@blamejs/pki 0.1.17 → 0.1.18

package/CHANGELOG.md

@@ -4,7 +4,29 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## v0.1.17 — 2026-07-07
+## v0.1.18 — 2026-07-08
+
+An RFC 7292 PKCS#12 (PFX) store parser joins the pki.schema family.
+
+### Added
+
+- pki.schema.pkcs12.parse(input) — RFC 7292 PFX parsing. It decodes a DER / BER Buffer or PEM into { version, integrityMode, mac, macedBytes, authSafeSigned, safeBags, encryptedSafes }. Password-integrity stores surface { kind, hashOid, hashName, hashParameters, pbmac1, macValue, macSalt, iterations } plus macedBytes — the exact value octets the HMAC covers, excluding the octet-string header, so an external verifier hashes the correct region. The RFC 9579 PBMAC1 arm is validated, not just recognized: its parameters must be present, the key-derivation function must be PBKDF2 with a keyLength, and the decoded KDF (salt, iteration count, key length, PRF) and MAC scheme surface on pbmac1. The X.690 DEFAULT rule is enforced (an explicitly encoded iterations = 1 is non-canonical and rejects). Public-key-integrity stores surface the CMS SignedData and must carry at least one signer (the signature itself is verified externally). Each safeBag carries its type, friendlyName / localKeyId (decoded, single-value and single-instance rules enforced), and all attributes: keyBags delegate to pki.schema.pkcs8.parse, shrouded key bags to parseEncrypted (algorithm surfaced, ciphertext opaque), cert / CRL / secret values stay raw and byte-exact, and safeContentsBags recurse under a depth ceiling. Encrypted and enveloped safes are validated structurally by the CMS module with ciphertext kept raw, and must declare id-data (a SafeContents) as their encrypted content type. The version-3 rule, the contradictory MacData-alongside-SignedData combination, the closed bag-type and cert/CRL-type sets, and per-list element caps all fail closed with typed pkcs12/* codes; a MacData-less id-data store is legal syntax and parses as integrityMode "none".
+- pki.schema.pkcs12.pemDecode(text, label?) / pemEncode(der, label?) — PEM handling for stores that transit text channels (default label PKCS12).
+- pki.asn1.decode gains an opt-in ber option accepting exactly two shapes — an indefinite length on a constructed value and a constructed OCTET STRING, whose segments reassemble into one primitive content — for formats whose content is normatively BER. The default remains strict DER; minimal-length, minimal-integer, trailing-byte, and size / depth verdicts are unchanged in both modes, an indefinite length on a primitive value still rejects, a foreign-type segment inside a constructed string rejects, and constructed-string nesting is capped (each level re-copies its payload, so deep nesting is memory amplification, not data).
+- pki.schema.engine.embeddedDer(schema, bytes, ctx, opts) — the named form of the re-decode idiom: decode a fresh DER / BER blob carried inside an already-decoded value and walk it against a schema, wrapping codec failures in the caller's typed code. A shared budget option bounds how many nested blobs one parse may unwrap, so a container that chains encodings across octet-string boundaries cannot restart the depth caps from zero. The timestamp, OCSP, and certificate-request parsers now route their embedded-structure decodes through it.
+- SEQUENCE OF / SET OF schemas can declare an element-count ceiling (max), so a container listing a great many tiny elements fails typed instead of amplifying memory through per-element parse products; a single attribute's value list is now capped this way across every format.
+- The OID registry gains the PKCS#12 bag types, the PKCS#12 password-based encryption identifiers, the PKCS#9 certTypes / crlTypes / friendlyName / localKeyId entries, PKCS#5 PBKDF2 / PBES2 / PBMAC1, the NIST AES content-encryption arc, and the HMAC-with-SHA identifiers, so a store's algorithms resolve to names.
+- The error taxonomy gains Pkcs12Error, carrying a stable pkcs12/* code.
+
+### Changed
+
+- The npm-publish workflow's vulnerability scan now scans the SBOM unconditionally and the vendored-bundle directory only when it holds a real bundle, so the scan is exact in both states instead of warning on the empty directory.
+
+### Fixed
+
+- Certification-path validation bounds the RSASSA-PSS saltLength and trailerField before numeric conversion, so an oversized value rejects with path/unsupported-algorithm instead of rounding silently on its way to the verifier — the same exact-or-rejected rule the PKCS#12 MAC parameters follow.
+
+## v0.1.17 — 2026-07-06
 
 An RFC 4211 certificate-request-message parser joins the pki.schema family.
 

