@blamejs/pki 0.1.23 → 0.1.24

package/lib/framework-error.js

@@ -219,6 +219,21 @@ var SmimeError = defineClass("SmimeError", { withCause: true });
 // inner `asn1/*` decode error) as `.cause`.
 var CtError = defineClass("CtError", { withCause: true });
 
+// CsrattrsError -- a byte sequence that is not a well-formed RFC 8951 sec. 3.5
+// CsrAttrs (SEQUENCE OF AttrOrOID), or one violating an RFC 9908 semantic rule
+// (a repeated id-ExtensionReq, an extension-request values SET that is not
+// exactly one Extensions, a template version other than v1(0), a mixed
+// extension-request template). Carries the underlying leaf fault as `.cause`.
+var CsrattrsError = defineClass("CsrattrsError", { withCause: true });
+
+// EstError -- an RFC 7030 / 8951 / 9908 Enrollment-over-Secure-Transport
+// protocol fault: a payload that fails a per-operation validator (a non-certs-
+// only /cacerts response, a serverkeygen recipient-arm mismatch), a transfer /
+// multipart framing violation, or an HTTP response the classifier rejects.
+// Carries the underlying leaf / delegated fault (e.g. a cms/* or asn1/*) as
+// `.cause`.
+var EstError = defineClass("EstError", { withCause: true });
+
 module.exports = {
   PkiError:         PkiError,
   defineClass:      defineClass,
@@ -241,4 +256,6 @@ module.exports = {
   PathError:        PathError,
   CtError:          CtError,
   SmimeError:       SmimeError,
+  CsrattrsError:    CsrattrsError,
+  EstError:         EstError,
 };

package/lib/oid.js

@@ -211,10 +211,15 @@ var FAMILIES = {
   // signingCertificateV2 (ESSCertIDv2) carries a non-SHA-1 cert hash (RFC 5816 sec. 2.2.1).
   // The RFC 2634 originals (receiptRequest .. contentReference) are name-only: they
   // resolve to a name so an unsupported-attribute diagnostic is legible, not decoded.
+  // decryptKeyID / asymmDecryptKeyID name the out-of-band key-encryption key a
+  // /serverkeygen client references (RFC 4108 sec. 2.2.5 / RFC 7030 sec. 4.4.1);
+  // certificationRequestInfoTemplate / extensionReqTemplate are the RFC 9908
+  // CSR-attributes template carriers.
   smimeAa: { base: [1, 2, 840, 113549, 1, 9, 16, 2], of: {
     receiptRequest: 1, eSSSecurityLabel: 2, mlExpansionHistory: 3, contentHints: 4,
     msgSigDigest: 5, contentIdentifier: 7, equivalentLabels: 9, contentReference: 10,
-    signingCertificate: 12, timeStampToken: 14, signingCertificateV2: 47 } },
+    signingCertificate: 12, timeStampToken: 14, decryptKeyID: 37, signingCertificateV2: 47,
+    asymmDecryptKeyID: 54, certificationRequestInfoTemplate: 61, extensionReqTemplate: 62 } },
 
   // ANSI X9.62 EC public key, named curve, and ECDSA signatures.
   ansiX962: { base: [1, 2, 840, 10045], of: {

package/lib/schema-all.js

@@ -42,6 +42,7 @@ var ocsp = require("./schema-ocsp");
 var tsp = require("./schema-tsp");
 var crmf = require("./schema-crmf");
 var cmp = require("./schema-cmp");
+var csrattrs = require("./schema-csrattrs");
 var attrcert = require("./schema-attrcert");
 // smime is a COMPANION decoder for CMS signed-attribute values, NOT a top-level
 // format -- it has no self-describing DER root (an ESS attribute value is a bare
@@ -122,6 +123,20 @@ var FORMATS = [
     detect: cmp.matches,
     parse: function (input) { return cmp.parse(input); },
   },
+  {
+    // CsrAttrs ::= SEQUENCE SIZE (0..MAX) OF AttrOrOID (RFC 8951 sec. 3.5) -- a
+    // SEQUENCE whose every child is a bare universal OID or an Attribute (a
+    // universal SEQUENCE of exactly 2: OID + SET). A 1-2-element all-Attribute
+    // CsrAttrs satisfies the permissive ocsp-request probe below (SEQUENCE +
+    // constructed first child), and the empty 30 00 is a CsrAttrs no other root
+    // accepts -- so csrattrs is the strict refinement and MUST sit ahead of
+    // ocsp-request, the same resolution tsp / cmp use. Disjoint from cmp (whose
+    // body child is context-[0..26], never a universal OID/Attribute).
+    name: "csrattrs",
+    module: csrattrs,
+    detect: csrattrs.matches,
+    parse: function (input) { return csrattrs.parse(input); },
+  },
   {
     // OCSPRequest ::= SEQUENCE { tbsRequest SEQUENCE, optionalSignature [0] EXPLICIT
     // OPTIONAL } -- a SEQUENCE of 1-2 whose first child is the tbsRequest SEQUENCE.
@@ -289,6 +304,7 @@ module.exports = {
   tsp: { parse: tsp.parse, parseTstInfo: tsp.parseTstInfo, parseToken: tsp.parseToken, pemDecode: tsp.pemDecode, pemEncode: tsp.pemEncode },
   crmf: { parse: crmf.parse, pemDecode: crmf.pemDecode, pemEncode: crmf.pemEncode },
   cmp: { parse: cmp.parse, pemDecode: cmp.pemDecode, pemEncode: cmp.pemEncode },
+  csrattrs: { parse: csrattrs.parse },
   attrcert: { parse: attrcert.parse, pemDecode: attrcert.pemDecode, pemEncode: attrcert.pemEncode },
   smime: { parseSigningCertificate: smime.parseSigningCertificate, parseSigningCertificateV2: smime.parseSigningCertificateV2, parseSmimeCapabilities: smime.parseSmimeCapabilities, decodeAttribute: smime.decodeAttribute },
   all: all,

