@blamejs/pki 0.1.17 → 0.1.19

package/lib/schema-cms.js

@@ -132,12 +132,11 @@ function rawElement(item) {
 // [3], a v2AttrCert [2], a v1AttrCert [1]; a RevocationInfoChoice `other` is [1]),
 // the SignerInfo versions, and whether the content type is id-data.
 function _expectedSignedDataVersion(certificates, crls, signerInfos, eContentType) {
-  function ctx(el, n) { return el.tagClass === "context" && el.tagNumber === n; }
-  var otherCert = certificates.some(function (c) { return ctx(c, 3); });
-  var otherCrl = crls.some(function (c) { return ctx(c, 1); });
+  var otherCert = certificates.some(function (c) { return schema.isContext(c, 3); });
+  var otherCrl = crls.some(function (c) { return schema.isContext(c, 1); });
   if (otherCert || otherCrl) return 5;
-  if (certificates.some(function (c) { return ctx(c, 2); })) return 4;   // v2AttrCert [2]
-  if (certificates.some(function (c) { return ctx(c, 1); }) ||           // v1AttrCert [1]
+  if (certificates.some(function (c) { return schema.isContext(c, 2); })) return 4;   // v2AttrCert [2]
+  if (certificates.some(function (c) { return schema.isContext(c, 1); }) ||           // v1AttrCert [1]
       signerInfos.some(function (si) { return si.version === 3; }) ||
       eContentType !== OID_DATA) return 3;
   return 1;
@@ -528,12 +527,11 @@ var ORIGINATOR_INFO = schema.seq([
 // [2]; a crl `other` is [1]; a pwri or ori forces v3; all-ktri-IAS with no
 // originatorInfo/unprotectedAttrs is v0; everything else v2).
 function _expectedEnvelopedDataVersion(originatorInfo, recipientInfos, hasUnprotectedAttrs) {
-  function ctx(el, n) { return el.tagClass === "context" && el.tagNumber === n; }
   var hasOrig = !!originatorInfo;
   var certs = hasOrig ? originatorInfo.certs : [];
   var crls = hasOrig ? originatorInfo.crls : [];
-  if (hasOrig && (certs.some(function (c) { return ctx(c, 3); }) || crls.some(function (c) { return ctx(c, 1); }))) return 4;
-  if ((hasOrig && certs.some(function (c) { return ctx(c, 2); })) ||
+  if (hasOrig && (certs.some(function (c) { return schema.isContext(c, 3); }) || crls.some(function (c) { return schema.isContext(c, 1); }))) return 4;
+  if ((hasOrig && certs.some(function (c) { return schema.isContext(c, 2); })) ||
       recipientInfos.some(function (r) { return r.type === "pwri" || r.type === "ori"; })) return 3;
   if (!hasOrig && !hasUnprotectedAttrs &&
       recipientInfos.every(function (r) { return r.type === "ktri" && r.ridType === "issuerAndSerialNumber"; })) return 0;
@@ -676,11 +674,10 @@ function pemEncode(der, label) { return pkix.pemEncode(der, label || "CMS", PemE
 // registry order.
 function matches(root) {
   var TAGS = asn1.TAGS;
-  if (!root || root.tagClass !== "universal" || root.tagNumber !== TAGS.SEQUENCE) return false;
-  var k = root.children;
-  if (!k || k.length !== 2) return false;
-  if (!(k[0].tagClass === "universal" && k[0].tagNumber === TAGS.OBJECT_IDENTIFIER)) return false;
-  if (!(k[1].tagClass === "context" && k[1].tagNumber === 0 && k[1].children)) return false;
+  var k = pkix.rootSequenceChildren(root, 2, 2);
+  if (!k) return false;
+  if (!schema.isUniversal(k[0], TAGS.OBJECT_IDENTIFIER)) return false;
+  if (!(schema.isContext(k[1], 0) && k[1].children)) return false;
   return true;
 }
 
@@ -692,10 +689,20 @@ function matches(root) {
 // universal SEQUENCE (an IMPLICIT [n] EnvelopedData is retagged by the caller).
 function walkEnvelopedData(node) { return schema.walk(ENVELOPED_DATA, node, NS).result; }
 
