@blamejs/pki 0.1.31 → 0.1.32

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.1.32 — 2026-07-11
+
+OCSP-backed revocation checking joins certification-path validation.
+
+### Added
+
+- pki.path.ocspChecker(responses) -> RevocationChecker builds an OCSP-backed revocation checker for pki.path.validate's revocationChecker option from a set of pre-fetched OCSP responses (DER Buffer, PEM string, or already-parsed). It matches the full CertID triple against the certificate under whichever hash algorithm the CertID declares, authorizes the responder (issuing CA or a CA-issued id-kp-OCSPSigning delegate), verifies the response signature over tbsResponseData, and enforces thisUpdate/nextUpdate currency, reporting good, revoked (with revocationReason), or unknown. A wrong-issuer CertID, an unauthorized responder, a stale, not-yet-valid, or nextUpdate-less response, a non-successful responseStatus, or any verification failure yields unknown, which the validator fails closed unless softFail is set. RFC 6960.
+
 ## v0.1.31 — 2026-07-11
 
 The DER format cohort and the JOSE surface graduate to stable.

package/README.md

@@ -220,7 +220,7 @@ is callable today; nothing below is a stub.
 | `pki.acme` | RFC 8555 / 8737 / 8738 / 9773 ACME message layer over `pki.jose` — resource-object validators (closed status enums, conditional-required fields, unknown fields ignored), the three §7.1.6 state machines, request builders (newAccount + EAB, newOrder + `replaces`, finalize with CSR identifier-set match and account-key-reuse rejection, challenge responses, deactivation, revokeCert in both key modes, the keyChange nested JWS, POST-as-GET), the http-01 / dns-01 / tls-alpn-01 challenge computations, the dns/ip identifier validators, and the ARI certID (serial sign-padding preserved). A message layer, not an HTTP client — transport-injectable, fail-closed — `validate`, `identify`, `assertTransition`, the builders, `keyAuthorization`, `http01`, `dns01`, `tlsAlpn01Extension`, `verifyTlsAlpn01`, `ariCertId` |
 | `pki.schema.smime` | Decode S/MIME ESS signed-attribute values (RFC 5035 / RFC 8551) — `parseSigningCertificate` / `parseSigningCertificateV2` bind a signature to its signing certificate (cert hash, hash algorithm, issuer `GeneralNames` + serial), `parseSmimeCapabilities` decodes the ordered capability list, and `decodeAttribute` OID-dispatches a CMS attribute (enforcing the single-value rule, recognize-and-defer for unknown types). A companion decoder for CMS signed attributes, not an auto-routed format, fail-closed — `parseSigningCertificate`, `parseSigningCertificateV2`, `parseSmimeCapabilities`, `decodeAttribute` |
 | `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk` / `encode` / `embeddedDer` plus the schema combinators |
-| `pki.path` | RFC 5280 §6 certification-path validation — `validate` runs the §6.1 state machine (signature chaining, validity windows, name chaining, basic constraints and path length, key usage, name constraints, the certificate-policy tree) over an ordered path and a trust anchor, returning a structured verdict with per-check reason codes; `crlChecker` supplies CRL-based revocation. Pure and re-entrant, fail-closed — `validate`, `crlChecker` |
+| `pki.path` | RFC 5280 §6 certification-path validation — `validate` runs the §6.1 state machine (signature chaining, validity windows, name chaining, basic constraints and path length, key usage, name constraints, the certificate-policy tree) over an ordered path and a trust anchor, returning a structured verdict with per-check reason codes; `crlChecker` supplies CRL-based revocation and `ocspChecker` supplies OCSP-based revocation (RFC 6960 — CertID binding, responder authorization, signature, currency) over the same pluggable hook. Pure and re-entrant, fail-closed — `validate`, `crlChecker`, `ocspChecker` |
 | `pki.ct` | Parse RFC 6962 Certificate Transparency SCT lists — `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries in the SCT extension (a TLS-presentation-language payload inside the §3.3 double DER wrap) into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature; `reconstructSignedData` rebuilds the exact `digitally-signed` preimage for external verification. Structure decoded, crypto surfaced raw, bounded decode, fail-closed — `parseSctList`, `reconstructSignedData` |
 | `pki.merkle` | RFC 6962 / RFC 9162 Merkle-tree proof verification — `leafHash` / `nodeHash` / `emptyRootHash` build the domain-separated (0x00 leaf / 0x01 node) SHA-256 tree hashes; `verifyInclusion` folds an audit proof back to a root and `verifyConsistency` reconstructs both the old and new root (the append-only guarantee), each constant-time-compared to a trusted checkpoint root. Fail-closed on bad geometry, sync hashing, transport-free — `leafHash`, `nodeHash`, `emptyRootHash`, `verifyInclusion`, `verifyConsistency` |
 | `pki.C` / `pki.constants` | Version-stable constants — functional scale helpers (`C.TIME.*`, `C.BYTES.*`), codec `LIMITS`, `version` |