package/lib/schema-csr.js

@@ -75,7 +75,11 @@ var DIRECTORY_STRING_TAGS = [
 ];
 var RECOGNIZED_ATTRIBUTE_VALUE = {};
 RECOGNIZED_ATTRIBUTE_VALUE[oid.byName("extensionRequest")] = function (node, ctx) {
-  try { schema.walk(EXTENSIONS, node, ctx); }
+  // Surface the requested extensions decoded (same {oid,name,critical,value}
+  // shape as a certificate's extensions) so a CA pipeline -- and the EST
+  // re-enroll guard -- reads them off the attribute instead of re-walking the
+  // raw Extensions bytes. Returned as an enrichment merged onto the attribute.
+  try { return { extensions: schema.walk(EXTENSIONS, node, ctx).result }; }
   catch (e) {
     throw ctx.E("csr/bad-attribute-value",
       "extensionRequest value must be a well-formed Extensions SEQUENCE (RFC 2985 sec. 5.4.2): " + ((e && e.message) || String(e)), e);
@@ -115,7 +119,8 @@ var CERTIFICATION_REQUEST_INFO = schema.seq([
         if (valueItems.length !== 1) {
           throw ctx.E("csr/bad-attribute-value", (a.name || a.type) + " is a SINGLE VALUE attribute (RFC 2985 sec. 5.4)");
         }
-        checkValue(valueItems[0].node, ctx);
+        var enriched = checkValue(valueItems[0].node, ctx);
+        if (enriched) { Object.keys(enriched).forEach(function (k) { a[k] = enriched[k]; }); }
       }
       return a;
     });
@@ -165,7 +170,10 @@ var CERTIFICATION_REQUEST = pkix.signedEnvelope(NS, CERTIFICATION_REQUEST_INFO,
  * Every field is validated on the way in; a malformed CertificationRequest /
  * CertificationRequestInfo throws a typed `CsrError` (`csr/*`) and a leaf-level
  * codec fault surfaces as `asn1/*`. Attribute values are returned as raw DER
- * buffers so an unrecognized attribute type never fails the parse.
+ * buffers so an unrecognized attribute type never fails the parse; the
+ * `extensionRequest` attribute additionally carries its requested extensions
+ * decoded on `.extensions` (the `{ oid, name, critical, value }` shape a
+ * certificate's extensions use).
  *
  * @example
  *   var csr = pki.schema.csr.parse(der);
@@ -231,4 +239,10 @@ module.exports = {
   pemDecode: pemDecode,
   pemEncode: pemEncode,
   matches: matches,
+  // The top schema, exposed (not on the curated pki.schema.csr surface) so a
+  // composer can drive the encode direction -- schema.encode(schema, v) -> a
+  // CertificationRequest -- and prove the round-trip. The EST builder uses it
+  // to re-encode a CSR with added attributes (the crmf certReqMessagesSchema
+  // precedent).
+  certificationRequestSchema: CERTIFICATION_REQUEST,
 };