+// Validate a bare SignedData / EncryptedData node the same way — for a composer
+// that holds an already-decoded content node and must not re-decode its bytes
+// (an RFC 7292 PFX authSafe or encrypted safe, whose wire encoding may be BER
+// that the strict `parse` entry would refuse). Same contract as
+// walkEnvelopedData: the node is the bare structure, typed cms/* on rejection.
+function walkSignedData(node) { return schema.walk(SIGNED_DATA, node, NS).result; }
+function walkEncryptedData(node) { return schema.walk(ENCRYPTED_DATA, node, NS).result; }
+
 module.exports = {
   parse: parse,
   pemDecode: pemDecode,
   pemEncode: pemEncode,
   matches: matches,
   walkEnvelopedData: walkEnvelopedData,
+  walkSignedData: walkSignedData,
+  walkEncryptedData: walkEncryptedData,
 };

package/lib/schema-crl.js

@@ -238,10 +238,10 @@ function matches(root) {
   // version, then signature (SEQUENCE) + issuer (SEQUENCE); the next element is
   // thisUpdate (Time) for a CRL, Validity (SEQUENCE) for a certificate.
   var i = 0;
-  if (tbs.children[i] && tbs.children[i].tagClass === "universal" && tbs.children[i].tagNumber === TAGS.INTEGER) i++;
+  if (schema.isUniversal(tbs.children[i], TAGS.INTEGER)) i++;
   i += 2; // signature + issuer
   var pos = tbs.children[i];
-  return !!pos && pos.tagClass === "universal" && (pos.tagNumber === TAGS.UTC_TIME || pos.tagNumber === TAGS.GENERALIZED_TIME);
+  return schema.isUniversalOneOf(pos, [TAGS.UTC_TIME, TAGS.GENERALIZED_TIME]);
 }
 
