@bakobo/fiki 0.7.0 → 0.8.0

package/README.md

@@ -35,7 +35,7 @@ By default the signature binds the method, the host, the path, the query string,
 ```js
 import { verifyRequest } from '@bakobo/fiki';
 
-const { aid, covered } = await verifyRequest({
+const { aid, keyid, covered } = await verifyRequest({
   method: request.method,
   url: request.url,          // a full URL, or a path plus a Host header
   headers: request.headers,
@@ -44,7 +44,15 @@ const { aid, covered } = await verifyRequest({
 });
 ```
 
-`maxAge` has no default and must be given. Both defaults would be wrong: a number guesses at somebody else's clock skew and replay window, and skipping the check silently is the thing the argument exists to prevent. An `expires` the signer declared is enforced either way.
+`keyid` is the keyid exactly as it appeared on the wire, or `null` when the signature had none; `aid` is the identity that vouched for the key — the non-transferable AID of a raw key, the keyid a resolver vouched for, or the AID of `expectedAid`.
+
+`maxAge` has no default and must be given. Both defaults would be wrong: a number guesses at somebody else's clock skew and replay window, and skipping the check silently is the thing the argument exists to prevent. An `expires` the signer declared is enforced either way. `maxAge` and `skew`, when given, are positive whole numbers of seconds.
+
+## What is refused before it is read
+
+`Signature`, `Signature-Input` and `Content-Digest` are each read only up to `MAX_FIELD_BYTES` (8192 bytes, measured before any trimming), `MAX_DICTIONARY_MEMBERS` (16) members, `MAX_INNER_LIST_ITEMS` (64) items in an inner list and `MAX_PARAMETERS` (16) parameters on an item; a header over any of them is that header's malformed error. All four are exported. RFC 8941 is parsed strictly: an integer of more than fifteen digits, a decimal, and a byte sequence that is not canonically padded base64 are refused. A URL whose port is not a number from 0 to 65535, or with anything but `:port` after an IP-literal's `]`, is a `SignatureMismatch` when a covered `@authority` needs it.
+
+The signer refuses, as a `TypeError`, anything it would otherwise serialize into a header that does not belong there: a method that is not an HTTP token, a label that is not an RFC 8941 key, a `keyid`, `nonce` or `tag` outside printable ASCII, a component name that is not a field name, a `created` or `expires` outside 0 to 999999999999999, a header value that is not a string, and a supplied `Content-Digest` the body does not bear out.
 
 ## Keys in a browser
 
@@ -62,11 +70,10 @@ The safe shape is the default and the portable one is explicit, because the two
 
 ## Differences from the Python port
 
-Everything is async. WebCrypto's `sign`, `verify`, `digest` and `importKey` all return promises, so `signRequest`, `signResponse`, `verifyRequest`, `verifyResponse` and the `Key` constructors do too, where the Python versions are synchronous. Names are otherwise the same in camelCase — `signatureBase`, `responseSignatureBase`, `verifyingKey`, `Key.fromSeed`, `key.aid`, `expectedKeyid` — so the two read as one library. Four more differences are deliberate (`this.i` @9enyfktu):
+Everything is async. WebCrypto's `sign`, `verify`, `digest` and `importKey` all return promises, so `signRequest`, `signResponse`, `verifyRequest`, `verifyResponse` and the `Key` constructors do too, where the Python versions are synchronous. Names are otherwise the same in camelCase — `signatureBase`, `responseSignatureBase`, `verifyingKey`, `Key.fromSeed`, `key.aid`, `expectedKeyid` — so the two read as one library. Three more differences are deliberate (`this.i` @9enyfktu):
 