package/lib/schema-csrattrs.js

@@ -0,0 +1,371 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * @module     pki.schema.csrattrs
+ * @nav        Schema
+ * @title      CSR Attributes
+ * @order      185
+ * @slug       csrattrs
+ *
+ * @intro
+ *   The EST CSR Attributes wire format per RFC 8951 sec. 3.5 (the RFC 7030
+ *   sec. 4.5.2 ASN.1 was syntactically broken, erratum 4384) with the RFC 9908
+ *   template structures. `parse` turns a DER `Buffer` into
+ *   `{ items }` -- `CsrAttrs ::= SEQUENCE SIZE (0..MAX) OF AttrOrOID`, where
+ *   `AttrOrOID ::= CHOICE { oid OBJECT IDENTIFIER, attribute Attribute }`
+ *   disambiguates on the universal tag. An empty SEQUENCE is a COMPLETE valid
+ *   document ("no additional information desired"). Each item surfaces its
+ *   `kind` (`"oid"` / `"attribute"`), the `oid` (dotted) and registry `name`;
+ *   an attribute keeps its raw `values` and, for the three types RFC 9908
+ *   gives meaning, a decoded view: `id-ExtensionReq` -> `extensions`, the
+ *   `ecPublicKey` / `rsaEncryption` key-type conventions -> `curve` / `keySize`,
+ *   and `id-aa-certificationRequestInfoTemplate` -> a fully-decoded `template`.
+ *
+ *   Structure is strict-DER throughout, but UNKNOWN OIDs and attribute types
+ *   are TOLERATED -- surfaced raw, never a parse fault ("the client MUST ignore
+ *   any OID or attribute it does not recognize", RFC 8951 sec. 4.5.2). The
+ *   RFC 9908 semantic MUSTs that ARE enforced fail closed with a typed
+ *   `csrattrs/*` code: at most one `id-ExtensionReq` attribute, its values a SET
+ *   of exactly one `Extensions`, template version v1(0), and a template's inner
+ *   attributes carrying at most one `id-aa-extensionReqTemplate` and never both
+ *   extension-request kinds. Template PRIORITY (a client that understands the
+ *   template ignores the legacy elements, RFC 9908 sec. 4) is a `pki.est` builder
+ *   rule, not a parse rejection -- parse surfaces everything.
+ *
+ *   There is NO `pemDecode` / `pemEncode`: no RFC 7468 label exists for
+ *   CsrAttrs; the wire encoding is bare RFC 4648 base64 handled by the EST
+ *   transfer codec (`pki.est.transferDecode`), not a PEM envelope.
+ *
+ * @card
+ *   Parse DER EST CSR Attributes (RFC 8951 / RFC 9908) into ordered items --
+ *   bare OIDs, attributes with raw values, decoded extension requests / key-type
+ *   conventions / request-info templates; unknown types tolerated, fail-closed.
+ */
+
+var asn1 = require("./asn1-der");
+var schema = require("./schema-engine");
+var pkix = require("./schema-pkix");
+var oid = require("./oid");
+var frameworkError = require("./framework-error");
+
+var CsrattrsError = frameworkError.CsrattrsError;
+
+var NS = pkix.makeNS("csrattrs", CsrattrsError, oid);
+var T = asn1.TAGS;
+
+// The base Attribute is SET SIZE(1..MAX); ATTRIBUTE_KEYTYPE lowers the floor to 0
+// ONLY for the ecPublicKey / rsaEncryption key-type hints, whose empty values SET
+// means "any key of this type" (RFC 9908 sec. 3.2). Every other attribute -- and
+// every template inner attribute -- keeps the non-empty floor, so an empty
+// challengePassword or unknown attribute still fails closed.
+// ATTRIBUTE keeps the base SET SIZE(1..MAX); ATTRIBUTE_OPTIONAL_VALUES lowers the
+// floor to 0. Only the recognized NON-KEY attributes that require a value
+// (id-ExtensionReq, the request-info template) use the strict form; a key-type
+// hint's empty SET means "any key of this type" (RFC 9908 sec. 3.2), and an
+// UNKNOWN attribute (a key type this build does not know yet, or any other OID) is
+// TOLERATED with an empty SET too -- RFC 8951 ignores what it does not recognize,
+// so an unfamiliar OID must not fail the whole response.
+var ATTRIBUTE = pkix.attribute(NS);
+var ATTRIBUTE_OPTIONAL_VALUES = pkix.attribute(NS, { minValues: 0 });
+var EXTENSIONS = pkix.extensions(NS);
+var ALGORITHM_IDENTIFIER = pkix.algorithmIdentifier(NS);
+
+// The RFC 9908 semantically-meaningful attribute OIDs (registry, never literals).
+var OID_EXTENSION_REQUEST = oid.byName("extensionRequest");                  // id-ExtensionReq
+var OID_EC_PUBLIC_KEY = oid.byName("ecPublicKey");
+var OID_RSA_ENCRYPTION = oid.byName("rsaEncryption");
+var OID_TEMPLATE = oid.byName("certificationRequestInfoTemplate");
+var OID_EXT_REQ_TEMPLATE = oid.byName("extensionReqTemplate");
+
+// The recognized non-key attributes that MUST carry a value (empty SET rejected).
