@blamejs/pki 0.1.16 → 0.1.18

package/CHANGELOG.md

@@ -4,6 +4,45 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.1.18 — 2026-07-08
+
+An RFC 7292 PKCS#12 (PFX) store parser joins the pki.schema family.
+
+### Added
+
+- pki.schema.pkcs12.parse(input) — RFC 7292 PFX parsing. It decodes a DER / BER Buffer or PEM into { version, integrityMode, mac, macedBytes, authSafeSigned, safeBags, encryptedSafes }. Password-integrity stores surface { kind, hashOid, hashName, hashParameters, pbmac1, macValue, macSalt, iterations } plus macedBytes — the exact value octets the HMAC covers, excluding the octet-string header, so an external verifier hashes the correct region. The RFC 9579 PBMAC1 arm is validated, not just recognized: its parameters must be present, the key-derivation function must be PBKDF2 with a keyLength, and the decoded KDF (salt, iteration count, key length, PRF) and MAC scheme surface on pbmac1. The X.690 DEFAULT rule is enforced (an explicitly encoded iterations = 1 is non-canonical and rejects). Public-key-integrity stores surface the CMS SignedData and must carry at least one signer (the signature itself is verified externally). Each safeBag carries its type, friendlyName / localKeyId (decoded, single-value and single-instance rules enforced), and all attributes: keyBags delegate to pki.schema.pkcs8.parse, shrouded key bags to parseEncrypted (algorithm surfaced, ciphertext opaque), cert / CRL / secret values stay raw and byte-exact, and safeContentsBags recurse under a depth ceiling. Encrypted and enveloped safes are validated structurally by the CMS module with ciphertext kept raw, and must declare id-data (a SafeContents) as their encrypted content type. The version-3 rule, the contradictory MacData-alongside-SignedData combination, the closed bag-type and cert/CRL-type sets, and per-list element caps all fail closed with typed pkcs12/* codes; a MacData-less id-data store is legal syntax and parses as integrityMode "none".
+- pki.schema.pkcs12.pemDecode(text, label?) / pemEncode(der, label?) — PEM handling for stores that transit text channels (default label PKCS12).
+- pki.asn1.decode gains an opt-in ber option accepting exactly two shapes — an indefinite length on a constructed value and a constructed OCTET STRING, whose segments reassemble into one primitive content — for formats whose content is normatively BER. The default remains strict DER; minimal-length, minimal-integer, trailing-byte, and size / depth verdicts are unchanged in both modes, an indefinite length on a primitive value still rejects, a foreign-type segment inside a constructed string rejects, and constructed-string nesting is capped (each level re-copies its payload, so deep nesting is memory amplification, not data).
+- pki.schema.engine.embeddedDer(schema, bytes, ctx, opts) — the named form of the re-decode idiom: decode a fresh DER / BER blob carried inside an already-decoded value and walk it against a schema, wrapping codec failures in the caller's typed code. A shared budget option bounds how many nested blobs one parse may unwrap, so a container that chains encodings across octet-string boundaries cannot restart the depth caps from zero. The timestamp, OCSP, and certificate-request parsers now route their embedded-structure decodes through it.
+- SEQUENCE OF / SET OF schemas can declare an element-count ceiling (max), so a container listing a great many tiny elements fails typed instead of amplifying memory through per-element parse products; a single attribute's value list is now capped this way across every format.
+- The OID registry gains the PKCS#12 bag types, the PKCS#12 password-based encryption identifiers, the PKCS#9 certTypes / crlTypes / friendlyName / localKeyId entries, PKCS#5 PBKDF2 / PBES2 / PBMAC1, the NIST AES content-encryption arc, and the HMAC-with-SHA identifiers, so a store's algorithms resolve to names.
+- The error taxonomy gains Pkcs12Error, carrying a stable pkcs12/* code.
+
+### Changed
+
+- The npm-publish workflow's vulnerability scan now scans the SBOM unconditionally and the vendored-bundle directory only when it holds a real bundle, so the scan is exact in both states instead of warning on the empty directory.
+
+### Fixed
+
+- Certification-path validation bounds the RSASSA-PSS saltLength and trailerField before numeric conversion, so an oversized value rejects with path/unsupported-algorithm instead of rounding silently on its way to the verifier — the same exact-or-rejected rule the PKCS#12 MAC parameters follow.
+
+## v0.1.17 — 2026-07-06
+
+An RFC 4211 certificate-request-message parser joins the pki.schema family.
+
+### Added
+
+- pki.schema.crmf.parse(input) — RFC 4211 CertReqMessages parsing. It decodes a DER Buffer or PEM into { messages: [ { certReq, popo, regInfo } ] }, where each certReq is { certReqId, certReqIdHex, certTemplate, controls, certReqBytes } and certTemplate carries the requestable fields version, issuer, validity, subject, publicKey, and extensions (each null when absent). The fields RFC 4211 §5 requires a request to omit — serialNumber and signingAlg (assigned by the CA) and issuerUID and subjectUID (deprecated) — are rejected, not returned, so a requester cannot dictate a CA-assigned value. issuer and subject Names are accepted in both the EXPLICIT and the IMPLICIT wire encodings; the OptionalValidity times are EXPLICIT UTCTime or GeneralizedTime; a supplied CertTemplate version must be 2; certReqId is an unbounded signed integer. popo is null, a raVerified marker, a decoded signature proof (with its poposkInput and signature surfaced raw), or a raw key-encipherment / key-agreement arm; for a signature proof, poposkInput's presence is checked against the template per §4.1. certReqBytes is the exact CertRequest byte range a proof-of-possession verifier hashes. Malformed input fails closed with a typed crmf/* or asn1/* code.
+- pki.schema.crmf.pemDecode(text, label?) — extract the DER bytes from a PEM block (the first block unless a label is given).
+- The OID registry gains the RFC 4211 registration-control (id-regCtrl) and registration-info (id-regInfo) identifiers on the id-pkip arc, so a parsed control or info entry resolves to its name (oldCertID, pkiArchiveOptions, utf8Pairs, and the rest).
+- The error taxonomy gains CrmfError, carrying a stable crmf/* code.
+- pki.schema.engine.encode(schema, value) — the constructor direction of the schema engine. A single declarative schema now drives both decode (walk, bytes to value) and encode (canonical DER, value to bytes): every leaf carries a read and a write, and EXPLICIT wrapping and IMPLICIT context-tag retagging are applied in one place, so an encoder can no longer emit a different tag than the decoder reads. A round-trip test proves walk(decode(encode(value))) recovers the value across universal, IMPLICIT, EXPLICIT, and SET-OF-ordered shapes, and the CRMF request format is proven to round-trip end to end.
+
+### Changed
+
+- pki.schema.ocsp request and response parsing (parseRequest, parseResponse, pemDecode) is now stable.
+- An experimental primitive is surfaced for a graduation review once it has been experimental for a fixed number of releases; the review is recorded as a graduation to stable or a dated keep-experimental decision, so the experimental-to-stable-to-deprecated transition is driven on a schedule (see LTS-CALENDAR.md).
+
 ## v0.1.16 — 2026-07-06
 
