CMS

Verify a CMS SignedData signature (RFC 5652 sec. 5) -- the structure S/MIME signed mail, RFC 3161 timestamp tokens, and code-signing all rest on. verify(cms, opts) parses the SignedData (over the strict pki.schema.cms codec), locates each SignerInfo's signer certificate by its issuerAndSerialNumber or subjectKeyIdentifier, and checks the signature over the exact bytes RFC 5652 sec. 5.4 defines: when signed attributes are present it confirms the message-digest attribute equals the digest of the content and verifies the signature over the DER re-encoding of the SignedAttributes (the on-wire [0] tag replaced by a universal SET OF); otherwise it verifies directly over the content. Attached and detached content, single and multiple signers, and RSA / RSASSA-PSS / ECDSA / EdDSA, the post-quantum ML-DSA (ML-DSA-44/65/87, RFC 9882) and SLH-DSA (the twelve FIPS 205 sets, RFC 9814), and composite ML-DSA (pairing ML-DSA with a traditional RSA / ECDSA / EdDSA, accepted only when BOTH components verify -- draft-ietf-lamps-cms-composite-sigs) are covered. It reports a per-signer verdict; it does NOT chain the signer certificate to a trust anchor -- that is the caller's step through pki.path.validate.

pki.cms.verify(input, opts?) -> Promise<{ valid, signers }>

certs    Extra signer certificates (an array of DER `Buffer`s) to match against, in
                addition to the certificates embedded in the SignedData.

async function example() {
  var res = await pki.cms.verify(p7sDer, { content: detachedBytes });
  res.valid;                         // boolean
  res.signers[0].ok;                 // per-signer verdict
}
example();

pki.cms.sign(content, signers, opts?) -> Promise<Buffer|string>

unsignedAttributes  Unsigned attributes for every SignerInfo, each `{ type, values }`
                         (`type` an OID name or dotted string, `values` an array of DER value
                         `Buffer`s). Placed in the SignerInfo `[1]` unsignedAttrs -- OUTSIDE the
                         signature, so they carry no cryptographic assurance and a verifier never
                         reports them authenticated. The vehicle for an RFC 3161 timestamp token
                         (`timeStampToken`); content-type / message-digest / signing-time are
                         rejected here (RFC 5652 sec. 11). Use `pki.cms.countersign` for a
                         countersignature specifically.

async function example() {
  var p7 = await pki.cms.sign(Buffer.from("hello"), { cert: signerCertDer, key: signerKeyPkcs8 });
  var res = await pki.cms.verify(p7);   // res.valid === true
}
example();

pki.cms.countersign(cms, signers, opts?) -> Promise<Buffer|string>

pem                   Return a PEM string instead of a DER Buffer.

async function example() {
  var p7 = await pki.cms.sign(Buffer.from("hi"), { cert: signerCertDer, key: signerKeyPkcs8 });
  var cs = await pki.cms.countersign(p7, { cert: signerCertDer, key: signerKeyPkcs8 });
  var res = await pki.cms.verify(cs);
  res.signers[0].countersignatures[0].ok;   // true
}
example();

pki.cms.encrypt(content, recipients, opts?) -> Promise<Buffer | string>

pem           Return a PEM string instead of a DER Buffer.

async function example() {
  var env = await pki.cms.encrypt(Buffer.from("secret"), [{ cert: recipientCertDer }]);
}
example();

pki.cms.authenticate(content, recipients, opts?) -> Promise<Buffer | string>

pem Return a PEM string (`-----BEGIN CMS-----`) instead of a DER Buffer.

async function example() {
  var r = pki.cms; // authenticate a message to an RSA recipient, then verify via decrypt
  var auth = await r.authenticate(Buffer.from("hi"), [{ cert: recipientCertDer }]);
  var out = await r.decrypt(auth, { key: recipientKeyPkcs8, cert: recipientCertDer });
  out.authenticated;   // true
}
example();

pki.cms.decrypt(input, keyMaterial, opts?) -> Promise<{ content, contentType, contentTypeName, recipientType, recipientIndex, contentEncryptionAlgorithm, authenticated }>

maxIterations  Lower the PBKDF2 iteration cap (a DoS bound; downward only).

async function example() {
  var res = await pki.cms.decrypt(envDer, { key: recipientKeyPkcs8, cert: recipientCertDer });
  res.content;   // the recovered plaintext Buffer
}
example();

pki.cms.compress(content, opts?) -> Promise<Buffer | string>

pem         Return a PEM string instead of a DER Buffer.

async function example() {
  var z = await pki.cms.compress(Buffer.from("compress me"));
}
example();

pki.cms.decompress(input, opts?) -> Promise<{ content, contentType, contentTypeName, compressionAlgorithm }>

maxOutputBytes Lower the decompressed-output cap (a DoS bound; downward only).

async function example() {
  var res = await pki.cms.decompress(compressedDer);
  res.content;   // the recovered plaintext Buffer
}
example();