@blamejs/pki 0.1.18 → 0.1.20

package/CHANGELOG.md

@@ -4,6 +4,40 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.1.20 — 2026-07-09
+
+An RFC 6962 Certificate Transparency SCT-list parser joins the toolkit.
+
+### Added
+
+- pki.ct.parseSctList(extValue) — RFC 6962 SCT-list parsing. It decodes the SignedCertificateTimestampList extension value (the raw extnValue content an x509 or OCSP extension surfaces) into { scts, unknownScts }. Each scts entry is a fully decoded v1 SCT: version (0), logId (32-byte Buffer) plus logIdHex, timestamp (exact BigInt) plus timestampMs (a Number, or null above 2^53) plus timestampDate, extensions (raw Buffer), the hashAlg / sigAlg code points plus a named signatureAlgorithm, the raw signature, and rawSct (the full SerializedSCT body). A SerializedSCT whose version is not v1 is preserved opaque in unknownScts as { version, rawSct } rather than failing the list (RFC 6962 §3.3 gives each SerializedSCT its own length so unknown versions are skippable). The extension value is the §3.3 double DER OCTET STRING wrap over a TLS-encoded list, decoded with a bounded reader that validates the list and per-SCT framing and every internal length, and asserts a per-list byte and count cap before it iterates. The signature is never verified and the log id never recomputed. Malformed input fails closed with a typed ct/* (or leaf asn1/*) code.
+- pki.ct.reconstructSignedData(entry, sct) — rebuilds the exact digitally-signed preimage a verifier hashes to check an SCT's signature (RFC 6962 §3.2), for a decoded v1 SCT. entry selects the log-entry form: { entryType: 0, leafCert } for an SCT delivered over TLS or OCSP (signed over the leaf certificate), or { entryType: 1, tbsCertificate, issuerKeyHash } for an SCT embedded in a certificate (signed over the issuer key hash and the precertificate TBS). The preimage reuses the parsed SCT's raw extensions byte-for-byte; a verifier hashes the returned bytes and checks the signature with the log's public key.
+- The certificate-extension value registry gains the SCT-list decoder and the precertificate-poison decoder (the poison value is content-validated as ASN.1 NULL, not merely tag-checked).
+- The OID registry gains the Certificate Transparency arc — the SCT-list, precertificate-poison, precertificate-signing-certificate, and OCSP SCT-list identifiers — so those extension OIDs resolve to names.
+- The error taxonomy gains CtError, carrying a stable ct/* code.
+
+## v0.1.19 — 2026-07-09
+
+An RFC 9810 Certificate Management Protocol message parser joins the pki.schema family.
+
+### Added
+
+- pki.schema.cmp.parse(input) — RFC 9810 PKIMessage parsing. It decodes a DER Buffer or PEM into { header, headerBytes, body, bodyBytes, protection, extraCerts }. The header carries pvno (1..3), validated sender / recipient GeneralNames (the anonymous NULL-DN accepted), and the optional messageTime (GeneralizedTime only), protectionAlg, senderKID / recipKID, transactionID, senderNonce / recipNonce, freeText, and generalInfo (recognized id-it values are syntax-checked). The body is { arm, tag, bytes, decoded? }: ir / cr / kur / krr / ccr decode through the CRMF parser; ip / cp / kup / ccp decode to a certificate-response structure (an encrypted certificate's EnvelopedData decodes through the CMS parser; the deprecated EncryptedValue arm and caPubs surface raw, conferring no trust); krp decodes to a key-recovery structure ({ status, newSigCert, caCerts, keyPairHist }); rr / rp, genm / genp, error, certConf (an empty confirmation is the legal reject-all), and pollReq / pollRep decode structurally; pkiconf decodes to null; every other defined arm — p10cr, the challenge-response and announcement arms, and nested (never auto-recursed) — surfaces raw. certReqId values are big integers and accept the protocol's -1 sentinel. The two cross-field coherence rules (protection bits and protectionAlg present together or absent together; a certConf hashAlg requires version cmp2021) are enforced. Protection is surfaced, not verified: headerBytes and bodyBytes are the exact wire slices, so a verifier reconstructs the protected part as a DER SEQUENCE wrapping them and checks the MAC or signature. Malformed input fails closed with a typed cmp/* or asn1/* code.
+- pki.schema.cmp.pemDecode(text, label?) / pemEncode(der, label?) — PEM handling for messages that transit text channels (default label CMP).
+- pki.schema.crmf.parse now surfaces every CertTemplate field, including serialNumber and the issuer/subject unique identifiers. RFC 4211's rule that a certificate request must omit the CA-assigned fields (serialNumber, signingAlg) and the deprecated unique identifiers moved from the shared CertTemplate structure to the request layer, so a request that sets them still fails closed while the same structure can identify an existing certificate — serialNumber and issuer present — inside a CMP revocation.
+- The OID registry gains the CMP id-it information types and the message-protection MAC algorithm identifiers (passwordBasedMac, dhBasedMac, kemBasedMac), so a parsed message's info types and protection algorithm resolve to names.
+- The error taxonomy gains CmpError, carrying a stable cmp/* code.
+
+### Changed
+
+- pki.schema.tsp parsing (parse, parseTstInfo, parseToken, pemDecode) is now stable.
+- The npm-publish vulnerability scan reads the committed lockfiles (the dev and build toolchain that runs during a publish) instead of the runtime SBOM, which is empty by construction because the package ships zero runtime dependencies.
+
+### Fixed
+
+- Certification-path validation bounds the BasicConstraints pathLenConstraint and the PolicyConstraints / InhibitAnyPolicy skip counts before narrowing them to a number, so a certificate carrying a value past the safe-integer range is rejected rather than having the counter round silently to the wrong value (the same exact-or-rejected rule the RSASSA-PSS salt length and PKCS#12 iteration count follow).
+- Certification-path validation rejects a non-empty DER NULL in an RSASSA-PSS hash AlgorithmIdentifier's parameters — a NULL must carry empty content (X.690 8.8.2), so the previous tag-only check accepted a malformed encoding it now fails closed.
+
 ## v0.1.18 — 2026-07-08
 
