@blamejs/pki 0.1.17 → 0.1.19

package/CHANGELOG.md

@@ -4,7 +4,51 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## v0.1.17 — 2026-07-07
+## v0.1.19 — 2026-07-09
+
+An RFC 9810 Certificate Management Protocol message parser joins the pki.schema family.
+
+### Added
+
+- pki.schema.cmp.parse(input) — RFC 9810 PKIMessage parsing. It decodes a DER Buffer or PEM into { header, headerBytes, body, bodyBytes, protection, extraCerts }. The header carries pvno (1..3), validated sender / recipient GeneralNames (the anonymous NULL-DN accepted), and the optional messageTime (GeneralizedTime only), protectionAlg, senderKID / recipKID, transactionID, senderNonce / recipNonce, freeText, and generalInfo (recognized id-it values are syntax-checked). The body is { arm, tag, bytes, decoded? }: ir / cr / kur / krr / ccr decode through the CRMF parser; ip / cp / kup / ccp decode to a certificate-response structure (an encrypted certificate's EnvelopedData decodes through the CMS parser; the deprecated EncryptedValue arm and caPubs surface raw, conferring no trust); krp decodes to a key-recovery structure ({ status, newSigCert, caCerts, keyPairHist }); rr / rp, genm / genp, error, certConf (an empty confirmation is the legal reject-all), and pollReq / pollRep decode structurally; pkiconf decodes to null; every other defined arm — p10cr, the challenge-response and announcement arms, and nested (never auto-recursed) — surfaces raw. certReqId values are big integers and accept the protocol's -1 sentinel. The two cross-field coherence rules (protection bits and protectionAlg present together or absent together; a certConf hashAlg requires version cmp2021) are enforced. Protection is surfaced, not verified: headerBytes and bodyBytes are the exact wire slices, so a verifier reconstructs the protected part as a DER SEQUENCE wrapping them and checks the MAC or signature. Malformed input fails closed with a typed cmp/* or asn1/* code.
+- pki.schema.cmp.pemDecode(text, label?) / pemEncode(der, label?) — PEM handling for messages that transit text channels (default label CMP).
+- pki.schema.crmf.parse now surfaces every CertTemplate field, including serialNumber and the issuer/subject unique identifiers. RFC 4211's rule that a certificate request must omit the CA-assigned fields (serialNumber, signingAlg) and the deprecated unique identifiers moved from the shared CertTemplate structure to the request layer, so a request that sets them still fails closed while the same structure can identify an existing certificate — serialNumber and issuer present — inside a CMP revocation.
+- The OID registry gains the CMP id-it information types and the message-protection MAC algorithm identifiers (passwordBasedMac, dhBasedMac, kemBasedMac), so a parsed message's info types and protection algorithm resolve to names.
+- The error taxonomy gains CmpError, carrying a stable cmp/* code.
+
+### Changed
+
+- pki.schema.tsp parsing (parse, parseTstInfo, parseToken, pemDecode) is now stable.
+- The npm-publish vulnerability scan reads the committed lockfiles (the dev and build toolchain that runs during a publish) instead of the runtime SBOM, which is empty by construction because the package ships zero runtime dependencies.
+
+### Fixed
+
+- Certification-path validation bounds the BasicConstraints pathLenConstraint and the PolicyConstraints / InhibitAnyPolicy skip counts before narrowing them to a number, so a certificate carrying a value past the safe-integer range is rejected rather than having the counter round silently to the wrong value (the same exact-or-rejected rule the RSASSA-PSS salt length and PKCS#12 iteration count follow).
+- Certification-path validation rejects a non-empty DER NULL in an RSASSA-PSS hash AlgorithmIdentifier's parameters — a NULL must carry empty content (X.690 8.8.2), so the previous tag-only check accepted a malformed encoding it now fails closed.
+
+## v0.1.18 — 2026-07-08
+
+An RFC 7292 PKCS#12 (PFX) store parser joins the pki.schema family.
+
+### Added
+
+- pki.schema.pkcs12.parse(input) — RFC 7292 PFX parsing. It decodes a DER / BER Buffer or PEM into { version, integrityMode, mac, macedBytes, authSafeSigned, safeBags, encryptedSafes }. Password-integrity stores surface { kind, hashOid, hashName, hashParameters, pbmac1, macValue, macSalt, iterations } plus macedBytes — the exact value octets the HMAC covers, excluding the octet-string header, so an external verifier hashes the correct region. The RFC 9579 PBMAC1 arm is validated, not just recognized: its parameters must be present, the key-derivation function must be PBKDF2 with a keyLength, and the decoded KDF (salt, iteration count, key length, PRF) and MAC scheme surface on pbmac1. The X.690 DEFAULT rule is enforced (an explicitly encoded iterations = 1 is non-canonical and rejects). Public-key-integrity stores surface the CMS SignedData and must carry at least one signer (the signature itself is verified externally). Each safeBag carries its type, friendlyName / localKeyId (decoded, single-value and single-instance rules enforced), and all attributes: keyBags delegate to pki.schema.pkcs8.parse, shrouded key bags to parseEncrypted (algorithm surfaced, ciphertext opaque), cert / CRL / secret values stay raw and byte-exact, and safeContentsBags recurse under a depth ceiling. Encrypted and enveloped safes are validated structurally by the CMS module with ciphertext kept raw, and must declare id-data (a SafeContents) as their encrypted content type. The version-3 rule, the contradictory MacData-alongside-SignedData combination, the closed bag-type and cert/CRL-type sets, and per-list element caps all fail closed with typed pkcs12/* codes; a MacData-less id-data store is legal syntax and parses as integrityMode "none".
+- pki.schema.pkcs12.pemDecode(text, label?) / pemEncode(der, label?) — PEM handling for stores that transit text channels (default label PKCS12).
+- pki.asn1.decode gains an opt-in ber option accepting exactly two shapes — an indefinite length on a constructed value and a constructed OCTET STRING, whose segments reassemble into one primitive content — for formats whose content is normatively BER. The default remains strict DER; minimal-length, minimal-integer, trailing-byte, and size / depth verdicts are unchanged in both modes, an indefinite length on a primitive value still rejects, a foreign-type segment inside a constructed string rejects, and constructed-string nesting is capped (each level re-copies its payload, so deep nesting is memory amplification, not data).
+- pki.schema.engine.embeddedDer(schema, bytes, ctx, opts) — the named form of the re-decode idiom: decode a fresh DER / BER blob carried inside an already-decoded value and walk it against a schema, wrapping codec failures in the caller's typed code. A shared budget option bounds how many nested blobs one parse may unwrap, so a container that chains encodings across octet-string boundaries cannot restart the depth caps from zero. The timestamp, OCSP, and certificate-request parsers now route their embedded-structure decodes through it.
+- SEQUENCE OF / SET OF schemas can declare an element-count ceiling (max), so a container listing a great many tiny elements fails typed instead of amplifying memory through per-element parse products; a single attribute's value list is now capped this way across every format.
+- The OID registry gains the PKCS#12 bag types, the PKCS#12 password-based encryption identifiers, the PKCS#9 certTypes / crlTypes / friendlyName / localKeyId entries, PKCS#5 PBKDF2 / PBES2 / PBMAC1, the NIST AES content-encryption arc, and the HMAC-with-SHA identifiers, so a store's algorithms resolve to names.
+- The error taxonomy gains Pkcs12Error, carrying a stable pkcs12/* code.
+
+### Changed
+
+- The npm-publish workflow's vulnerability scan now scans the SBOM unconditionally and the vendored-bundle directory only when it holds a real bundle, so the scan is exact in both states instead of warning on the empty directory.
+
+### Fixed
+
+- Certification-path validation bounds the RSASSA-PSS saltLength and trailerField before numeric conversion, so an oversized value rejects with path/unsupported-algorithm instead of rounding silently on its way to the verifier — the same exact-or-rejected rule the PKCS#12 MAC parameters follow.
+
+## v0.1.17 — 2026-07-06
 
