synta-certificate 0.2.6

//! Composite ML-DSA key generation, signing, and verification for the NSS backend.
//!
//! NSS limitations (documented):
//! - The SHAKE256 hash (sub_arc 51, MLDSA87-Ed448-SHAKE256) is not available via
//!   `PK11_HashBuf`; that variant is unsupported for both signing and verification.
//! - Brainpool curves (sub-arcs 47, 50) are unsupported for both **signing** and
//!   **verification** on NSS (no brainpool support in `ec_alg_params`).
//!
//! The ML-DSA component is signed and verified using `PK11_SignWithMechanism` /
//! `PK11_VerifyWithMechanism` with `CKM_ML_DSA` and a `CK_SIGN_ADDITIONAL_CONTEXT`
//! carrying `spec.label` as the context string, fully conforming to §3.1 of
//! draft-ietf-lamps-pq-composite-sigs-19.
//!
//! RSA-PSS signing uses `PK11_SignWithMechanism` with `CKM_SHA256/512_RSA_PKCS_PSS`
//! and `CK_RSA_PKCS_PSS_PARAMS`.  Ed448 signing uses `PK11_SignWithMechanism` with
//! `CKM_EDDSA` and `CK_EDDSA_PARAMS { phFlag = 0 }` (pure EdDSA, no prehash).

use std::ptr;

use nss_sys::nspr::{PR_FALSE, PR_TRUE};
use nss_sys::{SECAlgorithmIDStr, SECItemStr, SECItemType, SECStatus};

use synta::ToDer;

use crate::crypto::composite_mldsa::{
    build_m_prime_from_hash, composite_oid_components, composite_spec, encode_composite_pkcs8,
    encode_composite_spki, extract_spki_bitstring_payload, pkcs8_private_key_content,
    split_composite_privkey, split_composite_sig, split_composite_spki_content, CompHash,
    CompositeMlDsaSpec, TradAlg,
};
use crate::crypto::{BackendPrivateKey, ErasedCertificateSigner, PrivateKeyError};
use crate::oids;

use super::ensure_nss_init;
use super::ffi::SECOidTag;
use super::ffi::{
    CkEddsaParams, CkRsaPkcsPssParams, CkSignAdditionalContext, PK11_FreeSlot,
    PK11_GetInternalSlot, PK11_HashBuf, PK11_ImportDERPrivateKeyInfoAndReturnKey,
    PK11_SignWithMechanism, PK11_SignatureLen, PK11_Verify, PK11_VerifyWithMechanism,
    SECKEY_DecodeDERSubjectPublicKeyInfo, SECKEY_DestroyPrivateKey, SECKEY_DestroyPublicKey,
    SECKEY_DestroySubjectPublicKeyInfo, SECKEY_ExtractPublicKey, VFY_VerifyDataWithAlgorithmID,
    CKG_MGF1_SHA256, CKG_MGF1_SHA512, CKH_HEDGE_PREFERRED, CKM_EDDSA, CKM_ML_DSA, CKM_SHA256,
    CKM_SHA256_RSA_PKCS_PSS, CKM_SHA512, CKM_SHA512_RSA_PKCS_PSS, KU_DIGITAL_SIGNATURE,
    SEC_OID_SHA256, SEC_OID_SHA512,
};
use super::ffi::{
    SEC_OID_ANSIX962_ECDSA_SHA256_SIGNATURE, SEC_OID_ANSIX962_ECDSA_SHA512_SIGNATURE,
    SEC_OID_ED25519_SIGNATURE, SEC_OID_PKCS1_SHA256_WITH_RSA_ENCRYPTION,
    SEC_OID_PKCS1_SHA512_WITH_RSA_ENCRYPTION,
};
use super::signing::{do_nss_sign, NssSignerError};

// ── Composite error type ──────────────────────────────────────────────────────

#[derive(Debug)]
pub(super) struct CompositeNssError(pub String);

impl std::fmt::Display for CompositeNssError {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.write_str(&self.0)
    }
}

impl std::error::Error for CompositeNssError {}

impl From<String> for CompositeNssError {
    fn from(s: String) -> Self {
        CompositeNssError(s)
    }
}

// ── NSS hash for M' construction ─────────────────────────────────────────────

fn nss_hash_tbs(tbs_der: &[u8], hash: CompHash) -> Result<Vec<u8>, CompositeNssError> {
    if !ensure_nss_init() {
        return Err(CompositeNssError("NSS initialisation failed".to_string()));
    }
    let (nss_tag, out_len) = match hash {
        CompHash::Sha256 => (SEC_OID_SHA256, 32usize),
        CompHash::Sha512 => (SEC_OID_SHA512, 64usize),
        CompHash::Shake256_64 => {
            return Err(CompositeNssError(
                "SHAKE256 is not supported in the NSS composite path (sub_arc 51)".to_string(),
            ));
        }
    };
    let mut out = vec![0u8; out_len];
    let in_len = i32::try_from(tbs_der.len())
        .map_err(|_| CompositeNssError("PK11_HashBuf: input exceeds i32::MAX bytes".to_string()))?;
    // SAFETY: out is a valid writable buffer of `out_len` bytes;
    // tbs_der is a valid readable slice of `in_len` bytes.
    let status = unsafe { PK11_HashBuf(nss_tag, out.as_mut_ptr(), tbs_der.as_ptr(), in_len) };
    if status == SECStatus::SECSuccess {
        Ok(out)
    } else {
        let nss_err = unsafe { nss_sys::nspr::PR_GetError() };
        let hash_name = match hash {
            CompHash::Sha256 => "SHA-256",
            CompHash::Sha512 => "SHA-512",
            CompHash::Shake256_64 => "SHAKE256",
        };
        Err(CompositeNssError(format!(
            "PK11_HashBuf failed for {hash_name} on {}-byte input (NSS error {nss_err})",
            tbs_der.len()
        )))
    }
}

fn nss_build_m_prime(
    tbs_der: &[u8],
    spec: &CompositeMlDsaSpec,
) -> Result<Vec<u8>, CompositeNssError> {
    let hash = nss_hash_tbs(tbs_der, spec.hash)?;
    Ok(build_m_prime_from_hash(&hash, spec))
}

// ── DER helpers for standalone component SPKI and PKCS#8 ─────────────────────

fn encode_standalone_spki(
    oid_comps: &[u32],
    alg_params: Option<synta::types::constructed::Element<'_>>,
    raw_pk: &[u8],
) -> Result<Vec<u8>, String> {
    use synta::tag::{Tag, TAG_SEQUENCE};
    use synta::types::string::BitStringRef;
    use synta::{Encoder, Encoding, ObjectIdentifier};

    let oid = ObjectIdentifier::new(oid_comps).map_err(|e| format!("invalid OID: {e}"))?;
    let pk_bit =
        BitStringRef::new(raw_pk, 0).map_err(|e| format!("BIT STRING encoding failed: {e}"))?;

