@blamejs/pki 0.1.21 → 0.1.23

package/lib/schema-ocsp.js

@@ -9,8 +9,8 @@
  * @slug       ocsp
  *
  * @intro
- *   OCSP request and response handling per RFC 6960 (§4.1 OCSPRequest, §4.2
- *   OCSPResponse). Two entry points — `parseRequest` and `parseResponse` — turn a
+ *   OCSP request and response handling per RFC 6960 (sec. 4.1 OCSPRequest, sec. 4.2
+ *   OCSPResponse). Two entry points -- `parseRequest` and `parseResponse` -- turn a
  *   DER or PEM message into a structured object. A response is a two-stage
  *   OID-dispatch: `OCSPResponse` carries an ENUMERATED `responseStatus` and an
  *   OPTIONAL `responseBytes`; when the `responseType` is `id-pkix-ocsp-basic` its
@@ -23,11 +23,13 @@
  *   `issuerNameHash` / `issuerKeyHash` as raw octets, and the responder's `byKey`
  *   hash and the raw `signature` bytes are left for the caller to verify. Embedded
  *   certificates are surfaced as raw DER, so an unknown alternative never fails the
- *   parse. DER-only, fail-closed.
+ *   parse. The nonce extension's value syntax is validated (OCTET STRING of 1..128
+ *   octets, RFC 9654 sec. 2.1) with the decoded bytes surfaced as `nonce` alongside the
+ *   raw value; other extension values stay opaque. DER-only, fail-closed.
  *
  * @card
  *   Parse DER / PEM OCSP requests and responses (RFC 6960) into structured,
- *   validated fields — per-certificate status, responder identity, raw tbs bytes for
+ *   validated fields -- per-certificate status, responder identity, raw tbs bytes for
  *   external verification, certificates kept raw, fail-closed.
  */
 
@@ -56,31 +58,32 @@ var VERSION = pkix.versionReader(NS, {});
 // other is recognized-and-deferred. Resolved from the registry, never a literal.
 var OID_OCSP_BASIC = oid.byName("ocspBasic");
 
-// OCSPResponseStatus ::= ENUMERATED — value 4 is "not used" and >= 7 is undefined,
-// so both are rejected (RFC 6960 §4.2.1).
+// id-pkix-ocsp-nonce -- the request/response binding extension whose value syntax
+// RFC 9654 sec. 2.1 (updating RFC 6960 sec. 4.4.1) fixes to OCTET STRING (SIZE(1..128)).
+var OID_OCSP_NONCE = oid.byName("ocspNonce");
+
+// OCSPResponseStatus ::= ENUMERATED -- value 4 is "not used" and >= 7 is undefined,
+// so both are rejected (RFC 6960 sec. 4.2.1).
 var STATUS_NAMES = { "0": "successful", "1": "malformedRequest", "2": "internalError", "3": "tryLater", "5": "sigRequired", "6": "unauthorized" };
 
-// CRLReason ::= ENUMERATED — value 7 is "not used"; the rest are RFC 5280 §5.3.1.
-var CRL_REASONS = { "0": "unspecified", "1": "keyCompromise", "2": "cACompromise", "3": "affiliationChanged", "4": "superseded", "5": "cessationOfOperation", "6": "certificateHold", "8": "removeFromCRL", "9": "privilegeWithdrawn", "10": "aACompromise" };
+// CRLReason ::= ENUMERATED -- value 7 is "not used"; the rest are RFC 5280
+// sec. 5.3.1. The legal set + names live once in pkix.CRL_REASON_NAMES (shared
+// with the CRL reasonCode decoder, which surfaces the numeric code).
+var CRL_REASONS = pkix.CRL_REASON_NAMES;
 