package/README.md

@@ -200,10 +200,11 @@ is callable today; nothing below is a stub.
 | `pki.schema.tsp` | Parse DER / PEM RFC 3161 timestamp responses and tokens — the TSTInfo payload (imprint, genTime with sub-second precision, serial, nonce, accuracy), the status-to-token coupling, and the token wrapper composed over CMS with the single-signer rule, fail-closed — `parse`, `parseTstInfo`, `parseToken`, `pemDecode` |
 | `pki.schema.attrcert` | Parse DER / PEM RFC 5755 attribute certificates — the holder and issuer identities (validated GeneralNames), the validity window (real `Date`s), the privilege attributes (role / group / clearance) and extensions, with the raw signed region for a verifier; the obsolete v1 form is recognized and deferred, fail-closed — `parse`, `pemDecode` |
 | `pki.schema.crmf` | Parse DER / PEM RFC 4211 certificate request messages (CertReqMessages — the CMP / EST enrollment body) — the requested-certificate template (subject, public key, validity, extensions), proof-of-possession, and registration controls, with the raw `CertRequest` region a POP verifier hashes; names dual-accepted (IMPLICIT and EXPLICIT), fail-closed — `parse`, `pemDecode` |
-| `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk` plus the schema combinators |
+| `pki.schema.pkcs12` | Parse DER / BER / PEM RFC 7292 PKCS#12 (PFX) stores — key bags via the PKCS#8 parser, shrouded keys (algorithm surfaced, ciphertext opaque), cert / CRL / secret bags raw and byte-exact, encrypted and enveloped safes structurally via CMS, `friendlyName` / `localKeyId` decoded, and the exact MAC byte range (`macedBytes`) plus RFC 9579 PBMAC1 recognition for external verification; BER accepted exactly where §4.1 requires it, fail-closed — `parse`, `pemDecode`, `pemEncode` |
+| `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk` / `encode` / `embeddedDer` plus the schema combinators |
 | `pki.path` | RFC 5280 §6 certification-path validation — `validate` runs the §6.1 state machine (signature chaining, validity windows, name chaining, basic constraints and path length, key usage, name constraints, the certificate-policy tree) over an ordered path and a trust anchor, returning a structured verdict with per-check reason codes; `crlChecker` supplies CRL-based revocation. Pure and re-entrant, fail-closed — `validate`, `crlChecker` |
 | `pki.C` / `pki.constants` | Version-stable constants — functional scale helpers (`C.TIME.*`, `C.BYTES.*`), codec `LIMITS`, `version` |
-| `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError` / `TspError` / `AttrCertError` / `CrmfError` / `PathError`, each carrying a stable `code` in `domain/reason` form |
+| `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError` / `TspError` / `AttrCertError` / `CrmfError` / `Pkcs12Error` / `PathError`, each carrying a stable `code` in `domain/reason` form |
 | `pki` CLI | `pki version`, `pki oid <dotted\|name>`, `pki parse <cert>` |
 
 ### CLI
@@ -217,11 +218,11 @@ pki parse cert.pem                       # structured JSON summary of a certific
 
 ### What's coming
 
-Certificate build/sign/verify, certification-path
-validation, CMS (SignedData / EnvelopedData / EncryptedData / AuthenticatedData),
-OCSP, RFC 3161 timestamping, PKCS#8 decryption (PBES2) / SPKI / PKCS#12, and the
-post-quantum certificate and CMS surface (ML-DSA / ML-KEM / SLH-DSA and hybrid
-composites) are on the roadmap and ride this same core. See
+Certificate build/sign/verify, CMS AuthenticatedData /
+AuthEnvelopedData, PKCS#8 decryption (PBES2) / SPKI, PKCS#12 MAC verification
+and bag decryption, and the post-quantum certificate and CMS surface (ML-DSA /
+ML-KEM / SLH-DSA and hybrid composites) are on the roadmap and ride this same
+core. See
 [ROADMAP.md](ROADMAP.md) for the full plan and current status of each area, and
 [CHANGELOG.md](CHANGELOG.md) for what has landed.
 

package/lib/asn1-der.js

@@ -127,10 +127,19 @@ function _asBuffer(input, who) {
  * after the top-level value (unless `allowTrailing`), or exceeding the
  * size / depth caps.
  *
+ * `ber: true` is a scoped relaxation for formats whose content regions are
+ * normatively BER (RFC 7292 PKCS#12): it accepts an indefinite length on a
+ * constructed value and a constructed OCTET STRING, whose segments are
+ * reassembled into one primitive `content`. Nothing else is relaxed —
+ * definite lengths stay minimal, an indefinite length on a primitive value
+ * and a foreign-type segment still reject, and the size / depth caps hold.
+ *
  * @opts
  *   maxBytes:       number,   // default: C.LIMITS.DER_MAX_BYTES (16 MiB)
  *   maxDepth:       number,   // default: C.LIMITS.DER_MAX_DEPTH (64)
  *   allowTrailing:  boolean,  // default: false — allow bytes after the top TLV
+ *   ber:            boolean,  // default: false — accept indefinite lengths +
+ *                             // constructed OCTET STRINGs (BER content regions)
  *
  * @example
  *   var node = pki.asn1.decode(der);
@@ -144,14 +153,14 @@ function decode(input, opts) {
   if (buf.length > maxBytes) {
     throw new Asn1Error("asn1/too-large", "input " + buf.length + " bytes exceeds cap " + maxBytes);
   }
-  var r = _decodeTLV(buf, 0, buf.length, 0, maxDepth);
+  var r = _decodeTLV(buf, 0, buf.length, 0, maxDepth, opts.ber === true);
   if (!opts.allowTrailing && r.end !== buf.length) {
     throw new Asn1Error("asn1/trailing-bytes", (buf.length - r.end) + " trailing byte(s) after the top-level value");
   }
   return r.node;
 }
 