+var STRICT_VALUES_OIDS = new Set([OID_EXTENSION_REQUEST, OID_TEMPLATE]);
+
+// The recognized public-key type OIDs -- used to FLAG a parsed attribute isKeyType
+// for the enroll planner (rsaEncryption / ecPublicKey are only the RFC 9908 sec. 3.2
+// examples; a no-parameter key like Ed25519 or an ML-DSA / SLH-DSA / ML-KEM type is
+// equally valid). Built by registered NAME (a typo fails at load), never literals.
+var KEY_TYPE_OIDS = new Set([
+  "rsaEncryption", "ecPublicKey", "Ed25519", "Ed448", "X25519", "X448",
+  "id-ml-dsa-44", "id-ml-dsa-65", "id-ml-dsa-87",
+  "id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024",
+  "id-slh-dsa-sha2-128s", "id-slh-dsa-sha2-128f", "id-slh-dsa-sha2-192s",
+  "id-slh-dsa-sha2-192f", "id-slh-dsa-sha2-256s", "id-slh-dsa-sha2-256f",
+  "id-slh-dsa-shake-128s", "id-slh-dsa-shake-128f", "id-slh-dsa-shake-192s",
+  "id-slh-dsa-shake-192f", "id-slh-dsa-shake-256s", "id-slh-dsa-shake-256f",
+].map(function (nm) {
+  var d = oid.byName(nm);
+  if (typeof d !== "string") throw new Error("csrattrs key-type seed " + JSON.stringify(nm) + " is not a registered OID name");
+  return d;
+}));
+
+// ---- RFC 9908 sec. 3.4 CertificationRequestInfoTemplate ------------------
+
+// version MUST be v1(0). A dedicated leaf (not pkix.versionReader) so the reject
+// carries the template-specific code the RFC 9908 sec. 3.4 MUST names.
+var TEMPLATE_VERSION = schema.decode(function (n, ctx) {
+  var v = asn1.read.integer(n);
+  if (v !== 0n) throw ctx.E("csrattrs/bad-template-version", "CertificationRequestInfoTemplate version must be v1(0) (RFC 9908 sec. 3.4)");
+  return 0;
+}, function () { return asn1.build.integer(0n); });
+
+// SingleAttributeTemplate ::= SEQUENCE { type OID, value ANY OPTIONAL } -- a
+// value-absent element means "the client fills this in" (RFC 9908 sec. 3.4). The
+// trailing OPTIONAL ANY is the algorithmIdentifier-parameters shape.
+var SINGLE_ATTR_TEMPLATE = schema.seq([
+  schema.field("type", schema.oidLeaf()),
+  schema.optional("value", schema.any(), { whenAny: true }),
+], {
+  assert: "sequence", arity: { min: 1, max: 2 }, code: "csrattrs/bad-name-template", what: "SingleAttributeTemplate",
+  build: function (m, ctx) {
+    return { type: m.fields.type.value, name: ctx.oid.name(m.fields.type.value) || null,
+             value: m.fields.value.present ? m.fields.value.node.bytes : null };
+  },
+});
+
+// RelativeDistinguishedNameTemplate ::= SET SIZE (1..MAX) OF SingleAttributeTemplate.
+var RDN_TEMPLATE = schema.setOf(SINGLE_ATTR_TEMPLATE, {
+  assert: "set", min: 1, code: "csrattrs/bad-name-template", what: "RelativeDistinguishedNameTemplate",
+  build: function (m) { return m.items.map(function (it) { return it.value.result; }); },
+});
+// NameTemplate ::= RDNSequence (a SEQUENCE OF RDN-template SETs) -> array of RDNs,
+// each an array of { type, name, value } (value null = "the client fills it in").
+var NAME_TEMPLATE = schema.seqOf(RDN_TEMPLATE, {
+  assert: "sequence", code: "csrattrs/bad-name-template", what: "NameTemplate",
+  build: function (m) { return m.items.map(function (it) { return it.value.result; }); },
+});
+
+// SubjectPublicKeyInfoTemplate ::= SEQUENCE { algorithm AlgorithmIdentifier,
+//   subjectPublicKey BIT STRING OPTIONAL } -- the key is OPTIONAL (present ONLY
+//   as an RSA modulus-size placeholder), so pkix.spki (key required, arity 2)
+//   cannot be reused.
+var SPKI_TEMPLATE = schema.seq([
+  schema.field("algorithm", ALGORITHM_IDENTIFIER),
+  schema.optional("placeholderKey", schema.bitString(), { whenUniversal: [T.BIT_STRING] }),
+], {
+  // subjectPKInfo is [0] IMPLICIT (RFC 9908 sec. 3.4) -- the context tag replaces
+  // the universal SEQUENCE tag, so the node is context-[0] constructed and its
+  // children are read directly (the pwri keyDerivationAlgorithm [0] precedent).
+  assert: "implicit", implicitTag: 0, arity: { min: 1, max: 2 }, code: "csrattrs/bad-spki-template", what: "SubjectPublicKeyInfoTemplate",
+  build: function (m) {
+    return { algorithm: m.fields.algorithm.value.result,
+             placeholderKey: m.fields.placeholderKey.present ? m.fields.placeholderKey.value.bytes : null };
+  },
+});
+
+// ExtensionTemplate ::= SEQUENCE { extnID OID, critical BOOLEAN DEFAULT FALSE,
+//   extnValue OCTET STRING OPTIONAL } -- extnValue absent means "client supplies";
+//   an explicit critical FALSE is non-DER (BOOLEAN DEFAULT FALSE). Not reusable