 - A `resolve` function may return the key or a promise of it, and verification awaits either, because a KERI resolver usually reads key state from storage or a network.
 - The request a response answers is a plain object, `{ method, url, headers, body }`, rather than an exported `Request` class.
-- A mistake in the call rather than the message — `expectedAid` together with `resolve`, a `minimum` smaller than the profile's, a missing `maxAge`, a response binding the request's digest verified without the request body — is a `TypeError`. Python raises `TypeError` for some of these and `ValueError` for others; JavaScript has no `ValueError`. None of them is a `FikiError`.
-- `KERI_VECTORS_FORMAT` is exported beside `VECTORS_FORMAT`, so the KERI profile's contract (`vectors/keri/`) can be read the same way as the shared one.
+- A mistake in the call rather than the message — `expectedAid` together with `resolve`, a `minimum` smaller than the profile's, a missing or non-positive `maxAge`, a response binding the request's digest verified without the request body, and everything the signer refuses above — is a `TypeError`. Python raises `TypeError` for some of these and `ValueError` for others; JavaScript has no `ValueError`. None of them is a `FikiError`.
 
-URLs are split as sent, as Python's `urlsplit` does, rather than parsed with `new URL`, which normalizes the path that RFC 9421 and the KERI profile sign unnormalized (`this.i` @90y0gsfx).
+URLs are cleaned as Python's `urlsplit` cleans them — leading control characters and spaces stripped, TAB, CR and LF removed anywhere — and then split as sent rather than parsed with `new URL`, which normalizes the path that RFC 9421 and the KERI profile sign unnormalized (`this.i` @90y0gsfx).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bakobo/fiki",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Sign and verify HTTP requests with a bare Ed25519 key as the identifier. Standard RFC 9421, no KERI dependencies.",
   "keywords": [
     "rfc9421",

package/src/base.js

@@ -42,13 +42,40 @@ const DEFAULT_PORTS = new Map([
   ['wss', '443'],
 ]);
 
+// RFC 9110 section 5.6.2: a token is one or more tchar. A method is one (section 9.1), and so is a
+// field name (section 5.1), which fiki further requires lowercased in a covered list.
+const TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+// RFC 8941 section 3.3.3: an sf-string holds printable ASCII and nothing else.
+const SF_STRING = /^[\x20-\x7e]*$/;
+// RFC 8941 section 3.1.2: a dictionary key, which is what a signature label is.
+const SF_KEY = /^[a-z*][a-z0-9_.*-]*$/;
+// RFC 8941 section 3.3.1: at most fifteen digits.
+const SF_INTEGER_MAX = 999_999_999_999_999;
+
+// A caller's value in a message about it: quoted when it is a string, so a control character shows.
+const shown = (value) => (typeof value === 'string' ? JSON.stringify(value) : String(value));
+
 /** A component identifier from a caller's spelling of it.
  *
  * A plain name (`"@method"`, `"Content-Digest"`) or its RFC 8941 serialization with parameters
  * (`'"@method";req'`). Names are lowercased as a convenience to a local caller; a name parsed from
- * the wire is never lowercased, and is refused instead when it is not already.
+ * the wire is never lowercased, and is refused instead when it is not already. A field name that
+ * is not a token is the caller's mistake, a TypeError, because it would be serialized into
+ * Signature-Input as given (@5zrf8gjk); a derived name fiki does not build is refused later, as
+ * UnsupportedComponent, which names it.
  */
 export function component(spec) {
+  const item = componentItem(spec);
+  if (!item.value.startsWith('@') && !TOKEN.test(item.value)) {
+    throw new TypeError(
+      `${JSON.stringify(spec)} is not a component fiki can name: a field is named by an HTTP field ` +
+        'name, one or more token characters, and a derived component by its @ name.',
+    );
+  }
+  return item;
+}
+
+function componentItem(spec) {
   if (!spec.startsWith('"')) return { value: spec.toLowerCase(), params: new Map() };
   let item;
   try {
@@ -122,30 +149,96 @@ export function checkCovered(items, { response }) {
  * percent-encodes characters such as a space, so its pathname is not the path that was sent. The
  * KERI profile requires @path "in its encoded form, percent-encoding included and unnormalized"
  * (section 2), and so does RFC 9421 section 2.2.6, which is what fiki-py's urlsplit gives.
+ *
+ * Cleaned first exactly as urlsplit cleans it, so every port builds one base for the same URL
+ * (@0e832nug): leading C0 controls and spaces are stripped, and TAB, CR and LF are removed
+ * wherever they are. Trailing controls are kept, as urlsplit keeps them, and a covered component
+ * holding one is then refused like any other control character.
  */
 export function splitUrl(url) {
-  const match = /^(?:([A-Za-z][A-Za-z0-9+.-]*):)?(?:\/\/([^/?#]*))?([^?#]*)(?:\?([^#]*))?/.exec(url);
+  const cleaned = url.replace(/^[\x00-\x20]+/, '').replace(/[\t\r\n]/g, '');
+  const match = /^(?:([A-Za-z][A-Za-z0-9+.-]*):)?(?:\/\/([^/?#]*))?([^?#]*)(?:\?([^#]*))?/.exec(cleaned);
   const [, scheme = '', netloc, path, query = ''] = match;
   return { scheme: scheme.toLowerCase(), netloc: netloc ?? '', path, query };
 }
 