 An RFC 4211 certificate-request-message parser joins the pki.schema family.
 

package/README.md

@@ -200,10 +200,12 @@ is callable today; nothing below is a stub.
 | `pki.schema.tsp` | Parse DER / PEM RFC 3161 timestamp responses and tokens — the TSTInfo payload (imprint, genTime with sub-second precision, serial, nonce, accuracy), the status-to-token coupling, and the token wrapper composed over CMS with the single-signer rule, fail-closed — `parse`, `parseTstInfo`, `parseToken`, `pemDecode` |
 | `pki.schema.attrcert` | Parse DER / PEM RFC 5755 attribute certificates — the holder and issuer identities (validated GeneralNames), the validity window (real `Date`s), the privilege attributes (role / group / clearance) and extensions, with the raw signed region for a verifier; the obsolete v1 form is recognized and deferred, fail-closed — `parse`, `pemDecode` |
 | `pki.schema.crmf` | Parse DER / PEM RFC 4211 certificate request messages (CertReqMessages — the CMP / EST enrollment body) — the requested-certificate template (subject, public key, validity, extensions), proof-of-possession, and registration controls, with the raw `CertRequest` region a POP verifier hashes; names dual-accepted (IMPLICIT and EXPLICIT), fail-closed — `parse`, `pemDecode` |
-| `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk` plus the schema combinators |
+| `pki.schema.pkcs12` | Parse DER / BER / PEM RFC 7292 PKCS#12 (PFX) stores — key bags via the PKCS#8 parser, shrouded keys (algorithm surfaced, ciphertext opaque), cert / CRL / secret bags raw and byte-exact, encrypted and enveloped safes structurally via CMS, `friendlyName` / `localKeyId` decoded, and the exact MAC byte range (`macedBytes`) plus RFC 9579 PBMAC1 recognition for external verification; BER accepted exactly where §4.1 requires it, fail-closed — `parse`, `pemDecode`, `pemEncode` |
+| `pki.schema.cmp` | Parse DER / PEM RFC 9810 Certificate Management Protocol messages (PKIMessage) — the header (version, sender / recipient incl. the anonymous NULL-DN, nonces, transaction id, general info), the 27-arm body (certificate requests via the CRMF parser, an encrypted certificate's EnvelopedData via CMS, response / revocation / confirmation / error / support / polling arms structural, the rest raw), and the exact `headerBytes` / `bodyBytes` slices an external verifier reconstructs the protected part from; the CMP-before-OCSP dispatch order is enforced, fail-closed — `parse`, `pemDecode`, `pemEncode` |
+| `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk` / `encode` / `embeddedDer` plus the schema combinators |
 | `pki.path` | RFC 5280 §6 certification-path validation — `validate` runs the §6.1 state machine (signature chaining, validity windows, name chaining, basic constraints and path length, key usage, name constraints, the certificate-policy tree) over an ordered path and a trust anchor, returning a structured verdict with per-check reason codes; `crlChecker` supplies CRL-based revocation. Pure and re-entrant, fail-closed — `validate`, `crlChecker` |
 | `pki.C` / `pki.constants` | Version-stable constants — functional scale helpers (`C.TIME.*`, `C.BYTES.*`), codec `LIMITS`, `version` |
-| `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError` / `TspError` / `AttrCertError` / `CrmfError` / `PathError`, each carrying a stable `code` in `domain/reason` form |
+| `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError` / `TspError` / `AttrCertError` / `CrmfError` / `Pkcs12Error` / `CmpError` / `PathError`, each carrying a stable `code` in `domain/reason` form |
 | `pki` CLI | `pki version`, `pki oid <dotted\|name>`, `pki parse <cert>` |
 