 An RFC 7292 PKCS#12 (PFX) store parser joins the pki.schema family.

package/README.md

@@ -201,10 +201,12 @@ is callable today; nothing below is a stub.
 | `pki.schema.attrcert` | Parse DER / PEM RFC 5755 attribute certificates — the holder and issuer identities (validated GeneralNames), the validity window (real `Date`s), the privilege attributes (role / group / clearance) and extensions, with the raw signed region for a verifier; the obsolete v1 form is recognized and deferred, fail-closed — `parse`, `pemDecode` |
 | `pki.schema.crmf` | Parse DER / PEM RFC 4211 certificate request messages (CertReqMessages — the CMP / EST enrollment body) — the requested-certificate template (subject, public key, validity, extensions), proof-of-possession, and registration controls, with the raw `CertRequest` region a POP verifier hashes; names dual-accepted (IMPLICIT and EXPLICIT), fail-closed — `parse`, `pemDecode` |
 | `pki.schema.pkcs12` | Parse DER / BER / PEM RFC 7292 PKCS#12 (PFX) stores — key bags via the PKCS#8 parser, shrouded keys (algorithm surfaced, ciphertext opaque), cert / CRL / secret bags raw and byte-exact, encrypted and enveloped safes structurally via CMS, `friendlyName` / `localKeyId` decoded, and the exact MAC byte range (`macedBytes`) plus RFC 9579 PBMAC1 recognition for external verification; BER accepted exactly where §4.1 requires it, fail-closed — `parse`, `pemDecode`, `pemEncode` |
+| `pki.schema.cmp` | Parse DER / PEM RFC 9810 Certificate Management Protocol messages (PKIMessage) — the header (version, sender / recipient incl. the anonymous NULL-DN, nonces, transaction id, general info), the 27-arm body (certificate requests via the CRMF parser, an encrypted certificate's EnvelopedData via CMS, response / revocation / confirmation / error / support / polling arms structural, the rest raw), and the exact `headerBytes` / `bodyBytes` slices an external verifier reconstructs the protected part from; the CMP-before-OCSP dispatch order is enforced, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk` / `encode` / `embeddedDer` plus the schema combinators |
 | `pki.path` | RFC 5280 §6 certification-path validation — `validate` runs the §6.1 state machine (signature chaining, validity windows, name chaining, basic constraints and path length, key usage, name constraints, the certificate-policy tree) over an ordered path and a trust anchor, returning a structured verdict with per-check reason codes; `crlChecker` supplies CRL-based revocation. Pure and re-entrant, fail-closed — `validate`, `crlChecker` |
+| `pki.ct` | Parse RFC 6962 Certificate Transparency SCT lists — `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries in the SCT extension (a TLS-presentation-language payload inside the §3.3 double DER wrap) into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature; `reconstructSignedData` rebuilds the exact `digitally-signed` preimage for external verification. Structure decoded, crypto surfaced raw, bounded decode, fail-closed — `parseSctList`, `reconstructSignedData` |
 | `pki.C` / `pki.constants` | Version-stable constants — functional scale helpers (`C.TIME.*`, `C.BYTES.*`), codec `LIMITS`, `version` |
-| `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError` / `TspError` / `AttrCertError` / `CrmfError` / `Pkcs12Error` / `PathError`, each carrying a stable `code` in `domain/reason` form |
+| `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError` / `TspError` / `AttrCertError` / `CrmfError` / `Pkcs12Error` / `CmpError` / `PathError` / `CtError`, each carrying a stable `code` in `domain/reason` form |
 | `pki` CLI | `pki version`, `pki oid <dotted\|name>`, `pki parse <cert>` |
 
 ### CLI

package/index.js

@@ -30,6 +30,7 @@ var oid       = require("./lib/oid");
 var webcrypto = require("./lib/webcrypto");
 var schema    = require("./lib/schema-all");
 var path      = require("./lib/path-validate");
+var ct        = require("./lib/ct");
 
 module.exports = {
   version:   constants.version,
@@ -46,6 +47,10 @@ module.exports = {
   // `path` is RFC 5280 §6 certification-path validation — pki.path.validate
   // runs the §6.1 state machine over an already-parsed path + a trust anchor.
   path:      path,
+  // `ct` is RFC 6962 Certificate Transparency — pki.ct.parseSctList decodes the
+  // SCT-list extension a certificate / OCSP response carries; the signature is
+  // surfaced raw for external verification (pki.ct.reconstructSignedData).
+  ct:        ct,
   // A ready W3C Crypto instance (globalThis.crypto shape) with the classes for
   // constructing more attached under the same namespace (pki.webcrypto.CryptoKey,
   // .SubtleCrypto, .Crypto, .WebCryptoError). PQC-first, classical-capable, zero-dep.