 module.exports = {

package/lib/schema-crmf.js

@@ -216,7 +216,7 @@ function popoPrivKey(type) {
       }
     }
     if (inner.tagNumber === 3) {
-      try { schema.walk(PKMAC_VALUE, asn1.decode(asn1.sequenceTlv(inner)), NS); }
+      try { schema.embeddedDer(PKMAC_VALUE, asn1.sequenceTlv(inner), NS, { code: "crmf/bad-popo", what: "agreeMAC [3] PKMACValue" }); }
       catch (e) { throw ctx.E("crmf/bad-popo", "agreeMAC [3] must be a PKMACValue SEQUENCE { algId, BIT STRING } (RFC 4211 §4.2)", e); }
     }
     // encryptedKey [4] EnvelopedData — validate the CMS structure fail-closed by
@@ -296,30 +296,27 @@ var CERT_TEMPLATE = schema.seq([
   assert: "sequence", code: "crmf/bad-cert-template", what: "CertTemplate",
   build: function (m, ctx) {
     var f = m.fields;
-    // RFC 4211 §5 — serialNumber, signingAlg, issuerUID, and subjectUID MUST be
-    // omitted from a CertTemplate: serialNumber and signingAlg are assigned by the
-    // CA, and the UID pair is deprecated. A requester must not dictate a
-    // CA-assigned value (a requester-chosen serialNumber is a real hazard), so a
-    // template that sets any of them is rejected fail-closed, not surfaced as
-    // acceptable. They stay in the field map (parsed, then rejected) so the
-    // diagnostic names the offending field rather than a bare tag number.
-    var caAssigned = ["serialNumber", "signingAlg", "issuerUID", "subjectUID"];
-    for (var i = 0; i < caAssigned.length; i++) {
-      if (f[caAssigned[i]].present) {
-        throw ctx.E("crmf/bad-cert-template", "CertTemplate " + caAssigned[i] + " MUST be omitted — it is CA-assigned or deprecated (RFC 4211 §5)");
-      }
-    }
-    // version MUST be 2 (v3) when supplied; SHOULD be omitted (RFC 4211 §5).
+    // version MUST be 2 (v3) when supplied; SHOULD be omitted (RFC 4211 §5). This
+    // is a structural CertTemplate rule (it holds wherever the template appears);
+    // the CA-assigned-field omission rule is REQUEST-context-specific and lives in
+    // CERT_REQUEST.build, because the same CertTemplate structure identifies an
+    // existing certificate — serialNumber and issuer present — inside a CMP
+    // RevDetails (RFC 9810 §5.3.9). Every field is surfaced so both the request
+    // omission check and the revocation consumer read them off one result.
     if (f.version.present && f.version.value !== 2n) {
       throw ctx.E("crmf/bad-version", "CertTemplate version MUST be 2 (v3) if supplied (RFC 4211 §5)");
     }
     return {
-      version:    f.version.present ? f.version.value : null,
-      issuer:     f.issuer.present ? f.issuer.value : null,
-      validity:   f.validity.present ? f.validity.value.result : null,
-      subject:    f.subject.present ? f.subject.value : null,
-      publicKey:  f.publicKey.present ? f.publicKey.value.result : null,
-      extensions: f.extensions.present ? f.extensions.value.result : null,
+      version:     f.version.present ? f.version.value : null,
+      serialNumber: f.serialNumber.present ? f.serialNumber.value : null,
+      signingAlg:  f.signingAlg.present ? f.signingAlg.value.result : null,
+      issuer:      f.issuer.present ? f.issuer.value : null,
+      validity:    f.validity.present ? f.validity.value.result : null,
+      subject:     f.subject.present ? f.subject.value : null,
+      publicKey:   f.publicKey.present ? f.publicKey.value.result : null,
+      issuerUID:   f.issuerUID.present ? f.issuerUID.value : null,
+      subjectUID:  f.subjectUID.present ? f.subjectUID.value : null,
+      extensions:  f.extensions.present ? f.extensions.value.result : null,
     };
   },
 });
@@ -334,11 +331,32 @@ var CERT_REQUEST = schema.seq([
   schema.optional("controls", CONTROLS, { whenUniversal: [TAGS.SEQUENCE] }),
 ], {
   assert: "sequence", code: "crmf/bad-cert-request", what: "CertRequest",
-  build: function (m) {
+  build: function (m, ctx) {
+    var tpl = m.fields.certTemplate.value.result;
+    // RFC 4211 §5 — serialNumber, signingAlg, issuerUID, and subjectUID MUST be
+    // omitted from a REQUEST's CertTemplate: serialNumber and signingAlg are
+    // assigned by the CA, and the UID pair is deprecated. A requester must not
+    // dictate a CA-assigned value (a requester-chosen serialNumber is a real
+    // hazard), so a request template that sets any of them is rejected
+    // fail-closed. The check lives HERE, not in CERT_TEMPLATE, because the same
+    // structure legitimately carries serialNumber/issuer in a CMP RevDetails.
+    // A cross-certification request (ccr) is the ONE exception: RFC 9810 Appendix
+    // D.6 profiles its template with signingAlg PRESENT (the requesting CA states
+    // the algorithm it wants the cross-certificate signed with), so the caller
+    // relaxes that single field via ctx.allowSigningAlg; serialNumber and the UID
+    // pair stay forbidden.
+    var caAssigned = ctx.allowSigningAlg
+      ? ["serialNumber", "issuerUID", "subjectUID"]
+      : ["serialNumber", "signingAlg", "issuerUID", "subjectUID"];
+    for (var i = 0; i < caAssigned.length; i++) {
+      if (tpl[caAssigned[i]] !== null) {
+        throw ctx.E("crmf/bad-cert-template", "CertTemplate " + caAssigned[i] + " MUST be omitted — it is CA-assigned or deprecated (RFC 4211 §5)");
+      }
+    }
     return {
       certReqId:     m.fields.certReqId.value,
       certReqIdHex:  m.fields.certReqId.node.content.toString("hex"),
-      certTemplate:  m.fields.certTemplate.value.result,
+      certTemplate:  tpl,
       controls:      m.fields.controls.present ? m.fields.controls.value.result : null,
       certReqBytes:  m.node.bytes,   // the exact CertRequest TLV the POP signature covers (§4.1)
     };
@@ -466,20 +484,36 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || null, Pem
 // ocsp-request: an OCSPRequest's tbsRequest never leads with the INTEGER-then-
 // SEQUENCE pair (its children[0] is a context [0] version or a requestList).
 function matches(root) {
-  if (!root || root.tagClass !== "universal" || root.tagNumber !== TAGS.SEQUENCE || !root.children || root.children.length < 1) return false;
-  var msg = root.children[0];
-  if (!msg.children || msg.tagClass !== "universal" || msg.tagNumber !== TAGS.SEQUENCE || msg.children.length < 1) return false;
+  var k = pkix.rootSequenceChildren(root, 1);
+  if (!k) return false;
+  var msg = k[0];
+  if (!(msg.children && schema.isUniversal(msg, TAGS.SEQUENCE) && msg.children.length >= 1)) return false;
   var certReq = msg.children[0];
-  if (!certReq.children || certReq.tagClass !== "universal" || certReq.tagNumber !== TAGS.SEQUENCE || certReq.children.length < 2) return false;
+  if (!(certReq.children && schema.isUniversal(certReq, TAGS.SEQUENCE) && certReq.children.length >= 2)) return false;
   var id = certReq.children[0], tpl = certReq.children[1];
-  return id.tagClass === "universal" && id.tagNumber === TAGS.INTEGER &&
-    tpl.tagClass === "universal" && tpl.tagNumber === TAGS.SEQUENCE && !!tpl.children;
+  return schema.isUniversal(id, TAGS.INTEGER) &&
+    schema.isUniversal(tpl, TAGS.SEQUENCE) && !!tpl.children;
+}
+
+// Validate a bare, already-decoded CertReqMessages / CertTemplate node — for a
+// composer that carries these structures inside its own envelope (an RFC 9810
+// CMP PKIBody's ir/cr/kur/krr/ccr arms; a RevDetails.certDetails). NS-bound to
+// crmf so an interior failure throws CrmfError with a crmf/* code, never the
+// composer's class wearing a foreign code. Same contract as the CMS walkers.
+// opts.allowSigningAlg relaxes the request-template signingAlg-omission rule for
+// the CMP cross-certification (ccr) arm only (RFC 9810 Appendix D.6).
+function walkCertReqMessages(node, opts) {
+  var ctx = (opts && opts.allowSigningAlg) ? Object.assign({}, NS, { allowSigningAlg: true }) : NS;
+  return schema.walk(CERT_REQ_MESSAGES, node, ctx).result;
 }
+function walkCertTemplate(node) { return schema.walk(CERT_TEMPLATE, node, NS).result; }
 