 ### CLI
@@ -217,11 +219,11 @@ pki parse cert.pem                       # structured JSON summary of a certific
 
 ### What's coming
 
-Certificate build/sign/verify, certification-path
-validation, CMS (SignedData / EnvelopedData / EncryptedData / AuthenticatedData),
-OCSP, RFC 3161 timestamping, PKCS#8 decryption (PBES2) / SPKI / PKCS#12, and the
-post-quantum certificate and CMS surface (ML-DSA / ML-KEM / SLH-DSA and hybrid
-composites) are on the roadmap and ride this same core. See
+Certificate build/sign/verify, CMS AuthenticatedData /
+AuthEnvelopedData, PKCS#8 decryption (PBES2) / SPKI, PKCS#12 MAC verification
+and bag decryption, and the post-quantum certificate and CMS surface (ML-DSA /
+ML-KEM / SLH-DSA and hybrid composites) are on the roadmap and ride this same
+core. See
 [ROADMAP.md](ROADMAP.md) for the full plan and current status of each area, and
 [CHANGELOG.md](CHANGELOG.md) for what has landed.
 

package/lib/asn1-der.js

@@ -127,10 +127,19 @@ function _asBuffer(input, who) {
  * after the top-level value (unless `allowTrailing`), or exceeding the
  * size / depth caps.
  *
+ * `ber: true` is a scoped relaxation for formats whose content regions are
+ * normatively BER (RFC 7292 PKCS#12): it accepts an indefinite length on a
+ * constructed value and a constructed OCTET STRING, whose segments are
+ * reassembled into one primitive `content`. Nothing else is relaxed —
+ * definite lengths stay minimal, an indefinite length on a primitive value
+ * and a foreign-type segment still reject, and the size / depth caps hold.
+ *
  * @opts
  *   maxBytes:       number,   // default: C.LIMITS.DER_MAX_BYTES (16 MiB)
  *   maxDepth:       number,   // default: C.LIMITS.DER_MAX_DEPTH (64)
  *   allowTrailing:  boolean,  // default: false — allow bytes after the top TLV
+ *   ber:            boolean,  // default: false — accept indefinite lengths +
+ *                             // constructed OCTET STRINGs (BER content regions)
  *
  * @example
  *   var node = pki.asn1.decode(der);
@@ -144,14 +153,14 @@ function decode(input, opts) {
   if (buf.length > maxBytes) {
     throw new Asn1Error("asn1/too-large", "input " + buf.length + " bytes exceeds cap " + maxBytes);
   }
-  var r = _decodeTLV(buf, 0, buf.length, 0, maxDepth);
+  var r = _decodeTLV(buf, 0, buf.length, 0, maxDepth, opts.ber === true);
   if (!opts.allowTrailing && r.end !== buf.length) {
     throw new Asn1Error("asn1/trailing-bytes", (buf.length - r.end) + " trailing byte(s) after the top-level value");
   }
   return r.node;
 }
 
-function _decodeTLV(buf, start, limit, depth, maxDepth) {
+function _decodeTLV(buf, start, limit, depth, maxDepth, ber, strDepth) {
   if (depth > maxDepth) {
     throw new Asn1Error("asn1/too-deep", "nesting exceeds depth cap " + maxDepth);
   }
@@ -195,8 +204,20 @@ function _decodeTLV(buf, start, limit, depth, maxDepth) {
   // encoded constructed is not valid DER. Without this a constructed string
   // tag decodes to a childless node that later paths (an X.509 DN attribute
   // value) would hex-render or dereference instead of failing closed.
+  // The ber mode licenses exactly one constructed primitive-only type — the
+  // OCTET STRING (the streamed content carrier RFC 7292 §4.1 permits); its
+  // segments are reassembled below. Every other primitive-only type stays
+  // primitive even in BER. Reassembly re-copies each nesting level's payload,
+  // so nesting is capped on the way down: real producers segment one level
+  // deep, and a deep chain multiplies transient memory without carrying data.
   if (tagClassBits === CLASS_UNIVERSAL && constructed && PRIMITIVE_ONLY_UNIVERSAL_TAGS[tagNumber]) {
-    throw new Asn1Error("asn1/constructed-primitive-type", "a universal primitive-only type must be encoded primitive in DER");
+    if (!(ber && tagNumber === TAGS.OCTET_STRING)) {
+      throw new Asn1Error("asn1/constructed-primitive-type", "a universal primitive-only type must be encoded primitive in DER");
+    }
+    strDepth = (strDepth || 0) + 1;
+    if (strDepth > constants.LIMITS.BER_MAX_STRING_NESTING) {
+      throw new Asn1Error("asn1/bad-constructed-string", "constructed OCTET STRING nesting exceeds the cap " + constants.LIMITS.BER_MAX_STRING_NESTING);
+    }
   }
 