-function _decodeTLV(buf, start, limit, depth, maxDepth) {
+function _decodeTLV(buf, start, limit, depth, maxDepth, ber, strDepth) {
   if (depth > maxDepth) {
     throw new Asn1Error("asn1/too-deep", "nesting exceeds depth cap " + maxDepth);
   }
@@ -195,8 +204,20 @@ function _decodeTLV(buf, start, limit, depth, maxDepth) {
   // encoded constructed is not valid DER. Without this a constructed string
   // tag decodes to a childless node that later paths (an X.509 DN attribute
   // value) would hex-render or dereference instead of failing closed.
+  // The ber mode licenses exactly one constructed primitive-only type — the
+  // OCTET STRING (the streamed content carrier RFC 7292 §4.1 permits); its
+  // segments are reassembled below. Every other primitive-only type stays
+  // primitive even in BER. Reassembly re-copies each nesting level's payload,
+  // so nesting is capped on the way down: real producers segment one level
+  // deep, and a deep chain multiplies transient memory without carrying data.
   if (tagClassBits === CLASS_UNIVERSAL && constructed && PRIMITIVE_ONLY_UNIVERSAL_TAGS[tagNumber]) {
-    throw new Asn1Error("asn1/constructed-primitive-type", "a universal primitive-only type must be encoded primitive in DER");
+    if (!(ber && tagNumber === TAGS.OCTET_STRING)) {
+      throw new Asn1Error("asn1/constructed-primitive-type", "a universal primitive-only type must be encoded primitive in DER");
+    }
+    strDepth = (strDepth || 0) + 1;
+    if (strDepth > constants.LIMITS.BER_MAX_STRING_NESTING) {
+      throw new Asn1Error("asn1/bad-constructed-string", "constructed OCTET STRING nesting exceeds the cap " + constants.LIMITS.BER_MAX_STRING_NESTING);
+    }
   }
 
   if (p >= limit) throw new Asn1Error("asn1/truncated", "expected a length octet");
@@ -205,7 +226,12 @@ function _decodeTLV(buf, start, limit, depth, maxDepth) {
   if (lenByte < 0x80) {
     length = lenByte;
   } else if (lenByte === 0x80) {
-    throw new Asn1Error("asn1/indefinite-length", "indefinite length is not valid DER");
+    // X.690 §8.1.3.6 — indefinite length is only defined for a constructed
+    // encoding; the value runs to the end-of-contents octets.
+    if (!ber || !constructed) {
+      throw new Asn1Error("asn1/indefinite-length", "indefinite length is not valid DER");
+    }
+    length = -1;
   } else {
     var numLenBytes = lenByte & 0x7f;
     if (numLenBytes > 6) throw new Asn1Error("asn1/length-too-large", "length uses more than 6 octets");
@@ -218,34 +244,79 @@ function _decodeTLV(buf, start, limit, depth, maxDepth) {
   }
 
   var contentStart = p;
-  var contentEnd = contentStart + length;
-  if (contentEnd > limit) throw new Asn1Error("asn1/truncated", "content length overruns the buffer");
+  var indefinite = length === -1;
+  var contentEnd = indefinite ? -1 : contentStart + length;
+  if (!indefinite && contentEnd > limit) throw new Asn1Error("asn1/truncated", "content length overruns the buffer");
+
+  var children = null;
+  var content = null;
+  var child;
+  var end;
+  if (constructed) {
+    children = [];
+    var cp = contentStart;
+    if (indefinite) {
+      for (;;) {
+        if (cp + 2 > limit) throw new Asn1Error("asn1/truncated", "indefinite-length value is missing its end-of-contents octets");
+        if (buf[cp] === 0x00 && buf[cp + 1] === 0x00) break;
+        child = _decodeTLV(buf, cp, limit, depth + 1, maxDepth, ber, strDepth);
+        children.push(child.node);
+        cp = child.end;
+      }
+      contentEnd = cp;
+      end = cp + 2;
+    } else {
+      while (cp < contentEnd) {
+        child = _decodeTLV(buf, cp, contentEnd, depth + 1, maxDepth, ber, strDepth);
+        children.push(child.node);
+        cp = child.end;
+      }
+      end = contentEnd;
+    }
+  } else {
+    content = buf.subarray(contentStart, contentEnd);
+    end = contentEnd;
+  }
 
   var node = {
     tagClass:     _className(tagClassBits),
     constructed:  constructed,
     tagNumber:    tagNumber,
-    length:       length,
+    length:       contentEnd - contentStart,
     header:       { start: start, end: contentStart },
     contentStart: contentStart,
     contentEnd:   contentEnd,
-    content:      null,
-    children:     null,
-    bytes:        buf.subarray(start, contentEnd),
+    content:      content,
+    children:     children,
+    bytes:        buf.subarray(start, end),
   };
 