 Certification path validation joins the toolkit — RFC 5280 section 6, as a pure re-entrant algorithm.

package/README.md

@@ -199,10 +199,12 @@ is callable today; nothing below is a stub.
 | `pki.schema.ocsp` | Parse DER / PEM OCSP requests and responses per RFC 6960 — per-certificate status (good / revoked / unknown), responder identity, raw tbs bytes for external verification, certificates kept raw, fail-closed; non-basic response types recognized (not decoded) — `parseRequest`, `parseResponse`, `pemDecode` |
 | `pki.schema.tsp` | Parse DER / PEM RFC 3161 timestamp responses and tokens — the TSTInfo payload (imprint, genTime with sub-second precision, serial, nonce, accuracy), the status-to-token coupling, and the token wrapper composed over CMS with the single-signer rule, fail-closed — `parse`, `parseTstInfo`, `parseToken`, `pemDecode` |
 | `pki.schema.attrcert` | Parse DER / PEM RFC 5755 attribute certificates — the holder and issuer identities (validated GeneralNames), the validity window (real `Date`s), the privilege attributes (role / group / clearance) and extensions, with the raw signed region for a verifier; the obsolete v1 form is recognized and deferred, fail-closed — `parse`, `pemDecode` |
-| `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk` plus the schema combinators |
+| `pki.schema.crmf` | Parse DER / PEM RFC 4211 certificate request messages (CertReqMessages — the CMP / EST enrollment body) — the requested-certificate template (subject, public key, validity, extensions), proof-of-possession, and registration controls, with the raw `CertRequest` region a POP verifier hashes; names dual-accepted (IMPLICIT and EXPLICIT), fail-closed — `parse`, `pemDecode` |
+| `pki.schema.pkcs12` | Parse DER / BER / PEM RFC 7292 PKCS#12 (PFX) stores — key bags via the PKCS#8 parser, shrouded keys (algorithm surfaced, ciphertext opaque), cert / CRL / secret bags raw and byte-exact, encrypted and enveloped safes structurally via CMS, `friendlyName` / `localKeyId` decoded, and the exact MAC byte range (`macedBytes`) plus RFC 9579 PBMAC1 recognition for external verification; BER accepted exactly where §4.1 requires it, fail-closed — `parse`, `pemDecode`, `pemEncode` |
+| `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk` / `encode` / `embeddedDer` plus the schema combinators |
 | `pki.path` | RFC 5280 §6 certification-path validation — `validate` runs the §6.1 state machine (signature chaining, validity windows, name chaining, basic constraints and path length, key usage, name constraints, the certificate-policy tree) over an ordered path and a trust anchor, returning a structured verdict with per-check reason codes; `crlChecker` supplies CRL-based revocation. Pure and re-entrant, fail-closed — `validate`, `crlChecker` |
 | `pki.C` / `pki.constants` | Version-stable constants — functional scale helpers (`C.TIME.*`, `C.BYTES.*`), codec `LIMITS`, `version` |
-| `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError` / `TspError` / `AttrCertError` / `PathError`, each carrying a stable `code` in `domain/reason` form |
+| `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError` / `TspError` / `AttrCertError` / `CrmfError` / `Pkcs12Error` / `PathError`, each carrying a stable `code` in `domain/reason` form |
 | `pki` CLI | `pki version`, `pki oid <dotted\|name>`, `pki parse <cert>` |
 
 ### CLI
@@ -216,11 +218,11 @@ pki parse cert.pem                       # structured JSON summary of a certific
 
 ### What's coming
 
-Certificate build/sign/verify, certification-path
-validation, CMS (SignedData / EnvelopedData / EncryptedData / AuthenticatedData),
-OCSP, RFC 3161 timestamping, PKCS#8 decryption (PBES2) / SPKI / PKCS#12, and the
-post-quantum certificate and CMS surface (ML-DSA / ML-KEM / SLH-DSA and hybrid
-composites) are on the roadmap and ride this same core. See
+Certificate build/sign/verify, CMS AuthenticatedData /
+AuthEnvelopedData, PKCS#8 decryption (PBES2) / SPKI, PKCS#12 MAC verification
+and bag decryption, and the post-quantum certificate and CMS surface (ML-DSA /
+ML-KEM / SLH-DSA and hybrid composites) are on the roadmap and ride this same
+core. See
 [ROADMAP.md](ROADMAP.md) for the full plan and current status of each area, and
 [CHANGELOG.md](CHANGELOG.md) for what has landed.
 