package/lib/constants.js

@@ -117,6 +117,17 @@ var LIMITS = {
   PEM_MAX_BYTES: BYTES.mib(16),
   DER_MAX_INTEGER_BYTES: BYTES.kib(16),
   OID_MAX_SUBIDENTIFIER_BYTES: 32,
+  // Certificate Transparency SCT-list bounds (RFC 6962 §3.3). The outer sct_list
+  // vector carries a 2-byte length prefix, so a well-formed list body is at most
+  // 2^16-1 = 65535 bytes and the full TLS blob (prefix + body) is at most 65537.
+  // The byte cap sits at that structural maximum, so the largest conforming list
+  // is accepted while an oversized inner OCTET STRING (up to the DER document cap)
+  // is refused BEFORE the list is walked; the per-list count cap is likewise
+  // asserted before iteration so a hostile length prefix cannot drive unbounded
+  // work (the CVE-2022-0778 class: crafted bytes inside a certificate extension
+  // pinning a validator). A real chain carries 2-5 SCTs; 256 is far above policy.
+  SCT_MAX_BYTES: BYTES.kib(64) + 1,
+  SCT_MAX_COUNT: 256,
   // Certification-path length ceiling: bounds the per-cert asymmetric verify
   // work on an untrusted certificate bundle (a real chain is well under this;
   // the operator may override via opts.maxPathCerts).