+//   from pkix.extension (whose extnValue is required), so the DER-critical rule
+//   is applied here directly.
+var EXTENSION_TEMPLATE = schema.decode(function (n, ctx) {
+  if (!schema.isUniversal(n, T.SEQUENCE) || !n.children || n.children.length < 1 || n.children.length > 3) {
+    throw ctx.E("csrattrs/bad-extension-template", "ExtensionTemplate must be a SEQUENCE of {extnID, critical?, extnValue?}");
+  }
+  var k = n.children, i = 1;
+  var extnID = asn1.read.oid(k[0]);
+  var critical = false, value = null;
+  if (i < k.length && schema.isUniversal(k[i], T.BOOLEAN)) {
+    critical = asn1.read.boolean(k[i]);
+    if (critical === false) throw ctx.E("csrattrs/bad-extension-template", "an explicit critical FALSE must be omitted (BOOLEAN DEFAULT FALSE)");
+    i += 1;
+  }
+  if (i < k.length) { value = asn1.read.octetString(k[i]); i += 1; }
+  if (i !== k.length) throw ctx.E("csrattrs/bad-extension-template", "ExtensionTemplate has an unexpected trailing element");
+  return { oid: extnID, name: ctx.oid.name(extnID) || null, critical: critical, value: value };
+});
+
+// ExtensionReqTemplate ::= ExtensionTemplates ::= SEQUENCE SIZE (1..MAX) OF
+// ExtensionTemplate (RFC 9908 sec. 3.4) -- the id-aa-extensionReqTemplate value
+// is a SEQUENCE OF ExtensionTemplate, not a single one.
+var EXTENSION_REQ_TEMPLATE = schema.seqOf(EXTENSION_TEMPLATE, {
+  assert: "sequence", min: 1, code: "csrattrs/bad-extension-template", what: "ExtensionReqTemplate",
+  build: function (m) { return m.items.map(function (it) { return it.value; }); },
+});
+
+// CertificationRequestInfoTemplate ::= SEQUENCE { version, subject NameTemplate
+//   OPTIONAL, subjectPKInfo [0] IMPLICIT OPTIONAL, attributes [1] IMPLICIT
+//   Attributes }. attributes is present (may be an empty SET). The RFC 9908
+//   sec. 3.4 inner-attribute MUSTs (<=1 extensionReqTemplate; not both
+//   extension-request kinds; a values SET of exactly one ExtensionTemplate) are
+//   enforced in the build.
+var CERT_REQ_INFO_TEMPLATE = schema.seq([
+  schema.field("version", TEMPLATE_VERSION),
+  schema.optional("subject", NAME_TEMPLATE, { whenUniversal: [T.SEQUENCE] }),
+  schema.optional("subjectPKInfo", SPKI_TEMPLATE, { tag: 0 }),
+  schema.field("attributes", schema.implicitSetOf(1, ATTRIBUTE, { min: 0, code: "csrattrs/bad-template-attrs", what: "template attributes" })),
+], {
+  assert: "sequence", code: "csrattrs/bad-template", what: "CertificationRequestInfoTemplate",
+  build: function (m, ctx) {
+    var attributes = m.fields.attributes.value.items.map(function (it) { return it.value.result; });
+    var extReqTemplates = 0, extReqs = 0, hasExtReq = false, extensionTemplates = [], extensions = null;
+    for (var i = 0; i < attributes.length; i++) {
+      var a = attributes[i];
+      if (a.type === OID_EXTENSION_REQUEST) {
+        hasExtReq = true;
+        extReqs += 1;
+        // A template id-ExtensionReq carries one Extensions value (RFC 9908 sec. 3.2);
+        // decode it so a client reads the requirements off .extensions instead of
+        // re-parsing raw bytes (the top-level extensionRequest exposes it the same way).
+        if (a.values.length !== 1) throw NS.E("csrattrs/bad-template-attrs", "a template id-ExtensionReq values must be a SET of exactly one Extensions (RFC 9908 sec. 3.2)");
+        extensions = schema.walk(EXTENSIONS, asn1.decode(a.values[0]), ctx).result;
+      }
+      if (a.type === OID_EXT_REQ_TEMPLATE) {
+        extReqTemplates += 1;
+        // The attribute's values SET holds exactly one ExtensionReqTemplate
+        // (RFC 9908 sec. 3.4); that value is itself a SEQUENCE OF ExtensionTemplate.
+        if (a.values.length !== 1) throw NS.E("csrattrs/bad-template-attrs", "an id-aa-extensionReqTemplate values must be a SET of exactly one ExtensionReqTemplate (RFC 9908 sec. 3.4)");
+        extensionTemplates = extensionTemplates.concat(schema.walk(EXTENSION_REQ_TEMPLATE, asn1.decode(a.values[0]), ctx).result);
+      }
+    }
+    if (extReqs > 1) throw NS.E("csrattrs/bad-template-attrs", "a template must not carry more than one id-ExtensionReq (RFC 9908 sec. 3.2)");
+    if (extReqTemplates > 1) throw NS.E("csrattrs/bad-template-attrs", "a template must not carry more than one id-aa-extensionReqTemplate (RFC 9908 sec. 3.4)");
+    if (extReqTemplates >= 1 && hasExtReq) throw NS.E("csrattrs/bad-template-attrs", "a template must not carry both id-ExtensionReq and id-aa-extensionReqTemplate (RFC 9908 sec. 3.4)");