-function authority(parts, headers) {
+/** A URL fiki cannot read: the caller's mistake when signing, an unbuildable base when not.
+ *
+ * The profile's section 9 names a base that cannot be built a signature mismatch, so a received
+ * URL whose authority cannot be read is refused like any other base that does not verify, never
+ * thrown as an exception from outside fiki's taxonomy (@5zrf8gjk).
+ */
+function unreadable(message, reason) {
+  if (message.received) {
+    return new SignatureMismatch(
+      `The URL ${message.url} cannot be read: ${reason} So there is no signature base to check the ` +
+        'signature against.',
+    );
+  }
+  return new TypeError(`The URL ${message.url} cannot be read: ${reason}`);
+}
+
+// RFC 3986 section 3.2.2's IP-literal, as Python's urlsplit checks it from 3.11.4, so a host fiki-py
+// refuses is refused here too: IPvFuture ("v", hex digits, ".", then anything but a line feed), or
+// an IPv6address with an optional zone after "%". The IPv6 grammar is RFC 3986's own, which accepts
+// exactly what Python's ipaddress.IPv6Address does.
+const H16 = '[0-9A-Fa-f]{1,4}';
+const DEC_OCTET = '(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])';
+const LS32 = `(?:${H16}:${H16}|${DEC_OCTET}(?:\\.${DEC_OCTET}){3})`;
+const IPV6 = [
+  `(?:${H16}:){6}${LS32}`,
+  `::(?:${H16}:){5}${LS32}`,
+  `(?:${H16})?::(?:${H16}:){4}${LS32}`,
+  `(?:(?:${H16}:){0,1}${H16})?::(?:${H16}:){3}${LS32}`,
+  `(?:(?:${H16}:){0,2}${H16})?::(?:${H16}:){2}${LS32}`,
+  `(?:(?:${H16}:){0,3}${H16})?::${H16}:${LS32}`,
+  `(?:(?:${H16}:){0,4}${H16})?::${LS32}`,
+  `(?:(?:${H16}:){0,5}${H16})?::${H16}`,
+  `(?:(?:${H16}:){0,6}${H16})?::`,
+].join('|');
+const IP_LITERAL = new RegExp(`^(?:v[0-9A-Fa-f]+\\.[^\\n]+|(?:${IPV6})(?:%[^%]+)?)$`);
+
+/** Split an authority's host-and-port into the host as written and the port's text.
+ *
+ * An IP-literal keeps its brackets, which RFC 3986 section 3.2.2 makes part of the host, and only
+ * ":port" may follow its closing bracket. A bracket anywhere else is not a host.
+ */
+function hostAndPort(hostport, message) {
+  if (hostport.startsWith('[')) {
+    const close = hostport.indexOf(']');
+    const rest = close < 0 ? '' : hostport.slice(close + 1);
+    if (close < 0 || (rest !== '' && !rest.startsWith(':'))) {
+      throw unreadable(message, 'an IP-literal must close with "]", followed by nothing but ":" and a port.');
+    }
+    if (!IP_LITERAL.test(hostport.slice(1, close))) {
+      throw unreadable(message, 'its IP-literal is not an IPv6 address or IPvFuture.');
+    }
+    return [hostport.slice(0, close + 1), rest.slice(1)];
+  }
+  const colon = hostport.indexOf(':');
+  const [host, port] = colon < 0 ? [hostport, ''] : [hostport.slice(0, colon), hostport.slice(colon + 1)];
+  if (/[[\]]/.test(host)) throw unreadable(message, 'a bracket belongs only around an IP-literal.');
+  return [host, port];
+}
+
+function authority(message) {