    (|| -> synta::Result<Vec<u8>> {
        let mut enc = Encoder::new(Encoding::Der);
        enc.start_constructed_no_guard(Tag::universal_constructed(TAG_SEQUENCE))?;
        enc.start_constructed_no_guard(Tag::universal_constructed(TAG_SEQUENCE))?;
        enc.encode(&oid)?;
        if let Some(params) = alg_params {
            enc.encode(&params)?;
        }
        enc.end_constructed()?;
        enc.encode(&pk_bit)?;
        enc.end_constructed()?;
        enc.finish()
    })()
    .map_err(|e| format!("SPKI DER encoding failed: {e}"))
}

fn encode_standalone_pkcs8(
    oid_comps: &[u32],
    alg_params: Option<synta::types::constructed::Element<'_>>,
    privkey_content: &[u8],
) -> Result<Vec<u8>, String> {
    use synta::types::string::OctetStringRef;
    use synta::ObjectIdentifier;

    let oid = ObjectIdentifier::new(oid_comps).map_err(|e| format!("invalid OID: {e}"))?;
    let alg = crate::AlgorithmIdentifier {
        algorithm: oid,
        parameters: alg_params,
    };
    let pki = crate::pkcs8_types::OneAsymmetricKey {
        version: synta::Integer::from_i64(0),
        private_key_algorithm: alg,
        private_key: OctetStringRef::new(privkey_content),
        attributes: None,
        public_key: None,
    };
    pki.to_der()
        .map_err(|e| format!("PKCS#8 DER encoding failed: {e}"))
}

fn ec_alg_params(curve: &str) -> Result<synta::types::constructed::Element<'static>, String> {
    use synta::{types::constructed::Element, ObjectIdentifier};
    let comps: &[u32] = match curve {
        "P-256" => oids::EC_CURVE_P256,
        "P-384" => oids::EC_CURVE_P384,
        "P-521" => oids::EC_CURVE_P521,
        other => return Err(format!("unsupported EC curve for NSS composite: {other}")),
    };
    let oid = ObjectIdentifier::new(comps).map_err(|e| format!("invalid curve OID: {e}"))?;
    Ok(Element::ObjectIdentifier(oid))
}

fn encode_trad_spki(trad_alg: &TradAlg, raw_pk: &[u8]) -> Result<Vec<u8>, String> {
    use synta::{Element, Null};
    match trad_alg {
        TradAlg::RsaPss { .. } | TradAlg::RsaPkcs15 { .. } => {
            encode_standalone_spki(oids::RSA_ENCRYPTION, Some(Element::Null(Null)), raw_pk)
        }
        TradAlg::Ec { curve, .. } => {
            let params = ec_alg_params(curve)?;
            encode_standalone_spki(oids::EC_PUBLIC_KEY, Some(params), raw_pk)
        }
        TradAlg::Ed25519 => encode_standalone_spki(oids::ED25519, None, raw_pk),
        TradAlg::Ed448 => encode_standalone_spki(oids::ED448, None, raw_pk),
    }
}

fn encode_trad_pkcs8(trad_alg: &TradAlg, trad_sk: &[u8]) -> Result<Vec<u8>, String> {
    use synta::{Element, Null};
    match trad_alg {
        TradAlg::RsaPss { .. } | TradAlg::RsaPkcs15 { .. } => {
            encode_standalone_pkcs8(oids::RSA_ENCRYPTION, Some(Element::Null(Null)), trad_sk)
        }
        TradAlg::Ec { curve, .. } => {
            let params = ec_alg_params(curve)?;
            encode_standalone_pkcs8(oids::EC_PUBLIC_KEY, Some(params), trad_sk)
        }
        TradAlg::Ed25519 => encode_standalone_pkcs8(oids::ED25519, None, trad_sk),
        TradAlg::Ed448 => encode_standalone_pkcs8(oids::ED448, None, trad_sk),
    }
}

// ── RSA-PSS AlgorithmIdentifier parameters DER ───────────────────────────────

/// Build the RSASSA-PSS parameters SEQUENCE DER for use in an AlgorithmIdentifier.
///
/// NSS's `VFY_VerifyDataWithAlgorithmID` reads PSS parameters from the
/// AlgorithmIdentifier when verifying RSA-PSS signatures.
fn build_rsa_pss_params_der(hash: &str) -> Result<Vec<u8>, String> {
    use synta::tag::{Tag, TAG_SEQUENCE};
    use synta::{Encoder, Encoding, Integer, ObjectIdentifier};

    let (hash_oid_comps, salt_len): (&[u32], i64) = match hash {
        "sha256" => (oids::ID_SHA256, 32),
        "sha512" => (oids::ID_SHA512, 64),
        other => return Err(format!("unsupported hash for RSA-PSS parameters: {other}")),
    };

    let hash_oid =
        ObjectIdentifier::new(hash_oid_comps).map_err(|e| format!("invalid hash OID: {e}"))?;
    let mgf1_oid =
        ObjectIdentifier::new(oids::MGF1).map_err(|e| format!("invalid MGF1 OID: {e}"))?;

    (|| -> synta::Result<Vec<u8>> {
        let mut enc = Encoder::new(Encoding::Der);
        enc.start_constructed_no_guard(Tag::universal_constructed(TAG_SEQUENCE))?;
        // [0] EXPLICIT hashAlgorithm
        enc.start_constructed_no_guard(Tag::context_specific_constructed(0))?;
        enc.start_constructed_no_guard(Tag::universal_constructed(TAG_SEQUENCE))?;
        enc.encode(&hash_oid)?;
        enc.end_constructed()?;
        enc.end_constructed()?;
        // [1] EXPLICIT maskGenAlgorithm: mgf1 + hash
        enc.start_constructed_no_guard(Tag::context_specific_constructed(1))?;
        enc.start_constructed_no_guard(Tag::universal_constructed(TAG_SEQUENCE))?;
        enc.encode(&mgf1_oid)?;
        enc.start_constructed_no_guard(Tag::universal_constructed(TAG_SEQUENCE))?;
        enc.encode(&hash_oid)?;
        enc.end_constructed()?;
        enc.end_constructed()?;
        enc.end_constructed()?;
        // [2] EXPLICIT saltLength
        enc.start_constructed_no_guard(Tag::context_specific_constructed(2))?;
        enc.encode(&Integer::from_i64(salt_len))?;
        enc.end_constructed()?;
        // [3] EXPLICIT trailerField = 1
        enc.start_constructed_no_guard(Tag::context_specific_constructed(3))?;
        enc.encode(&Integer::from_i64(1))?;
        enc.end_constructed()?;
        enc.end_constructed()?;
        enc.finish()
    })()
    .map_err(|e| format!("RSA-PSS params DER encoding failed: {e}"))
}

// ── OID DER encoding ──────────────────────────────────────────────────────────

fn encode_oid_der(oid_comps: &[u32]) -> Result<Vec<u8>, String> {
    let oid = synta::ObjectIdentifier::new(oid_comps).map_err(|e| format!("invalid OID: {e}"))?;
    oid.to_der()
        .map_err(|e| format!("OID DER encoding failed: {e}"))
}