package/lib/asn1-der.js

@@ -127,10 +127,19 @@ function _asBuffer(input, who) {
  * after the top-level value (unless `allowTrailing`), or exceeding the
  * size / depth caps.
  *
+ * `ber: true` is a scoped relaxation for formats whose content regions are
+ * normatively BER (RFC 7292 PKCS#12): it accepts an indefinite length on a
+ * constructed value and a constructed OCTET STRING, whose segments are
+ * reassembled into one primitive `content`. Nothing else is relaxed —
+ * definite lengths stay minimal, an indefinite length on a primitive value
+ * and a foreign-type segment still reject, and the size / depth caps hold.
+ *
  * @opts
  *   maxBytes:       number,   // default: C.LIMITS.DER_MAX_BYTES (16 MiB)
  *   maxDepth:       number,   // default: C.LIMITS.DER_MAX_DEPTH (64)
  *   allowTrailing:  boolean,  // default: false — allow bytes after the top TLV
+ *   ber:            boolean,  // default: false — accept indefinite lengths +
+ *                             // constructed OCTET STRINGs (BER content regions)
  *
  * @example
  *   var node = pki.asn1.decode(der);
@@ -144,14 +153,14 @@ function decode(input, opts) {
   if (buf.length > maxBytes) {
     throw new Asn1Error("asn1/too-large", "input " + buf.length + " bytes exceeds cap " + maxBytes);
   }
-  var r = _decodeTLV(buf, 0, buf.length, 0, maxDepth);
+  var r = _decodeTLV(buf, 0, buf.length, 0, maxDepth, opts.ber === true);
   if (!opts.allowTrailing && r.end !== buf.length) {
     throw new Asn1Error("asn1/trailing-bytes", (buf.length - r.end) + " trailing byte(s) after the top-level value");
   }
   return r.node;
 }
 
-function _decodeTLV(buf, start, limit, depth, maxDepth) {
+function _decodeTLV(buf, start, limit, depth, maxDepth, ber, strDepth) {
   if (depth > maxDepth) {
     throw new Asn1Error("asn1/too-deep", "nesting exceeds depth cap " + maxDepth);
   }
@@ -195,8 +204,20 @@ function _decodeTLV(buf, start, limit, depth, maxDepth) {
   // encoded constructed is not valid DER. Without this a constructed string
   // tag decodes to a childless node that later paths (an X.509 DN attribute
   // value) would hex-render or dereference instead of failing closed.
+  // The ber mode licenses exactly one constructed primitive-only type — the
+  // OCTET STRING (the streamed content carrier RFC 7292 §4.1 permits); its
+  // segments are reassembled below. Every other primitive-only type stays
+  // primitive even in BER. Reassembly re-copies each nesting level's payload,
+  // so nesting is capped on the way down: real producers segment one level
+  // deep, and a deep chain multiplies transient memory without carrying data.
   if (tagClassBits === CLASS_UNIVERSAL && constructed && PRIMITIVE_ONLY_UNIVERSAL_TAGS[tagNumber]) {
-    throw new Asn1Error("asn1/constructed-primitive-type", "a universal primitive-only type must be encoded primitive in DER");
+    if (!(ber && tagNumber === TAGS.OCTET_STRING)) {
+      throw new Asn1Error("asn1/constructed-primitive-type", "a universal primitive-only type must be encoded primitive in DER");
+    }
+    strDepth = (strDepth || 0) + 1;
+    if (strDepth > constants.LIMITS.BER_MAX_STRING_NESTING) {
+      throw new Asn1Error("asn1/bad-constructed-string", "constructed OCTET STRING nesting exceeds the cap " + constants.LIMITS.BER_MAX_STRING_NESTING);
+    }
   }
 
   if (p >= limit) throw new Asn1Error("asn1/truncated", "expected a length octet");
@@ -205,7 +226,12 @@ function _decodeTLV(buf, start, limit, depth, maxDepth) {
   if (lenByte < 0x80) {
     length = lenByte;
   } else if (lenByte === 0x80) {
-    throw new Asn1Error("asn1/indefinite-length", "indefinite length is not valid DER");
+    // X.690 §8.1.3.6 — indefinite length is only defined for a constructed
+    // encoding; the value runs to the end-of-contents octets.
+    if (!ber || !constructed) {
+      throw new Asn1Error("asn1/indefinite-length", "indefinite length is not valid DER");
+    }
+    length = -1;
   } else {
     var numLenBytes = lenByte & 0x7f;
     if (numLenBytes > 6) throw new Asn1Error("asn1/length-too-large", "length uses more than 6 octets");
@@ -218,34 +244,79 @@ function _decodeTLV(buf, start, limit, depth, maxDepth) {
   }
 