-  if (constructed) {
-    node.children = [];
-    var cp = contentStart;
-    while (cp < contentEnd) {
-      var child = _decodeTLV(buf, cp, contentEnd, depth + 1, maxDepth);
-      node.children.push(child.node);
-      cp = child.end;
+  // BER reassembly: a constructed OCTET STRING's segments concatenate into
+  // one primitive content, so every downstream reader sees the value a
+  // single-segment encoding would carry; `bytes` keeps the original wire
+  // range for raw round-trip surfaces. Nested constructed segments arrive
+  // already reassembled by the recursion (their nesting depth is capped on
+  // the way down — see the strDepth check above).
+  if (ber && constructed && tagClassBits === CLASS_UNIVERSAL && tagNumber === TAGS.OCTET_STRING) {
+    var segments = [];
+    for (var s = 0; s < children.length; s++) {
+      if (children[s].tagClass !== "universal" || children[s].tagNumber !== TAGS.OCTET_STRING) {
+        throw new Asn1Error("asn1/bad-constructed-string", "a constructed OCTET STRING segment must itself be an OCTET STRING");
+      }
+      segments.push(children[s].content);
     }
-  } else {
-    node.content = buf.subarray(contentStart, contentEnd);
+    node.content = Buffer.concat(segments);
+    node.constructed = false;
+    node.children = null;
   }
-  return { node: node, end: contentEnd };
+  // A context-tagged constructed node from a ber decode may be an IMPLICIT
+  // streamed string (the tag hides the underlying type), which only the
+  // schema-driven typed reader can identify — mark it so readers reassemble
+  // exactly those nodes and a strict decode's verdicts never change.
+  if (ber && constructed && tagClassBits === CLASS_CONTEXT && node.children) {
+    node.ber = true;
+  }
+  return { node: node, end: end };
 }
 
 // ---- Node assertions ------------------------------------------------
@@ -375,13 +446,29 @@ function readOctetString(node) {
 // Read a [tag] IMPLICIT OCTET STRING — a context-class PRIMITIVE node whose
 // content is the octet-string body (the IMPLICIT tag replaces the universal one,
 // so there is no inner universal node). Primitive-only, like its universal
-// counterpart, so the BER constructed/streamed form is rejected. Used for the CMS
-// SignerIdentifier subjectKeyIdentifier [0] (RFC 5652 §5.3).
+// counterpart, so a strict decode's constructed/streamed form is rejected.
+// A node from a ber decode (the `ber` marker) may carry the streamed form —
+// the context tag hides the underlying type from the decoder, so THIS reader
+// is where a [tag] IMPLICIT OCTET STRING's segments reassemble (the shape CMS
+// ciphertext streams as). Used for the CMS SignerIdentifier
+// subjectKeyIdentifier [0] (RFC 5652 §5.3) and EncryptedContentInfo
+// encryptedContent [0] (§6.1).
 function readOctetStringImplicit(node, tag) {
   if (node.tagClass !== "context" || node.tagNumber !== tag) {
     throw new Asn1Error("asn1/unexpected-tag", "readOctetStringImplicit: expected context tag [" + tag +
       "], got " + node.tagClass + "/" + node.tagNumber);
   }
+  if (node.constructed && node.ber === true) {
+    var segments = [];
+    for (var s = 0; s < node.children.length; s++) {
+      var seg = node.children[s];
+      if (seg.tagClass !== "universal" || seg.tagNumber !== TAGS.OCTET_STRING || seg.constructed || !seg.content) {
+        throw new Asn1Error("asn1/bad-constructed-string", "a constructed OCTET STRING segment must itself be an OCTET STRING");
+      }
+      segments.push(seg.content);
+    }
+    return Buffer.concat(segments);
+  }
   _expectPrimitive(node, "readOctetStringImplicit");
   return node.content;
 }

package/lib/constants.js

@@ -121,6 +121,22 @@ var LIMITS = {
   // work on an untrusted certificate bundle (a real chain is well under this;
   // the operator may override via opts.maxPathCerts).
   PATH_MAX_CERTS: 100,
+  // PKCS#12 container ceilings. A PFX carries lists at three altitudes
+  // (ContentInfos per AuthenticatedSafe, SafeBags per SafeContents,
+  // attributes per bag) and can chain fresh DER blobs inside OCTET STRINGs,
+  // where every re-decode would otherwise restart the depth cap from zero.
+  // A real keystore holds a handful of keys and certificates; thousands of
+  // elements or dozens of chained re-decodes is hostile input, not a store.
+  PKCS12_MAX_ELEMENTS: 1024,
+  PKCS12_MAX_REDECODES: 64,
+  PKCS12_MAX_BAG_DEPTH: 16,
+  // BER constructed-string reassembly copies each nesting level's payload, so
+  // nesting multiplies transient memory. Real producers segment one level
+  // deep; nesting past this cap is amplification, not a store.
+  BER_MAX_STRING_NESTING: 8,
+  // A single attribute's value SET — no deployed attribute carries more than
+  // a handful of values; a list at this scale is amplification.
+  ATTRIBUTE_MAX_VALUES: 256,
 };
 
 // Single-sourced from the package manifest so the reported version can

package/lib/framework-error.js

@@ -160,6 +160,12 @@ var AttrCertError = defineClass("AttrCertError", { withCause: true });
 // `.cause`.
 var CrmfError = defineClass("CrmfError", { withCause: true });
 
+// Pkcs12Error — a byte sequence that is not a well-formed RFC 7292 PFX
+// (AuthenticatedSafe / SafeContents / SafeBag), or a PFX violating a §4
+// coherence rule (version, integrity mode, bag dispatch, MacData). Carries
+// the underlying leaf fault as `.cause`.
+var Pkcs12Error = defineClass("Pkcs12Error", { withCause: true });
+
 // PathError — a certification path that fails RFC 5280 §6 validation, or a
 // malformed input handed to the validator (an extension value that does not
 // decode, an empty path, an unsupported signature algorithm). Carries the
@@ -184,5 +190,6 @@ module.exports = {
   TspError:         TspError,
   AttrCertError:    AttrCertError,
   CrmfError:        CrmfError,
+  Pkcs12Error:      Pkcs12Error,
   PathError:        PathError,
 };

package/lib/oid.js

@@ -128,10 +128,35 @@ var FAMILIES = {
     data: 1, signedData: 2, envelopedData: 3, signedAndEnvelopedData: 4,
     digestedData: 5, encryptedData: 6 } },
 