   // RFC 9421 section 2.2.3: lowercase host, default port omitted. A relative URL falls back to the
   // Host header, which in HTTP/1.1 *is* the authority — the shape a server-side verifier actually
   // holds. Nothing is normalized away there, because without a scheme no port is a default port.
+  const { parts, headers } = message;
   if (parts.netloc) {
-    const hostport = parts.netloc.slice(parts.netloc.lastIndexOf('@') + 1).toLowerCase();
-    const [, host, port = ''] = /^(\[[^\]]*\]|[^:]*)(?::(.*))?$/.exec(hostport);
-    if (port === '') return host;
+    const [host, port] = hostAndPort(parts.netloc.slice(parts.netloc.lastIndexOf('@') + 1), message);
+    // An empty port is no port at all, as RFC 3986 section 6.2.3 normalizes it.
+    if (port === '') return host.toLowerCase();
     // RFC 3986 section 3.2.3: port = *DIGIT, so any run of ASCII digits, leading zeros and all, and
     // the value is the number: "000080" is 80 and is the default, as urlsplit reads it. The range
     // is checked on the digits that remain, so a long run of zeros cannot hide an overflow.
     const digits = /^[0-9]+$/.test(port) ? port.replace(/^0+(?=[0-9])/, '') : null;
     if (digits === null || digits.length > 5 || Number(digits) > 65535) {
-      throw new TypeError(`The URL's port "${port}" is not a port number between 0 and 65535.`);
+      throw unreadable(message, `its port "${port}" is not a number from 0 to 65535.`);
     }
-    if (digits === DEFAULT_PORTS.get(parts.scheme)) return host;
-    return `${host}:${digits}`;
+    if (digits === DEFAULT_PORTS.get(parts.scheme)) return host.toLowerCase();
+    return `${host.toLowerCase()}:${digits}`;
   }
   const host = headers.get('host');
   if (host === undefined) {
@@ -169,6 +262,11 @@ export function canonicalHeaders(headers, name = 'headers') {
   // assignment to the prototype that silently drops it (PR #5 hostile review, H1).
   const out = Object.create(null);
   for (const [field, value] of Object.entries(headers ?? {})) {
+    // A name is always a string here, since an object's keys are; a value has to be checked
+    // (@5zrf8gjk), or null would be signed as the string "null".
+    if (typeof value !== 'string') {
+      throw new TypeError(`A header is a name and a string value; the value of "${field}" is ${String(value)}.`);
+    }
     const lower = field.toLowerCase();
     if (Object.hasOwn(out, lower)) {
       throw new TypeError(
@@ -186,7 +284,7 @@ function lowered(headers) {
   // are kept exactly as received here: they are checked for forbidden characters before any
   // whitespace is trimmed, or a trailing CR LF would be trimmed into the value that was signed.
   const map = new Map();
-  for (const [name, value] of Object.entries(canonicalHeaders(headers))) map.set(name, String(value));
+  for (const [name, value] of Object.entries(canonicalHeaders(headers))) map.set(name, value);
   return map;
 }
 