 module.exports = {
   parse: parse,
   pemDecode: pemDecode,
   matches: matches,
+  walkCertReqMessages: walkCertReqMessages,
+  walkCertTemplate: walkCertTemplate,
   // The top schema, exposed (not on the curated pki.schema.crmf surface) so a
   // round-trip test can prove schema.encode(schema, v) -> decode -> parse recovers
   // v — the invariant that structurally validates the IMPLICIT/EXPLICIT tag handling.

package/lib/schema-csr.js

@@ -171,10 +171,10 @@ function matches(root) {
   if (!cri) return false;
   var k = cri.children;
   if (k.length !== 4) return false;
-  return k[0].tagClass === "universal" && k[0].tagNumber === TAGS.INTEGER &&
-    k[1].tagClass === "universal" && k[1].tagNumber === TAGS.SEQUENCE &&
-    k[2].tagClass === "universal" && k[2].tagNumber === TAGS.SEQUENCE &&
-    k[3].tagClass === "context" && k[3].tagNumber === 0;
+  return schema.isUniversal(k[0], TAGS.INTEGER) &&
+    schema.isUniversal(k[1], TAGS.SEQUENCE) &&
+    schema.isUniversal(k[2], TAGS.SEQUENCE) &&
+    schema.isContext(k[3], 0);
 }
 