package/lib/guard-name.js

@@ -6,8 +6,9 @@
 // consumers whose name-string integrity composes this guard (pki.path.validate
 // DN chaining, pki.schema.x509 GeneralName / SAN decode).
 //
-// guard-name -- fail-closed rejection of an embedded control byte in a
-// distinguished-name / SAN string. Two policies over one concern.
+// guard-name -- fail-closed name integrity: reject an embedded control byte in a
+// distinguished-name / SAN string, and compare two distinguished names by their
+// RFC 5280 sec. 7.1 canonical identity rather than their raw bytes.
 //
 // Defends the name-truncation / display-confusion class (CVE-2009-2408): a NUL
 // or control byte embedded in a decoded name lets an attacker make two different
@@ -15,6 +16,14 @@
 // "good.example.com\0.evil.com" is treated as "good.example.com". CWE-158
 // (improper neutralization of null byte) / CWE-20. The reject is at decode, so a
 // truncation name never reaches a comparison or a display.
+//
+// Defends the DN identity-vs-bytes class (CWE-706): a distinguished name has many
+// RFC 5280 sec. 7.1-equal DER encodings (case, whitespace, PrintableString vs
+// UTF8String). Binding identity to raw bytes -- a byte compare, or hashing
+// name.bytes as a lookup key -- silently treats two equal names as different, so
+// certificate chaining breaks, a revocation issuer / OCSP responder fails to
+// match, or (the mirror risk) a name constraint is escaped. Every DN identity
+// decision routes through the one canonical comparison here.
 
 // assertNoControlBytes(str, E, code, label) -> str | throws E(code, ...)
 // DirectoryString policy (a DN attribute value): reject NUL and C0 control bytes
@@ -50,4 +59,53 @@ function assertPrintableIa5(buf, E, code, label) {
   return buf;
 }
 