package/lib/ct.js

@@ -0,0 +1,315 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * @module     pki.ct
+ * @nav        Transparency
+ * @title      CT
+ * @order      210
+ * @slug       ct
+ *
+ * @intro
+ *   Certificate Transparency SCT-list handling per RFC 6962. `parseSctList`
+ *   decodes the `SignedCertificateTimestampList` an X.509 certificate (or an
+ *   OCSP response) carries in the SCT extension into its individual signed
+ *   certificate timestamps.
+ *
+ *   The SCT payload is encoded in the TLS presentation language (RFC 8446 §3 /
+ *   RFC 5246 §4 conventions) — positional, tag-less, fixed-width big-endian
+ *   integers and length-prefixed opaque vectors — NOT ASN.1/DER. So this module
+ *   owns a bounded big-endian TLS-struct reader rather than composing the DER
+ *   schema engine; the only ASN.1 surface is the §3.3 double wrap (the
+ *   extension value is a DER OCTET STRING whose content is another DER OCTET
+ *   STRING whose content is the TLS list — the certificate/OCSP layer peels the
+ *   outer, this module peels the inner).
+ *
+ *   Structure is decoded, crypto is surfaced RAW: each SCT surfaces its `logId`
+ *   (32 raw bytes — SHA-256 of the log's SPKI, never recomputed), the exact
+ *   `timestamp` as a BigInt, the raw `extensions`, the named-but-not-interpreted
+ *   `hashAlg`/`sigAlg` code points, and the raw `signature`. The parser NEVER
+ *   verifies a signature, recomputes a LogID, or trusts a log — a verifier
+ *   composes `webcrypto` over `reconstructSignedData(...)`, the exact
+ *   `digitally-signed` preimage. DER-only carrier, fail-closed.
+ *
+ * @card
+ *   Parse RFC 6962 Certificate Transparency SCT lists from a certificate or OCSP
+ *   extension — per-SCT logId / timestamp (BigInt) / algorithm / raw signature,
+ *   the signed-preimage reconstruction surfaced for external verification,
+ *   bounded TLS-struct decode, fail-closed.
+ */
+
+var asn1 = require("./asn1-der.js");
+var constants = require("./constants.js");
+var frameworkError = require("./framework-error.js");
+
+var CtError = frameworkError.CtError;
+var C = constants;
+
+// RFC 5246 §7.4.1.4.1 code points — 1-byte, NOT OIDs. Surfaced named; an
+// unknown code surfaces as its numeric byte with a null name (never rejected —
+// off-profile-pair rejection is a verifier-tier log-conformance concern).
+var HASH_ALGORITHMS = {
+  0: "none", 1: "md5", 2: "sha1", 3: "sha224", 4: "sha256", 5: "sha384", 6: "sha512",
+};
+var SIGNATURE_ALGORITHMS = { 0: "anonymous", 1: "rsa", 2: "dsa", 3: "ecdsa" };
+
+// A minimum viable v1 SCT body: version(1) + LogID(32) + timestamp(8) +
+// empty-extensions(2) + digitally-signed{ hash(1) + sig(1) + empty-sig(2) } = 47.
+var SCT_MIN_BODY = 47;
+var LOGID_BYTES = 32;
+var MAX_SAFE = 9007199254740991n;   // 2^53 - 1; above this a Number loses precision
+
+// ---- TlsReader — the one net-new primitive (an ENCODING layer, not a schema
+// combinator): a bounded big-endian TLS-vector cursor with a hard [pos, end).
+// A lying inner length can overrun only the current sub-reader's `end`, never
+// the parent buffer, so bounds-before-slice is structural.
+function TlsReader(buf, start, end) { this.buf = buf; this.pos = start; this.end = end; }
+TlsReader.prototype._need = function (n, code) {
+  if (this.pos + n > this.end) {
+    throw new CtError(code || "ct/truncated", "need " + n + " byte(s), only " + (this.end - this.pos) + " remain");
+  }
+};
+TlsReader.prototype.u8 = function (code) { this._need(1, code); return this.buf[this.pos++]; };
+TlsReader.prototype.u16 = function (code) { this._need(2, code); var v = this.buf.readUInt16BE(this.pos); this.pos += 2; return v; };
+TlsReader.prototype.u24 = function (code) {
+  this._need(3, code);
+  var v = (this.buf[this.pos] << 16) | (this.buf[this.pos + 1] << 8) | this.buf[this.pos + 2];
+  this.pos += 3; return v;
+};
+TlsReader.prototype.u64 = function (code) { this._need(8, code); var v = this.buf.readBigUInt64BE(this.pos); this.pos += 8; return v; };
+TlsReader.prototype.fixed = function (n, code) {
+  this._need(n, code);
+  var s = this.buf.subarray(this.pos, this.pos + n); this.pos += n; return s;
+};
+// opaque<min..max> — a length-prefixed vector (lenWidth-byte big-endian prefix).
+// The length prefix itself is a plain read (a truncation there is ct/truncated);
+// only a LYING length whose body overruns the bound carries the field's own code.
+TlsReader.prototype.vector = function (lenWidth, min, max, code) {
+  var len = lenWidth === 3 ? this.u24() : this.u16();
+  if (len < min) throw new CtError(code, "vector length " + len + " below minimum " + min);
+  if (max != null && len > max) throw new CtError(code, "vector length " + len + " above maximum " + max);
+  this._need(len, code);
+  var s = this.buf.subarray(this.pos, this.pos + len); this.pos += len; return s;
+};
+TlsReader.prototype.subReader = function (len, code) {
+  this._need(len, code);
+  var r = new TlsReader(this.buf, this.pos, this.pos + len); this.pos += len; return r;
+};
+TlsReader.prototype.remaining = function () { return this.end - this.pos; };
+TlsReader.prototype.atEnd = function () { return this.pos === this.end; };
+
+// Peel the RFC 6962 §3.3 inner DER OCTET STRING (the certificate/OCSP layer
+// already peeled the outer extnValue OCTET STRING). Rides the strict codec, so
+// an indefinite length / constructed OCTET STRING / trailing bytes / single