-  // PKCS#9 attribute types — incl. the CMS signed-attribute OIDs (RFC 5652 §11).
+  // PKCS#9 attribute types — incl. the CMS signed-attribute OIDs (RFC 5652 §11)
+  // and the PKCS#12 bag attributes friendlyName / localKeyId (RFC 7292 §4.2).
   pkcs9: { base: [1, 2, 840, 113549, 1, 9], of: {
     emailAddress: 1, contentType: 3, messageDigest: 4, signingTime: 5,
-    challengePassword: 7, extensionRequest: 14 } },
+    challengePassword: 7, extensionRequest: 14, friendlyName: 20, localKeyId: 21 } },
+
+  // PKCS#9 CertBag / CRLBag value discriminators (RFC 7292 §4.2.3-§4.2.4).
+  pkcs9CertTypes: { base: [1, 2, 840, 113549, 1, 9, 22], of: { x509Certificate: 1, sdsiCertificate: 2 } },
+  pkcs9CrlTypes:  { base: [1, 2, 840, 113549, 1, 9, 23], of: { x509CRL: 1 } },
+
+  // PKCS#5 password-based schemes (RFC 8018) + the PBMAC1 MacData arm (RFC 9579).
+  pkcs5: { base: [1, 2, 840, 113549, 1, 5], of: { pbkdf2: 12, pbes2: 13, pbmac1: 14 } },
+
+  // PKCS#12 bag types (RFC 7292 §4.2, Appendix D).
+  pkcs12BagTypes: { base: [1, 2, 840, 113549, 1, 12, 10, 1], of: {
+    keyBag: 1, pkcs8ShroudedKeyBag: 2, certBag: 3, crlBag: 4, secretBag: 5, safeContentsBag: 6 } },
+
+  // PKCS#12 password-based encryption schemes (RFC 7292 Appendix C) — legacy
+  // PBE identifiers still emitted by deployed exporters; recognized so a
+  // shrouded bag's algorithm resolves to a name, never decrypted here.
+  pkcs12Pbe: { base: [1, 2, 840, 113549, 1, 12, 1], of: {
+    pbeWithSHAAnd128BitRC4: 1, pbeWithSHAAnd40BitRC4: 2,
+    "pbeWithSHAAnd3-KeyTripleDES-CBC": 3, "pbeWithSHAAnd2-KeyTripleDES-CBC": 4,
+    "pbeWithSHAAnd128BitRC2-CBC": 5, "pbeWithSHAAnd40BitRC2-CBC": 6 } },
+
+  // RSADSI digest / HMAC algorithms (RFC 8018 §B.1) — the PBKDF2 / PBMAC1 PRFs.
+  rsadsiDigest: { base: [1, 2, 840, 113549, 2], of: {
+    hmacWithSHA1: 7, hmacWithSHA224: 8, hmacWithSHA256: 9,
+    hmacWithSHA384: 10, hmacWithSHA512: 11 } },
 
   // S/MIME content types on the PKCS#9 smime arc (RFC 5652, RFC 3161): id-ct.
   smimeCt: { base: [1, 2, 840, 113549, 1, 9, 16, 1], of: { authData: 2, tSTInfo: 4, encKeyWithID: 21 } },
@@ -157,6 +182,12 @@ var FAMILIES = {
   // nistHash covers only SHA-256 and above.
   oiwSecsig: { base: [1, 3, 14, 3, 2], of: { sha1: 26 } },
 
+  // NIST AES content-encryption algorithms (arc 2.16.840.1.101.3.4.1) — the
+  // modern PBES2 / CMS content ciphers a PKCS#12 or EnvelopedData names.
+  nistAes: { base: [2, 16, 840, 1, 101, 3, 4, 1], of: {
+    "aes128-CBC": 2, "aes128-GCM": 6, "aes192-CBC": 22, "aes192-GCM": 26,
+    "aes256-CBC": 42, "aes256-GCM": 46 } },
+
   // NIST hash functions (SHA-2, SHA-3, SHAKE).
   nistHash: { base: [2, 16, 840, 1, 101, 3, 4, 2], of: {
     sha256: 1, sha384: 2, sha512: 3, "sha3-256": 8, "sha3-512": 10, shake256: 12 } },

