@blamejs/pki 0.1.14 → 0.1.16

package/lib/schema-cms.js

@@ -9,14 +9,16 @@
  * @slug       cms
  *
  * @intro
- *   CMS SignedData handling per RFC 5652 (§3 ContentInfo envelope, §5 SignedData).
- *   `parse` turns a DER or PEM (`CMS`) message into a structured object: the
- *   SignedData version, the digest algorithms, the encapsulated content, the
- *   certificate / CRL sets, and the signer infos. It is an OID-dispatch envelope —
- *   ContentInfo reads its `contentType` and structurally decodes only
- *   `id-signedData`; the other PKCS#7 content types (EnvelopedData, EncryptedData,
- *   …) are recognized and rejected with a precise `cms/unsupported-content-type`
- *   rather than a generic unknown-format error.
+ *   CMS handling per RFC 5652 (§3 ContentInfo envelope). `parse` turns a DER or PEM
+ *   (`CMS`) message into a structured object and is an OID-dispatch envelope —
+ *   ContentInfo reads its `contentType` and structurally decodes SignedData (§5),
+ *   EnvelopedData (§6, with all five RecipientInfo kinds — key-transport,
+ *   key-agreement per RFC 5753, KEK, password, and other), and EncryptedData (§8);
+ *   the remaining PKCS#7 content types are recognized and rejected with a precise
+ *   `cms/unsupported-content-type` rather than a generic unknown-format error. A
+ *   SignedData surfaces its version, digest algorithms, encapsulated content,
+ *   certificate / CRL sets, and signer infos; an EnvelopedData its recipient infos
+ *   and encrypted content info; an EncryptedData its encrypted content info.
  *
  *   CMS is a signed container: the bytes an external verifier must hash are
  *   surfaced RAW and never re-serialized. `encapContentInfo.eContent` is the raw
@@ -53,15 +55,26 @@ var NAME = pkix.name(NS);
 // version is {1,3} (RFC 5652 §5.1, §5.3). Wider accept maps than any other format.
 var SIGNED_DATA_VERSION = pkix.versionReader(NS, { "1": 1, "3": 3, "4": 4, "5": 5 });
 var SIGNER_VERSION = pkix.versionReader(NS, { "1": 1, "3": 3 });
+// EnvelopedData §6.1 (0/2/3/4), EncryptedData §8 (0/2), and the per-RecipientInfo
+// versions (RFC 5652 §6.2.1-§6.2.4): ktri {0,2}, kari {3}, kekri {4}, pwri {0}.
+var ENVELOPED_DATA_VERSION = pkix.versionReader(NS, { "0": 0, "2": 2, "3": 3, "4": 4 });
+var ENCRYPTED_DATA_VERSION = pkix.versionReader(NS, { "0": 0, "2": 2 });
+var KTRI_VERSION = pkix.versionReader(NS, { "0": 0, "2": 2 });
+var KARI_VERSION = pkix.versionReader(NS, { "3": 3 });
+var KEKRI_VERSION = pkix.versionReader(NS, { "4": 4 });
+var PWRI_VERSION = pkix.versionReader(NS, { "0": 0 });
 
-// id-signedData is the one content type this build structurally decodes; the rest
-// are recognized-and-deferred (a precise diagnostic, not a silent unknown-format).
-// OIDs resolve from the registry (pkcs7 / smimeCt families), never dotted literals.
+// id-signedData / id-envelopedData / id-encryptedData are the content types this
+// build structurally decodes; the rest are recognized-and-deferred (a precise
+// diagnostic, not a silent unknown-format). OIDs resolve from the registry (pkcs7 /
+// smimeCt families), never dotted literals.
 var OID_SIGNED_DATA = oid.byName("signedData");
+var OID_ENVELOPED_DATA = oid.byName("envelopedData");
+var OID_ENCRYPTED_DATA = oid.byName("encryptedData");
 var OID_DATA = oid.byName("data");
 var DEFERRED = new Set([
-  oid.byName("data"), oid.byName("envelopedData"), oid.byName("signedAndEnvelopedData"),
-  oid.byName("digestedData"), oid.byName("encryptedData"), oid.byName("authData"),
+  oid.byName("data"), oid.byName("signedAndEnvelopedData"),
+  oid.byName("digestedData"), oid.byName("authData"),
 ]);
 // The two mandatory signed-attribute types (RFC 5652 §5.3, §11.1/§11.2).