@@ -209,19 +307,31 @@ function checked(value, spec) {
   return value;
 }
 
-export function requestMessage(method, url, headers) {
-  // A method is the caller's to supply, and an absent one would otherwise be signed as the string
-  // "undefined". Required here, where every request and every response's request passes.
-  if (typeof method !== 'string' || method === '') {
-    throw new TypeError(`A request needs its method as a non-empty string, as sent; got ${String(method) || 'an empty string'}.`);
+/** A request's method is an RFC 9110 token, covered or not, or the call is a mistake.
+ *
+ * Its case is kept as given (@22g0xkr8). Checked wherever a request message is built, on sign and
+ * verify alike (@5zrf8gjk): an empty or spaced method is never a request anybody sent.
+ */
+function checkMethod(method) {
+  if (typeof method !== 'string' || !TOKEN.test(method)) {
+    throw new TypeError(
+      `The method ${shown(method)} is not an HTTP method: a method is a ` +
+        'string of one or more token characters, with no spaces, line breaks or separators.',
+    );
   }
-  return { headers: lowered(headers), method, parts: splitUrl(url) };
 }
 
-export const responseMessage = (status, headers, request) => ({
+export function requestMessage(method, url, headers, { received = false } = {}) {
+  checkMethod(method);
+  // `received` marks a message handed to a verifier rather than built by a signer, which decides
+  // what a URL that cannot be read is: a base that cannot be built, or a caller error.
+  return { headers: lowered(headers), method, url, parts: splitUrl(url), received };
+}
+
+export const responseMessage = (status, headers, request, { received = false } = {}) => ({
   headers: lowered(headers),
   status,
-  request: request ? requestMessage(request.method, request.url, request.headers) : null,
+  request: request ? requestMessage(request.method, request.url, request.headers, { received }) : null,
 });
 
 function componentValue(item, message) {
@@ -252,7 +362,7 @@ function componentValue(item, message) {
   }
   // Section 2.2.1: the method as sent, with no case transformation (@22g0xkr8).
   if (name === '@method') return source.method;
-  if (name === '@authority') return authority(source.parts, source.headers);
+  if (name === '@authority') return authority(source);
   // An empty path is the "/" the origin server would have received.
   if (name === '@path') return source.parts.path || '/';
   // Section 2.2.7: the whole query string including the leading "?", percent-encoding preserved,
@@ -289,6 +399,43 @@ export function componentLines({ method, url, headers, covered }) {
   return linesFor(items, requestMessage(method, url, headers));
 }
 
+/** What a signer serializes must be serializable, or the call is a mistake (@5zrf8gjk).
+ *
+ * created and expires are RFC 8941 integers that are not negative; keyid, alg, nonce and tag are
+ * sf-strings, printable ASCII only, so a line break can never forge a header line. An absent one
+ * (undefined or null) is not serialized and so not checked.
+ */
+export function checkSignerParams({ created, expires, keyid, alg, nonce, tag }) {
+  for (const [name, value] of [['created', created], ['expires', expires]]) {
+    if (value === undefined || value === null) continue;
+    if (!Number.isInteger(value) || value < 0 || value > SF_INTEGER_MAX) {
+      throw new TypeError(
+        `${name} is ${String(value)}, and RFC 8941 carries an integer of at most fifteen digits; fiki ` +
+          `signs a whole number of seconds from 0 to ${SF_INTEGER_MAX}.`,
+      );
+    }
+  }
+  for (const [name, value] of [['keyid', keyid], ['alg', alg], ['nonce', nonce], ['tag', tag]]) {
+    if (value === undefined || value === null) continue;
+    if (typeof value !== 'string' || !SF_STRING.test(value)) {
+      throw new TypeError(
+        `The ${name} ${shown(value)} is not a string of printable ASCII, which is all an RFC ` +
+          '8941 string can carry; a line break there would forge a header line.',
+      );
+    }
+  }
+}
+
+/** A signature label is an RFC 8941 dictionary key, or the call is a mistake (@5zrf8gjk). */
+export function checkLabel(label) {
+  if (typeof label !== 'string' || !SF_KEY.test(label)) {
+    throw new TypeError(
+      `The label ${shown(label)} is not an RFC 8941 key: it starts with a lowercase letter ` +
+        'or "*" and continues with lowercase letters, digits, "_", "-", "." and "*".',
+    );
+  }
+}
+
 /** The whole base for already-checked items: the component lines, then fiki's own parameters. */
 export function finishBase(items, message, values) {
   const lines = linesFor(items, message);
@@ -307,6 +454,7 @@ export function finishBase(items, message, values) {
  * the request does not carry.
  */
 export function signatureBase({ method, url, headers, covered, created, keyid, alg, expires, nonce, tag }) {
+  checkSignerParams({ created, expires, keyid, alg, nonce, tag });
   const items = covered.map(component);
   checkCovered(items, { response: false });
   return finishBase(items, requestMessage(method, url, headers), { created, expires, nonce, alg, keyid, tag });
@@ -319,6 +467,7 @@ export function signatureBase({ method, url, headers, covered, created, keyid, a
  * MissingComponent.
  */
 export function responseSignatureBase({ status, headers, covered, created, keyid, request, alg, expires, nonce, tag }) {
+  checkSignerParams({ created, expires, keyid, alg, nonce, tag });
   const items = covered.map(component);
   checkCovered(items, { response: true });
   return finishBase(items, responseMessage(status, headers, request), { created, expires, nonce, alg, keyid, tag });