 module.exports = {

package/lib/schema-engine.js

@@ -160,10 +160,10 @@ function optional(name, schema, opts) {
   var match = opts.whenAny
     ? function () { return true; }
     : opts.whenUniversal
-      ? function (n) { return n.tagClass === "universal" && opts.whenUniversal.indexOf(n.tagNumber) !== -1; }
+      ? function (n) { return isUniversalOneOf(n, opts.whenUniversal); }
       : opts.tags
-        ? function (n) { return n.tagClass === "context" && opts.tags.indexOf(n.tagNumber) !== -1; }
-        : function (n) { return n.tagClass === "context" && n.tagNumber === opts.tag; };
+        ? function (n) { return isContextOneOf(n, opts.tags); }
+        : function (n) { return isContext(n, opts.tag); };
   return { fkind: "optional", name: name, schema: schema, tag: opts.tag, match: match,
            explicit: !!opts.explicit, emptyCode: opts.emptyCode, hasDefault: ("default" in opts), def: opts.default };
 }
@@ -200,12 +200,14 @@ function choice(alts, opts) {
 function seqOf(item, opts) {
   opts = opts || {};
   return { kind: "repeat", item: item, assert: opts.assert || "sequence", code: opts.code, what: opts.what,
-           min: opts.min, unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
+           min: opts.min, max: opts.max, maxCode: opts.maxCode,
+           unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
 }
 function setOf(item, opts) {
   opts = opts || {};
   return { kind: "repeat", item: item, assert: opts.assert || "set", derSetOrder: true, code: opts.code, what: opts.what,
-           min: opts.min, unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
+           min: opts.min, max: opts.max, maxCode: opts.maxCode,
+           unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
 }
 function setOfUnique(item, keyFn, opts) {
   return setOf(item, Object.assign({ unique: keyFn }, opts || {}));
@@ -216,7 +218,8 @@ function setOfUnique(item, keyFn, opts) {
 function implicitSetOf(tag, item, opts) {
   opts = opts || {};
   return { kind: "repeat", item: item, assert: "implicit", implicitTag: tag, derSetOrder: true, code: opts.code, what: opts.what,
-           min: opts.min, unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
+           min: opts.min, max: opts.max, maxCode: opts.maxCode,
+           unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
 }
 // [tag] IMPLICIT SEQUENCE OF item — the context tag REPLACES the universal SEQUENCE
 // tag, so the node is a context-class constructed [tag] whose direct children are the
@@ -225,7 +228,8 @@ function implicitSetOf(tag, item, opts) {
 function implicitSeqOf(tag, item, opts) {
   opts = opts || {};
   return { kind: "repeat", item: item, assert: "implicit", implicitTag: tag, code: opts.code, what: opts.what,
-           min: opts.min, unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
+           min: opts.min, max: opts.max, maxCode: opts.maxCode,
+           unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
 }
 
 // ---- the walk engine -------------------------------------------------
@@ -304,6 +308,12 @@ function _walkRepeat(schema, node, ctx) {
   if (schema.min != null && kids.length < schema.min) {
     _fail(ctx, schema.code, (schema.what || "value") + " must contain at least " + schema.min + " element(s)");
   }
+  // The element-count ceiling: a container of a great many tiny elements
+  // amplifies memory through per-element walk products, so a schema that
+  // parses attacker-sized lists declares `max` and fails typed instead.
+  if (schema.max != null && kids.length > schema.max) {
+    _fail(ctx, schema.maxCode || schema.code, (schema.what || "value") + " exceeds the element cap " + schema.max);
+  }
   // DER (X.690 §11.6) — the components of a SET OF appear in ascending order, the
   // encodings compared as octet strings. SEQUENCE OF is order-preserving and is
   // exempt (no derSetOrder). Compare full TLV byte strings, the same canonical
@@ -500,6 +510,9 @@ function _encodeRepeat(schema, items, ctx) {
   if (schema.min != null && items.length < schema.min) {
     _encFail("this repeat requires at least " + schema.min + " element(s) but got " + items.length);
   }
+  if (schema.max != null && items.length > schema.max) {
+    _encFail("this repeat caps at " + schema.max + " element(s) but got " + items.length);
+  }
   var parts = items.map(function (it) { return encode(schema.item, it, ctx); });
   if (schema.unique) {
     var seen = new Set();
@@ -523,6 +536,96 @@ function _encodeChoice(schema, value, ctx) {
   return encode(schema.alts[value.arm].schema, value.value, ctx);
 }
 