 // ---- shared leaves ---------------------------------------------------
 
 // A GeneralizedTime-only leaf. OCSP times (producedAt / thisUpdate / nextUpdate /
 // revocationTime) are GeneralizedTime, never UTCTime (RFC 6960); assert the tag
 // before the codec reads it so a UTCTime is rejected ocsp/bad-time.
-var GENERALIZED_TIME = schema.decode(function (n, ctx) {
-  if (n.tagClass !== "universal" || n.tagNumber !== asn1.TAGS.GENERALIZED_TIME) {
-    throw ctx.E("ocsp/bad-time", "OCSP time must be a GeneralizedTime (RFC 6960)");
-  }
-  return asn1.read.time(n);
-});
+var GENERALIZED_TIME = pkix.generalizedTime(NS, { code: "ocsp/bad-time", message: "OCSP time must be a GeneralizedTime (RFC 6960)" });
 
 // OCSPResponseStatus decode-and-whitelist leaf. read.enumerated is tag-checked, so
 // an INTEGER-encoded status is rejected at the leaf (asn1/unexpected-tag).
 var OCSP_RESPONSE_STATUS = schema.decode(function (n, ctx) {
   var v = asn1.read.enumerated(n);
   var key = v.toString();
-  if (!Object.prototype.hasOwnProperty.call(STATUS_NAMES, key)) throw ctx.E("ocsp/bad-response-status", "undefined OCSPResponseStatus " + key + " (RFC 6960 §4.2.1)");
+  if (!Object.prototype.hasOwnProperty.call(STATUS_NAMES, key)) throw ctx.E("ocsp/bad-response-status", "undefined OCSPResponseStatus " + key + " (RFC 6960 sec. 4.2.1)");
   return { code: Number(v), name: STATUS_NAMES[key] };
 });
 
@@ -88,25 +91,20 @@ var OCSP_RESPONSE_STATUS = schema.decode(function (n, ctx) {
 var CRL_REASON = schema.decode(function (n, ctx) {
   var v = asn1.read.enumerated(n);
   var key = v.toString();
-  if (!Object.prototype.hasOwnProperty.call(CRL_REASONS, key)) throw ctx.E("ocsp/bad-revocation-reason", "undefined CRLReason " + key + " (RFC 5280 §5.3.1)");
+  if (!Object.prototype.hasOwnProperty.call(CRL_REASONS, key)) throw ctx.E("ocsp/bad-revocation-reason", "undefined CRLReason " + key + " (RFC 5280 sec. 5.3.1)");
   return CRL_REASONS[key];
 });
 
 // A certs [0] SEQUENCE OF Certificate element. Unlike the CMS CertificateChoices
-// (a tagged CHOICE), an OCSP certs element is a plain Certificate — a universal
-// SEQUENCE (RFC 5280 §4.1) — so assert that shape before surfacing its raw DER, and
+// (a tagged CHOICE), an OCSP certs element is a plain Certificate -- a universal
+// SEQUENCE (RFC 5280 sec. 4.1) -- so assert that shape before surfacing its raw DER, and
 // reject a non-SEQUENCE element rather than reporting arbitrary bytes as a cert.
 function certificateBytes() {
-  return schema.decode(function (n, ctx) {
-    if (n.tagClass !== "universal" || n.tagNumber !== asn1.TAGS.SEQUENCE || !n.children) {
-      throw ctx.E("ocsp/bad-certs", "each certs element must be a Certificate (a SEQUENCE) (RFC 6960 §4.1.1/§4.2.1)");
-    }
-    return n.bytes;
-  });
+  return pkix.rawNonEmptySequence(NS, { code: "ocsp/bad-certs", message: "each certs element must be a non-empty Certificate SEQUENCE (RFC 6960 sec. 4.1.1/sec. 4.2.1)" });
 }
 
-// requestorName [1] EXPLICIT GeneralName (RFC 6960 §4.1.1) — validated + surfaced raw
-// via the shared pkix.generalName primitive (RFC 5280 §4.2.1.6), so a malformed
+// requestorName [1] EXPLICIT GeneralName (RFC 6960 sec. 4.1.1) -- validated + surfaced raw
+// via the shared pkix.generalName primitive (RFC 5280 sec. 4.2.1.6), so a malformed
 // GeneralName fails closed and the OCSP + TSP parsers cannot drift on this grammar.
 var GENERAL_NAME_RAW = pkix.generalName(NS, { code: "ocsp/bad-requestor-name" });
 