 var OID_CONTENT_TYPE = oid.byName("contentType");
@@ -277,11 +290,313 @@ var SIGNED_DATA = schema.seq([
   },
 });
 
+// ==== EnvelopedData / EncryptedData (RFC 5652 §6/§8, RFC 5753) ========
+var T = asn1.TAGS;
+
+// EncryptedContentInfo ::= SEQUENCE { contentType OID, contentEncryptionAlgorithm
+//   AlgorithmIdentifier, encryptedContent [0] IMPLICIT OCTET STRING OPTIONAL } (RFC
+//   5652 §6.1). encryptedContent is [0] IMPLICIT (context PRIMITIVE) — its content
+//   octets ARE the ciphertext directly, so it reads through implicitOctetString(0),
+//   NOT the [0] EXPLICIT shape ENCAP_CONTENT_INFO uses (which would double-strip a
+//   length header). The ciphertext + algorithm parameters are surfaced RAW.
+var ENCRYPTED_CONTENT_INFO = schema.seq([
+  schema.field("contentType", schema.oidLeaf()),
+  schema.field("contentEncryptionAlgorithm", ALGORITHM_IDENTIFIER),
+  schema.optional("encryptedContent", schema.implicitOctetString(0), { tag: 0 }),
+], {
+  assert: "sequence", arity: { min: 2, max: 3 }, code: "cms/bad-encrypted-content-info", what: "EncryptedContentInfo",
+  build: function (m) {
+    return {
+      contentType: m.fields.contentType.value,
+      contentEncryptionAlgorithm: m.fields.contentEncryptionAlgorithm.value.result,
+      encryptedContent: m.fields.encryptedContent.present ? m.fields.encryptedContent.value : null,
+    };
+  },
+});
+
+// RecipientIdentifier ::= CHOICE { issuerAndSerialNumber, subjectKeyIdentifier [0]
+//   IMPLICIT OCTET STRING } (RFC 5652 §6.2.1) — structurally identical to
+//   SignerIdentifier; reuse ISSUER_AND_SERIAL + the implicitOctetString(0) leaf.
+var RECIPIENT_IDENTIFIER = schema.choice([
+  { when: { tagClass: "universal", tagNumber: T.SEQUENCE }, schema: ISSUER_AND_SERIAL },
+  { when: { tagClass: "context", tagNumber: 0 }, schema: schema.implicitOctetString(0) },
+], { code: "cms/bad-recipient-identifier", what: "RecipientIdentifier" });
+
+// KeyTransRecipientInfo ::= SEQUENCE { version(0|2), rid RecipientIdentifier,
+//   keyEncryptionAlgorithm, encryptedKey OCTET STRING } (RFC 5652 §6.2.1).
+var KEY_TRANS_RECIPIENT_INFO = schema.seq([
+  schema.field("version", KTRI_VERSION),
+  schema.field("rid", RECIPIENT_IDENTIFIER),
+  schema.field("keyEncryptionAlgorithm", ALGORITHM_IDENTIFIER),
+  schema.field("encryptedKey", schema.octetString()),
+], {
+  assert: "sequence", code: "cms/bad-ktri", what: "KeyTransRecipientInfo",
+  build: function (m) {
+    var version = m.fields.version.value;
+    var ridNode = m.fields.rid.node;
+    var isSkid = ridNode.tagClass === "context" && ridNode.tagNumber === 0;
+    // RFC 5652 §6.2.1 — rid ⇔ version: issuerAndSerialNumber ⇒ 0, subjectKeyIdentifier ⇒ 2.
+    if (isSkid && version !== 2) throw NS.E("cms/bad-recipient-version", "a subjectKeyIdentifier recipient identifier requires KeyTransRecipientInfo version 2 (RFC 5652 §6.2.1)");
+    if (!isSkid && version !== 0) throw NS.E("cms/bad-recipient-version", "an issuerAndSerialNumber recipient identifier requires KeyTransRecipientInfo version 0 (RFC 5652 §6.2.1)");
+    return {
+      type: "ktri", version: version,
+      rid: isSkid ? { subjectKeyIdentifier: m.fields.rid.value } : m.fields.rid.value.result,
+      ridType: isSkid ? "subjectKeyIdentifier" : "issuerAndSerialNumber",
+      keyEncryptionAlgorithm: m.fields.keyEncryptionAlgorithm.value.result,
+      encryptedKey: m.fields.encryptedKey.value,
+    };
+  },
+});
+
+// OriginatorPublicKey ::= SEQUENCE { algorithm, publicKey BIT STRING } (RFC 5753
+//   §3.1.1), reached as originatorKey [1] IMPLICIT — SPKI-shaped but cannot reuse
+//   pkix.spki (which asserts a universal SEQUENCE), so assert:"constructed".