package/lib/path-validate.js

@@ -193,10 +193,18 @@ function resolveRsaPss(paramsBytes) {
       // A negative saltLength must be rejected: the OpenSSL-backed verify shim
       // reads -1/-2/-3 as RSA_PSS_SALTLEN_DIGEST/AUTO/MAX, and AUTO (-2) accepts
       // a signature of ANY salt length — defeating the salt-length binding.
-      if (sl < 0n) throw E("path/unsupported-algorithm", "RSASSA-PSS saltLength must be non-negative");
+      // The upper bound keeps the value exact through Number conversion: the
+      // verifier binds to the salt length the certificate states, so a value
+      // that would round is not verifiable material (no real salt exceeds the
+      // modulus size, let alone this).
+      if (sl < 0n || sl > 2147483647n) throw E("path/unsupported-algorithm", "RSASSA-PSS saltLength must be a non-negative integer within the salt-length range");
       saltLength = Number(sl);
     } else if (f.tagNumber === 3) {
-      trailer = Number(asn1.read.integer(f.children[0]));
+      // Compared for equality with 1 below — bound before conversion so an
+      // oversized value cannot round on its way to the comparison.
+      var tf = asn1.read.integer(f.children[0]);
+      if (tf < 0n || tf > 2147483647n) throw E("path/unsupported-algorithm", "unsupported RSASSA-PSS trailerField " + tf.toString());
+      trailer = Number(tf);
     }
   });
   if (hash === null) throw E("path/unsupported-algorithm", "RSASSA-PSS hashAlgorithm must be stated explicitly (the SHA-1 default is rejected)");

package/lib/schema-all.js

@@ -11,9 +11,9 @@
  *
  * @intro
  *   The schema family: a declarative ASN.1 structure-schema engine and the
- *   per-format parsers built on it. Every format (X.509 certificates, CRLs,
- *   PKCS#10 certification requests, PKCS#8 private keys, and CMS SignedData) is a
- *   member that COMPOSES the
+ *   per-format parsers built on it. Every format — from X.509 certificates
+ *   and CRLs through CMS, OCSP, timestamps, and PKCS#12 stores; `all()`
+ *   enumerates the registered set — is a member that COMPOSES the
  *   shared engine and the shared PKIX sub-schemas (AlgorithmIdentifier, Name,
  *   Extension), so a structural rule — bounds-checked positional reads,
  *   optional / tagged field ordering, SET-OF uniqueness, fail-closed typed
@@ -36,6 +36,7 @@ var x509 = require("./schema-x509");
 var crl = require("./schema-crl");
 var csr = require("./schema-csr");
 var pkcs8 = require("./schema-pkcs8");
+var pkcs12 = require("./schema-pkcs12");
 var cms = require("./schema-cms");
 var ocsp = require("./schema-ocsp");
 var tsp = require("./schema-tsp");
@@ -47,9 +48,12 @@ var SchemaError = frameworkError.SchemaError;
 var PemError = frameworkError.PemError;
 
 // The shared parse-entry opts for the orchestrator: label-agnostic PEM unwrap
-// (any block type routes), the schema/* error family. Detection needs DER, so
-// the coerced DER is what gets routed to the matched format.
-var ENTRY = { pemLabel: null, PemError: PemError, ErrorClass: SchemaError, prefix: "schema", what: "input" };
+// (any block type routes), the schema/* error family. Detection needs a decoded
+// root, so the coerced bytes are what gets routed to the matched format. The
+// ber mode lets a BER-encoded PFX (the dominant real-world .p12 shape) decode
+// far enough to detect; a BER input matching a strict-DER-only format still
+// fails typed inside that format's own parse.
+var ENTRY = { pemLabel: null, PemError: PemError, ErrorClass: SchemaError, prefix: "schema", what: "input", ber: true };
 
 // REGISTRY — each format is declarative data: a name, a `detect(root)` that
 // recognizes the decoded DER root as this format's outer structure, and the
@@ -117,6 +121,20 @@ var FORMATS = [
     detect: ocsp.matchesResponse,
     parse: function (input) { return ocsp.parseResponse(input); },
   },
+  {
+    // PKCS#12 PFX ::= SEQUENCE { version INTEGER, authSafe ContentInfo, macData
+    // OPTIONAL } — INTEGER-first like pkcs8, so the discriminators are deeper:
+    // children[1] is a ContentInfo (SEQUENCE of exactly 2: OID + [0] constructed —
+    // a shape a PrivateKeyInfo's AlgorithmIdentifier never presents) and
+    // children[2] is a MacData SEQUENCE or absent (pkcs8 requires an OCTET STRING
+    // there). Shape-disjoint from pkcs8, and registered ahead of it as the more
+    // specific probe (RFC 7292 §4). A BER-encoded PFX detects through the
+    // orchestrator's BER decode fallback and routes here.
+    name: "pkcs12",
+    module: pkcs12,
+    detect: pkcs12.matches,
+    parse: function (input) { return pkcs12.parse(input); },
+  },
   {
     // PKCS#8 PrivateKeyInfo / OneAsymmetricKey — SEQUENCE whose first child is an
     // INTEGER (version) and third an OCTET STRING (privateKey); disjoint from the
@@ -193,7 +211,7 @@ var FORMATS = [
  * The names of every registered format, in detection order.
  *
  * @example
- *   pki.schema.all();  // → ["cms", "tsp", "crmf", "ocsp-request", "ocsp-response", "pkcs8", "csr", "attrcert", "attrcert-v1", "crl", "x509"]
+ *   pki.schema.all();  // → ["cms", "tsp", "crmf", "ocsp-request", "ocsp-response", "pkcs12", "pkcs8", "csr", "attrcert", "attrcert-v1", "crl", "x509"]
  */
 function all() { return FORMATS.map(function (f) { return f.name; }); }
 