   if (p >= limit) throw new Asn1Error("asn1/truncated", "expected a length octet");
@@ -205,7 +226,12 @@ function _decodeTLV(buf, start, limit, depth, maxDepth) {
   if (lenByte < 0x80) {
     length = lenByte;
   } else if (lenByte === 0x80) {
-    throw new Asn1Error("asn1/indefinite-length", "indefinite length is not valid DER");
+    // X.690 §8.1.3.6 — indefinite length is only defined for a constructed
+    // encoding; the value runs to the end-of-contents octets.
+    if (!ber || !constructed) {
+      throw new Asn1Error("asn1/indefinite-length", "indefinite length is not valid DER");
+    }
+    length = -1;
   } else {
     var numLenBytes = lenByte & 0x7f;
     if (numLenBytes > 6) throw new Asn1Error("asn1/length-too-large", "length uses more than 6 octets");
@@ -218,34 +244,79 @@ function _decodeTLV(buf, start, limit, depth, maxDepth) {
   }
 
   var contentStart = p;
-  var contentEnd = contentStart + length;
-  if (contentEnd > limit) throw new Asn1Error("asn1/truncated", "content length overruns the buffer");
+  var indefinite = length === -1;
+  var contentEnd = indefinite ? -1 : contentStart + length;
+  if (!indefinite && contentEnd > limit) throw new Asn1Error("asn1/truncated", "content length overruns the buffer");
+
+  var children = null;
+  var content = null;
+  var child;
+  var end;
+  if (constructed) {
+    children = [];
+    var cp = contentStart;
+    if (indefinite) {
+      for (;;) {
+        if (cp + 2 > limit) throw new Asn1Error("asn1/truncated", "indefinite-length value is missing its end-of-contents octets");
+        if (buf[cp] === 0x00 && buf[cp + 1] === 0x00) break;
+        child = _decodeTLV(buf, cp, limit, depth + 1, maxDepth, ber, strDepth);
+        children.push(child.node);
+        cp = child.end;
+      }
+      contentEnd = cp;
+      end = cp + 2;
+    } else {
+      while (cp < contentEnd) {
+        child = _decodeTLV(buf, cp, contentEnd, depth + 1, maxDepth, ber, strDepth);
+        children.push(child.node);
+        cp = child.end;
+      }
+      end = contentEnd;
+    }
+  } else {
+    content = buf.subarray(contentStart, contentEnd);
+    end = contentEnd;
+  }
 
   var node = {
     tagClass:     _className(tagClassBits),
     constructed:  constructed,
     tagNumber:    tagNumber,
-    length:       length,
+    length:       contentEnd - contentStart,
     header:       { start: start, end: contentStart },
     contentStart: contentStart,
     contentEnd:   contentEnd,
-    content:      null,
-    children:     null,
-    bytes:        buf.subarray(start, contentEnd),
+    content:      content,
+    children:     children,
+    bytes:        buf.subarray(start, end),
   };
 
-  if (constructed) {
-    node.children = [];
-    var cp = contentStart;
-    while (cp < contentEnd) {
-      var child = _decodeTLV(buf, cp, contentEnd, depth + 1, maxDepth);
-      node.children.push(child.node);
-      cp = child.end;
+  // BER reassembly: a constructed OCTET STRING's segments concatenate into
+  // one primitive content, so every downstream reader sees the value a
+  // single-segment encoding would carry; `bytes` keeps the original wire
+  // range for raw round-trip surfaces. Nested constructed segments arrive
+  // already reassembled by the recursion (their nesting depth is capped on
+  // the way down — see the strDepth check above).
+  if (ber && constructed && tagClassBits === CLASS_UNIVERSAL && tagNumber === TAGS.OCTET_STRING) {
+    var segments = [];
+    for (var s = 0; s < children.length; s++) {
+      if (children[s].tagClass !== "universal" || children[s].tagNumber !== TAGS.OCTET_STRING) {
+        throw new Asn1Error("asn1/bad-constructed-string", "a constructed OCTET STRING segment must itself be an OCTET STRING");
+      }
+      segments.push(children[s].content);
     }
-  } else {
-    node.content = buf.subarray(contentStart, contentEnd);
+    node.content = Buffer.concat(segments);
+    node.constructed = false;
+    node.children = null;
   }
-  return { node: node, end: contentEnd };
+  // A context-tagged constructed node from a ber decode may be an IMPLICIT
+  // streamed string (the tag hides the underlying type), which only the
+  // schema-driven typed reader can identify — mark it so readers reassemble
+  // exactly those nodes and a strict decode's verdicts never change.
+  if (ber && constructed && tagClassBits === CLASS_CONTEXT && node.children) {
+    node.ber = true;
+  }
+  return { node: node, end: end };
 }
 
