: CMS does not
+  // require DER of them, and real services list their certificates in chain
+  // order, the signing certificate before its issuer.
   const wrapper = expect(readElement(token, 0), TAG.SEQUENCE, 'the wrapper');
   if (wrapper.end !== token.length) throw badStamp('it has bytes left over.');
-  validateDer(token, wrapper);
+  validateDer(token, wrapper, false);
   const outer = children(token, wrapper, 2);
   if (outer.length !== 2 || hexOf(token, expect(outer[0], TAG.OID, 'the kind of content')) !== OID.signedData) throw badStamp('it is not signed data.');
   const inner = children(token, expect(outer[1], TAG.CONTEXT_0, 'the signed data'), 1);
@@ -309,7 +327,11 @@ export async function checkStamp(token, fingerprintBytes, options) {
   let next = 3;
   const certificates = [];
   if (parts[next] && parts[next].tag === TAG.CONTEXT_0) {
-    for (const c of children(token, parts[next], 8)) {
+    // A set of the signed data's own (RFC 5652 section 10.2.3), which CMS does
+    // not require to be in DER order; each certificate inside it is DER (RFC
+    // 5280 section 4.1), and is held to it when it is read.
+    const items = children(token, parts[next], 8);
+    for (const c of items) {
       // Other kinds of certificate may sit here; only the ordinary kind is read.
       if (c.tag === TAG.SEQUENCE) certificates.push(readCertificate(token, c));
     }
@@ -324,9 +346,16 @@ export async function checkStamp(token, fingerprintBytes, options) {
   if (!signer[1] || !((signerVersion === '01' && signer[1].tag === TAG.SEQUENCE) || (signerVersion === '03' && signer[1].tag === 0x80))) {
     throw badStamp('the signer is not named as its standard sets out.');
   }
-  const digestName = HASHES[algorithmOf(token, signer[2], 'the signer\'s fingerprint method').oid];
+  const digesting = algorithmOf(token, signer[2], 'the signer\'s fingerprint method');
+  const digestName = HASHES[digesting.oid];
   const attributes = expect(signer[3], TAG.CONTEXT_0, 'the signed attributes');
-  const signatureOid = algorithmOf(token, signer[4], 'the signing method').oid;
+  // A set under a tag of its own, in DER (RFC 5652 section 5.3), so its order,
+  // and the order of every set inside it, is held to DER here.
+  const attributeList = children(token, attributes, 16);
+  if (!setInOrder(token, attributeList)) throw badStamp('the signed attributes are not in the order DER requires.');
+  for (const a of attributeList) validateDer(token, a);
+  const signing = algorithmOf(token, signer[4], 'the signing method');
+  const signatureOid = signing.oid;
   const signature = contentOf(token, expect(signer[5], TAG.OCTET_STRING, 'the signature'));
   if (signer.length > 7 || (signer.length === 7 && signer[6].tag !== TAG.CONTEXT_1)) throw badStamp('the signer holds parts that are not in the order its standard sets out.');
 
@@ -344,7 +373,9 @@ export async function checkStamp(token, fingerprintBytes, options) {
   let kindNamed = false;
   let digestNamed = false;
   let named = null;
-  for (const attribute of children(token, attributes, 16)) {
+  let newerNamed = false;
+  let olderNamed = false;
+  for (const attribute of attributeList) {
     const pair = children(token, expect(attribute, TAG.SEQUENCE, 'an attribute'), 2);
     const name = hexOf(token, expect(pair[0], TAG.OID, 'the name of an attribute'));
     const values = children(token, expect(pair[1], TAG.SET, 'the value of an attribute'), 4);
@@ -360,8 +391,16 @@ export async function checkStamp(token, fingerprintBytes, options) {
       digestNamed = true;
     } else if (name === OID.signingCertificateV2 || name === OID.signingCertificate) {
       if (values.length !== 1) throw invalid('A time-stamp does not say, in one way, which certificate signed it.');
-      // Where both forms are present, the newer one is used.
-      if (named === null || name === OID.signingCertificateV2) named = signingCertificateOf(token, values[0], name === OID.signingCertificateV2);
+      // Each form at most once: RFC 5035 section 3 for the newer form, and
+      // for the older section 5.4.2 of RFC 2634 as RFC 5035 section 5 writes
+      // it. Where both forms are present, the newer one is used: this
+      // format's choice, where RFC 5035 section 7 lets a reader refuse a
+      // time-stamp whose two forms disagree.
+      const newer = name === OID.signingCertificateV2;
+      if (newer ? newerNamed : olderNamed) throw invalid('A time-stamp names the certificate that signed it more than once in the same form, which its standard does not allow.');
+      if (newer) newerNamed = true;
+      else olderNamed = true;
+      if (named === null || newer) named = signingCertificateOf(token, values[0], newer);
     }
   }
   if (!kindNamed || !digestNamed) throw invalid('A time-stamp\'s signature does not cover its statement.');
@@ -382,7 +421,7 @@ export async function checkStamp(token, fingerprintBytes, options) {
   // 5.4). The bytes are copied, so that the caller's time-stamp is not changed.
   const signed = new Uint8Array(wholeOf(token, attributes));
   signed[0] = TAG.SET;
-  const state = await verifyWith(certificate, token, signatureOid, digestName, signature, signed, without);
+  const state = await verifyWith(certificate, token, signatureOid, digestName, signature, signed, without, { signature: signing.parameters, digest: digesting.parameters });
   if (state === 'unavailable') return { state: 'unavailable', when: null, time: NaN, authority: null };
   if (state !== 'valid') throw invalid('A time-stamp\'s signature does not fit the certificate it names.');
   if (statement.time < certificate.notBefore || statement.time > certificate.notAfter) {