@@ -119,15 +117,43 @@ function _rawSignature(field) {
   return sig.bytes;
 }
 
-// certs [0] EXPLICIT SEQUENCE OF Certificate — each element raw. Shared by the
+// certs [0] EXPLICIT SEQUENCE OF Certificate -- each element raw. Shared by the
 // request Signature and the BasicOCSPResponse.
 var CERTS = schema.seqOf(certificateBytes(), { assert: "sequence", code: "ocsp/bad-certs", what: "certs" });
 
+// Validate the OCSP protocol extension values in a decoded extension list --
+// applied to every extension surface (request / single-request / response /
+// single-response) so a hostile placement cannot dodge the syntax rule. The
+// nonce is the one extension whose value the module names: Nonce ::= OCTET
+// STRING (SIZE(1..128)) (RFC 9654 sec. 2.1, updating RFC 6960 sec. 4.4.1 -- the 128
+// upper bound is the RFC 9654 responder rule; RFC 8954's was 32). The decoded
+// nonce bytes are surfaced on the extension as `nonce` alongside the raw value;
+// other extension values stay opaque (an unknown extension is representable,
+// not a fault).
+function _validateOcspExtensions(list) {
+  if (!list) return list;
+  for (var i = 0; i < list.length; i++) {
+    var ext = list[i];
+    if (ext.oid !== OID_OCSP_NONCE) continue;
+    var node;
+    try { node = asn1.decode(ext.value); }
+    catch (e) { throw NS.E("ocsp/bad-nonce", "the nonce extension value did not decode: " + ((e && e.message) || String(e)), e); }
+    if (!(node.tagClass === "universal" && node.tagNumber === asn1.TAGS.OCTET_STRING && node.content)) {
+      throw NS.E("ocsp/bad-nonce", "the nonce extension value must be an OCTET STRING (RFC 9654 sec. 2.1)");
+    }
+    if (node.content.length < 1 || node.content.length > 128) {
+      throw NS.E("ocsp/bad-nonce", "the nonce must be 1..128 octets (RFC 9654 sec. 2.1)");
+    }
+    ext.nonce = node.content;
+  }
+  return list;
+}
+
 // ---- CertID (shared request + response) ------------------------------
 
 // CertID ::= SEQUENCE { hashAlgorithm AlgorithmIdentifier, issuerNameHash OCTET
 // STRING, issuerKeyHash OCTET STRING, serialNumber CertificateSerialNumber }
-// (RFC 6960 §4.1.1). The two hashes are surfaced raw for the caller to verify.
+// (RFC 6960 sec. 4.1.1). The two hashes are surfaced raw for the caller to verify.
 var CERT_ID = schema.seq([
   schema.field("hashAlgorithm", ALGORITHM_IDENTIFIER),
   schema.field("issuerNameHash", schema.octetString()),
@@ -149,7 +175,7 @@ var CERT_ID = schema.seq([
 // ---- response tree ---------------------------------------------------
 
 // RevokedInfo ::= SEQUENCE { revocationTime GeneralizedTime, revocationReason [0]
-// EXPLICIT CRLReason OPTIONAL } (RFC 6960 §4.2.1). Walked on the [1] IMPLICIT node,
+// EXPLICIT CRLReason OPTIONAL } (RFC 6960 sec. 4.2.1). Walked on the [1] IMPLICIT node,
 // so assert:"constructed" (the context tag replaced the universal SEQUENCE tag).
 var REVOKED_INFO = schema.seq([
   schema.field("revocationTime", GENERALIZED_TIME),
@@ -167,7 +193,7 @@ var REVOKED_INFO = schema.seq([
 });
 