   var contentStart = p;
-  var contentEnd = contentStart + length;
-  if (contentEnd > limit) throw new Asn1Error("asn1/truncated", "content length overruns the buffer");
+  var indefinite = length === -1;
+  var contentEnd = indefinite ? -1 : contentStart + length;
+  if (!indefinite && contentEnd > limit) throw new Asn1Error("asn1/truncated", "content length overruns the buffer");
+
+  var children = null;
+  var content = null;
+  var child;
+  var end;
+  if (constructed) {
+    children = [];
+    var cp = contentStart;
+    if (indefinite) {
+      for (;;) {
+        if (cp + 2 > limit) throw new Asn1Error("asn1/truncated", "indefinite-length value is missing its end-of-contents octets");
+        if (buf[cp] === 0x00 && buf[cp + 1] === 0x00) break;
+        child = _decodeTLV(buf, cp, limit, depth + 1, maxDepth, ber, strDepth);
+        children.push(child.node);
+        cp = child.end;
+      }
+      contentEnd = cp;
+      end = cp + 2;
+    } else {
+      while (cp < contentEnd) {
+        child = _decodeTLV(buf, cp, contentEnd, depth + 1, maxDepth, ber, strDepth);
+        children.push(child.node);
+        cp = child.end;
+      }
+      end = contentEnd;
+    }
+  } else {
+    content = buf.subarray(contentStart, contentEnd);
+    end = contentEnd;
+  }
 
   var node = {
     tagClass:     _className(tagClassBits),
     constructed:  constructed,
     tagNumber:    tagNumber,
-    length:       length,
+    length:       contentEnd - contentStart,
     header:       { start: start, end: contentStart },
     contentStart: contentStart,
     contentEnd:   contentEnd,
-    content:      null,
-    children:     null,
-    bytes:        buf.subarray(start, contentEnd),
+    content:      content,
+    children:     children,
+    bytes:        buf.subarray(start, end),
   };
 
-  if (constructed) {
-    node.children = [];
-    var cp = contentStart;
-    while (cp < contentEnd) {
-      var child = _decodeTLV(buf, cp, contentEnd, depth + 1, maxDepth);
-      node.children.push(child.node);
-      cp = child.end;
+  // BER reassembly: a constructed OCTET STRING's segments concatenate into
+  // one primitive content, so every downstream reader sees the value a
+  // single-segment encoding would carry; `bytes` keeps the original wire
+  // range for raw round-trip surfaces. Nested constructed segments arrive
+  // already reassembled by the recursion (their nesting depth is capped on
+  // the way down — see the strDepth check above).
+  if (ber && constructed && tagClassBits === CLASS_UNIVERSAL && tagNumber === TAGS.OCTET_STRING) {
+    var segments = [];
+    for (var s = 0; s < children.length; s++) {
+      if (children[s].tagClass !== "universal" || children[s].tagNumber !== TAGS.OCTET_STRING) {
+        throw new Asn1Error("asn1/bad-constructed-string", "a constructed OCTET STRING segment must itself be an OCTET STRING");
+      }
+      segments.push(children[s].content);
     }
-  } else {
-    node.content = buf.subarray(contentStart, contentEnd);
+    node.content = Buffer.concat(segments);
+    node.constructed = false;
+    node.children = null;
+  }
+  // A context-tagged constructed node from a ber decode may be an IMPLICIT
+  // streamed string (the tag hides the underlying type), which only the
+  // schema-driven typed reader can identify — mark it so readers reassemble
+  // exactly those nodes and a strict decode's verdicts never change.
+  if (ber && constructed && tagClassBits === CLASS_CONTEXT && node.children) {
+    node.ber = true;
   }
-  return { node: node, end: contentEnd };
+  return { node: node, end: end };
 }
 
 // ---- Node assertions ------------------------------------------------
@@ -375,13 +446,29 @@ function readOctetString(node) {
 // Read a [tag] IMPLICIT OCTET STRING — a context-class PRIMITIVE node whose
 // content is the octet-string body (the IMPLICIT tag replaces the universal one,
 // so there is no inner universal node). Primitive-only, like its universal
-// counterpart, so the BER constructed/streamed form is rejected. Used for the CMS
-// SignerIdentifier subjectKeyIdentifier [0] (RFC 5652 §5.3).
+// counterpart, so a strict decode's constructed/streamed form is rejected.
+// A node from a ber decode (the `ber` marker) may carry the streamed form —
+// the context tag hides the underlying type from the decoder, so THIS reader
+// is where a [tag] IMPLICIT OCTET STRING's segments reassemble (the shape CMS
+// ciphertext streams as). Used for the CMS SignerIdentifier
+// subjectKeyIdentifier [0] (RFC 5652 §5.3) and EncryptedContentInfo
+// encryptedContent [0] (§6.1).
 function readOctetStringImplicit(node, tag) {
   if (node.tagClass !== "context" || node.tagNumber !== tag) {
     throw new Asn1Error("asn1/unexpected-tag", "readOctetStringImplicit: expected context tag [" + tag +
       "], got " + node.tagClass + "/" + node.tagNumber);
   }
+  if (node.constructed && node.ber === true) {
+    var segments = [];
+    for (var s = 0; s < node.children.length; s++) {
+      var seg = node.children[s];
+      if (seg.tagClass !== "universal" || seg.tagNumber !== TAGS.OCTET_STRING || seg.constructed || !seg.content) {
+        throw new Asn1Error("asn1/bad-constructed-string", "a constructed OCTET STRING segment must itself be an OCTET STRING");
+      }
+      segments.push(seg.content);
+    }
+    return Buffer.concat(segments);
+  }
   _expectPrimitive(node, "readOctetStringImplicit");
   return node.content;
 }
@@ -627,6 +714,18 @@ function encodeLength(n) {
   return Buffer.concat([Buffer.from([0x80 | bytes.length]), Buffer.from(bytes)]);
 }
 