+var ORIGINATOR_PUBLIC_KEY = schema.seq([
+  schema.field("algorithm", ALGORITHM_IDENTIFIER),
+  schema.field("publicKey", schema.bitString()),
+], {
+  assert: "constructed", code: "cms/bad-originator-public-key", what: "OriginatorPublicKey",
+  build: function (m) { return { algorithm: m.fields.algorithm.value.result, publicKey: m.fields.publicKey.value }; },
+});
+
+// OriginatorIdentifierOrKey ::= CHOICE { issuerAndSerialNumber, subjectKeyIdentifier
+//   [0] IMPLICIT OCTET STRING, originatorKey [1] IMPLICIT OriginatorPublicKey }.
+var ORIGINATOR_IDENTIFIER_OR_KEY = schema.choice([
+  { when: { tagClass: "universal", tagNumber: T.SEQUENCE }, schema: ISSUER_AND_SERIAL },
+  { when: { tagClass: "context", tagNumber: 0 }, schema: schema.implicitOctetString(0) },
+  { when: { tagClass: "context", tagNumber: 1 }, schema: ORIGINATOR_PUBLIC_KEY },
+], { code: "cms/bad-originator-identifier", what: "OriginatorIdentifierOrKey" });
+
+// RecipientKeyIdentifier (RFC 5652 §6.2.2) and KEKIdentifier (§6.2.3) are one
+//   shape — { <keyId> OCTET STRING, date GeneralizedTime OPTIONAL, other
+//   OtherKeyAttribute OPTIONAL } — differing only in the key-id field's name and
+//   the enclosing tag form. One factory defines both so the OPTIONAL handling
+//   (date and the raw-surfaced OtherKeyAttribute) cannot diverge between them.
+function keyIdentifierSchema(keyIdName, assert, code, what) {
+  return schema.seq([
+    schema.field(keyIdName, schema.octetString()),
+    schema.optional("date", schema.time(NS), { whenUniversal: [T.GENERALIZED_TIME] }),
+    schema.optional("other", schema.any(), { whenUniversal: [T.SEQUENCE] }),
+  ], {
+    assert: assert, code: code, what: what,
+    build: function (m) {
+      var out = {};
+      out[keyIdName] = m.fields[keyIdName].value;
+      out.date = m.fields.date.present ? m.fields.date.value : null;
+      out.other = m.fields.other.present ? m.fields.other.node.bytes : null;
+      return out;
+    },
+  });
+}
+
+// Reached as rKeyId [0] IMPLICIT (a SEQUENCE — constructed, unlike ktri's [0] leaf).
+var RECIPIENT_KEY_IDENTIFIER = keyIdentifierSchema("subjectKeyIdentifier",
+  "constructed", "cms/bad-recipient-key-identifier", "RecipientKeyIdentifier");
+
+// KeyAgreeRecipientIdentifier ::= CHOICE { issuerAndSerialNumber, rKeyId [0] IMPLICIT
+//   RecipientKeyIdentifier } (RFC 5652 §6.2.2).
+var KEY_AGREE_RECIPIENT_IDENTIFIER = schema.choice([
+  { when: { tagClass: "universal", tagNumber: T.SEQUENCE }, schema: ISSUER_AND_SERIAL },
+  { when: { tagClass: "context", tagNumber: 0 }, schema: RECIPIENT_KEY_IDENTIFIER },
+], { code: "cms/bad-kari-identifier", what: "KeyAgreeRecipientIdentifier" });
+
+// RecipientEncryptedKey ::= SEQUENCE { rid KeyAgreeRecipientIdentifier, encryptedKey
+//   OCTET STRING } (RFC 5652 §6.2.2).