 // ---- Node assertions ------------------------------------------------
@@ -375,13 +446,29 @@ function readOctetString(node) {
 // Read a [tag] IMPLICIT OCTET STRING — a context-class PRIMITIVE node whose
 // content is the octet-string body (the IMPLICIT tag replaces the universal one,
 // so there is no inner universal node). Primitive-only, like its universal
-// counterpart, so the BER constructed/streamed form is rejected. Used for the CMS
-// SignerIdentifier subjectKeyIdentifier [0] (RFC 5652 §5.3).
+// counterpart, so a strict decode's constructed/streamed form is rejected.
+// A node from a ber decode (the `ber` marker) may carry the streamed form —
+// the context tag hides the underlying type from the decoder, so THIS reader
+// is where a [tag] IMPLICIT OCTET STRING's segments reassemble (the shape CMS
+// ciphertext streams as). Used for the CMS SignerIdentifier
+// subjectKeyIdentifier [0] (RFC 5652 §5.3) and EncryptedContentInfo
+// encryptedContent [0] (§6.1).
 function readOctetStringImplicit(node, tag) {
   if (node.tagClass !== "context" || node.tagNumber !== tag) {
     throw new Asn1Error("asn1/unexpected-tag", "readOctetStringImplicit: expected context tag [" + tag +
       "], got " + node.tagClass + "/" + node.tagNumber);
   }
+  if (node.constructed && node.ber === true) {
+    var segments = [];
+    for (var s = 0; s < node.children.length; s++) {
+      var seg = node.children[s];
+      if (seg.tagClass !== "universal" || seg.tagNumber !== TAGS.OCTET_STRING || seg.constructed || !seg.content) {
+        throw new Asn1Error("asn1/bad-constructed-string", "a constructed OCTET STRING segment must itself be an OCTET STRING");
+      }
+      segments.push(seg.content);
+    }
+    return Buffer.concat(segments);
+  }
   _expectPrimitive(node, "readOctetStringImplicit");
   return node.content;
 }

package/lib/constants.js

@@ -121,6 +121,22 @@ var LIMITS = {
   // work on an untrusted certificate bundle (a real chain is well under this;
   // the operator may override via opts.maxPathCerts).
   PATH_MAX_CERTS: 100,
+  // PKCS#12 container ceilings. A PFX carries lists at three altitudes
+  // (ContentInfos per AuthenticatedSafe, SafeBags per SafeContents,
+  // attributes per bag) and can chain fresh DER blobs inside OCTET STRINGs,
+  // where every re-decode would otherwise restart the depth cap from zero.
+  // A real keystore holds a handful of keys and certificates; thousands of
+  // elements or dozens of chained re-decodes is hostile input, not a store.
+  PKCS12_MAX_ELEMENTS: 1024,
+  PKCS12_MAX_REDECODES: 64,
+  PKCS12_MAX_BAG_DEPTH: 16,
+  // BER constructed-string reassembly copies each nesting level's payload, so
+  // nesting multiplies transient memory. Real producers segment one level
+  // deep; nesting past this cap is amplification, not a store.
+  BER_MAX_STRING_NESTING: 8,
+  // A single attribute's value SET — no deployed attribute carries more than
+  // a handful of values; a list at this scale is amplification.
+  ATTRIBUTE_MAX_VALUES: 256,
 };
 
 // Single-sourced from the package manifest so the reported version can

package/lib/framework-error.js

@@ -160,6 +160,18 @@ var AttrCertError = defineClass("AttrCertError", { withCause: true });
 // `.cause`.
 var CrmfError = defineClass("CrmfError", { withCause: true });
 
+// Pkcs12Error — a byte sequence that is not a well-formed RFC 7292 PFX
+// (AuthenticatedSafe / SafeContents / SafeBag), or a PFX violating a §4
+// coherence rule (version, integrity mode, bag dispatch, MacData). Carries
+// the underlying leaf fault as `.cause`.
+var Pkcs12Error = defineClass("Pkcs12Error", { withCause: true });
+
+// CmpError — a byte sequence that is not a well-formed RFC 9810 PKIMessage
+// (PKIHeader / PKIBody / protection / extraCerts), or one violating a §5
+// coherence rule (protection⇔protectionAlg, certConf-hashAlg⇔pvno). Carries
+// the underlying leaf fault as `.cause`.
+var CmpError = defineClass("CmpError", { withCause: true });
+
 // PathError — a certification path that fails RFC 5280 §6 validation, or a
 // malformed input handed to the validator (an extension value that does not
 // decode, an empty path, an unsupported signature algorithm). Carries the
@@ -184,5 +196,7 @@ module.exports = {
   TspError:         TspError,
   AttrCertError:    AttrCertError,
   CrmfError:        CrmfError,
+  Pkcs12Error:      Pkcs12Error,
+  CmpError:         CmpError,
   PathError:        PathError,
 };

package/lib/oid.js

@@ -128,10 +128,50 @@ var FAMILIES = {
     data: 1, signedData: 2, envelopedData: 3, signedAndEnvelopedData: 4,
     digestedData: 5, encryptedData: 6 } },
 