-module.exports = { assertNoControlBytes: assertNoControlBytes, assertPrintableIa5: assertPrintableIa5 };
+// Canonical form of a single DN attribute value (RFC 5280 sec. 7.1): reject an
+// embedded control byte (CVE-2009-2408) then case-fold and collapse internal
+// whitespace. Every standard X.520 attribute uses caseIgnoreMatch, and this form
+// matches OpenSSL's X509_NAME_cmp, so a chain OpenSSL accepts is not rejected. This
+// canonicalization is the shape the guard-shape-reinlined detector keys on
+// (declared on dnEqual): a boundary hand-rolling it is re-implementing DN identity.
+function _canonAttrValue(v, E, code, label) {
+  if (typeof v !== "string") return v;
+  assertNoControlBytes(v, E, code, label);
+  return v.trim().replace(/\s+/g, " ").toLowerCase();
+}
+// rdnEqual(a, b, E, code, label) -> boolean. Canonical comparison of a single
+// RelativeDistinguishedName (an unordered SET of type/value pairs, compared as a
+// multiset). The RDN-level primitive a name-constraint directoryName prefix match
+// composes; dnEqual composes it over the RDN sequence. Comparing an RDN by raw DER
+// would treat two RFC 5280-equal names as different (or let a truncation name
+// compare equal).
+// @enforced-by guard-shape-reinlined  (shares the canonicalization shape declared on dnEqual)
+function rdnEqual(a, b, E, code, label) {
+  if (a.length !== b.length) return false;
+  var used = [];
+  for (var i = 0; i < a.length; i++) {
+    var found = false;
+    for (var j = 0; j < b.length; j++) {
+      if (used[j]) continue;
+      if (a[i].type === b[j].type && _canonAttrValue(a[i].value, E, code, label) === _canonAttrValue(b[j].value, E, code, label)) {
+        used[j] = true; found = true; break;
+      }
+    }
+    if (!found) return false;
+  }
+  return true;
+}
+// dnEqual(rdnsA, rdnsB, E, code, label) -> boolean. RFC 5280 sec. 7.1 canonical
+// distinguished-name comparison over the RDN sequence -- the ONE place a DN identity
+// is decided, so no caller binds identity to raw DER (a byte compare, or hashing
+// name.bytes, would treat two RFC 5280-equal names as different, breaking a chain /
+// a revocation match, or -- the mirror risk -- escaping a name constraint). The
+// per-RDN canonicalization + control-byte reject is in rdnEqual / _canonAttrValue.
+// @enforced-by guard-shape-reinlined
+// @guard-shape replace\(/\\s\+/g,
+function dnEqual(rdnsA, rdnsB, E, code, label) {
+  if (rdnsA.length !== rdnsB.length) return false;
+  for (var i = 0; i < rdnsA.length; i++) {
+    if (!rdnEqual(rdnsA[i], rdnsB[i], E, code, label)) return false;
+  }
+  return true;
+}
+
+module.exports = { assertNoControlBytes: assertNoControlBytes, assertPrintableIa5: assertPrintableIa5, dnEqual: dnEqual, rdnEqual: rdnEqual };

package/lib/path-validate.js

@@ -37,6 +37,7 @@ var asn1 = require("./asn1-der");
 var schema = require("./schema-engine");
 var x509 = require("./schema-x509");
 var crl = require("./schema-crl");
+var ocsp = require("./schema-ocsp");
 var guard = require("./guard-all");
 var constants = require("./constants");
 
@@ -336,42 +337,17 @@ function builtinVerify(state, cert) {
 
 // ---- 7.1 name comparison ---------------------------------------------------
 
-function normalizeAttrValue(v) {
-  // RFC 5280 7.1 canonical DN comparison: case-fold + collapse internal
-  // whitespace. Every standard X.520 DN attribute (CN/O/OU/L/ST/C/serialNumber/
-  // dnQualifier) uses caseIgnoreMatch, and this canonical form matches OpenSSL's
-  // X509_NAME_cmp -- applying it uniformly is the interoperable behavior, not a
-  // per-attribute caseExact rule that would reject a chain OpenSSL accepts.
-  // Reject embedded NUL / control bytes so a truncation attack (CVE-2009-2408)
-  // cannot make two different names compare equal.
-  if (typeof v !== "string") return v;
-  guard.name.assertNoControlBytes(v, E, "path/name-chaining", "distinguished name");
-  return v.trim().replace(/\s+/g, " ").toLowerCase();
+// RFC 5280 sec. 7.1 canonical DN / RDN comparison, via the shared name guard: the
+// canonical form (case-fold + internal-whitespace collapse) and the embedded
+// control-byte reject (CVE-2009-2408 -> path/name-chaining) live once in
+// guard-name, so no path-validation caller can reintroduce a raw-byte DN
+// comparison that treats two RFC 5280-equal names as different.
+function dnEqual(rdnsA, rdnsB) {
+  return guard.name.dnEqual(rdnsA, rdnsB, E, "path/name-chaining", "distinguished name");
 }
 
 function rdnEqual(a, b) {
-  if (a.length !== b.length) return false;
-  // An RDN is an unordered SET of type/value pairs; compare as multisets.
-  var used = [];
-  for (var i = 0; i < a.length; i++) {
-    var found = false;
-    for (var j = 0; j < b.length; j++) {
-      if (used[j]) continue;
-      if (a[i].type === b[j].type && normalizeAttrValue(a[i].value) === normalizeAttrValue(b[j].value)) {
-        used[j] = true; found = true; break;
-      }
-    }
-    if (!found) return false;
-  }
-  return true;
-}
-
-function dnEqual(rdnsA, rdnsB) {
-  if (rdnsA.length !== rdnsB.length) return false;
-  for (var i = 0; i < rdnsA.length; i++) {
-    if (!rdnEqual(rdnsA[i], rdnsB[i])) return false;
-  }
-  return true;
+  return guard.name.rdnEqual(a, b, E, "path/name-chaining", "distinguished name");
 }
 