@@ -235,6 +253,7 @@ module.exports = {
   crl:  { parse: crl.parse,  pemDecode: crl.pemDecode },
   csr:  { parse: csr.parse,  pemDecode: csr.pemDecode, pemEncode: csr.pemEncode },
   pkcs8: { parse: pkcs8.parse, parseEncrypted: pkcs8.parseEncrypted, pemDecode: pkcs8.pemDecode, pemEncode: pkcs8.pemEncode },
+  pkcs12: { parse: pkcs12.parse, pemDecode: pkcs12.pemDecode, pemEncode: pkcs12.pemEncode },
   cms:  { parse: cms.parse, pemDecode: cms.pemDecode, pemEncode: cms.pemEncode },
   ocsp: { parseRequest: ocsp.parseRequest, parseResponse: ocsp.parseResponse, pemDecode: ocsp.pemDecode },
   tsp: { parse: tsp.parse, parseTstInfo: tsp.parseTstInfo, parseToken: tsp.parseToken, pemDecode: tsp.pemDecode },

package/lib/schema-cms.js

@@ -692,10 +692,20 @@ function matches(root) {
 // universal SEQUENCE (an IMPLICIT [n] EnvelopedData is retagged by the caller).
 function walkEnvelopedData(node) { return schema.walk(ENVELOPED_DATA, node, NS).result; }
 
+// Validate a bare SignedData / EncryptedData node the same way — for a composer
+// that holds an already-decoded content node and must not re-decode its bytes
+// (an RFC 7292 PFX authSafe or encrypted safe, whose wire encoding may be BER
+// that the strict `parse` entry would refuse). Same contract as
+// walkEnvelopedData: the node is the bare structure, typed cms/* on rejection.
+function walkSignedData(node) { return schema.walk(SIGNED_DATA, node, NS).result; }
+function walkEncryptedData(node) { return schema.walk(ENCRYPTED_DATA, node, NS).result; }
+
 module.exports = {
   parse: parse,
   pemDecode: pemDecode,
   pemEncode: pemEncode,
   matches: matches,
   walkEnvelopedData: walkEnvelopedData,
+  walkSignedData: walkSignedData,
+  walkEncryptedData: walkEncryptedData,
 };

package/lib/schema-crmf.js

@@ -216,7 +216,7 @@ function popoPrivKey(type) {
       }
     }
     if (inner.tagNumber === 3) {
-      try { schema.walk(PKMAC_VALUE, asn1.decode(asn1.sequenceTlv(inner)), NS); }
+      try { schema.embeddedDer(PKMAC_VALUE, asn1.sequenceTlv(inner), NS, { code: "crmf/bad-popo", what: "agreeMAC [3] PKMACValue" }); }
       catch (e) { throw ctx.E("crmf/bad-popo", "agreeMAC [3] must be a PKMACValue SEQUENCE { algId, BIT STRING } (RFC 4211 §4.2)", e); }
     }
     // encryptedKey [4] EnvelopedData — validate the CMS structure fail-closed by

package/lib/schema-engine.js

@@ -200,12 +200,14 @@ function choice(alts, opts) {
 function seqOf(item, opts) {
   opts = opts || {};
   return { kind: "repeat", item: item, assert: opts.assert || "sequence", code: opts.code, what: opts.what,
-           min: opts.min, unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
+           min: opts.min, max: opts.max, maxCode: opts.maxCode,
+           unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
 }
 function setOf(item, opts) {
   opts = opts || {};
   return { kind: "repeat", item: item, assert: opts.assert || "set", derSetOrder: true, code: opts.code, what: opts.what,
-           min: opts.min, unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
+           min: opts.min, max: opts.max, maxCode: opts.maxCode,
+           unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
 }
 function setOfUnique(item, keyFn, opts) {
   return setOf(item, Object.assign({ unique: keyFn }, opts || {}));
@@ -216,7 +218,8 @@ function setOfUnique(item, keyFn, opts) {
 function implicitSetOf(tag, item, opts) {
   opts = opts || {};
   return { kind: "repeat", item: item, assert: "implicit", implicitTag: tag, derSetOrder: true, code: opts.code, what: opts.what,
-           min: opts.min, unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
+           min: opts.min, max: opts.max, maxCode: opts.maxCode,
+           unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
 }
 // [tag] IMPLICIT SEQUENCE OF item — the context tag REPLACES the universal SEQUENCE
 // tag, so the node is a context-class constructed [tag] whose direct children are the
@@ -225,7 +228,8 @@ function implicitSetOf(tag, item, opts) {
 function implicitSeqOf(tag, item, opts) {
   opts = opts || {};
   return { kind: "repeat", item: item, assert: "implicit", implicitTag: tag, code: opts.code, what: opts.what,
-           min: opts.min, unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
+           min: opts.min, max: opts.max, maxCode: opts.maxCode,
+           unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
 }
 