-  // PKCS#9 attribute types — incl. the CMS signed-attribute OIDs (RFC 5652 §11).
+  // PKCS#9 attribute types — incl. the CMS signed-attribute OIDs (RFC 5652 §11)
+  // and the PKCS#12 bag attributes friendlyName / localKeyId (RFC 7292 §4.2).
   pkcs9: { base: [1, 2, 840, 113549, 1, 9], of: {
     emailAddress: 1, contentType: 3, messageDigest: 4, signingTime: 5,
-    challengePassword: 7, extensionRequest: 14 } },
+    challengePassword: 7, extensionRequest: 14, friendlyName: 20, localKeyId: 21 } },
+
+  // PKCS#9 CertBag / CRLBag value discriminators (RFC 7292 §4.2.3-§4.2.4).
+  pkcs9CertTypes: { base: [1, 2, 840, 113549, 1, 9, 22], of: { x509Certificate: 1, sdsiCertificate: 2 } },
+  pkcs9CrlTypes:  { base: [1, 2, 840, 113549, 1, 9, 23], of: { x509CRL: 1 } },
+
+  // PKCS#5 password-based schemes (RFC 8018) + the PBMAC1 MacData arm (RFC 9579).
+  pkcs5: { base: [1, 2, 840, 113549, 1, 5], of: { pbkdf2: 12, pbes2: 13, pbmac1: 14 } },
+
+  // CMP InfoTypeAndValue types — id-it under id-pkix (RFC 9810 §5.3.19; the
+  // PKIXCMP-2023 module assigns these leaves, 8/9 unassigned).
+  idIt: { base: [1, 3, 6, 1, 5, 5, 7, 4], of: {
+    caProtEncCert: 1, signKeyPairTypes: 2, encKeyPairTypes: 3, preferredSymmAlg: 4,
+    caKeyUpdateInfo: 5, currentCRL: 6, unsupportedOIDs: 7, keyPairParamReq: 10,
+    keyPairParamRep: 11, revPassphrase: 12, implicitConfirm: 13, confirmWaitTime: 14,
+    origPKIMessage: 15, suppLangTags: 16, caCerts: 17, rootCaKeyUpdate: 18,
+    certReqTemplate: 19, rootCaCert: 20, certProfile: 21, crlStatusList: 22,
+    crls: 23, kemCiphertextInfo: 24 } },
+
+  // CMP message-protection MAC algorithms on the Entrust arc (RFC 9810
+  // §5.1.3.1/.2/.4; RFC 9481 §6.1.1).
+  entrustAlg: { base: [1, 2, 840, 113533, 7, 66], of: {
+    passwordBasedMac: 13, kemBasedMac: 16, dhBasedMac: 30 } },
+
+  // PKCS#12 bag types (RFC 7292 §4.2, Appendix D).
+  pkcs12BagTypes: { base: [1, 2, 840, 113549, 1, 12, 10, 1], of: {
+    keyBag: 1, pkcs8ShroudedKeyBag: 2, certBag: 3, crlBag: 4, secretBag: 5, safeContentsBag: 6 } },
+
+  // PKCS#12 password-based encryption schemes (RFC 7292 Appendix C) — legacy
+  // PBE identifiers still emitted by deployed exporters; recognized so a
+  // shrouded bag's algorithm resolves to a name, never decrypted here.
+  pkcs12Pbe: { base: [1, 2, 840, 113549, 1, 12, 1], of: {
+    pbeWithSHAAnd128BitRC4: 1, pbeWithSHAAnd40BitRC4: 2,
+    "pbeWithSHAAnd3-KeyTripleDES-CBC": 3, "pbeWithSHAAnd2-KeyTripleDES-CBC": 4,
+    "pbeWithSHAAnd128BitRC2-CBC": 5, "pbeWithSHAAnd40BitRC2-CBC": 6 } },
+
+  // RSADSI digest / HMAC algorithms (RFC 8018 §B.1) — the PBKDF2 / PBMAC1 PRFs.
+  rsadsiDigest: { base: [1, 2, 840, 113549, 2], of: {
+    hmacWithSHA1: 7, hmacWithSHA224: 8, hmacWithSHA256: 9,
+    hmacWithSHA384: 10, hmacWithSHA512: 11 } },
 
   // S/MIME content types on the PKCS#9 smime arc (RFC 5652, RFC 3161): id-ct.
   smimeCt: { base: [1, 2, 840, 113549, 1, 9, 16, 1], of: { authData: 2, tSTInfo: 4, encKeyWithID: 21 } },
@@ -157,6 +197,12 @@ var FAMILIES = {
   // nistHash covers only SHA-256 and above.
   oiwSecsig: { base: [1, 3, 14, 3, 2], of: { sha1: 26 } },
 
+  // NIST AES content-encryption algorithms (arc 2.16.840.1.101.3.4.1) — the
+  // modern PBES2 / CMS content ciphers a PKCS#12 or EnvelopedData names.
+  nistAes: { base: [2, 16, 840, 1, 101, 3, 4, 1], of: {
+    "aes128-CBC": 2, "aes128-GCM": 6, "aes192-CBC": 22, "aes192-GCM": 26,
+    "aes256-CBC": 42, "aes256-GCM": 46 } },
+
   // NIST hash functions (SHA-2, SHA-3, SHAKE).
   nistHash: { base: [2, 16, 840, 1, 101, 3, 4, 2], of: {
     sha256: 1, sha384: 2, sha512: 3, "sha3-256": 8, "sha3-512": 10, shake256: 12 } },