 // CertStatus ::= CHOICE { good [0] IMPLICIT NULL, revoked [1] IMPLICIT RevokedInfo,
-// unknown [2] IMPLICIT NULL } (RFC 6960 §4.2.1). good/unknown are primitive empty
+// unknown [2] IMPLICIT NULL } (RFC 6960 sec. 4.2.1). good/unknown are primitive empty
 // context nodes; revoked is a constructed context [1] whose body is RevokedInfo.
 var CERT_STATUS = schema.choice([
   { when: { tagClass: "context", tagNumber: 0 }, schema: schema.implicitNull(0) },
@@ -185,7 +211,7 @@ function _shapeCertStatus(field) {
 
 // SingleResponse ::= SEQUENCE { certID, certStatus, thisUpdate GeneralizedTime,
 // nextUpdate [0] EXPLICIT GeneralizedTime OPTIONAL, singleExtensions [1] EXPLICIT
-// Extensions OPTIONAL } (RFC 6960 §4.2.1). certStatus is consumed positionally
+// Extensions OPTIONAL } (RFC 6960 sec. 4.2.1). certStatus is consumed positionally
 // (before thisUpdate), so its context [0] good arm cannot be confused with the
 // trailing nextUpdate [0].
 var SINGLE_RESPONSE = schema.seq([
@@ -204,12 +230,12 @@ var SINGLE_RESPONSE = schema.seq([
       certStatus: _shapeCertStatus(m.fields.certStatus),
       thisUpdate: m.fields.thisUpdate.value,
       nextUpdate: m.fields.nextUpdate.present ? m.fields.nextUpdate.value : null,
-      singleExtensions: m.fields.singleExtensions.present ? m.fields.singleExtensions.value.result : null,
+      singleExtensions: m.fields.singleExtensions.present ? _validateOcspExtensions(m.fields.singleExtensions.value.result) : null,
     };
   },
 });
 
-// ResponderID ::= CHOICE { byName [1] Name, byKey [2] KeyHash } (RFC 6960 §4.2.1) —
+// ResponderID ::= CHOICE { byName [1] Name, byKey [2] KeyHash } (RFC 6960 sec. 4.2.1) --
 // both EXPLICIT (the module is EXPLICIT TAGS). byKey is an EXPLICIT-wrapped universal
 // OCTET STRING (0xA2 04 ...), NOT an IMPLICIT primitive [2].
 var RESPONDER_ID = schema.choice([
@@ -219,16 +245,16 @@ var RESPONDER_ID = schema.choice([
 
 function _shapeResponderID(field) {
   if (field.node.tagNumber === 1) return { byName: field.value.result };
-  // RFC 6960 §4.2.1 — KeyHash is the SHA-1 hash of the responder's public key, so a
+  // RFC 6960 sec. 4.2.1 -- KeyHash is the SHA-1 hash of the responder's public key, so a
   // conformant byKey ResponderID is exactly 20 octets; reject any other length.
   var keyHash = field.value;
-  if (keyHash.length !== 20) throw NS.E("ocsp/bad-responder-id", "ResponderID byKey (KeyHash) must be a 20-byte SHA-1 hash (RFC 6960 §4.2.1)");
+  if (keyHash.length !== 20) throw NS.E("ocsp/bad-responder-id", "ResponderID byKey (KeyHash) must be a 20-byte SHA-1 hash (RFC 6960 sec. 4.2.1)");
   return { byKey: keyHash };
 }
 