+var RECIPIENT_ENCRYPTED_KEY = schema.seq([
+  schema.field("rid", KEY_AGREE_RECIPIENT_IDENTIFIER),
+  schema.field("encryptedKey", schema.octetString()),
+], {
+  assert: "sequence", code: "cms/bad-recipient-encrypted-key", what: "RecipientEncryptedKey",
+  build: function (m) {
+    var ridNode = m.fields.rid.node;
+    var isRkid = ridNode.tagClass === "context" && ridNode.tagNumber === 0;
+    return {
+      rid: isRkid ? m.fields.rid.value.result : m.fields.rid.value.result,
+      encryptedKey: m.fields.encryptedKey.value,
+    };
+  },
+});
+
+// KeyAgreeRecipientInfo ::= [1] IMPLICIT SEQUENCE { version(3), originator [0]
+//   EXPLICIT OriginatorIdentifierOrKey, ukm [1] EXPLICIT OPTIONAL,
+//   keyEncryptionAlgorithm, recipientEncryptedKeys SEQUENCE OF } (RFC 5652 §6.2.2 +
+//   RFC 5753 §3.1.1). originator [0] is EXPLICIT (wraps a CHOICE).
+var KEY_AGREE_RECIPIENT_INFO = schema.seq([
+  schema.field("version", KARI_VERSION),
+  schema.field("originator", schema.explicit(0, ORIGINATOR_IDENTIFIER_OR_KEY, { code: "cms/bad-kari" })),
+  schema.optional("ukm", schema.octetString(), { tag: 1, explicit: true, emptyCode: "cms/bad-kari" }),
+  schema.field("keyEncryptionAlgorithm", ALGORITHM_IDENTIFIER),
+  schema.field("recipientEncryptedKeys", schema.seqOf(RECIPIENT_ENCRYPTED_KEY, { code: "cms/bad-recipient-encrypted-keys", what: "recipientEncryptedKeys" })),
+], {
+  assert: "constructed", code: "cms/bad-kari", what: "KeyAgreeRecipientInfo",
+  build: function (m) {
+    var origNode = m.fields.originator.node.children[0];
+    var origForm = origNode.tagClass === "context" ? (origNode.tagNumber === 0 ? "subjectKeyIdentifier" : "originatorKey") : "issuerAndSerialNumber";
+    var origVal = m.fields.originator.value;
+    return {
+      type: "kari", version: m.fields.version.value,
+      originator: { form: origForm, value: origForm === "subjectKeyIdentifier" ? origVal : origVal.result },
+      ukm: m.fields.ukm.present ? m.fields.ukm.value : null,
+      keyEncryptionAlgorithm: m.fields.keyEncryptionAlgorithm.value.result,
+      recipientEncryptedKeys: m.fields.recipientEncryptedKeys.value.items.map(function (it) { return it.value.result; }),
+    };
+  },
+});
+
+// KEKRecipientInfo ::= [2] IMPLICIT SEQUENCE { version(4), kekid KEKIdentifier,
+//   keyEncryptionAlgorithm, encryptedKey } (RFC 5652 §6.2.3).
+var KEK_IDENTIFIER = keyIdentifierSchema("keyIdentifier",
+  "sequence", "cms/bad-kek-identifier", "KEKIdentifier");
+var KEK_RECIPIENT_INFO = schema.seq([
+  schema.field("version", KEKRI_VERSION),
+  schema.field("kekid", KEK_IDENTIFIER),
+  schema.field("keyEncryptionAlgorithm", ALGORITHM_IDENTIFIER),
+  schema.field("encryptedKey", schema.octetString()),
+], {
+  assert: "constructed", code: "cms/bad-kekri", what: "KEKRecipientInfo",
+  build: function (m) {
+    return {
+      type: "kekri", version: m.fields.version.value,
+      kekid: m.fields.kekid.value.result,
+      keyEncryptionAlgorithm: m.fields.keyEncryptionAlgorithm.value.result,
+      encryptedKey: m.fields.encryptedKey.value,
+    };
+  },
+});
+
+// PasswordRecipientInfo ::= [3] IMPLICIT SEQUENCE { version(0), keyDerivationAlgorithm
+//   [0] IMPLICIT AlgorithmIdentifier OPTIONAL, keyEncryptionAlgorithm, encryptedKey }
+//   (RFC 5652 §6.2.4). keyDerivationAlgorithm [0] IMPLICIT is the one field needing
+//   the implicitTag AlgorithmIdentifier; present iff the first post-version node is [0].