// ── Key generation ────────────────────────────────────────────────────────────

/// Generate a composite ML-DSA key pair using the NSS backend.
///
/// Generates each component key separately (ML-DSA via `CKM_ML_DSA_KEY_PAIR_GEN`,
/// traditional via the appropriate NSS mechanism), then concatenates the private
/// material and public keys into the composite PKCS#8 and SPKI formats.
///
/// # NSS limitations
///
/// - Brainpool curves (`brainpoolP256r1`, `brainpoolP384r1`) are not supported
///   by the NSS internal slot; those variants return an error.
/// - Ed448 key generation is attempted via `CKM_EC_EDWARDS_KEY_PAIR_GEN`.
pub(crate) fn priv_generate_composite_mldsa(
    sub_arc: u32,
) -> Result<BackendPrivateKey, PrivateKeyError> {
    let spec = composite_spec(sub_arc).ok_or_else(|| {
        PrivateKeyError::new(CompositeNssError(format!(
            "unknown composite ML-DSA sub_arc: {sub_arc}"
        )))
    })?;

    // Generate ML-DSA component key.
    let mldsa_key = super::key_ops::generate_ml_dsa(spec.mldsa_variant)?;
    let mldsa_pkcs8 = mldsa_key.pkcs8_bytes().to_vec();
    let mldsa_seed = pkcs8_private_key_content(&mldsa_pkcs8)
        .map_err(|e| PrivateKeyError::new(CompositeNssError(e)))?;
    // Derive the ML-DSA public key SPKI, then extract its BIT STRING payload.
    let mldsa_spki = mldsa_key
        .public_key()
        .map_err(|e| PrivateKeyError::new(CompositeNssError(format!("{e}"))))?
        .spki_der;
    let mldsa_pk = extract_spki_bitstring_payload(&mldsa_spki)
        .map_err(|e| PrivateKeyError::new(CompositeNssError(e)))?;

    // Generate traditional component key.
    let (trad_sk, trad_pk) = generate_trad_key_nss(&spec.trad_alg)?;

    // Build composite OID and encoded keys.
    let oid_comps = composite_oid_components(spec.sub_arc);
    let spki_der = encode_composite_spki(&oid_comps, &mldsa_pk, &trad_pk)
        .map_err(|e| PrivateKeyError::new(CompositeNssError(e)))?;
    let pkcs8_der = encode_composite_pkcs8(&oid_comps, &mldsa_seed, &trad_sk)
        .map_err(|e| PrivateKeyError::new(CompositeNssError(e)))?;

    let pkcs8_cell = std::sync::OnceLock::new();
    pkcs8_cell.set(pkcs8_der).expect("fresh OnceLock");
    Ok(BackendPrivateKey {
        pkcs8_der: pkcs8_cell,
        spki_cache: Some(spki_der),
        pkcs11: None,
    })
}

/// Generate the traditional component key using NSS and return `(trad_sk, trad_pk)`.
fn generate_trad_key_nss(trad_alg: &TradAlg) -> Result<(Vec<u8>, Vec<u8>), PrivateKeyError> {
    let err = |s: String| PrivateKeyError::new(CompositeNssError(s));

    match trad_alg {
        TradAlg::RsaPss { bits, .. } | TradAlg::RsaPkcs15 { bits, .. } => {
            let key = BackendPrivateKey::generate_rsa(*bits, 65537)?;
            let pkcs8 = key.pkcs8_bytes().to_vec();
            let trad_sk = pkcs8_private_key_content(&pkcs8).map_err(err)?;
            let spki = key
                .public_key()
                .map_err(|e| PrivateKeyError::new(CompositeNssError(format!("{e}"))))?
                .spki_der;
            let trad_pk = extract_spki_bitstring_payload(&spki).map_err(err)?;
            Ok((trad_sk, trad_pk))
        }
        TradAlg::Ec { curve, .. } => {
            let key = BackendPrivateKey::generate_ec(curve)?;
            let pkcs8 = key.pkcs8_bytes().to_vec();
            let trad_sk = pkcs8_private_key_content(&pkcs8).map_err(err)?;
            let spki = key
                .public_key()
                .map_err(|e| PrivateKeyError::new(CompositeNssError(format!("{e}"))))?
                .spki_der;
            let trad_pk = extract_spki_bitstring_payload(&spki).map_err(err)?;
            Ok((trad_sk, trad_pk))
        }
        TradAlg::Ed25519 => {
            let key = BackendPrivateKey::generate_ed25519()?;
            let pkcs8 = key.pkcs8_bytes().to_vec();
            let trad_sk = pkcs8_private_key_content(&pkcs8).map_err(err)?;
            let spki = key
                .public_key()
                .map_err(|e| PrivateKeyError::new(CompositeNssError(format!("{e}"))))?
                .spki_der;
            let trad_pk = extract_spki_bitstring_payload(&spki).map_err(err)?;
            Ok((trad_sk, trad_pk))
        }
        TradAlg::Ed448 => {
            let key = BackendPrivateKey::generate_ed448()?;
            let pkcs8 = key.pkcs8_bytes().to_vec();
            let trad_sk = pkcs8_private_key_content(&pkcs8).map_err(err)?;
            let spki = key
                .public_key()
                .map_err(|e| PrivateKeyError::new(CompositeNssError(format!("{e}"))))?
                .spki_der;
            let trad_pk = extract_spki_bitstring_payload(&spki).map_err(err)?;
            Ok((trad_sk, trad_pk))
        }
    }
}

// ── Composite signer ──────────────────────────────────────────────────────────

/// Dispatch token for the traditional algorithm component of a composite sign.
enum NssTradSignerKind {
    /// Use `SEC_SignData` with the given NSS OID tag (RSA-PKCS15, ECDSA, Ed25519).
    SecSignData(SECOidTag),
    /// RSA-PSS via `PK11_SignWithMechanism(CKM_SHA256/512_RSA_PKCS_PSS)`.
    RsaPss { hash: &'static str },
    /// Ed448 via `PK11_SignWithMechanism(CKM_EDDSA, phFlag=0)`.
    Ed448,
}

/// NSS-backed signer for composite ML-DSA keys.
///
/// Signs M' with each component key and concatenates the results:
/// `mldsa_sig || trad_sig`.
///
/// # Security note
///
/// `mldsa_pkcs8` and `trad_pkcs8` store raw private key material and are **not**
/// zeroized on drop.  If the process handles sensitive keys, clear or replace
/// this signer before disposal.
pub(crate) struct CompositeMLDsaNssSigner {
    spec: &'static CompositeMlDsaSpec,
    mldsa_pkcs8: Vec<u8>,
    trad_pkcs8: Vec<u8>,
    trad_kind: NssTradSignerKind,
}

impl CompositeMLDsaNssSigner {
    fn from_composite_pkcs8(
        pkcs8_der: &[u8],
        spec: &'static CompositeMlDsaSpec,
    ) -> Result<Self, CompositeNssError> {
        let privkey = pkcs8_private_key_content(pkcs8_der).map_err(CompositeNssError::from)?;
        let (mldsa_seed, trad_sk) =
            split_composite_privkey(&privkey).map_err(CompositeNssError::from)?;