package/src/index.js

@@ -10,15 +10,16 @@
 // when their declared vectors format matches, whatever their own version numbers say — so this is
 // the number to compare, not the release. Monotonic, because a conformance contract has no
 // meaningful minor: an implementation either satisfies the vectors or it does not.
-export const VECTORS_FORMAT = 1;
+export const VECTORS_FORMAT = 2;
 
 // The KERI profile's own conformance contract, vectors/keri/ (`this.i` @8vwrexxc, @9enyfktu). A
 // separate number from VECTORS_FORMAT, because the two sets answer to different authorities and
 // move independently.
-export const KERI_VECTORS_FORMAT = 3;
+export const KERI_VECTORS_FORMAT = 4;
 
 export * as errors from './errors.js';
 export { FikiError } from './errors.js';
+export { MAX_DICTIONARY_MEMBERS, MAX_FIELD_BYTES, MAX_INNER_LIST_ITEMS, MAX_PARAMETERS } from './sfv.js';
 export { Key, toAid, verifyingKey, verifySignature } from './keys.js';
 export {
   CONTENT_DIGEST,

package/src/messages.js

@@ -18,6 +18,8 @@ import {
   DEFAULT_COVERED,
   canonicalHeaders,
   checkCovered,
+  checkLabel,
+  checkSignerParams,
   component,
   finishBase,
   identity,
@@ -50,7 +52,7 @@ import {
   UnsupportedAlgorithm,
 } from './errors.js';
 import { checkKey, misspelledAid, toAid, verifyWithRaw, verifyingKey } from './keys.js';
-import { parseDictionary, serializeByteSequence, serializeInnerList } from './sfv.js';
+import { MAX_FIELD_BYTES, parseDictionary, serializeByteSequence, serializeInnerList } from './sfv.js';
 
 export const ALG = 'ed25519';
 
@@ -152,6 +154,19 @@ const coversBody = (items) => items.some((item) => identity(item) === identity(c
 /** Cover a body the caller handed over, or refuse to sign (@2hwvpm42). */
 async function coverBody(items, sending, body, chosen) {
   if (body === null) return;
+  if (hasName(sending, CONTENT_DIGEST)) {
+    // A digest the caller supplied is signed as given, so it must be one the verifier will accept
+    // for this body: one that does not parse, names nothing fiki computes, or does not match is
+    // the call's mistake, not a message (@5zrf8gjk).
+    try {
+      await compareDigest(readDigest(sending[CONTENT_DIGEST]), body);
+    } catch (err) {
+      throw new TypeError(
+        'The Content-Digest supplied with this body is not one a verifier would accept for it: ' +
+          `${err.message} Omit it and fiki computes one, or supply the body it describes.`,
+      );
+    }
+  }
   // Whether the caller CHOSE the covered set is the difference between fiki helping and fiki
   // overriding. On the default path a body simply gets covered; on an explicit path, silently
   // adding a component would mean the signature covers something the caller did not ask for, so
@@ -210,6 +225,10 @@ export async function signRequest({
   keyid = null,
   minimum = null,
 }) {
+  checkLabel(label);
+  created = createdOr(created);
+  keyid = keyid ?? key.keyid;
+  checkSignerParams({ created, expires, keyid, alg: ALG, nonce, tag });
   const floor = floored(minimum, REQUEST_MINIMUM);
   body = bodyBytes(body);
   headers = canonicalHeaders(headers);
@@ -222,11 +241,11 @@ export async function signRequest({
   }
   checkCovered(items, { response: false });
   const base = finishBase(items, requestMessage(method, url, sending), {
-    created: createdOr(created),
+    created,
     expires,
     nonce,
     alg: ALG,
-    keyid: keyid ?? key.keyid,
+    keyid,
     tag,
   });
   return signed(key, base, label, sending, headers);
@@ -258,6 +277,10 @@ export async function signResponse({
   keyid = null,
   minimum = null,
 }) {
+  checkLabel(label);
+  created = createdOr(created);
+  keyid = keyid ?? key.keyid;
+  checkSignerParams({ created, expires, keyid, alg: ALG, nonce, tag });
   const floor = floored(minimum, RESPONSE_MINIMUM);
   body = bodyBytes(body);
   request = normalRequest(request);
@@ -287,17 +310,24 @@ export async function signResponse({
   }
   checkCovered(items, { response: true });
   const base = finishBase(items, responseMessage(status, sending, request), {
-    created: createdOr(created),
+    created,
     expires,
     nonce,
     alg: ALG,
-    keyid: keyid ?? key.keyid,
+    keyid,
     tag,
   });
   return signed(key, base, label, sending, headers);
 }
 