+var PASSWORD_RECIPIENT_INFO = schema.seq([
+  schema.field("version", PWRI_VERSION),
+  schema.optional("keyDerivationAlgorithm", pkix.algorithmIdentifier(NS, { implicitTag: 0 }), { tag: 0 }),
+  schema.field("keyEncryptionAlgorithm", ALGORITHM_IDENTIFIER),
+  schema.field("encryptedKey", schema.octetString()),
+], {
+  assert: "constructed", code: "cms/bad-pwri", what: "PasswordRecipientInfo",
+  build: function (m) {
+    return {
+      type: "pwri", version: m.fields.version.value,
+      keyDerivationAlgorithm: m.fields.keyDerivationAlgorithm.present ? m.fields.keyDerivationAlgorithm.value.result : null,
+      keyEncryptionAlgorithm: m.fields.keyEncryptionAlgorithm.value.result,
+      encryptedKey: m.fields.encryptedKey.value,
+    };
+  },
+});
+
+// OtherRecipientInfo ::= [4] IMPLICIT SEQUENCE { oriType OID, oriValue ANY } (RFC
+//   5652 §6.2.5) — oriValue opaque, surfaced RAW (the shipped encoder routes
+//   KEMRecipientInfo through here).
+var OTHER_RECIPIENT_INFO = schema.seq([
+  schema.field("oriType", schema.oidLeaf()),
+  schema.field("oriValue", schema.any()),
+], {
+  assert: "constructed", code: "cms/bad-ori", what: "OtherRecipientInfo",
+  build: function (m) { return { type: "ori", oriType: m.fields.oriType.value, oriValue: m.fields.oriValue.node.bytes }; },
+});
+
+// RecipientInfo ::= CHOICE { ktri KeyTransRecipientInfo, kari [1], kekri [2], pwri
+//   [3], ori [4] } (RFC 5652 §6.2). A bare universal SEQUENCE is ktri (the untagged
+//   alternative). An unknown context tag → no arm → cms/bad-recipient-info.
+var RECIPIENT_INFO = schema.choice([
+  { when: { tagClass: "universal", tagNumber: T.SEQUENCE }, schema: KEY_TRANS_RECIPIENT_INFO },
+  { when: { tagClass: "context", tagNumber: 1 }, schema: KEY_AGREE_RECIPIENT_INFO },
+  { when: { tagClass: "context", tagNumber: 2 }, schema: KEK_RECIPIENT_INFO },
+  { when: { tagClass: "context", tagNumber: 3 }, schema: PASSWORD_RECIPIENT_INFO },
+  { when: { tagClass: "context", tagNumber: 4 }, schema: OTHER_RECIPIENT_INFO },
+], { code: "cms/bad-recipient-info", what: "RecipientInfo" });
+
+// OriginatorInfo ::= [0] IMPLICIT SEQUENCE { certs [0] IMPLICIT OPTIONAL, crls [1]
+//   IMPLICIT OPTIONAL } (RFC 5652 §6.1). Members surfaced RAW (their outer tag feeds
+//   the version rule).
+var ORIGINATOR_INFO = schema.seq([
+  schema.optional("certs", schema.implicitSetOf(0, schema.any(), { min: 1, code: "cms/bad-originator-certs", what: "certs" }), { tag: 0 }),
+  schema.optional("crls", schema.implicitSetOf(1, schema.any(), { min: 1, code: "cms/bad-originator-crls", what: "crls" }), { tag: 1 }),
+], {
+  assert: "constructed", code: "cms/bad-originator-info", what: "OriginatorInfo",
+  build: function (m) {
+    return {
+      certs: m.fields.certs.present ? m.fields.certs.value.items.map(rawElement) : [],
+      crls: m.fields.crls.present ? m.fields.crls.value.items.map(rawElement) : [],
+    };
+  },
+});
+
+// RFC 5652 §6.1 — the exact EnvelopedData CMSVersion, from originatorInfo's raw
+// cert/crl outer tags and the recipient arms (a cert `other` is [3], a v2AttrCert
+// [2]; a crl `other` is [1]; a pwri or ori forces v3; all-ktri-IAS with no
+// originatorInfo/unprotectedAttrs is v0; everything else v2).