 // ---- extension access ------------------------------------------------------
@@ -1583,23 +1559,295 @@ function crlEntryReason(entry) {
   return null;
 }
 
-function verifyCrlSignature(theCrl, issuer) {
+// Verify a raw signature over tbsBytes with an SPKI public key -- the shared core
+// of every certificate / CRL / OCSP signature check. Resolve the algorithm
+// descriptor, enforce the key-OID <-> sig-OID binding (the algorithm-confusion
+// guard, RFC 9814 sec. 4), import the SPKI, bridge an ECDSA DER signature to
+// P1363, and verify. Any fault -- an unresolvable/forbidden algorithm, a
+// key/sig mismatch, an import or verify failure -- resolves false: a signature
+// check never throws out of this path, it fails closed. `rawSig` is the raw
+// signature octets (the caller has already unwrapped any BIT STRING and rejected
+// a non-octet-aligned one).
+function _verifyWithSpki(sigAlg, rawSig, spkiBytes, tbsBytes) {
   var d;
   try {
-    d = resolveDescriptor(theCrl.signatureAlgorithm);
-    assertKeyMatchesSigAlg(issuer.workingPublicKey, theCrl.signatureAlgorithm.oid, d);
+    d = resolveDescriptor(sigAlg);
+    assertKeyMatchesSigAlg(spkiBytes, sigAlg.oid, d);
   } catch (_e) { return Promise.resolve(false); }
-  if (theCrl.signatureValue.unusedBits !== 0) return Promise.resolve(false);   // non-octet-aligned signature
-  var key;
-  return subtle.importKey("spki", issuer.workingPublicKey, d.imp, false, ["verify"]).then(function (k) {
-    key = k;
-    var sig = theCrl.signatureValue.bytes;
+  return subtle.importKey("spki", spkiBytes, d.imp, false, ["verify"]).then(function (key) {
+    var sig = rawSig;
     if (d.ecdsa) sig = ecdsaDerToP1363(sig, key.algorithm.namedCurve);
-    return subtle.verify(d.verify, key, sig, theCrl.tbsBytes);
+    return subtle.verify(d.verify, key, sig, tbsBytes);
   }).then(function (ok) { return ok === true; }, function () { return false; });
 }
 