 /** Verify a signed request, returning a verdict `{aid, covered, keyid}` or throwing.
+ *
+ * The verdict's `keyid` is the keyid exactly as it appeared on the wire, or null when the signature
+ * had none, so a verifier given `expectedAid` can still see what the signer claimed (@5zrf8gjk).
+ * Its `aid` is the identity that vouched for the key: the non-transferable AID of a raw key, the
+ * keyid a resolver vouched for (@6g9zjsv9), or the AID of `expectedAid`. `covered` names each
+ * component as `component` would accept it: a plain name, or its serialized form when it carries
+ * a parameter, such as `'"@path";req'`.
  *
  * `maxAge` has no default and must be given: seconds of tolerance, or `null` to decline the
  * check. Both defaults would be wrong (@67shl6c5). An `expires` the signer declared is enforced
@@ -331,10 +361,10 @@ export async function verifyRequest({
   expectedKeyid = null,
   authorities = null,
 }) {
-  requireMaxAge(maxAge, 'verifyRequest');
+  checkWindow(maxAge, skew, 'verifyRequest');
   const floor = floored(minimum, REQUEST_MINIMUM);
   headers = canonicalHeaders(headers);
-  return verify(requestMessage(method, url, headers), headers, bodyBytes(body), {
+  return verify(requestMessage(method, url, headers, { received: true }), headers, bodyBytes(body), {
     response: false,
     request: null,
     maxAge,
@@ -373,18 +403,19 @@ export async function verifyResponse({
   minimum = null,
   expectedKeyid = null,
 }) {
-  requireMaxAge(maxAge, 'verifyResponse');
+  checkWindow(maxAge, skew, 'verifyResponse');
   const floor = floored(minimum, RESPONSE_MINIMUM);
   body = bodyBytes(body);
   request = normalRequest(request);
   headers = canonicalHeaders(headers);
-  if (status === 401 && !hasName(headers, 'signature')) {
+  // An empty Signature is no signature: the same unsigned 401 (@5zrf8gjk).
+  if (status === 401 && !headers.signature) {
     throw new Unauthenticated(
       'The server answered 401 without signing the answer, so the request was not authenticated ' +
         'and the body of the refusal cannot be trusted.',
     );
   }
-  return verify(responseMessage(status, headers, request), headers, body, {
+  return verify(responseMessage(status, headers, request, { received: true }), headers, body, {
     response: true,
     request,
     maxAge,
@@ -398,13 +429,25 @@ export async function verifyResponse({
   });
 }
 