 // ResponseData ::= SEQUENCE { version [0] EXPLICIT DEFAULT v1, responderID,
 // producedAt GeneralizedTime, responses SEQUENCE OF SingleResponse,
-// responseExtensions [1] EXPLICIT Extensions OPTIONAL } (RFC 6960 §4.2.1).
+// responseExtensions [1] EXPLICIT Extensions OPTIONAL } (RFC 6960 sec. 4.2.1).
 var RESPONSE_DATA = schema.seq([
   schema.optional("version", VERSION, { tag: 0, explicit: true, default: 1, emptyCode: "ocsp/bad-version" }),
   schema.field("responderID", RESPONDER_ID),
@@ -245,15 +271,15 @@ var RESPONSE_DATA = schema.seq([
       responderID: _shapeResponderID(m.fields.responderID),
       producedAt: m.fields.producedAt.value,
       responses: m.fields.responses.value.items.map(function (it) { return it.value.result; }),
-      responseExtensions: m.fields.responseExtensions.present ? m.fields.responseExtensions.value.result : null,
+      responseExtensions: m.fields.responseExtensions.present ? _validateOcspExtensions(m.fields.responseExtensions.value.result) : null,
     };
   },
 });
 
 // BasicOCSPResponse ::= SEQUENCE { tbsResponseData ResponseData, signatureAlgorithm
 // AlgorithmIdentifier, signature BIT STRING, certs [0] EXPLICIT SEQUENCE OF
-// Certificate OPTIONAL } (RFC 6960 §4.2.1). tbsResponseData.node.bytes is the exact
-// signed region (no CMS-style re-tag divergence — the clean case).
+// Certificate OPTIONAL } (RFC 6960 sec. 4.2.1). tbsResponseData.node.bytes is the exact
+// signed region (no CMS-style re-tag divergence -- the clean case).
 var BASIC_OCSP_RESPONSE = schema.seq([
   schema.field("tbsResponseData", RESPONSE_DATA),
   schema.field("signatureAlgorithm", ALGORITHM_IDENTIFIER),
@@ -280,7 +306,7 @@ var BASIC_OCSP_RESPONSE = schema.seq([
 });
 
 // ResponseBytes ::= SEQUENCE { responseType OBJECT IDENTIFIER, response OCTET STRING }
-// (RFC 6960 §4.2.1). For id-pkix-ocsp-basic the response OCTET STRING content is a
+// (RFC 6960 sec. 4.2.1). For id-pkix-ocsp-basic the response OCTET STRING content is a
 // fresh DER BasicOCSPResponse (decoded + walked); an unknown responseType is
 // recognized-and-deferred with a precise ocsp/unsupported-response-type.
 var RESPONSE_BYTES = schema.seq([
@@ -292,7 +318,7 @@ var RESPONSE_BYTES = schema.seq([
     var responseType = m.fields.responseType.value;
     var raw = m.fields.response.value;
     if (responseType !== OID_OCSP_BASIC) {
-      throw NS.E("ocsp/unsupported-response-type", (ctx.oid.name(responseType) || responseType) + " is not id-pkix-ocsp-basic (RFC 6960 §4.2.1)");
+      throw NS.E("ocsp/unsupported-response-type", (ctx.oid.name(responseType) || responseType) + " is not id-pkix-ocsp-basic (RFC 6960 sec. 4.2.1)");
     }
     return {
       responseType: responseType,
@@ -305,9 +331,11 @@ var RESPONSE_BYTES = schema.seq([
 });
 