+function verifyCrlSignature(theCrl, issuer) {
+  if (theCrl.signatureValue.unusedBits !== 0) return Promise.resolve(false);   // non-octet-aligned signature
+  return _verifyWithSpki(theCrl.signatureAlgorithm, theCrl.signatureValue.bytes, issuer.workingPublicKey, theCrl.tbsBytes);
+}
+
+// ---- the OCSP revocation checker (RFC 6960) -------------------------------
+
+// CertID identity-hash algorithms (RFC 6960 sec. 4.1.1). Kept SEPARATE from the
+// signature SIG_ALGS/HASH_BY_OID set (which omits SHA-1 -- a SHA-1 *signature* is
+// refused, SHAttered): a CertID hash is an identity binding of an already-known
+// issuer, not a signature, so collision resistance is irrelevant to the lookup
+// and RFC 6960's default SHA-1 CertID MUST interoperate. A hash OID outside this
+// set cannot be reproduced -> no CertID match (fail closed), never an assumption.
+var OCSP_CERTID_HASHES = {};
+OCSP_CERTID_HASHES[oid.byName("sha1")] = "SHA-1";
+OCSP_CERTID_HASHES[oid.byName("sha256")] = "SHA-256";
+OCSP_CERTID_HASHES[oid.byName("sha384")] = "SHA-384";
+OCSP_CERTID_HASHES[oid.byName("sha512")] = "SHA-512";
+var OID_OCSP_SIGNING = oid.byName("ocspSigning");
+var OID_OCSP_NOCHECK = oid.byName("ocspNoCheck");
+
+// The subjectPublicKey BIT STRING VALUE (excluding the unused-bits octet) of an
+// SPKI DER -- the exact bytes an OCSP CertID issuerKeyHash / byKey KeyHash hash
+// over (RFC 6960 sec. 4.1.1). Throws on a malformed SPKI; the caller fails closed.
+function ocspKeyValue(spkiDer) {
+  return asn1.read.bitString(asn1.decode(spkiDer).children[1]).bytes;
+}
+
+// The delegate responder's importable SPKI. If its key omits algorithm parameters
+// and inherits them from the issuing CA (same key algorithm -- an EC public key
+// whose SPKI omits the namedCurve, RFC 5280 sec. 4.1.2.7), splice the issuer's
+// parameters in so importKey("spki", ...) has a complete key; otherwise a valid
+// response would verify as unknown. Mirrors updateWorkingKey's inheritance.
+function ocspResponderSpki(rc, issuer) {
+  var keyAlg = rc.subjectPublicKeyInfo.algorithm;
+  if (!isNullOrAbsentParams(keyAlg.parameters)) return rc.subjectPublicKeyInfo.bytes;
+  var issuerOid, issuerParams;
+  try {
+    var alg = asn1.decode(issuer.workingPublicKey).children[0];
+    issuerOid = asn1.read.oid(alg.children[0]);
+    issuerParams = alg.children[1] ? alg.children[1].bytes : null;
+  } catch (_e) { return rc.subjectPublicKeyInfo.bytes; }
+  if (issuerOid === keyAlg.oid && !isNullOrAbsentParams(issuerParams)) {
+    return spliceSpkiParameters(rc.subjectPublicKeyInfo, keyAlg.oid, issuerParams);
+  }
+  return rc.subjectPublicKeyInfo.bytes;
+}
+function ocspDigest(alg, buf) { return subtle.digest(alg, buf).then(function (h) { return Buffer.from(h); }); }
+
+// The checker implements NO OCSP response-extension semantics (the nonce is the
+// live client's, RFC 6960 sec. 4.4.1; CRL References / Archive Cutoff / Service
+// Locator are not consulted), so a CRITICAL responseExtension / singleExtension
+// may change a response's meaning in a way this code cannot honor -- treat it as
+// unusable (RFC 6960 sec. 4.4 / the RFC 5280 critical-extension contract, the OCSP
+// analogue of the crlChecker unhandled-critical skip). Returns true if `extList`
+// carries any critical extension.
+function ocspHasCriticalExtension(extList) {
+  if (!extList) return false;
+  for (var i = 0; i < extList.length; i++) if (extList[i].critical) return true;
+  return false;
+}
+
+// A SingleResponse's CertID names the target cert IFF its serial equals the
+// target's AND issuerNameHash + issuerKeyHash, recomputed under the CertID's OWN
+// hashAlgorithm, match the issuer (RFC 6960 sec. 4.1.1). A serial-only match would
+// let a "good" for issuer A serial N answer a query for issuer B serial N
+// (cross-CA substitution), so BOTH issuer hashes must match under the responder's
+// chosen algorithm -- never an assumed SHA-1.
+//
+// `issuerNameCandidates` is every byte encoding of the (name-chaining-validated)
+// issuer DN to try: the checked cert's issuer field (RFC 6960 sec. 4.1.1) plus,