+// The DER of a universal SEQUENCE recovered from a decoded IMPLICIT [n] SEQUENCE
+// `node`, whose context tag replaced the universal 0x30 on the wire (e.g. an RFC
+// 4211 CertTemplate publicKey [6] SubjectPublicKeyInfo, or a POPOSigningKey
+// poposkInput [0]): the field's value is imported / signed as a standalone SEQUENCE,
+// not as the context-tagged wire form. A constructed node exposes its content as
+// `children` (not `content`), so the content is those children's DER concatenated;
+// the identifier becomes the SEQUENCE tag and the length is canonical DER.
+function sequenceTlv(node) {
+  var content = node.content != null ? node.content : Buffer.concat((node.children || []).map(function (c) { return c.bytes; }));
+  return Buffer.concat([Buffer.from([TAGS.SEQUENCE | CONSTRUCTED_BIT]), encodeLength(content.length), content]);
+}
+
 function encodeIdentifier(classBits, constructed, tagNumber) {
   var lead = classBits | (constructed ? CONSTRUCTED_BIT : 0);
   if (tagNumber < 0x1f) return Buffer.from([lead | tagNumber]);
@@ -848,6 +947,7 @@ module.exports = {
   encode:        encodeTLV,
   encodeTLV:     encodeTLV,
   encodeLength:  encodeLength,
+  sequenceTlv:   sequenceTlv,
   encodeIdentifier: encodeIdentifier,
   decodeOidContent: decodeOidContent,
   encodeOidContent: encodeOidContent,

package/lib/constants.js

@@ -121,6 +121,22 @@ var LIMITS = {
   // work on an untrusted certificate bundle (a real chain is well under this;
   // the operator may override via opts.maxPathCerts).
   PATH_MAX_CERTS: 100,
+  // PKCS#12 container ceilings. A PFX carries lists at three altitudes
+  // (ContentInfos per AuthenticatedSafe, SafeBags per SafeContents,
+  // attributes per bag) and can chain fresh DER blobs inside OCTET STRINGs,
+  // where every re-decode would otherwise restart the depth cap from zero.
+  // A real keystore holds a handful of keys and certificates; thousands of
+  // elements or dozens of chained re-decodes is hostile input, not a store.
+  PKCS12_MAX_ELEMENTS: 1024,
+  PKCS12_MAX_REDECODES: 64,
+  PKCS12_MAX_BAG_DEPTH: 16,
+  // BER constructed-string reassembly copies each nesting level's payload, so
+  // nesting multiplies transient memory. Real producers segment one level
+  // deep; nesting past this cap is amplification, not a store.
+  BER_MAX_STRING_NESTING: 8,
+  // A single attribute's value SET — no deployed attribute carries more than
+  // a handful of values; a list at this scale is amplification.
+  ATTRIBUTE_MAX_VALUES: 256,
 };
 
 // Single-sourced from the package manifest so the reported version can

package/lib/framework-error.js

@@ -155,6 +155,17 @@ var TspError = defineClass("TspError", { withCause: true });
 // underlying leaf fault as `.cause`.
 var AttrCertError = defineClass("AttrCertError", { withCause: true });
 
+// CrmfError — a byte sequence that is not a well-formed RFC 4211 CertReqMessages
+// / CertReqMsg / CertRequest / CertTemplate. Carries the underlying leaf fault as
+// `.cause`.
+var CrmfError = defineClass("CrmfError", { withCause: true });
+
+// Pkcs12Error — a byte sequence that is not a well-formed RFC 7292 PFX
+// (AuthenticatedSafe / SafeContents / SafeBag), or a PFX violating a §4
+// coherence rule (version, integrity mode, bag dispatch, MacData). Carries
+// the underlying leaf fault as `.cause`.
+var Pkcs12Error = defineClass("Pkcs12Error", { withCause: true });
+
 // PathError — a certification path that fails RFC 5280 §6 validation, or a
 // malformed input handed to the validator (an extension value that does not
 // decode, an empty path, an unsupported signature algorithm). Carries the
@@ -178,5 +189,7 @@ module.exports = {
   OcspError:        OcspError,
   TspError:         TspError,
   AttrCertError:    AttrCertError,
+  CrmfError:        CrmfError,
+  Pkcs12Error:      Pkcs12Error,
   PathError:        PathError,
 };

package/lib/oid.js

@@ -103,6 +103,14 @@ var FAMILIES = {
     ocspBasic: 1, ocspNonce: 2, ocspCrl: 3, ocspResponse: 4, ocspNoCheck: 5,
     ocspArchiveCutoff: 6, ocspServiceLocator: 7, ocspPrefSigAlgs: 8, ocspExtendedRevoke: 9 } },
 
+  // CRMF (RFC 4211) registration controls (§6) and registration info (§7) on the
+  // id-pkip arc (id-pkix 5). id-regCtrl (id-pkip 1) names the control types a
+  // CertRequest carries; id-regInfo (id-pkip 2) names the registration-info types.
+  // The parser surfaces each control/info value RAW keyed by these names.
+  regCtrl: { base: [1, 3, 6, 1, 5, 5, 7, 5, 1], of: {
+    regToken: 1, authenticator: 2, pkiPublicationInfo: 3, pkiArchiveOptions: 4, oldCertID: 5, protocolEncrKey: 6 } },
+  regInfo: { base: [1, 3, 6, 1, 5, 5, 7, 5, 2], of: { utf8Pairs: 1, certReq: 2 } },
+
   // PKIX extended key purposes (id-kp, RFC 5280 §4.2.1.12). timeStamping is required
   // — critical and sole — on an RFC 3161 TSA signing certificate (§2.3).
   pkixKp: { base: [1, 3, 6, 1, 5, 5, 7, 3], of: {
@@ -120,13 +128,38 @@ var FAMILIES = {
     data: 1, signedData: 2, envelopedData: 3, signedAndEnvelopedData: 4,
     digestedData: 5, encryptedData: 6 } },
 