+function _expectedEnvelopedDataVersion(originatorInfo, recipientInfos, hasUnprotectedAttrs) {
+  function ctx(el, n) { return el.tagClass === "context" && el.tagNumber === n; }
+  var hasOrig = !!originatorInfo;
+  var certs = hasOrig ? originatorInfo.certs : [];
+  var crls = hasOrig ? originatorInfo.crls : [];
+  if (hasOrig && (certs.some(function (c) { return ctx(c, 3); }) || crls.some(function (c) { return ctx(c, 1); }))) return 4;
+  if ((hasOrig && certs.some(function (c) { return ctx(c, 2); })) ||
+      recipientInfos.some(function (r) { return r.type === "pwri" || r.type === "ori"; })) return 3;
+  if (!hasOrig && !hasUnprotectedAttrs &&
+      recipientInfos.every(function (r) { return r.type === "ktri" && r.ridType === "issuerAndSerialNumber"; })) return 0;
+  return 2;
+}
+
+// EnvelopedData ::= SEQUENCE { version, originatorInfo [0] IMPLICIT OPTIONAL,
+//   recipientInfos RecipientInfos (SET SIZE 1..MAX), encryptedContentInfo,
+//   unprotectedAttrs [1] IMPLICIT OPTIONAL } (RFC 5652 §6.1). recipientInfos is
+//   min:1 (an empty SET is non-conformant — the INVERSE of SignedData's degenerate
+//   signerInfos).
+var ENVELOPED_DATA = schema.seq([
+  schema.field("version", ENVELOPED_DATA_VERSION),
+  schema.optional("originatorInfo", ORIGINATOR_INFO, { tag: 0 }),
+  schema.field("recipientInfos", schema.setOf(RECIPIENT_INFO, { min: 1, code: "cms/bad-recipient-infos", what: "recipientInfos" })),
+  schema.field("encryptedContentInfo", ENCRYPTED_CONTENT_INFO),
+  schema.optional("unprotectedAttrs", schema.implicitSetOf(1, ATTRIBUTE, { min: 1, code: "cms/bad-unprotected-attrs", what: "unprotectedAttrs" }), { tag: 1 }),
+], {
+  assert: "sequence", code: "cms/bad-enveloped-data", what: "EnvelopedData",
+  build: function (m) {
+    var version = m.fields.version.value;
+    var originatorInfo = m.fields.originatorInfo.present ? m.fields.originatorInfo.value.result : null;
+    var recipientInfos = m.fields.recipientInfos.value.items.map(function (it) { return it.value.result; });
+    var hasUnprotectedAttrs = m.fields.unprotectedAttrs.present;
+    var expected = _expectedEnvelopedDataVersion(originatorInfo, recipientInfos, hasUnprotectedAttrs);
+    if (version !== expected) throw NS.E("cms/bad-version", "EnvelopedData version " + version + " does not match its contents (RFC 5652 §6.1 requires v" + expected + ")");
+    return {
+      version: version,
+      originatorInfo: originatorInfo,
+      recipientInfos: recipientInfos,
+      encryptedContentInfo: m.fields.encryptedContentInfo.value.result,
+      unprotectedAttrs: hasUnprotectedAttrs ? m.fields.unprotectedAttrs.value.items.map(function (it) { return it.value.result; }) : null,
+    };
+  },
+});
+
+// EncryptedData ::= SEQUENCE { version, encryptedContentInfo, unprotectedAttrs [1]
+//   IMPLICIT OPTIONAL } (RFC 5652 §8) — no recipients, no originatorInfo; the CEK is
+//   distributed out of band. version is 0, or 2 iff unprotectedAttrs are present.
+var ENCRYPTED_DATA = schema.seq([
+  schema.field("version", ENCRYPTED_DATA_VERSION),
+  schema.field("encryptedContentInfo", ENCRYPTED_CONTENT_INFO),
+  schema.optional("unprotectedAttrs", schema.implicitSetOf(1, ATTRIBUTE, { min: 1, code: "cms/bad-unprotected-attrs", what: "unprotectedAttrs" }), { tag: 1 }),
+], {
+  assert: "sequence", code: "cms/bad-encrypted-data", what: "EncryptedData",
+  build: function (m) {
+    var version = m.fields.version.value;
+    var hasUnprotectedAttrs = m.fields.unprotectedAttrs.present;
+    var expected = hasUnprotectedAttrs ? 2 : 0;
+    if (version !== expected) throw NS.E("cms/bad-version", "EncryptedData version " + version + " does not match its contents (RFC 5652 §8 requires v" + expected + ")");
+    return {
+      version: version,
+      encryptedContentInfo: m.fields.encryptedContentInfo.value.result,
+      unprotectedAttrs: hasUnprotectedAttrs ? m.fields.unprotectedAttrs.value.items.map(function (it) { return it.value.result; }) : null,
+    };
+  },
+});
+
 // ContentInfo ::= SEQUENCE { contentType OID, content [0] EXPLICIT ANY DEFINED BY
 //   contentType } (RFC 5652 §3). The content is captured raw (explicit(0, any()))
 //   and re-dispatched by contentType inside the build: id-signedData walks
-//   SIGNED_DATA, the other PKCS#7 types are recognized-and-deferred, unknown OIDs
-//   are rejected.