+// when available, the issuer certificate's own subject encoding. These are RFC
+// 5280 sec. 7.1-equal (they chained) but MAY differ in DER -- case, whitespace, a
+// PrintableString-vs-UTF8String DirectoryString choice -- and a responder MAY have
+// hashed any of them; matching the CertID against any is still the SAME validated
+// issuer, because the issuerKeyHash + serial + authorized signature carry the
+// binding. The key (raw octets, no encoding variance) is matched once.
+async function ocspCertIdMatches(certID, cert, issuerNameCandidates, issuerKeyBits) {
+  if (certID.serialNumberHex !== cert.serialNumberHex) return false;
+  var hashName = OCSP_CERTID_HASHES[certID.hashAlgorithm.oid];
+  if (!hashName) return false;   // an unreproducible hash -> the match cannot be confirmed
+  var keyHash = await ocspDigest(hashName, issuerKeyBits);
+  if (!certID.issuerKeyHash.equals(keyHash)) return false;
+  for (var i = 0; i < issuerNameCandidates.length; i++) {
+    if (certID.issuerNameHash.equals(await ocspDigest(hashName, issuerNameCandidates[i]))) return true;
+  }
+  return false;
+}
+
+// Resolve the signer of a BasicOCSPResponse to an AUTHORIZED responder's SPKI DER,
+// or null when none is authorized (RFC 6960 sec. 4.2.2.2). Two models: the issuing
+// CA signing directly (responderID identifies the issuer), or a CA-delegated
+// responder -- a certificate in `certs` issued by the SAME CA, valid at `time`,
+// bearing id-kp-OCSPSigning in its extendedKeyUsage. anyExtendedKeyUsage and an
+// ABSENT EKU do NOT authorize an OCSP delegate (the opposite of the path-validation
+// EKU default), so an ordinary leaf the CA issued cannot forge revocation status.
+// Fails closed at every branch (a malformed delegate, a control-byte DN, an
+// unreadable EKU -> skip that candidate).
+async function ocspAuthorizeResponder(basicResponse, cert, issuer, issuerKeyBits, time) {
+  var rid = basicResponse.responderID;
+  var matchesIssuer = false;
+  try {
+    if (rid.byName) matchesIssuer = dnEqual(rid.byName.rdns, cert.issuer.rdns);
+    else if (rid.byKey) matchesIssuer = rid.byKey.equals(await ocspDigest("SHA-1", issuerKeyBits));
+  } catch (_e) { matchesIssuer = false; }
+  if (matchesIssuer) return issuer.workingPublicKey;
+
+  for (var i = 0; i < basicResponse.certs.length; i++) {
+    var rc;
+    try { rc = x509.parse(basicResponse.certs[i]); }
+    catch (_e) { continue; }
+    var identifies = false;
+    try {
+      if (rid.byName) identifies = dnEqual(rid.byName.rdns, rc.subject.rdns);
+      else if (rid.byKey) identifies = rid.byKey.equals(await ocspDigest("SHA-1", ocspKeyValue(rc.subjectPublicKeyInfo.bytes)));
+    } catch (_e) { identifies = false; }
+    if (!identifies) continue;
+    // The delegate MUST be issued directly by the CA that issued the target.
+    var issuedByCa;
+    try { issuedByCa = dnEqual(rc.issuer.rdns, cert.issuer.rdns); }
+    catch (_e) { continue; }
+    if (!issuedByCa) continue;
+    if (rc.signatureValue.unusedBits !== 0) continue;
+    if (!(await _verifyWithSpki(rc.signatureAlgorithm, rc.signatureValue.bytes, issuer.workingPublicKey, rc.tbsBytes))) continue;
+    // The delegate certificate MUST itself be valid at the validation instant.
+    if (time < rc.validity.notBefore || time > rc.validity.notAfter) continue;
+    // The delegate MUST assert id-kp-OCSPSigning; anyEKU / an absent EKU do not.
+    var eku;
+    try { eku = decodeExt(rc, OID.extKeyUsage); }
+    catch (_e) { continue; }
+    if (!eku || eku.value.indexOf(OID_OCSP_SIGNING) === -1) continue;
+    // A delegate asserting keyUsage MUST permit digitalSignature -- signing an OCSP
+    // response is a digitalSignature operation (RFC 5280 sec. 4.2.1.3); an absent
+    // keyUsage is unrestricted, an unreadable one is not authoritative.
+    var ku;
+    try { ku = decodeExt(rc, OID.keyUsage); }
+    catch (_e) { continue; }
+    if (ku && ku.value.digitalSignature !== true) continue;
+    // A delegate carrying a critical extension this code does not process is
+    // unusable, the same fail-closed rule the path validator applies to any cert