+// wrap all fail closed here; the asn1/* fault attaches as `.cause`.
+function _peelInner(extValue) {
+  var node;
+  try { node = asn1.decode(extValue); }
+  catch (e) { throw new CtError("ct/bad-der", "the SCT-list extension value is not valid DER (RFC 6962 §3.3)", e); }
+  try { return asn1.read.octetString(node); }
+  catch (e) { throw new CtError("ct/bad-der", "the SCT-list extension value must be a DER OCTET STRING wrapping the TLS list (RFC 6962 §3.3)", e); }
+}
+
+function _toBuffer(v, field) {
+  if (Buffer.isBuffer(v)) return v;
+  if (v instanceof Uint8Array) return Buffer.from(v);
+  throw new CtError("ct/bad-input", field + " must be a Buffer or Uint8Array");
+}
+
+// Parse one SerializedSCT body inside a sub-reader bounded to the element (so a
+// lying extensions/signature length overruns the element, never the list). A
+// version this parser does not define is preserved OPAQUE, not rejected: RFC 6962
+// §3.3 gives every SerializedSCT its own length prefix precisely so a client "can
+// still parse old SCTs while skipping over new SCTs whose versions they don't
+// understand" — so an unknown version yields { unknown, version, rawSct } and the
+// v1-specific field decode (and the 47-byte floor) is skipped.
+function _parseSct(r, sctLen) {
+  var bodyStart = r.pos;
+  var version = r.u8();   // sctLen >= 1 is guaranteed by the SerializedSCT<1..> check
+  if (version !== 0) {
+    return { unknown: true, version: version, rawSct: r.buf.subarray(bodyStart, r.end) };
+  }
+  if (sctLen < SCT_MIN_BODY) {
+    throw new CtError("ct/sct-too-short", "a v1 SCT body is at least " + SCT_MIN_BODY + " bytes, got " + sctLen + " (RFC 6962 §3.2)");
+  }
+  var logId = r.fixed(LOGID_BYTES);
+  var timestamp = r.u64();
+  var extensions = r.vector(2, 0, null, "ct/ext-overrun");
+  var hashAlg = r.u8();
+  var sigAlg = r.u8();
+  var signature = r.vector(2, 0, null, "ct/sig-overrun");
+  if (!r.atEnd()) {
+    throw new CtError("ct/sct-trailing-bytes", (r.end - r.pos) + " byte(s) left in a SerializedSCT after the signature (RFC 6962 §3.3)");
+  }
+  var timestampMs = timestamp <= MAX_SAFE ? Number(timestamp) : null;
+  return {
+    version: 0,
+    logId: logId, logIdHex: logId.toString("hex"),
+    timestamp: timestamp,
+    timestampMs: timestampMs,
+    timestampDate: new Date(timestampMs != null ? timestampMs : Number(timestamp)),
+    extensions: extensions,
+    hashAlg: hashAlg, sigAlg: sigAlg,
+    signatureAlgorithm: {
+      hash: hashAlg, hashName: HASH_ALGORITHMS[hashAlg] || null,
+      signature: sigAlg, signatureName: SIGNATURE_ALGORITHMS[sigAlg] || null,
+    },
+    signature: signature,
+    rawSct: r.buf.subarray(bodyStart, r.end),
+  };
+}
+
+/**
+ * @primitive  pki.ct.parseSctList
+ * @signature  pki.ct.parseSctList(extValue) -> { scts, unknownScts }
+ * @since      0.1.20
+ * @status     experimental
+ * @spec       RFC 6962, RFC 5246, RFC 8446
+ * @related    pki.ct.reconstructSignedData, pki.schema.x509.parse
+ *
+ * Parse the value of an RFC 6962 SCT-list extension (the raw `extnValue`
+ * content an `x509.parse` / OCSP extension already surfaces) into
+ * `{ scts, unknownScts }`. Each entry of `scts` is a fully decoded v1 SCT:
+ * `version` (0), `logId` (32-byte Buffer) + `logIdHex`, `timestamp` (BigInt,
+ * exact) + `timestampMs` (Number or `null` above 2^53) + `timestampDate`,
+ * `extensions` (raw Buffer), `hashAlg` / `sigAlg` (1-byte code points) + a named
+ * `signatureAlgorithm`, the raw `signature` Buffer, and `rawSct` (the full
+ * SerializedSCT body). A SerializedSCT whose version this parser does not define
+ * is preserved OPAQUE in `unknownScts` as `{ version, rawSct }` rather than
+ * failing the list — RFC 6962 §3.3 frames each SerializedSCT with its own length
+ * so unknown versions are skippable (forward compatibility).
+ *
+ * The extension value is a DER `OCTET STRING` wrapping the TLS-encoded list
+ * (RFC 6962 §3.3 double wrap); everything below that peel is TLS presentation
+ * language, decoded with a bounded cursor. Structure is decoded, crypto is
+ * surfaced RAW — the signature is never verified and the LogID never recomputed.
+ *
+ * Throws `CtError` with a stable `ct/*` code on any malformed input (a bad inner
+ * DER wrap is `ct/bad-der` with the `asn1/*` fault as `.cause`), never a raw
+ * `TypeError`.
+ *
+ * @example
+ *   var cert = pki.schema.x509.parse(pem);
+ *   var sctOid = pki.oid.byName("signedCertificateTimestampList");
+ *   var ext = (cert.extensions || []).find(function (e) { return e.oid === sctOid; });
+ *   if (ext) {
+ *     var list = pki.ct.parseSctList(ext.value);
+ *     list.scts[0].logIdHex;      // the log's key id
+ *     list.scts[0].timestamp;     // exact BigInt ms since epoch
+ *   }
+ */
+function parseSctList(extValue) {
+  if (!Buffer.isBuffer(extValue) && !(extValue instanceof Uint8Array)) {
+    throw new CtError("ct/bad-input", "parseSctList expects the SCT-list extension value as a Buffer or Uint8Array");
+  }
+  var blob = _peelInner(Buffer.isBuffer(extValue) ? extValue : Buffer.from(extValue));
+  if (blob.length > C.LIMITS.SCT_MAX_BYTES) {
+    throw new CtError("ct/too-large", "SCT list " + blob.length + " bytes exceeds the cap " + C.LIMITS.SCT_MAX_BYTES);
+  }
+  var outer = new TlsReader(blob, 0, blob.length);
+  var listLen = outer.u16("ct/bad-list");
+  if (listLen + 2 !== blob.length) {
