@blamejs/pki 0.1.31 → 0.2.0

package/lib/path-validate.js

@@ -37,6 +37,7 @@ var asn1 = require("./asn1-der");
 var schema = require("./schema-engine");
 var x509 = require("./schema-x509");
 var crl = require("./schema-crl");
+var ocsp = require("./schema-ocsp");
 var guard = require("./guard-all");
 var constants = require("./constants");
 
@@ -69,6 +70,7 @@ var OID = {
   emailAddress: oid.byName("emailAddress"),
   extKeyUsage: oid.byName("extKeyUsage"),
   anyExtendedKeyUsage: oid.byName("anyExtendedKeyUsage"),
+  cRLDistributionPoints: oid.byName("cRLDistributionPoints"),
 };
 
 // The set of extension OIDs the validator PROCESSES -- an unrecognized critical
@@ -79,9 +81,15 @@ var OID = {
 // is the caller's opt-in via opts.requiredEku (RFC 5280 6.1 defines no EKU
 // processing step -- the required purpose is application context).
 var PROCESSED_EXTENSIONS = {};
+// cRLDistributionPoints is processed: the CRL checker consults it for the
+// sec. 6.3.3 shard correspondence, and a critical instance (sec. 4.2.1.13 is a
+// SHOULD-non-critical) is structurally validated by
+// validateCriticalExtensionStructure via the registered decoder. freshestCRL
+// stays OUT: sec. 4.2.1.15 requires it non-critical and the validator does not
+// consult it (no delta merge), so a critical instance fails unrecognized.
 [OID.basicConstraints, OID.keyUsage, OID.nameConstraints, OID.certificatePolicies,
  OID.policyMappings, OID.policyConstraints, OID.inhibitAnyPolicy, OID.subjectAltName,
- OID.extKeyUsage].
+ OID.extKeyUsage, OID.cRLDistributionPoints].
   forEach(function (o) { PROCESSED_EXTENSIONS[o] = true; });
 
 // ---- signature verify bridge (NEW 6) ---------------------------------------
@@ -317,7 +325,7 @@ function builtinVerify(state, cert) {
   } catch (e) { return Promise.resolve({ ok: false, code: pathCode(e, "path/unsupported-algorithm"), error: e }); }
   // The signature is an octet-aligned BIT STRING (no unused bits) for every
   // supported algorithm; a non-zero unused-bit count is malformed.
-  if (cert.signatureValue.unusedBits !== 0) return Promise.resolve({ ok: false, code: "path/bad-signature" });
+  if (!guard.crypto.isOctetAligned(cert.signatureValue)) return Promise.resolve({ ok: false, code: "path/bad-signature" });
   var key;
   return subtle.importKey("spki", state.workingPublicKey, d.imp, false, ["verify"]).then(function (k) {
     key = k;
@@ -336,42 +344,17 @@ function builtinVerify(state, cert) {
 
 // ---- 7.1 name comparison ---------------------------------------------------
 
-function normalizeAttrValue(v) {
-  // RFC 5280 7.1 canonical DN comparison: case-fold + collapse internal
-  // whitespace. Every standard X.520 DN attribute (CN/O/OU/L/ST/C/serialNumber/
-  // dnQualifier) uses caseIgnoreMatch, and this canonical form matches OpenSSL's
-  // X509_NAME_cmp -- applying it uniformly is the interoperable behavior, not a
-  // per-attribute caseExact rule that would reject a chain OpenSSL accepts.
-  // Reject embedded NUL / control bytes so a truncation attack (CVE-2009-2408)
-  // cannot make two different names compare equal.
-  if (typeof v !== "string") return v;
-  guard.name.assertNoControlBytes(v, E, "path/name-chaining", "distinguished name");
-  return v.trim().replace(/\s+/g, " ").toLowerCase();
+// RFC 5280 sec. 7.1 canonical DN / RDN comparison, via the shared name guard: the
+// canonical form (case-fold + internal-whitespace collapse) and the embedded
+// control-byte reject (CVE-2009-2408 -> path/name-chaining) live once in
+// guard-name, so no path-validation caller can reintroduce a raw-byte DN
+// comparison that treats two RFC 5280-equal names as different.
+function dnEqual(rdnsA, rdnsB) {
+  return guard.name.dnEqual(rdnsA, rdnsB, E, "path/name-chaining", "distinguished name");
 }
 
 function rdnEqual(a, b) {
-  if (a.length !== b.length) return false;
-  // An RDN is an unordered SET of type/value pairs; compare as multisets.
-  var used = [];
-  for (var i = 0; i < a.length; i++) {
-    var found = false;
-    for (var j = 0; j < b.length; j++) {
-      if (used[j]) continue;
-      if (a[i].type === b[j].type && normalizeAttrValue(a[i].value) === normalizeAttrValue(b[j].value)) {
-        used[j] = true; found = true; break;
-      }
-    }
-    if (!found) return false;
-  }
-  return true;
-}
-
-function dnEqual(rdnsA, rdnsB) {
-  if (rdnsA.length !== rdnsB.length) return false;
-  for (var i = 0; i < rdnsA.length; i++) {
-    if (!rdnEqual(rdnsA[i], rdnsB[i])) return false;
-  }
-  return true;
+  return guard.name.rdnEqual(a, b, E, "path/name-chaining", "distinguished name");
 }
 