+/**
+ * @primitive  pki.schema.engine.embeddedDer
+ * @signature  pki.schema.engine.embeddedDer(schema, bytes, ctx, opts?) -> value
+ * @since      0.1.18
+ * @status     experimental
+ * @spec       X.690
+ * @defends    ASN.1-parser-DoS (CWE-400)
+ * @related    pki.schema.engine.walk, pki.asn1.decode
+ *
+ * Decode a fresh DER (or, with `ber: true`, BER) blob carried inside an
+ * already-decoded value — an OCTET STRING whose content is itself an encoded
+ * structure — and walk it against a schema. A codec failure is wrapped in the
+ * caller's typed `code`; a schema rejection keeps its own code. This is the
+ * one named form of the re-decode idiom, so the caps that a fresh
+ * `pki.asn1.decode` would restart from zero can be carried across re-decode
+ * boundaries: a shared `budget` (`{ remaining: n }`) decrements on every call
+ * and fails with `budgetCode` at zero, bounding how many nested blobs one
+ * parse may unwrap however deeply a container chains them.
+ *
+ * @opts
+ *   code:       string,   // typed code wrapping a codec failure (required)
+ *   what:       string,   // human label for the wrapped message
+ *   ber:        boolean,  // default false — BER content region (RFC 7292 §4.1)
+ *   budget:     object,   // { remaining: n } shared across a parse's re-decodes
+ *   budgetCode: string,   // typed code when the budget is exhausted
+ *
+ * @example
+ *   var S = pki.schema.engine;
+ *   var INNER = S.seq([S.field("version", S.integerLeaf())], { code: "app/bad-inner" });
+ *   var ns = { prefix: "app", E: MyError, oid: pki.oid };
+ *   S.embeddedDer(INNER, pki.asn1.build.sequence([pki.asn1.build.integer(3n)]), ns,
+ *     { code: "app/bad-der", what: "the embedded structure" });
+ */
+function embeddedDer(schema, bytes, ctx, opts) {
+  opts = opts || {};
+  if (opts.budget) {
+    if (!(opts.budget.remaining > 0)) {
+      throw ctx.E(opts.budgetCode || opts.code, (opts.what || "embedded DER") +
+        ": the cross-decode budget is exhausted (nesting chained across too many re-decode boundaries)");
+    }
+    opts.budget.remaining -= 1;
+  }
+  var node;
+  try {
+    node = asn1.decode(bytes, opts.ber ? { ber: true } : undefined);
+  } catch (e) {
+    throw ctx.E(opts.code, (opts.what || "embedded DER") + " did not decode: " + e.message, e);
+  }
+  return walk(schema, node, ctx);
+}
+
+// X.690 §11.2.2 — a NamedBitList BIT STRING (KeyUsage, PKIFailureInfo, and the
+// like) MUST drop every trailing zero bit under DER, giving one canonical
+// encoding per value: an empty value carries 0 unused bits; a non-empty value's
+// last content octet is non-zero AND its lowest USED bit (at position
+// `unusedBits`) is set. `fail(message)` throws the caller's typed domain error,
+// so the reject code stays per-format. Centralized so no format re-derives — and
+// silently diverges on — the minimal-encoding rule (a DER-canonicalization
+// bypass class); see the named-bitlist-minimal-encoding-inlined gate.
+// ASN.1 node tag predicates — the per-node `tagClass`/`tagNumber` test every
+// format's matches() detector (and the engine's own optional/choice walkers)
+// would otherwise re-inline. Centralized so a detector composes one predicate
+// instead of hand-rolling the comparison (and drifting); see the
+// detector-reinlines-root-tag-guard gate.
+function isUniversal(node, tagNumber) {
+  return !!node && node.tagClass === "universal" && node.tagNumber === tagNumber;
+}
+function isContext(node, tagNumber) {
+  return !!node && node.tagClass === "context" && node.tagNumber === tagNumber;
+}
+function isUniversalOneOf(node, tagNumbers) {
+  return !!node && node.tagClass === "universal" && tagNumbers.indexOf(node.tagNumber) !== -1;
+}
+function isContextOneOf(node, tagNumbers) {
+  return !!node && node.tagClass === "context" && tagNumbers.indexOf(node.tagNumber) !== -1;
+}
+function isContextInRange(node, min, max) {
+  return !!node && node.tagClass === "context" && node.tagNumber >= min && node.tagNumber <= max;
+}
+
+function assertMinimalNamedBits(unusedBits, bytes, fail) {
+  if (bytes.length === 0) {
+    if (unusedBits !== 0) fail("an empty NamedBitList must encode with 0 unused bits (X.690 §11.2.2)");
+    return;
+  }
+  var last = bytes[bytes.length - 1];
+  if (last === 0) fail("a NamedBitList must not carry a trailing all-zero octet (X.690 §11.2.2)");
+  if (((last >> unusedBits) & 1) !== 1) fail("a NamedBitList must drop all trailing zero bits (X.690 §11.2.2)");
+}
+
 module.exports = {
   // structural
   seq: seq, field: field, optional: optional, explicit: explicit, trailing: trailing,
@@ -533,5 +636,8 @@ module.exports = {
   implicitNull: implicitNull, implicitInteger: implicitInteger,
   any: any, decode: decode, time: time,
   // engine
-  walk: walk, encode: encode,
+  walk: walk, encode: encode, embeddedDer: embeddedDer, assertMinimalNamedBits: assertMinimalNamedBits,
+  // node tag predicates
+  isUniversal: isUniversal, isContext: isContext,
+  isUniversalOneOf: isUniversalOneOf, isContextOneOf: isContextOneOf, isContextInRange: isContextInRange,
 };