 // ---- the walk engine -------------------------------------------------
@@ -304,6 +308,12 @@ function _walkRepeat(schema, node, ctx) {
   if (schema.min != null && kids.length < schema.min) {
     _fail(ctx, schema.code, (schema.what || "value") + " must contain at least " + schema.min + " element(s)");
   }
+  // The element-count ceiling: a container of a great many tiny elements
+  // amplifies memory through per-element walk products, so a schema that
+  // parses attacker-sized lists declares `max` and fails typed instead.
+  if (schema.max != null && kids.length > schema.max) {
+    _fail(ctx, schema.maxCode || schema.code, (schema.what || "value") + " exceeds the element cap " + schema.max);
+  }
   // DER (X.690 §11.6) — the components of a SET OF appear in ascending order, the
   // encodings compared as octet strings. SEQUENCE OF is order-preserving and is
   // exempt (no derSetOrder). Compare full TLV byte strings, the same canonical
@@ -500,6 +510,9 @@ function _encodeRepeat(schema, items, ctx) {
   if (schema.min != null && items.length < schema.min) {
     _encFail("this repeat requires at least " + schema.min + " element(s) but got " + items.length);
   }
+  if (schema.max != null && items.length > schema.max) {
+    _encFail("this repeat caps at " + schema.max + " element(s) but got " + items.length);
+  }
   var parts = items.map(function (it) { return encode(schema.item, it, ctx); });
   if (schema.unique) {
     var seen = new Set();
@@ -523,6 +536,57 @@ function _encodeChoice(schema, value, ctx) {
   return encode(schema.alts[value.arm].schema, value.value, ctx);
 }
 
+/**
+ * @primitive  pki.schema.engine.embeddedDer
+ * @signature  pki.schema.engine.embeddedDer(schema, bytes, ctx, opts?) -> value
+ * @since      0.1.18
+ * @status     experimental
+ * @spec       X.690
+ * @defends    ASN.1-parser-DoS (CWE-400)
+ * @related    pki.schema.engine.walk, pki.asn1.decode
+ *
+ * Decode a fresh DER (or, with `ber: true`, BER) blob carried inside an
+ * already-decoded value — an OCTET STRING whose content is itself an encoded
+ * structure — and walk it against a schema. A codec failure is wrapped in the
+ * caller's typed `code`; a schema rejection keeps its own code. This is the
+ * one named form of the re-decode idiom, so the caps that a fresh
+ * `pki.asn1.decode` would restart from zero can be carried across re-decode
+ * boundaries: a shared `budget` (`{ remaining: n }`) decrements on every call
+ * and fails with `budgetCode` at zero, bounding how many nested blobs one
+ * parse may unwrap however deeply a container chains them.
+ *
+ * @opts
+ *   code:       string,   // typed code wrapping a codec failure (required)
+ *   what:       string,   // human label for the wrapped message
+ *   ber:        boolean,  // default false — BER content region (RFC 7292 §4.1)
+ *   budget:     object,   // { remaining: n } shared across a parse's re-decodes
+ *   budgetCode: string,   // typed code when the budget is exhausted
+ *
+ * @example
+ *   var S = pki.schema.engine;
+ *   var INNER = S.seq([S.field("version", S.integerLeaf())], { code: "app/bad-inner" });
+ *   var ns = { prefix: "app", E: MyError, oid: pki.oid };
+ *   S.embeddedDer(INNER, pki.asn1.build.sequence([pki.asn1.build.integer(3n)]), ns,
+ *     { code: "app/bad-der", what: "the embedded structure" });
+ */
+function embeddedDer(schema, bytes, ctx, opts) {
+  opts = opts || {};
+  if (opts.budget) {
+    if (!(opts.budget.remaining > 0)) {
+      throw ctx.E(opts.budgetCode || opts.code, (opts.what || "embedded DER") +
+        ": the cross-decode budget is exhausted (nesting chained across too many re-decode boundaries)");
+    }
+    opts.budget.remaining -= 1;
+  }
+  var node;
+  try {
+    node = asn1.decode(bytes, opts.ber ? { ber: true } : undefined);
+  } catch (e) {
+    throw ctx.E(opts.code, (opts.what || "embedded DER") + " did not decode: " + e.message, e);
+  }
+  return walk(schema, node, ctx);
+}
+
 module.exports = {
   // structural
   seq: seq, field: field, optional: optional, explicit: explicit, trailing: trailing,
@@ -533,5 +597,5 @@ module.exports = {
   implicitNull: implicitNull, implicitInteger: implicitInteger,
   any: any, decode: decode, time: time,
   // engine
-  walk: walk, encode: encode,
+  walk: walk, encode: encode, embeddedDer: embeddedDer,
 };

package/lib/schema-ocsp.js

@@ -294,14 +294,12 @@ var RESPONSE_BYTES = schema.seq([
     if (responseType !== OID_OCSP_BASIC) {
       throw NS.E("ocsp/unsupported-response-type", (ctx.oid.name(responseType) || responseType) + " is not id-pkix-ocsp-basic (RFC 6960 §4.2.1)");
     }
-    var inner;
-    try { inner = asn1.decode(raw); }
-    catch (e) { throw NS.E("ocsp/bad-der", "BasicOCSPResponse DER did not decode: " + ((e && e.message) || String(e)), e); }
     return {
       responseType: responseType,
       responseTypeName: ctx.oid.name(responseType) || null,
       response: raw,
-      basicResponse: schema.walk(BASIC_OCSP_RESPONSE, inner, ctx).result,
+      basicResponse: schema.embeddedDer(BASIC_OCSP_RESPONSE, raw, ctx,
+        { code: "ocsp/bad-der", what: "BasicOCSPResponse" }).result,
     };
   },
 });