        // Reconstruct standalone ML-DSA PKCS#8.
        let mldsa_oid: &[u32] = match spec.mldsa_variant {
            "ML-DSA-44" => oids::ML_DSA_44,
            "ML-DSA-65" => oids::ML_DSA_65,
            "ML-DSA-87" => oids::ML_DSA_87,
            other => {
                return Err(CompositeNssError(format!(
                    "unknown ML-DSA variant: {other}"
                )))
            }
        };
        let mldsa_pkcs8 = encode_standalone_pkcs8(mldsa_oid, None, mldsa_seed)
            .map_err(CompositeNssError::from)?;

        // Reconstruct standalone traditional PKCS#8.
        let trad_pkcs8 =
            encode_trad_pkcs8(&spec.trad_alg, trad_sk).map_err(CompositeNssError::from)?;

        // Determine signing dispatch for the traditional component.
        let trad_kind = match &spec.trad_alg {
            TradAlg::RsaPkcs15 { hash, .. } => match *hash {
                "sha256" => {
                    NssTradSignerKind::SecSignData(SEC_OID_PKCS1_SHA256_WITH_RSA_ENCRYPTION)
                }
                "sha512" => {
                    NssTradSignerKind::SecSignData(SEC_OID_PKCS1_SHA512_WITH_RSA_ENCRYPTION)
                }
                other => {
                    return Err(CompositeNssError(format!(
                        "unsupported RSA-PKCS15 hash: {other}"
                    )))
                }
            },
            TradAlg::Ec { hash, .. } => match *hash {
                "sha256" => NssTradSignerKind::SecSignData(SEC_OID_ANSIX962_ECDSA_SHA256_SIGNATURE),
                "sha512" => NssTradSignerKind::SecSignData(SEC_OID_ANSIX962_ECDSA_SHA512_SIGNATURE),
                other => {
                    return Err(CompositeNssError(format!(
                        "unsupported ECDSA hash: {other}"
                    )))
                }
            },
            TradAlg::Ed25519 => NssTradSignerKind::SecSignData(SEC_OID_ED25519_SIGNATURE),
            TradAlg::RsaPss { hash, .. } => NssTradSignerKind::RsaPss { hash },
            TradAlg::Ed448 => NssTradSignerKind::Ed448,
        };

        Ok(Self {
            spec,
            mldsa_pkcs8,
            trad_pkcs8,
            trad_kind,
        })
    }
}

impl ErasedCertificateSigner for CompositeMLDsaNssSigner {
    fn signature_algorithm_der_erased(&self) -> Result<Vec<u8>, PrivateKeyError> {
        let comps = composite_oid_components(self.spec.sub_arc);
        let oid = synta::ObjectIdentifier::new(&comps)
            .map_err(|e| PrivateKeyError::new(CompositeNssError(e.to_string())))?;
        let alg = crate::AlgorithmIdentifier {
            algorithm: oid,
            parameters: None,
        };
        alg.to_der()
            .map_err(|e| PrivateKeyError::new(CompositeNssError(e.to_string())))
    }

    fn sign_tbs_erased(&self, tbs_der: &[u8]) -> Result<Vec<u8>, PrivateKeyError> {
        let m_prime = nss_build_m_prime(tbs_der, self.spec).map_err(PrivateKeyError::new)?;

        // Sign the ML-DSA component using PK11_SignWithMechanism(CKM_ML_DSA) so that
        // spec.label is passed as the context string per composite ML-DSA §3.1.
        let mldsa_sig = sign_mldsa_with_context(
            &self.mldsa_pkcs8,
            &m_prime,
            self.spec.label.as_bytes(),
            self.spec.mldsa_sig_size,
        )
        .map_err(PrivateKeyError::new)?;

        let trad_sig = match &self.trad_kind {
            NssTradSignerKind::SecSignData(tag) => {
                do_nss_sign(&self.trad_pkcs8, &m_prime, *tag).map_err(PrivateKeyError::new)?
            }
            NssTradSignerKind::RsaPss { hash } => {
                sign_rsa_pss(&self.trad_pkcs8, &m_prime, hash).map_err(PrivateKeyError::new)?
            }
            NssTradSignerKind::Ed448 => {
                sign_ed448(&self.trad_pkcs8, &m_prime).map_err(PrivateKeyError::new)?
            }
        };

        let mut sig = Vec::with_capacity(mldsa_sig.len() + trad_sig.len());
        sig.extend_from_slice(&mldsa_sig);
        sig.extend_from_slice(&trad_sig);
        Ok(sig)
    }
}

/// Construct a boxed [`ErasedCertificateSigner`] for a composite ML-DSA key.
///
/// Called from [`BackendPrivateKey::as_signer`] when the PKCS#8 OID is in the
/// composite ML-DSA arc.
pub(crate) fn composite_mldsa_signer_from_pkcs8(
    pkcs8_der: &[u8],
    spec: &'static CompositeMlDsaSpec,
) -> Box<dyn ErasedCertificateSigner> {
    match CompositeMLDsaNssSigner::from_composite_pkcs8(pkcs8_der, spec) {
        Ok(signer) => Box::new(signer),
        Err(e) => Box::new(NssFailedCompositeSigner(format!(
            "composite signer init failed: {e}"
        ))),
    }
}

/// Reports a composite signer initialization error on first use (for debugging).
struct NssFailedCompositeSigner(String);

impl ErasedCertificateSigner for NssFailedCompositeSigner {
    fn signature_algorithm_der_erased(&self) -> Result<Vec<u8>, PrivateKeyError> {
        Err(PrivateKeyError::new(NssSignerError(self.0.clone())))
    }

    fn sign_tbs_erased(&self, _tbs_der: &[u8]) -> Result<Vec<u8>, PrivateKeyError> {
        Err(PrivateKeyError::new(NssSignerError(self.0.clone())))
    }
}

// ── Composite signature verification ─────────────────────────────────────────

/// Verify a composite ML-DSA signature using the NSS backend.
///
/// Called from `signature::do_verify_signature` when the signature OID is in
/// the composite ML-DSA arc.
pub(super) fn verify_composite_mldsa_signature(
    tbs_der: &[u8],
    sub_arc: u32,
    signature_bits: &[u8],
    issuer_spki_der: &[u8],
) -> Result<(), super::signature::NssVerifierError> {
    use super::signature::NssVerifierError;
    let err = |s: String| NssVerifierError(s);

    let spec = composite_spec(sub_arc)
        .ok_or_else(|| err(format!("unknown composite ML-DSA sub_arc: {sub_arc}")))?;