+    throw new CtError("ct/bad-list", "the SCT list declared length " + listLen + " does not match the " + (blob.length - 2) + " byte(s) present (RFC 6962 §3.3)");
+  }
+  if (listLen < 1) {
+    throw new CtError("ct/empty-list", "an SCT list must contain at least one SCT (RFC 6962 §3.3)");
+  }
+  var scts = [], unknownScts = [];
+  while (!outer.atEnd()) {
+    if (outer.remaining() < 2) {
+      throw new CtError("ct/list-trailing-bytes", "a dangling partial element after the last complete SCT (RFC 6962 §3.3)");
+    }
+    var sctLen = outer.u16("ct/list-trailing-bytes");
+    if (sctLen < 1) {
+      throw new CtError("ct/sct-empty", "a SerializedSCT must be non-empty (RFC 6962 §3.3)");
+    }
+    if (outer.remaining() < sctLen) {
+      throw new CtError("ct/list-trailing-bytes", "a SerializedSCT length " + sctLen + " overruns the list (RFC 6962 §3.3)");
+    }
+    var one = _parseSct(outer.subReader(sctLen, "ct/list-trailing-bytes"), sctLen);
+    if (one.unknown) unknownScts.push({ version: one.version, rawSct: one.rawSct });
+    else scts.push(one);
+    // The cap bounds the TOTAL element count (known + preserved-unknown) before it
+    // can drive unbounded per-element work.
+    if (scts.length + unknownScts.length > C.LIMITS.SCT_MAX_COUNT) {
+      throw new CtError("ct/too-many-scts", "SCT count exceeds the cap " + C.LIMITS.SCT_MAX_COUNT);
+    }
+  }
+  return { scts: scts, unknownScts: unknownScts };
+}
+
+function _u24Bytes(n) {
+  if (n < 1 || n > 0xffffff) {
+    throw new CtError("ct/bad-tbs-length", "a certificate / TBSCertificate length must be in 1..2^24-1, got " + n + " (RFC 6962 §3.1)");
+  }
+  return Buffer.from([(n >> 16) & 0xff, (n >> 8) & 0xff, n & 0xff]);
+}
+
+/**
+ * @primitive  pki.ct.reconstructSignedData
+ * @signature  pki.ct.reconstructSignedData(entry, sct) -> Buffer
+ * @since      0.1.20
+ * @status     experimental
+ * @spec       RFC 6962
+ * @related    pki.ct.parseSctList
+ *
+ * Rebuild the exact `digitally-signed` preimage bytes an external verifier
+ * hashes to check an SCT's signature (RFC 6962 §3.2), for a parsed `sct`.
+ * `entry` selects the log-entry arm:
+ *   - `{ entryType: 0, leafCert: <DER Buffer> }` — an SCT delivered over TLS /
+ *     OCSP, signed over `x509_entry(0)` with the leaf certificate.
+ *   - `{ entryType: 1, tbsCertificate: <DER Buffer>, issuerKeyHash: <32B> }` —
+ *     an SCT EMBEDDED in a certificate, signed over `precert_entry(1)` with the
+ *     issuer key hash + the precertificate TBS (the TBS with only the SCT
+ *     extension removed). `issuerKeyHash` is SHA-256 of the issuer's SPKI DER.
+ *
+ * The preimage reuses the parsed SCT's raw `extensions` byte-for-byte and
+ * re-emits the fixed-width scalars canonically. This never verifies anything —
+ * a verifier hashes the returned bytes and checks the signature with the log's
+ * public key (compose `webcrypto`). Throws `CtError` (`ct/bad-entry-type`,
+ * `ct/bad-issuer-key-hash`, `ct/bad-tbs-length`) on a malformed entry.
+ *
+ * @example
+ *   var sct = pki.ct.parseSctList(sctExtValue).scts[0];
+ *   var preimage = pki.ct.reconstructSignedData({ entryType: 0, leafCert: der }, sct);
+ *   // hash `preimage` + verify against the log's public key at the verify layer
+ */
+function reconstructSignedData(entry, sct) {
+  entry = entry || {};
+  var entryType = entry.entryType;
+  if (entryType !== 0 && entryType !== 1) {
+    throw new CtError("ct/bad-entry-type", "entryType must be x509_entry(0) or precert_entry(1), got " + entryType + " (RFC 6962 §3.1)");
+  }
+  // A fully decoded v1 SCT (from parseSctList().scts[]) — not an opaque
+  // unknownScts entry, whose body layout is undefined and cannot be signed over.
+  if (!sct || typeof sct.timestamp !== "bigint" || sct.version !== 0) {
+    throw new CtError("ct/bad-input", "reconstructSignedData expects a decoded v1 SCT from parseSctList().scts[]");
+  }
+  var parts = [];
+  parts.push(Buffer.from([sct.version & 0xff]));                          // Version — v1(0)
+  parts.push(Buffer.from([0]));                                          // SignatureType — certificate_timestamp(0)
+  var ts = Buffer.alloc(8); ts.writeBigUInt64BE(BigInt(sct.timestamp)); parts.push(ts);   // uint64 timestamp
+  parts.push(Buffer.from([(entryType >> 8) & 0xff, entryType & 0xff]));  // LogEntryType (2 bytes BE)
+  if (entryType === 0) {
+    var cert = _toBuffer(entry.leafCert, "leafCert");
+    parts.push(_u24Bytes(cert.length)); parts.push(cert);                // ASN.1Cert<1..2^24-1>
+  } else {
+    var ikh = _toBuffer(entry.issuerKeyHash, "issuerKeyHash");
+    if (ikh.length !== 32) {
+      throw new CtError("ct/bad-issuer-key-hash", "issuer_key_hash must be exactly 32 bytes (SHA-256 of the issuer SPKI), got " + ikh.length + " (RFC 6962 §3.2)");
+    }
+    var tbs = _toBuffer(entry.tbsCertificate, "tbsCertificate");
+    parts.push(ikh);
+    parts.push(_u24Bytes(tbs.length)); parts.push(tbs);                  // PreCert.tbs_certificate<1..2^24-1>
+  }
+  var ext = _toBuffer(sct.extensions, "sct.extensions");                 // reuse the parsed raw bytes, never re-encode
+  parts.push(Buffer.from([(ext.length >> 8) & 0xff, ext.length & 0xff])); parts.push(ext);   // CtExtensions
+  return Buffer.concat(parts);
+}
+
+module.exports = {
+  parseSctList: parseSctList,
+  reconstructSignedData: reconstructSignedData,
+  HASH_ALGORITHMS: HASH_ALGORITHMS,
+  SIGNATURE_ALGORITHMS: SIGNATURE_ALGORITHMS,
+};