package/lib/path-validate.js

@@ -144,6 +144,10 @@ function hashAlgOid(seq) {
   if (seq.children.length === 2) {
     var p = seq.children[1];
     if (p.tagClass !== "universal" || p.tagNumber !== asn1.TAGS.NULL) throw E("path/unsupported-algorithm", "hash AlgorithmIdentifier parameters must be NULL or absent (RFC 4055)");
+    // A NULL is well-formed only with empty content (X.690 §8.8.2); the tag check
+    // alone would accept a non-empty NULL as valid parameters.
+    try { asn1.read.nullValue(p); }
+    catch (e) { throw E("path/unsupported-algorithm", "hash AlgorithmIdentifier NULL parameters must have empty content (RFC 4055)", e); }
   }
   return o;
 }
@@ -193,10 +197,18 @@ function resolveRsaPss(paramsBytes) {
       // A negative saltLength must be rejected: the OpenSSL-backed verify shim
       // reads -1/-2/-3 as RSA_PSS_SALTLEN_DIGEST/AUTO/MAX, and AUTO (-2) accepts
       // a signature of ANY salt length — defeating the salt-length binding.
-      if (sl < 0n) throw E("path/unsupported-algorithm", "RSASSA-PSS saltLength must be non-negative");
+      // The upper bound keeps the value exact through Number conversion: the
+      // verifier binds to the salt length the certificate states, so a value
+      // that would round is not verifiable material (no real salt exceeds the
+      // modulus size, let alone this).
+      if (sl < 0n || sl > 2147483647n) throw E("path/unsupported-algorithm", "RSASSA-PSS saltLength must be a non-negative integer within the salt-length range");
       saltLength = Number(sl);
     } else if (f.tagNumber === 3) {
-      trailer = Number(asn1.read.integer(f.children[0]));
+      // Compared for equality with 1 below — bound before conversion so an
+      // oversized value cannot round on its way to the comparison.
+      var tf = asn1.read.integer(f.children[0]);
+      if (tf < 0n || tf > 2147483647n) throw E("path/unsupported-algorithm", "unsupported RSASSA-PSS trailerField " + tf.toString());
+      trailer = Number(tf);
     }
   });
   if (hash === null) throw E("path/unsupported-algorithm", "RSASSA-PSS hashAlgorithm must be stated explicitly (the SHA-1 default is rejected)");

package/lib/schema-all.js

@@ -11,9 +11,9 @@
  *
  * @intro
  *   The schema family: a declarative ASN.1 structure-schema engine and the
- *   per-format parsers built on it. Every format (X.509 certificates, CRLs,
- *   PKCS#10 certification requests, PKCS#8 private keys, and CMS SignedData) is a
- *   member that COMPOSES the
+ *   per-format parsers built on it. Every format — from X.509 certificates
+ *   and CRLs through CMS, OCSP, timestamps, and PKCS#12 stores; `all()`
+ *   enumerates the registered set — is a member that COMPOSES the
  *   shared engine and the shared PKIX sub-schemas (AlgorithmIdentifier, Name,
  *   Extension), so a structural rule — bounds-checked positional reads,
  *   optional / tagged field ordering, SET-OF uniqueness, fail-closed typed
@@ -36,10 +36,12 @@ var x509 = require("./schema-x509");
 var crl = require("./schema-crl");
 var csr = require("./schema-csr");
 var pkcs8 = require("./schema-pkcs8");
+var pkcs12 = require("./schema-pkcs12");
 var cms = require("./schema-cms");
 var ocsp = require("./schema-ocsp");
 var tsp = require("./schema-tsp");
 var crmf = require("./schema-crmf");
+var cmp = require("./schema-cmp");
 var attrcert = require("./schema-attrcert");
 var frameworkError = require("./framework-error");
 
@@ -47,9 +49,12 @@ var SchemaError = frameworkError.SchemaError;
 var PemError = frameworkError.PemError;
 
 // The shared parse-entry opts for the orchestrator: label-agnostic PEM unwrap
-// (any block type routes), the schema/* error family. Detection needs DER, so
-// the coerced DER is what gets routed to the matched format.
-var ENTRY = { pemLabel: null, PemError: PemError, ErrorClass: SchemaError, prefix: "schema", what: "input" };
+// (any block type routes), the schema/* error family. Detection needs a decoded
+// root, so the coerced bytes are what gets routed to the matched format. The
+// ber mode lets a BER-encoded PFX (the dominant real-world .p12 shape) decode
+// far enough to detect; a BER input matching a strict-DER-only format still
+// fails typed inside that format's own parse.
+var ENTRY = { pemLabel: null, PemError: PemError, ErrorClass: SchemaError, prefix: "schema", what: "input", ber: true };
 