 // OCSPResponse ::= SEQUENCE { responseStatus OCSPResponseStatus, responseBytes [0]
-// EXPLICIT ResponseBytes OPTIONAL } (RFC 6960 §4.2.1). The status <-> responseBytes
+// EXPLICIT ResponseBytes OPTIONAL } (RFC 6960 sec. 4.2.1). The status <-> responseBytes
 // biconditional (successful iff responseBytes present) is the OCSP-specific
-// cross-field guard.
+// cross-field guard. The top-level reject code predates the
+// `<prefix>/not-a-<structure>` convention (ocsp/not-a-request follows it) and
+// stays frozen on the public error-code surface.
 var OCSP_RESPONSE = schema.seq([
   schema.field("responseStatus", OCSP_RESPONSE_STATUS),
   schema.optional("responseBytes", RESPONSE_BYTES, { tag: 0, explicit: true, emptyCode: "ocsp/bad-ocsp-response" }),
@@ -316,10 +344,10 @@ var OCSP_RESPONSE = schema.seq([
   build: function (m) {
     var status = m.fields.responseStatus.value;
     var present = m.fields.responseBytes.present;
-    // RFC 6960 §4.2.1 — a successful response MUST carry responseBytes; any other
+    // RFC 6960 sec. 4.2.1 -- a successful response MUST carry responseBytes; any other
     // status MUST NOT (there is nothing to convey but the status).
-    if (status.code === 0 && !present) throw NS.E("ocsp/bad-response-bytes", "a successful OCSPResponse must carry responseBytes (RFC 6960 §4.2.1)");
-    if (status.code !== 0 && present) throw NS.E("ocsp/bad-response-bytes", "a non-successful OCSPResponse must not carry responseBytes (RFC 6960 §4.2.1)");
+    if (status.code === 0 && !present) throw NS.E("ocsp/bad-response-bytes", "a successful OCSPResponse must carry responseBytes (RFC 6960 sec. 4.2.1)");
+    if (status.code !== 0 && present) throw NS.E("ocsp/bad-response-bytes", "a non-successful OCSPResponse must not carry responseBytes (RFC 6960 sec. 4.2.1)");
     var rb = present ? m.fields.responseBytes.value.result : null;
     return {
       responseStatus: status,
@@ -332,7 +360,7 @@ var OCSP_RESPONSE = schema.seq([
 // ---- request tree ----------------------------------------------------
 
 // Request ::= SEQUENCE { reqCert CertID, singleRequestExtensions [0] EXPLICIT
-// Extensions OPTIONAL } (RFC 6960 §4.1.1).
+// Extensions OPTIONAL } (RFC 6960 sec. 4.1.1).
 var REQUEST = schema.seq([
   schema.field("reqCert", CERT_ID),
   schema.trailing([
@@ -343,13 +371,13 @@ var REQUEST = schema.seq([
   build: function (m) {
     return {
       certID: m.fields.reqCert.value.result,
-      singleRequestExtensions: m.fields.singleRequestExtensions.present ? m.fields.singleRequestExtensions.value.result : null,
+      singleRequestExtensions: m.fields.singleRequestExtensions.present ? _validateOcspExtensions(m.fields.singleRequestExtensions.value.result) : null,
     };
   },
 });
 
 // Signature ::= SEQUENCE { signatureAlgorithm AlgorithmIdentifier, signature BIT
-// STRING, certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL } (RFC 6960 §4.1.1).
+// STRING, certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL } (RFC 6960 sec. 4.1.1).
 var SIGNATURE = schema.seq([
   schema.field("signatureAlgorithm", ALGORITHM_IDENTIFIER),
   schema.field("signature", schema.bitString()),
@@ -369,7 +397,7 @@ var SIGNATURE = schema.seq([
 
 // TBSRequest ::= SEQUENCE { version [0] EXPLICIT DEFAULT v1, requestorName [1]
 // EXPLICIT GeneralName OPTIONAL, requestList SEQUENCE OF Request, requestExtensions
-// [2] EXPLICIT Extensions OPTIONAL } (RFC 6960 §4.1.1). requestorName is surfaced
+// [2] EXPLICIT Extensions OPTIONAL } (RFC 6960 sec. 4.1.1). requestorName is surfaced
 // raw (GeneralName is a wide CHOICE with no factory yet).
 var TBS_REQUEST = schema.seq([
   schema.optional("version", VERSION, { tag: 0, explicit: true, default: 1, emptyCode: "ocsp/bad-version" }),
@@ -386,13 +414,13 @@ var TBS_REQUEST = schema.seq([
       version: m.fields.version.value,
       requestorName: rn.present ? { bytes: rn.value.bytes, tagClass: rn.value.tagClass, tagNumber: rn.value.tagNumber } : null,
       requestList: m.fields.requestList.value.items.map(function (it) { return it.value.result; }),
-      requestExtensions: m.fields.requestExtensions.present ? m.fields.requestExtensions.value.result : null,
+      requestExtensions: m.fields.requestExtensions.present ? _validateOcspExtensions(m.fields.requestExtensions.value.result) : null,
     };
   },
 });
 