    // Build M'.
    let m_prime = nss_build_m_prime(tbs_der, spec).map_err(|e| err(e.to_string()))?;

    // Extract and split the composite SPKI BIT STRING.
    let spki_payload = extract_spki_bitstring_payload(issuer_spki_der).map_err(|e| err(e))?;
    let (mldsa_pk, trad_pk) =
        split_composite_spki_content(&spki_payload, spec).map_err(|e| err(e))?;

    // Split the composite signature.
    let (mldsa_sig, trad_sig) = split_composite_sig(signature_bits, spec).map_err(|e| err(e))?;

    // Determine ML-DSA standalone OID.
    let mldsa_oid: &[u32] = match spec.mldsa_variant {
        "ML-DSA-44" => oids::ML_DSA_44,
        "ML-DSA-65" => oids::ML_DSA_65,
        "ML-DSA-87" => oids::ML_DSA_87,
        other => return Err(err(format!("unknown ML-DSA variant: {other}"))),
    };

    // Reconstruct ML-DSA SPKI and verify with the composite context string.
    // Uses PK11_VerifyWithMechanism(CKM_ML_DSA) so the Label is passed as the
    // ML-DSA context string per draft-ietf-lamps-pq-composite-sigs-19 §3.1.
    let mldsa_spki = encode_standalone_spki(mldsa_oid, None, mldsa_pk).map_err(|e| err(e))?;
    let mldsa_result =
        verify_mldsa_with_context(&mldsa_spki, &m_prime, mldsa_sig, spec.label.as_bytes())
            .map_err(|e| err(e.to_string()));

    // Reconstruct traditional SPKI and verify.
    // Both components are always checked to avoid a timing oracle that would reveal
    // which component failed.
    let trad_spki = encode_trad_spki(&spec.trad_alg, trad_pk).map_err(|e| err(e))?;
    let trad_result = verify_trad_component_nss(&trad_spki, &m_prime, trad_sig, &spec.trad_alg)
        .map_err(|e| err(e.to_string()));

    mldsa_result.and(trad_result)
}

/// Sign the ML-DSA component of a composite key with a context string.
///
/// Uses `PK11_SignWithMechanism(CKM_ML_DSA)` with a `CK_SIGN_ADDITIONAL_CONTEXT`
/// carrying `label` (the composite algorithm Label, e.g.
/// `"COMPSIG-MLDSA44-RSA2048-PSS-SHA256"`) as the context string, satisfying
/// §3.1 of draft-ietf-lamps-pq-composite-sigs-19.
///
/// `sig_size` must equal the ML-DSA signature size for the variant (2420 / 3309 / 4627).
fn sign_mldsa_with_context(
    mldsa_pkcs8: &[u8],
    message: &[u8],
    label: &[u8],
    sig_size: usize,
) -> Result<Vec<u8>, CompositeNssError> {
    if !ensure_nss_init() {
        return Err(CompositeNssError("NSS initialisation failed".to_string()));
    }

    // Import the ML-DSA private key into the NSS internal in-memory slot.
    // SAFETY: PK11_GetInternalSlot is thread-safe after NSS_NoDB_Init returns.
    let slot = unsafe { PK11_GetInternalSlot() };
    if slot.is_null() {
        return Err(CompositeNssError("PK11_GetInternalSlot failed".to_string()));
    }

    // SAFETY (cast): import call reads only from pkcs8_item.data.
    let pkcs8_item = SECItemStr {
        type_: SECItemType::siBuffer,
        data: mldsa_pkcs8.as_ptr() as *mut _,
        len: mldsa_pkcs8.len() as u32,
    };
    let mut priv_key: *mut super::ffi::SECKEYPrivateKeyStr = ptr::null_mut();
    // SAFETY: slot and pkcs8_item are valid; privk receives the output pointer.
    let import_status = unsafe {
        PK11_ImportDERPrivateKeyInfoAndReturnKey(
            slot,
            &pkcs8_item,
            ptr::null(),
            ptr::null(),
            PR_FALSE,
            PR_TRUE,
            KU_DIGITAL_SIGNATURE,
            &mut priv_key,
            ptr::null_mut(),
        )
    };
    // Release the slot reference; the key holds its own.
    // SAFETY: slot is non-null.
    unsafe { PK11_FreeSlot(slot) };

    if import_status != SECStatus::SECSuccess || priv_key.is_null() {
        return Err(CompositeNssError(
            "ML-DSA key import into NSS slot failed".to_string(),
        ));
    }

    // Build the CKM_ML_DSA mechanism parameter with the composite Label.
    // SAFETY: label slice lives for the duration of this function; the struct
    // is read-only by PK11_SignWithMechanism.
    let ctx = CkSignAdditionalContext {
        hedge_variant: CKH_HEDGE_PREFERRED,
        p_context: label.as_ptr(),
        ul_context_len: label.len() as std::ffi::c_ulong,
    };
    // SAFETY (cast): CkSignAdditionalContext has no padding or pointers that
    // NSS would write through; *const → *mut satisfies the C API type only.
    let param_item = SECItemStr {
        type_: SECItemType::siBuffer,
        data: &ctx as *const CkSignAdditionalContext as *mut _,
        len: std::mem::size_of::<CkSignAdditionalContext>() as u32,
    };

    let mut sig_buf = vec![0u8; sig_size];
    let mut sig_item = SECItemStr {
        type_: SECItemType::siBuffer,
        data: sig_buf.as_mut_ptr(),
        len: sig_buf.len() as u32,
    };
    // SAFETY (cast): message is a valid read-only slice; *const → *mut satisfies
    // the C API field type only; PK11_SignWithMechanism does not write through it.
    let msg_item = SECItemStr {
        type_: SECItemType::siBuffer,
        data: message.as_ptr() as *mut _,
        len: message.len() as u32,
    };

    // SAFETY: priv_key, param_item, sig_item, and msg_item are all valid.
    let sign_status = unsafe {
        PK11_SignWithMechanism(priv_key, CKM_ML_DSA, &param_item, &mut sig_item, &msg_item)
    };
    // SAFETY: priv_key is non-null.
    unsafe { SECKEY_DestroyPrivateKey(priv_key) };

    if sign_status != SECStatus::SECSuccess {
        let nss_err = unsafe { nss_sys::nspr::PR_GetError() };
        return Err(CompositeNssError(format!(
            "PK11_SignWithMechanism (CKM_ML_DSA) failed (NSS error {nss_err})"
        )));
    }

    // NSS writes the actual length into sig_item.len.
    sig_buf.truncate(sig_item.len as usize);
    Ok(sig_buf)
}