 // REGISTRY — each format is declarative data: a name, a `detect(root)` that
 // recognizes the decoded DER root as this format's outer structure, and the
@@ -97,12 +102,28 @@ var FORMATS = [
     detect: crmf.matches,
     parse: function (input) { return crmf.parse(input); },
   },
+  {
+    // PKIMessage ::= SEQUENCE { header PKIHeader, body PKIBody [0..26],
+    // protection [0]?, extraCerts [1]? } (RFC 9810 §5.1) — a SEQUENCE of 2-4
+    // whose first child is a >=3-child SEQUENCE leading with a bare INTEGER
+    // (pvno) and whose second child is context-constructed [0..26]. ORDER IS
+    // LOAD-BEARING here: a 2-child PKIMessage whose body is ir [0] also
+    // satisfies the shallow ocsp-request probe below (k[0] SEQUENCE +
+    // k[1] context-[0]), while no OCSPRequest satisfies this detector (its
+    // tbsRequest never leads with a bare INTEGER) — so cmp MUST sit ahead of
+    // ocsp-request for the pair to dispatch deterministically.
+    name: "cmp",
+    module: cmp,
+    detect: cmp.matches,
+    parse: function (input) { return cmp.parse(input); },
+  },
   {
     // OCSPRequest ::= SEQUENCE { tbsRequest SEQUENCE, optionalSignature [0] EXPLICIT
     // OPTIONAL } — a SEQUENCE of 1-2 whose first child is the tbsRequest SEQUENCE.
     // Leads with a SEQUENCE like the signed-envelope trio, but is excluded by arity
     // (the trio is EXACTLY 3 children; an OCSPRequest is 1-2). Checked AFTER tsp,
-    // whose detector is a strict refinement (RFC 6960 §4.1.1).
+    // whose detector is a strict refinement (RFC 6960 §4.1.1), and AFTER cmp,
+    // whose 2-child ir-body shape this probe would otherwise shadow.
     name: "ocsp-request",
     module: ocsp,
     detect: ocsp.matchesRequest,
@@ -117,6 +138,20 @@ var FORMATS = [
     detect: ocsp.matchesResponse,
     parse: function (input) { return ocsp.parseResponse(input); },
   },
+  {
+    // PKCS#12 PFX ::= SEQUENCE { version INTEGER, authSafe ContentInfo, macData
+    // OPTIONAL } — INTEGER-first like pkcs8, so the discriminators are deeper:
+    // children[1] is a ContentInfo (SEQUENCE of exactly 2: OID + [0] constructed —
+    // a shape a PrivateKeyInfo's AlgorithmIdentifier never presents) and
+    // children[2] is a MacData SEQUENCE or absent (pkcs8 requires an OCTET STRING
+    // there). Shape-disjoint from pkcs8, and registered ahead of it as the more
+    // specific probe (RFC 7292 §4). A BER-encoded PFX detects through the
+    // orchestrator's BER decode fallback and routes here.
+    name: "pkcs12",
+    module: pkcs12,
+    detect: pkcs12.matches,
+    parse: function (input) { return pkcs12.parse(input); },
+  },
   {
     // PKCS#8 PrivateKeyInfo / OneAsymmetricKey — SEQUENCE whose first child is an
     // INTEGER (version) and third an OCTET STRING (privateKey); disjoint from the
@@ -193,7 +228,7 @@ var FORMATS = [
  * The names of every registered format, in detection order.
  *
  * @example
- *   pki.schema.all();  // → ["cms", "tsp", "crmf", "ocsp-request", "ocsp-response", "pkcs8", "csr", "attrcert", "attrcert-v1", "crl", "x509"]
+ *   pki.schema.all();  // → ["cms", "tsp", "crmf", "cmp", "ocsp-request", "ocsp-response", "pkcs12", "pkcs8", "csr", "attrcert", "attrcert-v1", "crl", "x509"]
  */
 function all() { return FORMATS.map(function (f) { return f.name; }); }
 
@@ -235,10 +270,12 @@ module.exports = {
   crl:  { parse: crl.parse,  pemDecode: crl.pemDecode },
   csr:  { parse: csr.parse,  pemDecode: csr.pemDecode, pemEncode: csr.pemEncode },
   pkcs8: { parse: pkcs8.parse, parseEncrypted: pkcs8.parseEncrypted, pemDecode: pkcs8.pemDecode, pemEncode: pkcs8.pemEncode },
+  pkcs12: { parse: pkcs12.parse, pemDecode: pkcs12.pemDecode, pemEncode: pkcs12.pemEncode },
   cms:  { parse: cms.parse, pemDecode: cms.pemDecode, pemEncode: cms.pemEncode },
   ocsp: { parseRequest: ocsp.parseRequest, parseResponse: ocsp.parseResponse, pemDecode: ocsp.pemDecode },
   tsp: { parse: tsp.parse, parseTstInfo: tsp.parseTstInfo, parseToken: tsp.parseToken, pemDecode: tsp.pemDecode },
   crmf: { parse: crmf.parse, pemDecode: crmf.pemDecode },
+  cmp: { parse: cmp.parse, pemDecode: cmp.pemDecode, pemEncode: cmp.pemEncode },
   attrcert: { parse: attrcert.parse, pemDecode: attrcert.pemDecode },
   all: all,
   parse: parse,

package/lib/schema-attrcert.js

@@ -353,11 +353,11 @@ function matches(root) {
   if (!acinfo) return false;
   var k = acinfo.children;
   if (!k || k.length < 7) return false;
-  if (!(k[0].tagClass === "universal" && k[0].tagNumber === TAGS.INTEGER)) return false;
-  if (!(k[1].tagClass === "universal" && k[1].tagNumber === TAGS.SEQUENCE && k[1].children)) return false;
+  if (!schema.isUniversal(k[0], TAGS.INTEGER)) return false;
+  if (!(schema.isUniversal(k[1], TAGS.SEQUENCE) && k[1].children)) return false;
   var v = k[5];
-  if (!(v && v.tagClass === "universal" && v.tagNumber === TAGS.SEQUENCE && v.children && v.children.length === 2)) return false;
-  return v.children.every(function (t) { return t.tagClass === "universal" && t.tagNumber === TAGS.GENERALIZED_TIME; });
+  if (!(schema.isUniversal(v, TAGS.SEQUENCE) && v.children && v.children.length === 2)) return false;
+  return v.children.every(function (t) { return schema.isUniversal(t, TAGS.GENERALIZED_TIME); });
 }
 
 // matchesV1(root): the obsolete AttributeCertificateV1 — its acInfo (version DEFAULT
@@ -370,8 +370,8 @@ function matchesV1(root) {
   if (!acinfo) return false;
   var k = acinfo.children;
   if (!k || k.length < 6) return false;
-  if (!(k[0].tagClass === "context" && (k[0].tagNumber === 0 || k[0].tagNumber === 1) && k[0].children)) return false;
-  return !!k[1] && k[1].tagClass === "universal" && k[1].tagNumber === TAGS.SEQUENCE;
+  if (!(schema.isContextOneOf(k[0], [0, 1]) && k[0].children)) return false;
+  return schema.isUniversal(k[1], TAGS.SEQUENCE);
 }
 
 module.exports = {