+    // (RFC 5280 sec. 6.1.4(o)) -- an unknown critical constraint must not be ignored
+    // while its key is trusted to authenticate revocation status. A RECOGNIZED
+    // critical extension whose value is malformed is likewise rejected via the
+    // shared structure validation, exactly as the path validator rejects it.
+    if (unrecognizedCriticalExtension(rc, false)) continue;
+    if (validateCriticalExtensionStructure(rc)) continue;
+    // The delegate MUST carry id-pkix-ocsp-nocheck (RFC 6960 sec. 4.2.2.2.1): a
+    // transport-free checker cannot otherwise confirm the responder certificate has
+    // not itself been revoked, and a revoked OCSP-signing certificate would keep
+    // signing "good" until its notAfter. A deployment that instead supplies the
+    // responder's own status opts in through a future checker; absent nocheck, fail
+    // closed (unknown) rather than trust an unvalidated responder.
+    if (!findExt(rc, OID_OCSP_NOCHECK)) continue;
+    return ocspResponderSpki(rc, issuer);
+  }
+  return null;
+}
+
+/**
+ * @primitive  pki.path.ocspChecker
+ * @signature  pki.path.ocspChecker(responses) -> RevocationChecker
+ * @since      0.1.32
+ * @status     experimental
+ * @spec       RFC 6960
+ * @related    pki.path.validate, pki.schema.ocsp.parseResponse, pki.path.crlChecker
+ *
+ * Build an OCSP-backed `RevocationChecker` for `pki.path.validate`'s
+ * `revocationChecker` option from a set of pre-fetched OCSP responses (DER/PEM
+ * or already-parsed). For each certificate it locates a SingleResponse whose
+ * CertID binds this cert's serial to its issuer -- recomputing `issuerNameHash`
+ * and `issuerKeyHash` under the CertID's own hashAlgorithm (SHA-1 or SHA-2), so
+ * a response using either matches -- confirms the responder is authorized (the
+ * issuing CA directly, or a valid CA-issued delegate bearing both id-kp-OCSPSigning
+ * and id-pkix-ocsp-nocheck), verifies the response signature over
+ * `tbsResponseDataBytes`, checks currency
+ * (`thisUpdate`/`nextUpdate`), and reports `{ status: "good"|"revoked"|
+ * "unknown" }`. A wrong-issuer CertID, an unauthorized responder, a stale,
+ * not-yet-valid, nextUpdate-less, non-successful, or unverifiable response
+ * yields `unknown`, which the validator fails closed unless `softFail` is set;
+ * a `revoked` status surfaces its `revocationReason`. It is transport-free: the
+ * caller supplies bytes it collected (an OCSP fetch or a stapled response), so
+ * nonce anti-replay is the live client's responsibility and the residual replay
+ * defense is the `thisUpdate`/`nextUpdate` currency window.
+ *
+ * @example
+ *   var checker = pki.path.ocspChecker([]);   // no responses -> every cert is "unknown"
+ *   typeof checker.check;                       // "function"
+ */
+function ocspChecker(responses) {
+  var parsed = (responses || []).map(function (r) { return (r && r.responseStatus) ? r : ocsp.parseResponse(r); });
+  return {
+    check: async function (cert, issuer, ctx) {
+      var time = ctx.time;
+      var historical = ctx.historicalMode === true;
+      // Issuer DN candidates to match the CertID against (RFC 6960 sec. 4.1.1 names
+      // the checked cert's issuer field; a response MAY instead carry the issuer
+      // certificate's own subject encoding -- sec. 7.1-equal but not byte-identical).
+      var issuerNameCandidates = [cert.issuer.bytes];
+      function addNameCandidate(nm) {
+        if (nm && nm.bytes && !issuerNameCandidates.some(function (e) { return e.equals(nm.bytes); })) issuerNameCandidates.push(nm.bytes);
+      }
+      if (issuer.issuerCert) addNameCandidate(issuer.issuerCert.subject);
+      addNameCandidate(issuer.workingIssuerName);
+      var issuerKeyBits;
+      try { issuerKeyBits = ocspKeyValue(issuer.workingPublicKey); }
+      catch (_e) { return { status: "unknown", reason: "the issuer public key could not be read to recompute the OCSP CertID" }; }
+
+      // A serial is revoked if ANY authoritative, verified, current response says
+      // so -- a clean response must never shadow a revoking one (the crlChecker