/// Sign the RSA-PSS component of a composite key using `CKM_SHA256/512_RSA_PKCS_PSS`.
///
/// `hash` must be `"sha256"` or `"sha512"`.  The salt length equals the hash output
/// length (32 or 64 bytes) and the mask generation function is MGF1 with the same hash.
fn sign_rsa_pss(
    rsa_pkcs8: &[u8],
    message: &[u8],
    hash: &str,
) -> Result<Vec<u8>, CompositeNssError> {
    use nss_sys::SECStatus;

    if !ensure_nss_init() {
        return Err(CompositeNssError("NSS initialisation failed".to_string()));
    }

    let (mech, hash_alg, mgf, s_len) = match hash {
        "sha256" => (CKM_SHA256_RSA_PKCS_PSS, CKM_SHA256, CKG_MGF1_SHA256, 32u64),
        "sha512" => (CKM_SHA512_RSA_PKCS_PSS, CKM_SHA512, CKG_MGF1_SHA512, 64u64),
        other => {
            return Err(CompositeNssError(format!(
                "unsupported RSA-PSS hash for NSS composite signing: {other}"
            )))
        }
    };

    // SAFETY: PK11_GetInternalSlot is thread-safe after NSS_NoDB_Init returns.
    let slot = unsafe { PK11_GetInternalSlot() };
    if slot.is_null() {
        return Err(CompositeNssError("PK11_GetInternalSlot failed".to_string()));
    }

    // SAFETY (cast): import call reads only from pkcs8_item.data.
    let pkcs8_item = nss_sys::SECItemStr {
        type_: nss_sys::SECItemType::siBuffer,
        data: rsa_pkcs8.as_ptr() as *mut _,
        len: rsa_pkcs8.len() as u32,
    };
    let mut priv_key: *mut super::ffi::SECKEYPrivateKeyStr = ptr::null_mut();
    // SAFETY: slot and pkcs8_item are valid; privk receives the output pointer.
    let import_status = unsafe {
        PK11_ImportDERPrivateKeyInfoAndReturnKey(
            slot,
            &pkcs8_item,
            ptr::null(),
            ptr::null(),
            nss_sys::nspr::PR_FALSE,
            nss_sys::nspr::PR_TRUE,
            KU_DIGITAL_SIGNATURE,
            &mut priv_key,
            ptr::null_mut(),
        )
    };
    // SAFETY: slot is non-null.
    unsafe { PK11_FreeSlot(slot) };

    if import_status != SECStatus::SECSuccess || priv_key.is_null() {
        return Err(CompositeNssError(
            "RSA key import into NSS slot failed".to_string(),
        ));
    }

    // SAFETY: priv_key is non-null.
    let sig_size_raw = unsafe { PK11_SignatureLen(priv_key) };
    if sig_size_raw <= 0 {
        // SAFETY: priv_key is non-null.
        unsafe { SECKEY_DestroyPrivateKey(priv_key) };
        return Err(CompositeNssError(
            "PK11_SignatureLen returned <= 0 for RSA key".to_string(),
        ));
    }
    let sig_size = sig_size_raw as usize;

    // Build CK_RSA_PKCS_PSS_PARAMS for the chosen hash.
    let pss_params = CkRsaPkcsPssParams {
        hash_alg,
        mgf,
        s_len: s_len as std::ffi::c_ulong,
    };
    // SAFETY (cast): CkRsaPkcsPssParams has no pointers; *const → *mut satisfies
    // the C API field type; PK11_SignWithMechanism does not write through it.
    let param_item = nss_sys::SECItemStr {
        type_: nss_sys::SECItemType::siBuffer,
        data: &pss_params as *const CkRsaPkcsPssParams as *mut _,
        len: std::mem::size_of::<CkRsaPkcsPssParams>() as u32,
    };

    let mut sig_buf = vec![0u8; sig_size];
    let mut sig_item = nss_sys::SECItemStr {
        type_: nss_sys::SECItemType::siBuffer,
        data: sig_buf.as_mut_ptr(),
        len: sig_buf.len() as u32,
    };
    // SAFETY (cast): *const → *mut; PK11_SignWithMechanism does not write through msg_item.data.
    let msg_item = nss_sys::SECItemStr {
        type_: nss_sys::SECItemType::siBuffer,
        data: message.as_ptr() as *mut _,
        len: message.len() as u32,
    };

    // SAFETY: priv_key, param_item, sig_item, and msg_item are all valid.
    let sign_status =
        unsafe { PK11_SignWithMechanism(priv_key, mech, &param_item, &mut sig_item, &msg_item) };
    // SAFETY: priv_key is non-null.
    unsafe { SECKEY_DestroyPrivateKey(priv_key) };

    if sign_status != SECStatus::SECSuccess {
        let nss_err = unsafe { nss_sys::nspr::PR_GetError() };
        return Err(CompositeNssError(format!(
            "PK11_SignWithMechanism (RSA-PSS {hash}) failed (NSS error {nss_err})"
        )));
    }

    sig_buf.truncate(sig_item.len as usize);
    Ok(sig_buf)
}

/// Sign the Ed448 component of a composite key using `CKM_EDDSA` with `phFlag = 0`.
///
/// Pure EdDSA (no prehash) is used; the composite domain separation is already
/// embedded in M' so no additional EdDSA context string is needed.
fn sign_ed448(ed448_pkcs8: &[u8], message: &[u8]) -> Result<Vec<u8>, CompositeNssError> {
    use nss_sys::SECStatus;

    if !ensure_nss_init() {
        return Err(CompositeNssError("NSS initialisation failed".to_string()));
    }

    // SAFETY: PK11_GetInternalSlot is thread-safe after NSS_NoDB_Init returns.
    let slot = unsafe { PK11_GetInternalSlot() };
    if slot.is_null() {
        return Err(CompositeNssError("PK11_GetInternalSlot failed".to_string()));
    }

    // SAFETY (cast): import call reads only from pkcs8_item.data.
    let pkcs8_item = nss_sys::SECItemStr {
        type_: nss_sys::SECItemType::siBuffer,
        data: ed448_pkcs8.as_ptr() as *mut _,
        len: ed448_pkcs8.len() as u32,
    };
    let mut priv_key: *mut super::ffi::SECKEYPrivateKeyStr = ptr::null_mut();
    // SAFETY: slot and pkcs8_item are valid; privk receives the output pointer.
    let import_status = unsafe {
        PK11_ImportDERPrivateKeyInfoAndReturnKey(
            slot,
            &pkcs8_item,
            ptr::null(),
            ptr::null(),
            nss_sys::nspr::PR_FALSE,
            nss_sys::nspr::PR_TRUE,
            KU_DIGITAL_SIGNATURE,
            &mut priv_key,
            ptr::null_mut(),
        )
    };
    // SAFETY: slot is non-null.
    unsafe { PK11_FreeSlot(slot) };

    if import_status != SECStatus::SECSuccess || priv_key.is_null() {
        return Err(CompositeNssError(
            "Ed448 key import into NSS slot failed".to_string(),
        ));
    }