 // OCSPRequest ::= SEQUENCE { tbsRequest TBSRequest, optionalSignature [0] EXPLICIT
-// Signature OPTIONAL } (RFC 6960 §4.1.1). tbsRequest.node.bytes is the raw signed
+// Signature OPTIONAL } (RFC 6960 sec. 4.1.1). tbsRequest.node.bytes is the raw signed
 // region for external verification.
 var OCSP_REQUEST = schema.seq([
   schema.field("tbsRequest", TBS_REQUEST),
@@ -402,11 +430,11 @@ var OCSP_REQUEST = schema.seq([
   build: function (m) {
     var tbs = m.fields.tbsRequest.value.result;
     var optionalSignature = m.fields.optionalSignature.present ? m.fields.optionalSignature.value.result : null;
-    // RFC 6960 §4.1.2 — if the request is signed, the requestor SHALL specify its
+    // RFC 6960 sec. 4.1.2 -- if the request is signed, the requestor SHALL specify its
     // name in requestorName (the identity the signature binds to). A signed request
     // without it is internally inconsistent; reject fail-closed.
     if (optionalSignature && tbs.requestorName === null) {
-      throw NS.E("ocsp/missing-requestor-name", "a signed OCSPRequest must specify requestorName (RFC 6960 §4.1.2)");
+      throw NS.E("ocsp/missing-requestor-name", "a signed OCSPRequest must specify requestorName (RFC 6960 sec. 4.1.2)");
     }
     return {
       tbsRequestBytes: m.fields.tbsRequest.node.bytes,
@@ -482,6 +510,23 @@ var parseResponse = pkix.makeParser({ pemLabel: "OCSP RESPONSE", PemError: PemEr
  */
 function pemDecode(text, label) { return pkix.pemDecode(text, label || "OCSP RESPONSE", PemError); }
 
+/**
+ * @primitive  pki.schema.ocsp.pemEncode
+ * @signature  pki.schema.ocsp.pemEncode(der, label?) -> string
+ * @since      0.1.23
+ * @status     stable
+ * @spec       RFC 7468, RFC 6960
+ * @related    pki.schema.ocsp.pemDecode
+ *
+ * Wrap DER bytes in a PEM envelope (default label `OCSP RESPONSE`, the same
+ * default `pemDecode` reads; pass `"OCSP REQUEST"` for a request). Throws
+ * `PemError` on a malformed label.
+ *
+ * @example
+ *   var pem = pki.schema.ocsp.pemEncode(der);
+ */
+function pemEncode(der, label) { return pkix.pemEncode(der, label || "OCSP RESPONSE", PemError); }
+
 // An OCSPResponse root is the only registered structure that leads with an
 // ENUMERATED child (a SEQUENCE of 1-2: responseStatus + an optional context [0]
 // responseBytes). Every other root leads with a SEQUENCE (x509/crl/csr/ocsp-request),
@@ -499,7 +544,7 @@ function matchesResponse(root) {
 // An OCSPRequest root is a SEQUENCE of 1-2 whose first child is the tbsRequest
 // SEQUENCE (optionally followed by a context [0] EXPLICIT signature). It leads with
 // a SEQUENCE like x509/crl/csr, but those require EXACTLY 3 children (the
-// signed-envelope trio), while an OCSPRequest is 1-2 — so it is excluded by arity.
+// signed-envelope trio), while an OCSPRequest is 1-2 -- so it is excluded by arity.
 function matchesRequest(root) {
   var T = asn1.TAGS;
   var k = pkix.rootSequenceChildren(root, 1, 2);
@@ -513,6 +558,7 @@ module.exports = {
   parseRequest: parseRequest,
   parseResponse: parseResponse,
   pemDecode: pemDecode,
+  pemEncode: pemEncode,
   matchesRequest: matchesRequest,
   matchesResponse: matchesResponse,
 };