-  // PKCS#9 attribute types — incl. the CMS signed-attribute OIDs (RFC 5652 §11).
+  // PKCS#9 attribute types — incl. the CMS signed-attribute OIDs (RFC 5652 §11)
+  // and the PKCS#12 bag attributes friendlyName / localKeyId (RFC 7292 §4.2).
   pkcs9: { base: [1, 2, 840, 113549, 1, 9], of: {
     emailAddress: 1, contentType: 3, messageDigest: 4, signingTime: 5,
-    challengePassword: 7, extensionRequest: 14 } },
+    challengePassword: 7, extensionRequest: 14, friendlyName: 20, localKeyId: 21 } },
+
+  // PKCS#9 CertBag / CRLBag value discriminators (RFC 7292 §4.2.3-§4.2.4).
+  pkcs9CertTypes: { base: [1, 2, 840, 113549, 1, 9, 22], of: { x509Certificate: 1, sdsiCertificate: 2 } },
+  pkcs9CrlTypes:  { base: [1, 2, 840, 113549, 1, 9, 23], of: { x509CRL: 1 } },
+
+  // PKCS#5 password-based schemes (RFC 8018) + the PBMAC1 MacData arm (RFC 9579).
+  pkcs5: { base: [1, 2, 840, 113549, 1, 5], of: { pbkdf2: 12, pbes2: 13, pbmac1: 14 } },
+
+  // PKCS#12 bag types (RFC 7292 §4.2, Appendix D).
+  pkcs12BagTypes: { base: [1, 2, 840, 113549, 1, 12, 10, 1], of: {
+    keyBag: 1, pkcs8ShroudedKeyBag: 2, certBag: 3, crlBag: 4, secretBag: 5, safeContentsBag: 6 } },
+
+  // PKCS#12 password-based encryption schemes (RFC 7292 Appendix C) — legacy
+  // PBE identifiers still emitted by deployed exporters; recognized so a
+  // shrouded bag's algorithm resolves to a name, never decrypted here.
+  pkcs12Pbe: { base: [1, 2, 840, 113549, 1, 12, 1], of: {
+    pbeWithSHAAnd128BitRC4: 1, pbeWithSHAAnd40BitRC4: 2,
+    "pbeWithSHAAnd3-KeyTripleDES-CBC": 3, "pbeWithSHAAnd2-KeyTripleDES-CBC": 4,
+    "pbeWithSHAAnd128BitRC2-CBC": 5, "pbeWithSHAAnd40BitRC2-CBC": 6 } },
+
+  // RSADSI digest / HMAC algorithms (RFC 8018 §B.1) — the PBKDF2 / PBMAC1 PRFs.
+  rsadsiDigest: { base: [1, 2, 840, 113549, 2], of: {
+    hmacWithSHA1: 7, hmacWithSHA224: 8, hmacWithSHA256: 9,
+    hmacWithSHA384: 10, hmacWithSHA512: 11 } },
 
   // S/MIME content types on the PKCS#9 smime arc (RFC 5652, RFC 3161): id-ct.
-  smimeCt: { base: [1, 2, 840, 113549, 1, 9, 16, 1], of: { authData: 2, tSTInfo: 4 } },
+  smimeCt: { base: [1, 2, 840, 113549, 1, 9, 16, 1], of: { authData: 2, tSTInfo: 4, encKeyWithID: 21 } },
 
   // S/MIME authenticated attributes (id-aa, RFC 2634 / RFC 5035 / RFC 5816). The ESS
   // signing-certificate attributes bind a CMS / TSP SignerInfo to its signing cert;
@@ -149,6 +182,12 @@ var FAMILIES = {
   // nistHash covers only SHA-256 and above.
   oiwSecsig: { base: [1, 3, 14, 3, 2], of: { sha1: 26 } },
 
+  // NIST AES content-encryption algorithms (arc 2.16.840.1.101.3.4.1) — the
+  // modern PBES2 / CMS content ciphers a PKCS#12 or EnvelopedData names.
+  nistAes: { base: [2, 16, 840, 1, 101, 3, 4, 1], of: {
+    "aes128-CBC": 2, "aes128-GCM": 6, "aes192-CBC": 22, "aes192-GCM": 26,
+    "aes256-CBC": 42, "aes256-GCM": 46 } },
+
   // NIST hash functions (SHA-2, SHA-3, SHAKE).
   nistHash: { base: [2, 16, 840, 1, 101, 3, 4, 2], of: {
     sha256: 1, sha384: 2, sha512: 3, "sha3-256": 8, "sha3-512": 10, shake256: 12 } },