+    return {
+      version: m.fields.version.value,
+      subject: m.fields.subject.present ? m.fields.subject.value.result : null,
+      subjectPKInfo: m.fields.subjectPKInfo.present ? m.fields.subjectPKInfo.value.result : null,
+      attributes: attributes,
+      extensions: extensions,
+      extensionTemplates: extensionTemplates,
+    };
+  },
+});
+
+// ---- AttrOrOID + the semantic enrichment ---------------------------------
+
+// Decode the three RFC 9908-meaningful attribute types onto an already-walked
+// Attribute { type, name, values }. Unknown types keep only their raw values.
+// A recognized public-key type is flagged isKeyType so a consumer (the pki.est
+// enroll planner) treats every accepted key type uniformly, not just RSA/EC.
+function _enrichAttribute(item, ctx) {
+  if (KEY_TYPE_OIDS.has(item.oid)) item.isKeyType = true;
+  if (item.oid === OID_EXTENSION_REQUEST) {
+    if (item.values.length !== 1) throw ctx.E("csrattrs/bad-extension-req", "an id-ExtensionReq attribute values must be a SET of exactly one Extensions (RFC 9908 sec. 3.2)");
+    item.extensions = schema.walk(EXTENSIONS, asn1.decode(item.values[0]), ctx).result;
+  } else if (item.oid === OID_EC_PUBLIC_KEY) {
+    // A key-type hint's values SET is empty ("any curve") or a singleton naming
+    // ONE curve (RFC 9908 sec. 3.2); a multi-valued SET is ambiguous -- fail
+    // closed rather than letting DER ordering pick the advertised constraint.
+    if (item.values.length > 1) throw ctx.E("csrattrs/bad-key-type-attr", "an ecPublicKey attribute values must be empty or a SET of exactly one named-curve OBJECT IDENTIFIER (RFC 9908 sec. 3.2)");
+    if (item.values.length === 1) {
+      try { item.curve = asn1.read.oid(asn1.decode(item.values[0])); }
+      catch (e) { throw ctx.E("csrattrs/bad-key-type-attr", "an ecPublicKey attribute value must be a named-curve OBJECT IDENTIFIER (RFC 9908 sec. 3.2)", e); }
+    }
+  } else if (item.oid === OID_RSA_ENCRYPTION) {
+    // Empty ("any size") or a singleton naming ONE key size; reject a multi-valued SET.
+    if (item.values.length > 1) throw ctx.E("csrattrs/bad-key-type-attr", "an rsaEncryption attribute values must be empty or a SET of exactly one INTEGER key size (RFC 9908 sec. 3.2)");
+    if (item.values.length === 1) {
+      var sz;
+      try { sz = asn1.read.integer(asn1.decode(item.values[0])); }
+      catch (e) { throw ctx.E("csrattrs/bad-key-type-attr", "an rsaEncryption attribute value must be an INTEGER key size (RFC 9908 sec. 3.2)", e); }
+      // Bound before narrowing to a Number: an RSA modulus-size hint of 1..65536
+      // bits covers every real key; a value past 2^53 would round silently.
+      if (sz < 1n || sz > 65536n) throw ctx.E("csrattrs/bad-key-type-attr", "the rsaEncryption key size " + sz + " is out of range (1..65536 bits)");
+      item.keySize = Number(sz);
+    }
+  } else if (item.oid === OID_TEMPLATE) {
+    if (item.values.length !== 1) throw ctx.E("csrattrs/bad-template", "a certificationRequestInfoTemplate attribute values must be a SET of exactly one template (RFC 9908 sec. 3.4)");
+    item.template = schema.walk(CERT_REQ_INFO_TEMPLATE, asn1.decode(item.values[0]), ctx).result;
+  }
+}
+
+// AttrOrOID ::= CHOICE { oid OBJECT IDENTIFIER, attribute Attribute }. The two
+// arms are the two universal tags; anything else is not an AttrOrOID. A decode
+// leaf (not schema.choice) so the enrichment + the paired write live together.
+var ATTR_OR_OID = schema.decode(function (n, ctx) {
+  if (schema.isUniversal(n, T.OBJECT_IDENTIFIER) && !n.constructed) {
+    var o = asn1.read.oid(n);
+    return { kind: "oid", oid: o, name: ctx.oid.name(o) || null };
+  }
+  if (schema.isUniversal(n, T.SEQUENCE) && n.children) {
+    // Peek the type OID to choose the values-arity rule: only a recognized non-key
+    // attribute (id-ExtensionReq / template) requires SET SIZE(1..MAX); a key-type
+    // hint OR an unknown OID MAY carry an empty SET (RFC 9908 sec. 3.2 / RFC 8951).
+    var typeOid = (n.children.length >= 1 && schema.isUniversal(n.children[0], T.OBJECT_IDENTIFIER) && !n.children[0].constructed) ? asn1.read.oid(n.children[0]) : null;
+    var attrSchema = STRICT_VALUES_OIDS.has(typeOid) ? ATTRIBUTE : ATTRIBUTE_OPTIONAL_VALUES;
+    var a = schema.walk(attrSchema, n, ctx).result;          // { type, name, values:[bytes] }