    // SAFETY: priv_key is non-null.
    let sig_size_raw = unsafe { PK11_SignatureLen(priv_key) };
    if sig_size_raw <= 0 {
        // SAFETY: priv_key is non-null.
        unsafe { SECKEY_DestroyPrivateKey(priv_key) };
        return Err(CompositeNssError(
            "PK11_SignatureLen returned <= 0 for Ed448 key".to_string(),
        ));
    }
    let sig_size = sig_size_raw as usize;

    // phFlag = 0: pure EdDSA, no pre-hash.  Context = empty (composite domain
    // separation lives in M', not in the EdDSA context field).
    static DUMMY: u8 = 0;
    let eddsa_params = CkEddsaParams {
        ph_flag: 0,
        ul_context_data_len: 0,
        p_context_data: &DUMMY as *const u8,
    };
    // SAFETY (cast): CkEddsaParams is read-only for the mechanism call; *const → *mut
    // satisfies the C API field type.
    let param_item = nss_sys::SECItemStr {
        type_: nss_sys::SECItemType::siBuffer,
        data: &eddsa_params as *const CkEddsaParams as *mut _,
        len: std::mem::size_of::<CkEddsaParams>() as u32,
    };

    let mut sig_buf = vec![0u8; sig_size];
    let mut sig_item = nss_sys::SECItemStr {
        type_: nss_sys::SECItemType::siBuffer,
        data: sig_buf.as_mut_ptr(),
        len: sig_buf.len() as u32,
    };
    // SAFETY (cast): *const → *mut; PK11_SignWithMechanism does not write through msg_item.data.
    let msg_item = nss_sys::SECItemStr {
        type_: nss_sys::SECItemType::siBuffer,
        data: message.as_ptr() as *mut _,
        len: message.len() as u32,
    };

    // SAFETY: priv_key, param_item, sig_item, and msg_item are all valid.
    let sign_status = unsafe {
        PK11_SignWithMechanism(priv_key, CKM_EDDSA, &param_item, &mut sig_item, &msg_item)
    };
    // SAFETY: priv_key is non-null.
    unsafe { SECKEY_DestroyPrivateKey(priv_key) };

    if sign_status != SECStatus::SECSuccess {
        let nss_err = unsafe { nss_sys::nspr::PR_GetError() };
        return Err(CompositeNssError(format!(
            "PK11_SignWithMechanism (CKM_EDDSA) for Ed448 failed (NSS error {nss_err})"
        )));
    }

    sig_buf.truncate(sig_item.len as usize);
    Ok(sig_buf)
}

/// Verify the ML-DSA component of a composite signature with a context string.
///
/// Uses `PK11_VerifyWithMechanism(CKM_ML_DSA)` with a `CK_SIGN_ADDITIONAL_CONTEXT`
/// carrying `label` as the context string, matching the signing convention in
/// `sign_mldsa_with_context`.
fn verify_mldsa_with_context(
    mldsa_spki_der: &[u8],
    message: &[u8],
    sig: &[u8],
    label: &[u8],
) -> Result<(), CompositeNssError> {
    if !ensure_nss_init() {
        return Err(CompositeNssError("NSS initialisation failed".to_string()));
    }

    // Decode the ML-DSA SPKI to obtain a public key.
    // SAFETY (cast): SECKEY_DecodeDERSubjectPublicKeyInfo reads only from spki_item.data.
    let spki_item = SECItemStr {
        type_: SECItemType::siBuffer,
        data: mldsa_spki_der.as_ptr() as *mut _,
        len: mldsa_spki_der.len() as u32,
    };
    // SAFETY: spki_item.data points to a valid buffer of spki_item.len bytes.
    let spki_info = unsafe { SECKEY_DecodeDERSubjectPublicKeyInfo(&spki_item) };
    if spki_info.is_null() {
        let nss_err = unsafe { nss_sys::nspr::PR_GetError() };
        return Err(CompositeNssError(format!(
            "SECKEY_DecodeDERSubjectPublicKeyInfo failed for ML-DSA SPKI (NSS error {nss_err})"
        )));
    }
    // SAFETY: spki_info is non-null.
    let pub_key = unsafe { SECKEY_ExtractPublicKey(spki_info) };
    // SAFETY: always destroy spki_info.
    unsafe { SECKEY_DestroySubjectPublicKeyInfo(spki_info) };
    if pub_key.is_null() {
        let nss_err = unsafe { nss_sys::nspr::PR_GetError() };
        return Err(CompositeNssError(format!(
            "SECKEY_ExtractPublicKey failed for ML-DSA SPKI (NSS error {nss_err})"
        )));
    }

    // Build the CKM_ML_DSA mechanism parameter carrying the composite Label.
    // SAFETY: label slice lives for the duration of this function.
    let ctx = CkSignAdditionalContext {
        hedge_variant: CKH_HEDGE_PREFERRED,
        p_context: label.as_ptr(),
        ul_context_len: label.len() as std::ffi::c_ulong,
    };
    // SAFETY (cast): *const → *mut satisfies the C API field type; NSS does not
    // write through param_item.data for PK11_VerifyWithMechanism.
    let param_item = SECItemStr {
        type_: SECItemType::siBuffer,
        data: &ctx as *const CkSignAdditionalContext as *mut _,
        len: std::mem::size_of::<CkSignAdditionalContext>() as u32,
    };
    // SAFETY (cast): *const → *mut; NSS does not write through sig_item.data or
    // msg_item.data for PK11_VerifyWithMechanism.
    let sig_item = SECItemStr {
        type_: SECItemType::siBuffer,
        data: sig.as_ptr() as *mut _,
        len: sig.len() as u32,
    };
    let msg_item = SECItemStr {
        type_: SECItemType::siBuffer,
        data: message.as_ptr() as *mut _,
        len: message.len() as u32,
    };

    // SAFETY: pub_key, param_item, sig_item, and msg_item are all valid.
    let status = unsafe {
        PK11_VerifyWithMechanism(
            pub_key,
            CKM_ML_DSA,
            &param_item,
            &sig_item,
            &msg_item,
            ptr::null_mut(),
        )
    };
    // SAFETY: pub_key is non-null.
    unsafe { SECKEY_DestroyPublicKey(pub_key) };

    if status == SECStatus::SECSuccess {
        Ok(())
    } else {
        let nss_err = unsafe { nss_sys::nspr::PR_GetError() };
        Err(CompositeNssError(format!(
            "ML-DSA composite component verification failed (NSS error {nss_err})"
        )))
    }
}

/// Verify a signature using NSS via `SECKEY_DecodeDERSubjectPublicKeyInfo` +
/// `VFY_VerifyDataWithAlgorithmID` (or `PK11_Verify` for EdDSA).
///
/// `alg_oid_comps` is the OID component array for the signing algorithm.
/// `alg_params_der` is the raw DER bytes of the AlgorithmIdentifier parameters
/// (empty slice means no parameters).
/// `use_pk11_verify` forces the `PK11_Verify` path (for Ed25519/Ed448).
fn verify_component_nss(
    spki_der: &[u8],
    message: &[u8],
    signature: &[u8],
    alg_oid_comps: &[u32],
    alg_params_der: Option<&[u8]>,
    use_pk11_verify: bool,
) -> Result<(), CompositeNssError> {
    if !ensure_nss_init() {
        return Err(CompositeNssError("NSS initialisation failed".to_string()));
    }