package/lib/path-validate.js

@@ -193,10 +193,18 @@ function resolveRsaPss(paramsBytes) {
       // A negative saltLength must be rejected: the OpenSSL-backed verify shim
       // reads -1/-2/-3 as RSA_PSS_SALTLEN_DIGEST/AUTO/MAX, and AUTO (-2) accepts
       // a signature of ANY salt length — defeating the salt-length binding.
-      if (sl < 0n) throw E("path/unsupported-algorithm", "RSASSA-PSS saltLength must be non-negative");
+      // The upper bound keeps the value exact through Number conversion: the
+      // verifier binds to the salt length the certificate states, so a value
+      // that would round is not verifiable material (no real salt exceeds the
+      // modulus size, let alone this).
+      if (sl < 0n || sl > 2147483647n) throw E("path/unsupported-algorithm", "RSASSA-PSS saltLength must be a non-negative integer within the salt-length range");
       saltLength = Number(sl);
     } else if (f.tagNumber === 3) {
-      trailer = Number(asn1.read.integer(f.children[0]));
+      // Compared for equality with 1 below — bound before conversion so an
+      // oversized value cannot round on its way to the comparison.
+      var tf = asn1.read.integer(f.children[0]);
+      if (tf < 0n || tf > 2147483647n) throw E("path/unsupported-algorithm", "unsupported RSASSA-PSS trailerField " + tf.toString());
+      trailer = Number(tf);
     }
   });
   if (hash === null) throw E("path/unsupported-algorithm", "RSASSA-PSS hashAlgorithm must be stated explicitly (the SHA-1 default is rejected)");

package/lib/schema-all.js

@@ -11,9 +11,9 @@
  *
  * @intro
  *   The schema family: a declarative ASN.1 structure-schema engine and the
- *   per-format parsers built on it. Every format (X.509 certificates, CRLs,
- *   PKCS#10 certification requests, PKCS#8 private keys, and CMS SignedData) is a
- *   member that COMPOSES the
+ *   per-format parsers built on it. Every format — from X.509 certificates
+ *   and CRLs through CMS, OCSP, timestamps, and PKCS#12 stores; `all()`
+ *   enumerates the registered set — is a member that COMPOSES the
  *   shared engine and the shared PKIX sub-schemas (AlgorithmIdentifier, Name,
  *   Extension), so a structural rule — bounds-checked positional reads,
  *   optional / tagged field ordering, SET-OF uniqueness, fail-closed typed
@@ -36,9 +36,11 @@ var x509 = require("./schema-x509");
 var crl = require("./schema-crl");
 var csr = require("./schema-csr");
 var pkcs8 = require("./schema-pkcs8");
+var pkcs12 = require("./schema-pkcs12");
 var cms = require("./schema-cms");
 var ocsp = require("./schema-ocsp");
 var tsp = require("./schema-tsp");
+var crmf = require("./schema-crmf");
 var attrcert = require("./schema-attrcert");
 var frameworkError = require("./framework-error");
 
@@ -46,9 +48,12 @@ var SchemaError = frameworkError.SchemaError;
 var PemError = frameworkError.PemError;
 
 // The shared parse-entry opts for the orchestrator: label-agnostic PEM unwrap
-// (any block type routes), the schema/* error family. Detection needs DER, so
-// the coerced DER is what gets routed to the matched format.
-var ENTRY = { pemLabel: null, PemError: PemError, ErrorClass: SchemaError, prefix: "schema", what: "input" };
+// (any block type routes), the schema/* error family. Detection needs a decoded
+// root, so the coerced bytes are what gets routed to the matched format. The
+// ber mode lets a BER-encoded PFX (the dominant real-world .p12 shape) decode
+// far enough to detect; a BER input matching a strict-DER-only format still
+// fails typed inside that format's own parse.
+var ENTRY = { pemLabel: null, PemError: PemError, ErrorClass: SchemaError, prefix: "schema", what: "input", ber: true };
 
 // REGISTRY — each format is declarative data: a name, a `detect(root)` that
 // recognizes the decoded DER root as this format's outer structure, and the
@@ -83,6 +88,19 @@ var FORMATS = [
     detect: tsp.matches,
     parse: function (input) { return tsp.parse(input); },
   },
+  {
+    // CertReqMessages ::= SEQUENCE SIZE(1..MAX) OF CertReqMsg (RFC 4211 §3) — a
+    // SEQUENCE whose first CertReqMsg's CertRequest leads with a universal INTEGER
+    // (certReqId) then a universal SEQUENCE (certTemplate). Leads with a SEQUENCE
+    // like the signed-envelope trio and the ocsp-request, but the INTEGER-then-
+    // SEQUENCE pair at that depth is disjoint from both. Registered AHEAD of
+    // ocsp-request: a single-message CertReqMessages is the only remaining overlap
+    // with the ocsp-request detector, and crmf's deeper probe is the more specific.
+    name: "crmf",
+    module: crmf,
+    detect: crmf.matches,
+    parse: function (input) { return crmf.parse(input); },
+  },
   {
     // OCSPRequest ::= SEQUENCE { tbsRequest SEQUENCE, optionalSignature [0] EXPLICIT
     // OPTIONAL } — a SEQUENCE of 1-2 whose first child is the tbsRequest SEQUENCE.
@@ -103,6 +121,20 @@ var FORMATS = [
     detect: ocsp.matchesResponse,
     parse: function (input) { return ocsp.parseResponse(input); },
   },
+  {
+    // PKCS#12 PFX ::= SEQUENCE { version INTEGER, authSafe ContentInfo, macData
+    // OPTIONAL } — INTEGER-first like pkcs8, so the discriminators are deeper:
+    // children[1] is a ContentInfo (SEQUENCE of exactly 2: OID + [0] constructed —
+    // a shape a PrivateKeyInfo's AlgorithmIdentifier never presents) and
+    // children[2] is a MacData SEQUENCE or absent (pkcs8 requires an OCTET STRING
+    // there). Shape-disjoint from pkcs8, and registered ahead of it as the more
+    // specific probe (RFC 7292 §4). A BER-encoded PFX detects through the
+    // orchestrator's BER decode fallback and routes here.
+    name: "pkcs12",
+    module: pkcs12,
+    detect: pkcs12.matches,
+    parse: function (input) { return pkcs12.parse(input); },
+  },
   {
     // PKCS#8 PrivateKeyInfo / OneAsymmetricKey — SEQUENCE whose first child is an
     // INTEGER (version) and third an OCTET STRING (privateKey); disjoint from the
@@ -179,7 +211,7 @@ var FORMATS = [
  * The names of every registered format, in detection order.
  *
  * @example
- *   pki.schema.all();  // → ["cms", "tsp", "ocsp-request", "ocsp-response", "pkcs8", "csr", "attrcert", "attrcert-v1", "crl", "x509"]
+ *   pki.schema.all();  // → ["cms", "tsp", "crmf", "ocsp-request", "ocsp-response", "pkcs12", "pkcs8", "csr", "attrcert", "attrcert-v1", "crl", "x509"]
  */
 function all() { return FORMATS.map(function (f) { return f.name; }); }
 