package/lib/schema-ocsp.js

@@ -294,14 +294,12 @@ var RESPONSE_BYTES = schema.seq([
     if (responseType !== OID_OCSP_BASIC) {
       throw NS.E("ocsp/unsupported-response-type", (ctx.oid.name(responseType) || responseType) + " is not id-pkix-ocsp-basic (RFC 6960 §4.2.1)");
     }
-    var inner;
-    try { inner = asn1.decode(raw); }
-    catch (e) { throw NS.E("ocsp/bad-der", "BasicOCSPResponse DER did not decode: " + ((e && e.message) || String(e)), e); }
     return {
       responseType: responseType,
       responseTypeName: ctx.oid.name(responseType) || null,
       response: raw,
-      basicResponse: schema.walk(BASIC_OCSP_RESPONSE, inner, ctx).result,
+      basicResponse: schema.embeddedDer(BASIC_OCSP_RESPONSE, raw, ctx,
+        { code: "ocsp/bad-der", what: "BasicOCSPResponse" }).result,
     };
   },
 });
@@ -491,11 +489,10 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || "OCSP RES
 // unconditionally exclusive.
 function matchesResponse(root) {
   var T = asn1.TAGS;
-  if (!root || root.tagClass !== "universal" || root.tagNumber !== T.SEQUENCE || !root.children) return false;
-  var k = root.children;
-  if (k.length < 1 || k.length > 2) return false;
-  if (!(k[0].tagClass === "universal" && k[0].tagNumber === T.ENUMERATED)) return false;
-  if (k.length === 2 && !(k[1].tagClass === "context" && k[1].tagNumber === 0 && k[1].children)) return false;
+  var k = pkix.rootSequenceChildren(root, 1, 2);
+  if (!k) return false;
+  if (!schema.isUniversal(k[0], T.ENUMERATED)) return false;
+  if (k.length === 2 && !(schema.isContext(k[1], 0) && k[1].children)) return false;
   return true;
 }
 
@@ -505,11 +502,10 @@ function matchesResponse(root) {
 // signed-envelope trio), while an OCSPRequest is 1-2 — so it is excluded by arity.
 function matchesRequest(root) {
   var T = asn1.TAGS;
-  if (!root || root.tagClass !== "universal" || root.tagNumber !== T.SEQUENCE || !root.children) return false;
-  var k = root.children;
-  if (k.length < 1 || k.length > 2) return false;
-  if (!(k[0].tagClass === "universal" && k[0].tagNumber === T.SEQUENCE && k[0].children)) return false;
-  if (k.length === 2 && !(k[1].tagClass === "context" && k[1].tagNumber === 0 && k[1].children)) return false;
+  var k = pkix.rootSequenceChildren(root, 1, 2);
+  if (!k) return false;
+  if (!(schema.isUniversal(k[0], T.SEQUENCE) && k[0].children)) return false;
+  if (k.length === 2 && !(schema.isContext(k[1], 0) && k[1].children)) return false;
   return true;
 }