package/lib/framework-error.js

@@ -166,6 +166,12 @@ var CrmfError = defineClass("CrmfError", { withCause: true });
 // the underlying leaf fault as `.cause`.
 var Pkcs12Error = defineClass("Pkcs12Error", { withCause: true });
 
+// CmpError — a byte sequence that is not a well-formed RFC 9810 PKIMessage
+// (PKIHeader / PKIBody / protection / extraCerts), or one violating a §5
+// coherence rule (protection⇔protectionAlg, certConf-hashAlg⇔pvno). Carries
+// the underlying leaf fault as `.cause`.
+var CmpError = defineClass("CmpError", { withCause: true });
+
 // PathError — a certification path that fails RFC 5280 §6 validation, or a
 // malformed input handed to the validator (an extension value that does not
 // decode, an empty path, an unsupported signature algorithm). Carries the
@@ -173,6 +179,15 @@ var Pkcs12Error = defineClass("Pkcs12Error", { withCause: true });
 // `.cause`.
 var PathError = defineClass("PathError", { withCause: true });
 
+// CtError — a byte sequence that is not a well-formed RFC 6962 Certificate
+// Transparency SCT list: a malformed inner DER OCTET-STRING wrap, or a TLS
+// presentation-language framing violation (a lying vector length, a field read
+// past its bound, a truncated element). An SCT whose version this parser does
+// not define is NOT an error — RFC 6962 §3.3 makes unknown versions skippable,
+// so they are preserved opaque. Carries the underlying leaf fault (e.g. the
+// inner `asn1/*` decode error) as `.cause`.
+var CtError = defineClass("CtError", { withCause: true });
+
 module.exports = {
   PkiError:         PkiError,
   defineClass:      defineClass,
@@ -191,5 +206,7 @@ module.exports = {
   AttrCertError:    AttrCertError,
   CrmfError:        CrmfError,
   Pkcs12Error:      Pkcs12Error,
+  CmpError:         CmpError,
   PathError:        PathError,
+  CtError:          CtError,
 };

package/lib/oid.js

@@ -116,6 +116,15 @@ var FAMILIES = {
   pkixKp: { base: [1, 3, 6, 1, 5, 5, 7, 3], of: {
     serverAuth: 1, clientAuth: 2, codeSigning: 3, emailProtection: 4, timeStamping: 8, ocspSigning: 9 } },
 
+  // Google Certificate Transparency (RFC 6962) on the 1.3.6.1.4.1.11129.2.4 arc:
+  // the SCT-list X.509 extension (§3.3), the precertificate poison (§3.1), the
+  // precert-signing EKU (§3.1, naming only), and the OCSP-delivered SCT list
+  // (§3.3). The SCT payload itself is TLS presentation language, not DER — it is
+  // parsed by lib/ct.js (pki.ct), never routed through the DER schema engine.
+  ct: { base: [1, 3, 6, 1, 4, 1, 11129, 2, 4], of: {
+    signedCertificateTimestampList: 2, precertificatePoison: 3,
+    precertificateSigningCert: 4, ocspSignedCertificateTimestampList: 5 } },
+
   // PKCS#1 RSA public-key + RSASSA signature algorithms.
   rsa: { base: [1, 2, 840, 113549, 1, 1], of: {
     rsaEncryption: 1, rsaesOaep: 7, mgf1: 8, rsassaPss: 10,
@@ -141,6 +150,21 @@ var FAMILIES = {
   // PKCS#5 password-based schemes (RFC 8018) + the PBMAC1 MacData arm (RFC 9579).
   pkcs5: { base: [1, 2, 840, 113549, 1, 5], of: { pbkdf2: 12, pbes2: 13, pbmac1: 14 } },
 
+  // CMP InfoTypeAndValue types — id-it under id-pkix (RFC 9810 §5.3.19; the
+  // PKIXCMP-2023 module assigns these leaves, 8/9 unassigned).
+  idIt: { base: [1, 3, 6, 1, 5, 5, 7, 4], of: {
+    caProtEncCert: 1, signKeyPairTypes: 2, encKeyPairTypes: 3, preferredSymmAlg: 4,
+    caKeyUpdateInfo: 5, currentCRL: 6, unsupportedOIDs: 7, keyPairParamReq: 10,
+    keyPairParamRep: 11, revPassphrase: 12, implicitConfirm: 13, confirmWaitTime: 14,
+    origPKIMessage: 15, suppLangTags: 16, caCerts: 17, rootCaKeyUpdate: 18,
+    certReqTemplate: 19, rootCaCert: 20, certProfile: 21, crlStatusList: 22,
+    crls: 23, kemCiphertextInfo: 24 } },
+
+  // CMP message-protection MAC algorithms on the Entrust arc (RFC 9810
+  // §5.1.3.1/.2/.4; RFC 9481 §6.1.1).
+  entrustAlg: { base: [1, 2, 840, 113533, 7, 66], of: {
+    passwordBasedMac: 13, kemBasedMac: 16, dhBasedMac: 30 } },
+
   // PKCS#12 bag types (RFC 7292 §4.2, Appendix D).
   pkcs12BagTypes: { base: [1, 2, 840, 113549, 1, 12, 10, 1], of: {
     keyBag: 1, pkcs8ShroudedKeyBag: 2, certBag: 3, crlBag: 4, secretBag: 5, safeContentsBag: 6 } },

package/lib/path-validate.js

@@ -144,6 +144,10 @@ function hashAlgOid(seq) {
   if (seq.children.length === 2) {
     var p = seq.children[1];
     if (p.tagClass !== "universal" || p.tagNumber !== asn1.TAGS.NULL) throw E("path/unsupported-algorithm", "hash AlgorithmIdentifier parameters must be NULL or absent (RFC 4055)");
+    // A NULL is well-formed only with empty content (X.690 §8.8.2); the tag check
+    // alone would accept a non-empty NULL as valid parameters.
+    try { asn1.read.nullValue(p); }
+    catch (e) { throw E("path/unsupported-algorithm", "hash AlgorithmIdentifier NULL parameters must have empty content (RFC 4055)", e); }
   }
   return o;
 }

package/lib/schema-all.js

@@ -41,6 +41,7 @@ var cms = require("./schema-cms");
 var ocsp = require("./schema-ocsp");
 var tsp = require("./schema-tsp");
 var crmf = require("./schema-crmf");
+var cmp = require("./schema-cmp");
 var attrcert = require("./schema-attrcert");
 var frameworkError = require("./framework-error");
 