-function requireMaxAge(maxAge, name) {
+/** maxAge must be given, and a freshness window, when given, is a positive whole number of seconds.
+ *
+ * The KERI profile's section 3 says so (@5zrf8gjk), and a zero or negative one would refuse every
+ * honest message or none. `maxAge: null` still declines the age check; there is no way to decline
+ * the skew, which the expiry check uses whatever maxAge is.
+ */
+function checkWindow(maxAge, skew, name) {
   if (maxAge === undefined) {
     throw new TypeError(
       `${name} requires maxAge: seconds of tolerance, or null to decline the check. There is no ` +
         'default because both defaults are wrong.',
     );
   }
+  for (const [field, value] of [['maxAge', maxAge], ['skew', skew]]) {
+    if (value === null && field === 'maxAge') continue;
+    if (!Number.isInteger(value) || value <= 0) {
+      throw new TypeError(`${field} is ${String(value)}, and a freshness window is a positive whole number of seconds.`);
+    }
+  }
 }
 
 /** The KERI profile's section 9 order, so a message has exactly one correct refusal. */
@@ -673,7 +716,16 @@ function checkInput(member, { requireKeyid, requireCreated }) {
   }
 }
 
+/** Parse one signature-related header, bounded before it is read (@5zrf8gjk).
+ *
+ * Size before shape: the raw field value is measured in UTF-8 bytes before any parsing or
+ * trimming, and the parser enforces the member, item and parameter counts as it goes.
+ */
 function parse(raw, name, ErrorClass) {
+  const size = utf8(raw).length;
+  if (size > MAX_FIELD_BYTES) {
+    throw new ErrorClass(`The ${name} header is ${size} bytes, and fiki reads one of at most ${MAX_FIELD_BYTES}.`);
+  }
   try {
     return parseDictionary(raw);
   } catch {

package/src/sfv.js

@@ -22,7 +22,19 @@ const MalformedSyntax = SfvSyntaxError;
 
 import { fromBase64, toBase64 } from './bytes.js';
 
-const BASE64 = /^[A-Za-z0-9+/]*={0,2}$/;
+// RFC 4648 base64 whose only "=" are the ones completing the final quantum (section 3.3), which is
+// the only spelling RFC 8941 section 3.3.5 decodes: missing or partial padding is refused, and so
+// is anything outside the alphabet, CR and LF included (@5zrf8gjk).
+const BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+
+// Input bounds (@5zrf8gjk, ticks 65q7 and 6mhg), far above anything an honest signer sends and low
+// enough that no parse is slow. The byte bound is checked by the caller before parsing; these
+// counts are enforced as the parse reaches them, so an over-long list is refused without being
+// read to its end.
+export const MAX_FIELD_BYTES = 8192;
+export const MAX_DICTIONARY_MEMBERS = 16;
+export const MAX_INNER_LIST_ITEMS = 64;
+export const MAX_PARAMETERS = 16;
 
 class Cursor {
   constructor(text) {
@@ -135,6 +147,9 @@ function parseParameters(cursor) {
     } else {
       params.set(key, true);
     }
+    if (params.size > MAX_PARAMETERS) {
+      throw new MalformedSyntax(`An item carries more than ${MAX_PARAMETERS} parameters.`);
+    }
   }
   return params;
 }
@@ -150,6 +165,9 @@ function parseInnerList(cursor) {
       break;
     }
     items.push({ value: parseBareItem(cursor), params: parseParameters(cursor) });
+    if (items.length > MAX_INNER_LIST_ITEMS) {
+      throw new MalformedSyntax(`An inner list holds more than ${MAX_INNER_LIST_ITEMS} items.`);
+    }
     if (!cursor.done && cursor.peek() !== ' ' && cursor.peek() !== ')') {
       throw new MalformedSyntax(`Expected a space or ")" at offset ${cursor.at}.`);
     }
@@ -185,6 +203,9 @@ export function parseDictionary(text) {
       value = { value: true, params: parseParameters(cursor) };
     }
     out.set(key, value);
+    if (out.size > MAX_DICTIONARY_MEMBERS) {
+      throw new MalformedSyntax(`A dictionary holds more than ${MAX_DICTIONARY_MEMBERS} members.`);
+    }
     cursor.skipSpace();
     if (cursor.done) break;
     cursor.expect(',');