+      // fail-closed law). "good" needs at least one authoritative match; every
+      // other outcome is undetermined.
+      var revokedResult = null;
+      var sawGood = false;
+      var sawUnknownStatus = false;
+
+      for (var k = 0; k < parsed.length; k++) {
+        var resp = parsed[k];
+        if (resp.responseStatus.code !== 0) continue;   // non-successful -> conveys no status
+        var br = resp.basicResponse;
+        if (!br) continue;
+        var signerSpki = await ocspAuthorizeResponder(br, cert, issuer, issuerKeyBits, time);
+        if (!signerSpki) continue;                       // unauthorized responder
+        if (!(await _verifyWithSpki(br.signatureAlgorithm, br.signature, signerSpki, br.tbsResponseDataBytes))) continue;
+        // A critical responseExtension changes the meaning of the WHOLE response
+        // and this code processes none -> the response is unusable.
+        if (ocspHasCriticalExtension(br.responseExtensions)) continue;
+        for (var s = 0; s < br.responses.length; s++) {
+          var sr = br.responses[s];
+          if (!(await ocspCertIdMatches(sr.certID, cert, issuerNameCandidates, issuerKeyBits))) continue;   // not about this cert
+          if (ocspHasCriticalExtension(sr.singleExtensions)) continue;   // a critical per-response extension this code cannot process -> skip
+          if (sr.thisUpdate > time) continue;                    // not yet valid
+          if (!sr.nextUpdate || sr.nextUpdate < time) continue;  // no bounded validity / stale -> fail closed
+          var st = sr.certStatus;
+          if (st.type === "revoked") {
+            // A revocation is effective as of its revocationTime. Present-time
+            // validation revokes regardless (a future revocationTime is
+            // post-dating/skew, never "good"); only an EXPLICIT historical
+            // validation defers a strictly-future revocation.
+            if (historical && st.revocationTime instanceof Date && st.revocationTime.getTime() > time.getTime()) { sawGood = true; }
+            else {
+              revokedResult = {
+                status: "revoked",
+                revocationReason: st.revocationReason || null,
+                reason: "certificate reported revoked by an authorized OCSP responder" + (st.revocationReason ? " (" + st.revocationReason + ")" : ""),
+              };
+            }
+          } else if (st.type === "good") {
+            sawGood = true;
+          } else {
+            sawUnknownStatus = true;   // an explicit responder "unknown"
+          }
+        }
+      }
+      if (revokedResult) return revokedResult;
+      if (sawGood) return { status: "good" };
+      return {
+        status: "unknown",
+        reason: sawUnknownStatus
+          ? "the OCSP responder reported certStatus unknown for this certificate"
+          : "no authoritative, current, in-scope OCSP response covers this certificate",
+      };
+    },
+  };
+}
+
 module.exports = {
   validate: validate,
   crlChecker: crlChecker,
+  ocspChecker: ocspChecker,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.1.31",
+  "version": "0.1.32",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",
@@ -72,6 +72,6 @@
   "devDependencies": {
     "c8": "11.0.0",
     "esbuild": "0.28.1",
-    "eslint": "10.3.0"
+    "eslint": "10.7.0"
   }
 }

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:2ed2aa23-5194-4472-96f3-c4013f134834",
+  "serialNumber": "urn:uuid:87ae1f84-9b42-4b45-820b-1323915f3fbe",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-11T16:09:44.713Z",
+    "timestamp": "2026-07-11T18:49:24.325Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.1.31",
+      "bom-ref": "@blamejs/pki@0.1.32",
       "type": "application",
       "name": "pki",
-      "version": "0.1.31",
+      "version": "0.1.32",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.1.31",
+      "purl": "pkg:npm/%40blamejs/pki@0.1.32",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.1.31",
+      "ref": "@blamejs/pki@0.1.32",
       "dependsOn": []
     }
   ]