@@ -101,12 +102,28 @@ var FORMATS = [
     detect: crmf.matches,
     parse: function (input) { return crmf.parse(input); },
   },
+  {
+    // PKIMessage ::= SEQUENCE { header PKIHeader, body PKIBody [0..26],
+    // protection [0]?, extraCerts [1]? } (RFC 9810 §5.1) — a SEQUENCE of 2-4
+    // whose first child is a >=3-child SEQUENCE leading with a bare INTEGER
+    // (pvno) and whose second child is context-constructed [0..26]. ORDER IS
+    // LOAD-BEARING here: a 2-child PKIMessage whose body is ir [0] also
+    // satisfies the shallow ocsp-request probe below (k[0] SEQUENCE +
+    // k[1] context-[0]), while no OCSPRequest satisfies this detector (its
+    // tbsRequest never leads with a bare INTEGER) — so cmp MUST sit ahead of
+    // ocsp-request for the pair to dispatch deterministically.
+    name: "cmp",
+    module: cmp,
+    detect: cmp.matches,
+    parse: function (input) { return cmp.parse(input); },
+  },
   {
     // OCSPRequest ::= SEQUENCE { tbsRequest SEQUENCE, optionalSignature [0] EXPLICIT
     // OPTIONAL } — a SEQUENCE of 1-2 whose first child is the tbsRequest SEQUENCE.
     // Leads with a SEQUENCE like the signed-envelope trio, but is excluded by arity
     // (the trio is EXACTLY 3 children; an OCSPRequest is 1-2). Checked AFTER tsp,
-    // whose detector is a strict refinement (RFC 6960 §4.1.1).
+    // whose detector is a strict refinement (RFC 6960 §4.1.1), and AFTER cmp,
+    // whose 2-child ir-body shape this probe would otherwise shadow.
     name: "ocsp-request",
     module: ocsp,
     detect: ocsp.matchesRequest,
@@ -211,7 +228,7 @@ var FORMATS = [
  * The names of every registered format, in detection order.
  *
  * @example
- *   pki.schema.all();  // → ["cms", "tsp", "crmf", "ocsp-request", "ocsp-response", "pkcs12", "pkcs8", "csr", "attrcert", "attrcert-v1", "crl", "x509"]
+ *   pki.schema.all();  // → ["cms", "tsp", "crmf", "cmp", "ocsp-request", "ocsp-response", "pkcs12", "pkcs8", "csr", "attrcert", "attrcert-v1", "crl", "x509"]
  */
 function all() { return FORMATS.map(function (f) { return f.name; }); }
 
@@ -258,6 +275,7 @@ module.exports = {
   ocsp: { parseRequest: ocsp.parseRequest, parseResponse: ocsp.parseResponse, pemDecode: ocsp.pemDecode },
   tsp: { parse: tsp.parse, parseTstInfo: tsp.parseTstInfo, parseToken: tsp.parseToken, pemDecode: tsp.pemDecode },
   crmf: { parse: crmf.parse, pemDecode: crmf.pemDecode },
+  cmp: { parse: cmp.parse, pemDecode: cmp.pemDecode, pemEncode: cmp.pemEncode },
   attrcert: { parse: attrcert.parse, pemDecode: attrcert.pemDecode },
   all: all,
   parse: parse,

package/lib/schema-attrcert.js

@@ -353,11 +353,11 @@ function matches(root) {
   if (!acinfo) return false;
   var k = acinfo.children;
   if (!k || k.length < 7) return false;
-  if (!(k[0].tagClass === "universal" && k[0].tagNumber === TAGS.INTEGER)) return false;
-  if (!(k[1].tagClass === "universal" && k[1].tagNumber === TAGS.SEQUENCE && k[1].children)) return false;
+  if (!schema.isUniversal(k[0], TAGS.INTEGER)) return false;
+  if (!(schema.isUniversal(k[1], TAGS.SEQUENCE) && k[1].children)) return false;
   var v = k[5];
-  if (!(v && v.tagClass === "universal" && v.tagNumber === TAGS.SEQUENCE && v.children && v.children.length === 2)) return false;
-  return v.children.every(function (t) { return t.tagClass === "universal" && t.tagNumber === TAGS.GENERALIZED_TIME; });
+  if (!(schema.isUniversal(v, TAGS.SEQUENCE) && v.children && v.children.length === 2)) return false;
+  return v.children.every(function (t) { return schema.isUniversal(t, TAGS.GENERALIZED_TIME); });
 }
 
 // matchesV1(root): the obsolete AttributeCertificateV1 — its acInfo (version DEFAULT
@@ -370,8 +370,8 @@ function matchesV1(root) {
   if (!acinfo) return false;
   var k = acinfo.children;
   if (!k || k.length < 6) return false;
-  if (!(k[0].tagClass === "context" && (k[0].tagNumber === 0 || k[0].tagNumber === 1) && k[0].children)) return false;
-  return !!k[1] && k[1].tagClass === "universal" && k[1].tagNumber === TAGS.SEQUENCE;
+  if (!(schema.isContextOneOf(k[0], [0, 1]) && k[0].children)) return false;
+  return schema.isUniversal(k[1], TAGS.SEQUENCE);
 }
 
 module.exports = {