+    var item = { kind: "attribute", oid: a.type, name: a.name, values: a.values };
+    _enrichAttribute(item, ctx);
+    return item;
+  }
+  throw ctx.E("csrattrs/bad-attr-or-oid", "each CsrAttrs element must be an OBJECT IDENTIFIER or an Attribute SEQUENCE (RFC 8951 sec. 3.5)");
+}, function (item) {
+  // Paired encoder (one structure, both directions): reconstruct from the arm's
+  // identifying fields + raw values -- the typed enrichment is decode-only.
+  if (item.kind === "oid") return asn1.build.oid(item.oid);
+  return asn1.build.sequence([asn1.build.oid(item.oid), asn1.build.set(item.values)]);
+});
+
+// CsrAttrs ::= SEQUENCE SIZE (0..MAX) OF AttrOrOID. min:0 -- an empty SEQUENCE is
+// a complete valid document. The cross-element MUSTs (RFC 9908 sec. 3.2 single
+// id-ExtensionReq; sec. 3.4 single template) are enforced in the build.
+var CSR_ATTRS = schema.seqOf(ATTR_OR_OID, {
+  assert: "sequence", code: "csrattrs/not-csrattrs", what: "CsrAttrs",
+  build: function (m) {
+    var items = m.items.map(function (it) { return it.value; });
+    var extReq = 0, tpl = 0;
+    for (var i = 0; i < items.length; i++) {
+      if (items[i].kind !== "attribute") continue;
+      if (items[i].oid === OID_EXTENSION_REQUEST) extReq += 1;
+      if (items[i].oid === OID_TEMPLATE) tpl += 1;
+    }
+    if (extReq > 1) throw NS.E("csrattrs/duplicate-extension-req", "at most one id-ExtensionReq attribute is permitted in CsrAttrs (RFC 9908 sec. 3.2)");
+    if (tpl > 1) throw NS.E("csrattrs/duplicate-template", "at most one certificationRequestInfoTemplate attribute is permitted in CsrAttrs (RFC 9908 sec. 3.4)");
+    return { items: items };
+  },
+});
+
+/**
+ * @primitive  pki.schema.csrattrs.parse
+ * @signature  pki.schema.csrattrs.parse(der) -> { items }
+ * @since      0.1.24
+ * @status     experimental
+ * @spec       RFC 8951, RFC 9908, RFC 7030
+ * @related    pki.schema.parse, pki.est.buildEnrollAttributes
+ *
+ * Parse a DER `Buffer` of EST CSR Attributes (`CsrAttrs`, RFC 8951 sec. 3.5) into
+ * `{ items }`. Each item is `{ kind, oid, name }` -- `kind` `"oid"` for a bare
+ * OID, `"attribute"` for an `Attribute`, which adds raw `values` plus, for the
+ * RFC 9908 meaningful types, `extensions` (id-ExtensionReq), `curve` / `keySize`
+ * (EC / RSA key-type conventions), or `template` (the request-info template). An
+ * empty `SEQUENCE` yields `{ items: [] }` ("no additional information desired").
+ * Unknown OIDs / attribute types are tolerated (surfaced raw); a malformed
+ * structure or an RFC 9908 semantic violation throws a typed `CsrattrsError`
+ * (`csrattrs/*`) and a leaf-level codec fault surfaces as `asn1/*`.
+ *
+ * @example
+ *   var a = pki.schema.csrattrs.parse(der);
+ *   a.items[0].kind;   // -> "oid" | "attribute"
+ */
+var parse = pkix.makeParser({ pemLabel: null, PemError: frameworkError.PemError, ErrorClass: CsrattrsError, prefix: "csrattrs", what: "CsrAttrs", topSchema: CSR_ATTRS, ns: NS });
+
+// matches(root): a CsrAttrs is a universal SEQUENCE whose children are each a
+// bare universal OID or an Attribute (a universal SEQUENCE of exactly 2 whose
+// first child is an OID and second a SET). An empty SEQUENCE (30 00) is a valid
+// CsrAttrs and no other registered document root accepts it. Registered BEFORE
+// ocsp-request (a permissive superset probe) as the strict refinement, the same
+// resolution tsp / crmf already use.
+function matches(root) {
+  var k = pkix.rootSequenceChildren(root, 0);
+  if (!k) return false;
+  if (k.length === 0) return true;
+  for (var i = 0; i < k.length; i++) {
+    var c = k[i];
+    // bare-OID arm: a primitive universal OBJECT IDENTIFIER.
+    if (schema.isUniversal(c, T.OBJECT_IDENTIFIER) && !c.constructed) continue;
+    // Attribute arm: a universal SEQUENCE of exactly { OID, SET }.
+    if (!schema.isUniversal(c, T.SEQUENCE) || !c.children || c.children.length !== 2) return false;
+    if (!schema.isUniversal(c.children[0], T.OBJECT_IDENTIFIER)) return false;
+    if (!(schema.isUniversal(c.children[1], T.SET) && c.children[1].children)) return false;
+  }
+  return true;
+}
+
+module.exports = {
+  parse: parse,
+  matches: matches,
+  // The top schema, exposed (not on the curated pki.schema.csrattrs surface) so a
+  // composer can drive the encode direction and prove the round-trip.
+  csrAttrsSchema: CSR_ATTRS,
+};