+//   SIGNED_DATA, id-envelopedData / id-encryptedData walk their schemas, the other
+//   PKCS#7 types are recognized-and-deferred, unknown OIDs are rejected.
 var CONTENT_INFO = schema.seq([
   schema.field("contentType", schema.oidLeaf()),
   schema.field("content", schema.explicit(0, schema.any(), { code: "cms/not-a-content-info" })),
@@ -290,6 +605,8 @@ var CONTENT_INFO = schema.seq([
   build: function (m, ctx) {
     var ct = m.fields.contentType.value;
     if (ct === OID_SIGNED_DATA) return schema.walk(SIGNED_DATA, m.fields.content.value, ctx).result;
+    if (ct === OID_ENVELOPED_DATA) return schema.walk(ENVELOPED_DATA, m.fields.content.value, ctx).result;
+    if (ct === OID_ENCRYPTED_DATA) return schema.walk(ENCRYPTED_DATA, m.fields.content.value, ctx).result;
     if (DEFERRED.has(ct)) {
       throw NS.E("cms/unsupported-content-type", (ctx.oid.name(ct) || ct) + " is recognized but not parsed by this build");
     }

package/lib/schema-crl.js

@@ -121,6 +121,11 @@ var REVOKED_LIST = schema.seqOf(REVOKED_ENTRY, {
 // revokedCertificates=SEQUENCE) are disambiguated by their universal tag;
 // crlExtensions is modeled as a trailing [0]..[0] so a stray non-[0] trailing
 // context tag is REJECTED (crl/bad-tbs), not silently ignored.
+// `signature` is consumed by the CERTIFICATE_LIST build (the §5.1.1.2
+// outer==inner agreement check reads tbsMatch.fields.signature.node.bytes);
+// the operator reads the surfaced outer signatureAlgorithm, which that
+// check proves byte-identical.
+// allow:schema-build-drops-parsed-field
 var TBS_CERTLIST = schema.seq([
   schema.optional("version", CRL_VERSION, { whenUniversal: [TAGS.INTEGER] }),
   schema.field("signature", ALGORITHM_IDENTIFIER),

package/lib/schema-engine.js

@@ -63,11 +63,12 @@ function _assertShape(schema, node, ctx) {
       _fail(ctx, schema.code, (schema.what || "value") + " must be a constructed value");
     }
   } else if (mode === "implicit") {
-    // IMPLICIT [tag] SET/SEQUENCE OF: the context tag replaces the universal
-    // tag, so the node is a context-class constructed [tag] and its direct
-    // children are the items (no inner universal SET, no EXPLICIT unwrap).
+    // IMPLICIT [tag] SET/SEQUENCE OF or a fixed-field IMPLICIT [tag] SEQUENCE body:
+    // the context tag replaces the universal tag, so the node is a context-class
+    // constructed [tag] and its direct children are the items / positional fields
+    // (no inner universal tag, no EXPLICIT unwrap).
     if (node.tagClass !== "context" || node.tagNumber !== schema.implicitTag || !node.children) {
-      _fail(ctx, schema.code, (schema.what || "value") + " must be an IMPLICIT [" + schema.implicitTag + "] SET OF");
+      _fail(ctx, schema.code, (schema.what || "value") + " must be an IMPLICIT [" + schema.implicitTag + "] constructed value");
     }
   } else {
     _fail(ctx, schema.code, "unknown assert mode " + JSON.stringify(mode));
@@ -163,7 +164,7 @@ function trailing(members, opts) {
 
 function seq(fields, opts) {
   opts = opts || {};
-  return { kind: "seq", fields: fields, assert: opts.assert || "sequence", arity: opts.arity,
+  return { kind: "seq", fields: fields, assert: opts.assert || "sequence", implicitTag: opts.implicitTag, arity: opts.arity,
            code: opts.code, what: opts.what, build: opts.build, checks: opts.checks || [] };
 }