@@ -221,9 +253,11 @@ module.exports = {
   crl:  { parse: crl.parse,  pemDecode: crl.pemDecode },
   csr:  { parse: csr.parse,  pemDecode: csr.pemDecode, pemEncode: csr.pemEncode },
   pkcs8: { parse: pkcs8.parse, parseEncrypted: pkcs8.parseEncrypted, pemDecode: pkcs8.pemDecode, pemEncode: pkcs8.pemEncode },
+  pkcs12: { parse: pkcs12.parse, pemDecode: pkcs12.pemDecode, pemEncode: pkcs12.pemEncode },
   cms:  { parse: cms.parse, pemDecode: cms.pemDecode, pemEncode: cms.pemEncode },
   ocsp: { parseRequest: ocsp.parseRequest, parseResponse: ocsp.parseResponse, pemDecode: ocsp.pemDecode },
   tsp: { parse: tsp.parse, parseTstInfo: tsp.parseTstInfo, parseToken: tsp.parseToken, pemDecode: tsp.pemDecode },
+  crmf: { parse: crmf.parse, pemDecode: crmf.pemDecode },
   attrcert: { parse: attrcert.parse, pemDecode: attrcert.pemDecode },
   all: all,
   parse: parse,

package/lib/schema-cms.js

@@ -618,7 +618,7 @@ var CONTENT_INFO = schema.seq([
  * @primitive  pki.schema.cms.parse
  * @signature  pki.schema.cms.parse(input) -> signedData
  * @since      0.1.10
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5652
  * @related    pki.schema.parse, pki.schema.x509.parse
  *
@@ -642,7 +642,7 @@ var parse = pkix.makeParser({ pemLabel: "CMS", PemError: PemError, ErrorClass: C
  * @primitive  pki.schema.cms.pemDecode
  * @signature  pki.schema.cms.pemDecode(text, label?) -> Buffer
  * @since      0.1.10
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468, RFC 5652
  * @related    pki.schema.cms.parse
  *
@@ -658,7 +658,7 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || "CMS", Pe
  * @primitive  pki.schema.cms.pemEncode
  * @signature  pki.schema.cms.pemEncode(der, label?) -> string
  * @since      0.1.10
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468
  * @related    pki.schema.cms.pemDecode
  *
@@ -684,9 +684,28 @@ function matches(root) {
   return true;
 }
 
+// Validate a bare EnvelopedData (RFC 5652 §6.1) — a universal SEQUENCE node —
+// returning its structured value; throws a typed cms/* error on a malformed
+// structure. Exposed for a composer that carries a bare EnvelopedData OUTSIDE a
+// ContentInfo (an RFC 4211 CRMF encryptedKey [4] POPOPrivKey arm), which the
+// content-type dispatch in `parse` cannot reach. The node MUST already be a
+// universal SEQUENCE (an IMPLICIT [n] EnvelopedData is retagged by the caller).
+function walkEnvelopedData(node) { return schema.walk(ENVELOPED_DATA, node, NS).result; }
+
+// Validate a bare SignedData / EncryptedData node the same way — for a composer
+// that holds an already-decoded content node and must not re-decode its bytes
+// (an RFC 7292 PFX authSafe or encrypted safe, whose wire encoding may be BER
+// that the strict `parse` entry would refuse). Same contract as
+// walkEnvelopedData: the node is the bare structure, typed cms/* on rejection.
+function walkSignedData(node) { return schema.walk(SIGNED_DATA, node, NS).result; }
+function walkEncryptedData(node) { return schema.walk(ENCRYPTED_DATA, node, NS).result; }
+
 module.exports = {
   parse: parse,
   pemDecode: pemDecode,
   pemEncode: pemEncode,
   matches: matches,
+  walkEnvelopedData: walkEnvelopedData,
+  walkSignedData: walkSignedData,
+  walkEncryptedData: walkEncryptedData,
 };

package/lib/schema-crl.js

@@ -190,7 +190,7 @@ var CERTIFICATE_LIST = pkix.signedEnvelope(NS, TBS_CERTLIST, {
  * @primitive  pki.schema.crl.parse
  * @signature  pki.schema.crl.parse(input) -> crl
  * @since      0.1.7
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5280
  * @related    pki.schema.x509.parse, pki.schema.parse
  *
@@ -210,7 +210,7 @@ var parse = pkix.makeParser({ pemLabel: "X509 CRL", PemError: PemError, ErrorCla
  * @primitive  pki.schema.crl.pemDecode
  * @signature  pki.schema.crl.pemDecode(text, label?) -> Buffer
  * @since      0.1.7
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468, RFC 5280
  * @related    pki.schema.crl.parse
  *