    // SAFETY (cast): NSS does not write through SECItemStr.data for read-only operations
    // such as SECKEY_DecodeDERSubjectPublicKeyInfo; the *const → *mut cast satisfies
    // the C API field type without granting write access.
    let spki_item = SECItemStr {
        type_: SECItemType::siBuffer,
        data: spki_der.as_ptr() as *mut _,
        len: spki_der.len() as u32,
    };

    // SAFETY: spki_item.data points to a valid buffer of spki_item.len bytes.
    let spki_info = unsafe { SECKEY_DecodeDERSubjectPublicKeyInfo(&spki_item) };
    if spki_info.is_null() {
        let nss_err = unsafe { nss_sys::nspr::PR_GetError() };
        return Err(CompositeNssError(format!(
            "SECKEY_DecodeDERSubjectPublicKeyInfo failed for composite SPKI (NSS error {nss_err})"
        )));
    }

    // SAFETY: spki_info is non-null.
    let pub_key = unsafe { SECKEY_ExtractPublicKey(spki_info) };
    // SAFETY: always destroy spki_info regardless of ExtractPublicKey result.
    unsafe { SECKEY_DestroySubjectPublicKeyInfo(spki_info) };
    if pub_key.is_null() {
        let nss_err = unsafe { nss_sys::nspr::PR_GetError() };
        return Err(CompositeNssError(format!(
            "SECKEY_ExtractPublicKey failed for composite SPKI (NSS error {nss_err})"
        )));
    }

    // SAFETY (cast): NSS does not write through SECItemStr.data for signature
    // verification (PK11_Verify, VFY_VerifyDataWithAlgorithmID); *const → *mut
    // cast satisfies the C API field type only.
    let sig_item = SECItemStr {
        type_: SECItemType::siBuffer,
        data: signature.as_ptr() as *mut _,
        len: signature.len() as u32,
    };

    let status = if use_pk11_verify {
        // SAFETY (cast): NSS does not write through msg_item.data for PK11_Verify;
        // *const → *mut cast satisfies the C API field type only.
        let msg_item = SECItemStr {
            type_: SECItemType::siBuffer,
            data: message.as_ptr() as *mut _,
            len: message.len() as u32,
        };
        // SAFETY: pub_key, sig_item, and msg_item are all valid for this call.
        unsafe { PK11_Verify(pub_key, &sig_item, &msg_item, ptr::null_mut()) }
    } else {
        // Build SECAlgorithmIDStr from the OID components and optional params.
        // Compute oid_der before any early return to avoid leaking pub_key.
        let oid_der = match encode_oid_der(alg_oid_comps) {
            Ok(der) => der,
            Err(e) => {
                // SAFETY: pub_key is non-null.
                unsafe { SECKEY_DestroyPublicKey(pub_key) };
                return Err(CompositeNssError(e));
            }
        };
        // Guard against implausibly large messages before the c_int cast.
        let msg_len = match i32::try_from(message.len()) {
            Ok(n) => n,
            Err(_) => {
                // SAFETY: pub_key is non-null.
                unsafe { SECKEY_DestroyPublicKey(pub_key) };
                return Err(CompositeNssError(
                    "VFY_VerifyDataWithAlgorithmID: message exceeds i32::MAX bytes".to_string(),
                ));
            }
        };
        // SAFETY (cast): NSS does not write through alg_id.algorithm.data or
        // alg_id.parameters.data for VFY_VerifyDataWithAlgorithmID; *const → *mut
        // casts satisfy the C API field types only.
        let alg_id = SECAlgorithmIDStr {
            algorithm: SECItemStr {
                type_: SECItemType::siDEROID,
                data: oid_der.as_ptr() as *mut _,
                len: oid_der.len() as u32,
            },
            parameters: SECItemStr {
                type_: SECItemType::siBuffer,
                data: if let Some(p) = alg_params_der {
                    p.as_ptr() as *mut _
                } else {
                    ptr::null_mut()
                },
                len: alg_params_der.map(|p| p.len() as u32).unwrap_or(0),
            },
        };
        // SAFETY: message, pub_key, sig_item, and alg_id are all valid for the
        // duration of this call.
        unsafe {
            VFY_VerifyDataWithAlgorithmID(
                message.as_ptr(),
                msg_len,
                pub_key,
                &sig_item,
                &alg_id,
                ptr::null(),
                ptr::null_mut(),
            )
        }
    };

    // SAFETY: pub_key is non-null.
    unsafe { SECKEY_DestroyPublicKey(pub_key) };

    if status == nss_sys::SECSuccess {
        Ok(())
    } else {
        Err(CompositeNssError(
            "composite component signature verification failed".to_string(),
        ))
    }
}

/// Verify the traditional component of a composite signature.
fn verify_trad_component_nss(
    trad_spki_der: &[u8],
    m_prime: &[u8],
    trad_sig: &[u8],
    trad_alg: &TradAlg,
) -> Result<(), CompositeNssError> {
    match trad_alg {
        TradAlg::RsaPkcs15 { hash, .. } => {
            let oid_comps: &[u32] = match *hash {
                "sha256" => oids::SHA256_WITH_RSA,
                "sha512" => oids::SHA512_WITH_RSA,
                other => {
                    return Err(CompositeNssError(format!(
                        "unsupported RSA-PKCS15 hash: {other}"
                    )))
                }
            };
            verify_component_nss(trad_spki_der, m_prime, trad_sig, oid_comps, None, false)
        }
        TradAlg::RsaPss { hash, .. } => {
            // Build RSASSA-PSS AlgorithmIdentifier with parameters.
            let pss_params_der = build_rsa_pss_params_der(hash).map_err(CompositeNssError::from)?;
            verify_component_nss(
                trad_spki_der,
                m_prime,
                trad_sig,
                oids::RSASSA_PSS,
                Some(&pss_params_der),
                false,
            )
        }
        TradAlg::Ec { hash, .. } => {
            let oid_comps: &[u32] = match *hash {
                "sha256" => oids::ECDSA_WITH_SHA256,
                "sha512" => oids::ECDSA_WITH_SHA512,
                other => {
                    return Err(CompositeNssError(format!(
                        "unsupported ECDSA hash: {other}"
                    )))
                }
            };
            verify_component_nss(trad_spki_der, m_prime, trad_sig, oid_comps, None, false)
        }
        TradAlg::Ed25519 => {
            verify_component_nss(trad_spki_der, m_prime, trad_sig, oids::ED25519, None, true)
        }
        TradAlg::Ed448 => {
            verify_component_nss(trad_spki_der, m_prime, trad_sig, oids::ED448, None, true)
        }
    }
}