package/lib/schema-pkix.js

@@ -340,7 +340,10 @@ function name(ns, opts) {
       rdns.push(atvs);
       parts.push(atvParts.join("+"));
     });
-    return { rdns: rdns, dn: parts.join(", ") };
+    // `bytes` is the raw Name DER (the universal SEQUENCE TLV, recovered from the
+    // wire node even in IMPLICIT [tag] mode) -- a byte-exact comparison a consumer
+    // needs when a rendered DN is not enough (the EST re-enroll subject MUST).
+    return { rdns: rdns, dn: parts.join(", "), bytes: opts.implicitTag != null ? asn1.sequenceTlv(m.node) : m.node.bytes };
   }
   if (opts.implicitTag != null) {
     return schema.implicitSeqOf(opts.implicitTag, relativeDistinguishedName(ns), {
@@ -913,13 +916,17 @@ function spki(ns, opts) {
 
 // Attribute ::= SEQUENCE { type OBJECT IDENTIFIER, values SET OF AttributeValue }.
 // AttributeValue is ANY, kept as raw DER (node.bytes) -- an unrecognized attribute
-// type never fails the parse. values is SET SIZE (1..MAX): an empty SET is
-// rejected; there is NO SET-OF uniqueness. Shared by the CSR (requested
+// type never fails the parse. values is SET SIZE (1..MAX) by default: an empty SET
+// is rejected; there is NO SET-OF uniqueness. Shared by the CSR (requested
 // attributes, RFC 2986 sec. 4.1) and PKCS#8 (private-key attributes, RFC 5958 sec. 2).
-function attribute(ns) {
+// opts.minValues (default 1) lowers the floor to 0 for the EST CsrAttrs key-type
+// hints, whose empty values SET means "any key of this type" (RFC 9908 sec. 3.2).
+function attribute(ns, opts) {
+  opts = opts || {};
+  var minValues = opts.minValues === undefined ? 1 : opts.minValues;
   return schema.seq([
     schema.field("type", schema.oidLeaf()),
-    schema.field("values", schema.setOf(schema.any(), { assert: "set", min: 1, max: constants.LIMITS.ATTRIBUTE_MAX_VALUES,
+    schema.field("values", schema.setOf(schema.any(), { assert: "set", min: minValues, max: constants.LIMITS.ATTRIBUTE_MAX_VALUES,
       code: ns.prefix + "/bad-attribute-values", what: "attribute values" })),
   ], {
     assert: "sequence", arity: { exact: 2 }, code: ns.prefix + "/bad-attribute", what: "Attribute",

package/lib/webcrypto.js

@@ -339,10 +339,11 @@ SubtleCrypto.prototype.verify = async function verify(algorithm, key, signature,
     hm.update(buf);
     // Verify must RESOLVE false for any invalid signature, including one of
     // the wrong length. timingSafeEqual throws RangeError on a length
-    // mismatch, so gate on length first; the length is already public, so
-    // this leaks nothing a constant-time compare would protect.
-    var mac = hm.digest();
-    return mac.length === sig.length && nodeCrypto.timingSafeEqual(mac, sig);
+    // mismatch, so gate on the (public) length first, then compare the bytes
+    // in constant time. The length check leaks nothing a constant-time compare
+    // would protect; the secret-dependent byte comparison is timingSafeEqual.
+    var digest = hm.digest();
+    return digest.length === sig.length && nodeCrypto.timingSafeEqual(digest, sig);
   }
   throw new WebCryptoError("webcrypto/not-supported", "verify: unsupported algorithm " + JSON.stringify(name));
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:a62885e0-295d-4f1c-aa93-536269dabd5b",
+  "serialNumber": "urn:uuid:dfb00f98-2ca7-4fd1-b0e7-90fccf92604a",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-10T06:16:22.938Z",
+    "timestamp": "2026-07-10T12:57:51.582Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.1.23",
+      "bom-ref": "@blamejs/pki@0.1.24",
       "type": "application",
       "name": "pki",
-      "version": "0.1.23",
+      "version": "0.1.24",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.1.23",
+      "purl": "pkg:npm/%40blamejs/pki@0.1.24",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.1.23",
+      "ref": "@blamejs/pki@0.1.24",
       "dependsOn": []
     }
   ]