 // ---- extension access ------------------------------------------------------
@@ -1074,8 +1057,7 @@ async function validate(path, opts) {
   // Bound the per-cert asymmetric-verify work BEFORE parsing an untrusted bundle
   // (the policy-tree cap guards CVE-2023-0464-style blow-up; this guards linear
   // crypto amplification from an oversized path). Entry-point tier: throw.
-  var maxCerts = opts.maxPathCerts !== undefined ? opts.maxPathCerts : constants.LIMITS.PATH_MAX_CERTS;
-  if (typeof maxCerts !== "number" || !isFinite(maxCerts) || maxCerts < 1) throw E("path/bad-input", "validate: opts.maxPathCerts must be a positive number");
+  var maxCerts = guard.limits.cap(opts.maxPathCerts, "validate: opts.maxPathCerts", constants.LIMITS.PATH_MAX_CERTS, { E: E, code: "path/bad-input", min: 1 });
   if (path.length > maxCerts) throw E("path/bad-input", "validate: the certification path has " + path.length + " certificates, exceeding the maxPathCerts limit (" + maxCerts + ")");
   var certs = path.map(function (c) { return (c && c.tbsBytes) ? c : x509.parse(c); });
   var n = certs.length;
@@ -1088,9 +1070,9 @@ async function validate(path, opts) {
   }
   // Entry-point tier for the remaining 6.1.1 user-initial inputs: a bad value
   // throws here rather than silently disabling the behavior it configures.
-  if (opts.maxPolicyNodes !== undefined && (typeof opts.maxPolicyNodes !== "number" || !isFinite(opts.maxPolicyNodes) || opts.maxPolicyNodes < 1)) {
-    throw E("path/bad-input", "validate: opts.maxPolicyNodes must be a positive number");
-  }
+  // Validate-if-present (the default is applied where the policy state is built);
+  // the shared integer cap rejects a fractional / negative / non-numeric budget.
+  guard.limits.cap(opts.maxPolicyNodes, "validate: opts.maxPolicyNodes", undefined, { E: E, code: "path/bad-input", min: 1 });
   // user-initial-policy-set is a non-empty SET of policy OID strings (6.1.1(c)).
   // Membership is tested with indexOf, so a raw string here would be consulted
   // as a SUBSTRING match -- validated to an array of strings instead.
@@ -1098,6 +1080,11 @@ async function validate(path, opts) {
     var uipsOk = Array.isArray(opts.userInitialPolicySet) && opts.userInitialPolicySet.length > 0 &&
       opts.userInitialPolicySet.every(function (p) { return typeof p === "string" && p.length > 0; });
     if (!uipsOk) throw E("path/bad-input", "validate: opts.userInitialPolicySet must be a non-empty array of policy OID strings");
+    // Each entry is compared (indexOf) against canonical decoder output, so a
+    // non-canonical key would silently never match -- fail the typo closed here.
+    opts.userInitialPolicySet.forEach(function (p) {
+      guard.identifier.assertCanonicalOid(p, E, "path/bad-input", "validate: opts.userInitialPolicySet entry " + JSON.stringify(p));
+    });
   }
   var seeds = {
     permitted: checkedSubtreeSeeds(opts.initialPermittedSubtrees, "initialPermittedSubtrees"),
@@ -1113,12 +1100,33 @@ async function validate(path, opts) {
     }
     requiredEku = opts.requiredEku.map(function (p) {
       if (typeof p !== "string" || p.length === 0) throw E("path/bad-input", "validate: opts.requiredEku entries must be non-empty strings");
-      if (/^\d+(\.\d+)+$/.test(p)) return p;
+      // A dotted-form attempt (leads with a digit) must be a canonical OID -- a
+      // loose regex accepted a leading-zero / out-of-bounds key that would never
+      // match the canonical EKU the target advertises; anything else is a name.
+      if (/^[0-9]/.test(p)) return guard.identifier.assertCanonicalOid(p, E, "path/bad-input", "validate: opts.requiredEku entry " + JSON.stringify(p));
       var dotted = oid.byName(p);
       if (typeof dotted !== "string") throw E("path/bad-input", "validate: opts.requiredEku entry " + JSON.stringify(p) + " is not a registered OID name");
       return dotted;
     });
   }
+  // opts.checkPurpose -- the single key purpose the ANCHOR's NSS trust metadata
+  // (distrustAfter / purposes) is consulted for. Independent of requiredEku
+  // (which gates the leaf's own EKU extension): this selects the per-purpose
+  // key in the trust-anchor constraint contract. A purpose OID name (or a
+  // canonical dotted OID normalized to its name); a bad value throws here.
+  var checkPurpose = null;
+  if (opts.checkPurpose !== undefined) {
+    if (typeof opts.checkPurpose !== "string" || opts.checkPurpose.length === 0) {
+      throw E("path/bad-input", "validate: opts.checkPurpose must be a key-purpose OID name or dotted OID string");
+    }
+    if (/^[0-9]/.test(opts.checkPurpose)) {
+      var cpDotted = guard.identifier.assertCanonicalOid(opts.checkPurpose, E, "path/bad-input", "validate: opts.checkPurpose");
+      checkPurpose = oid.name(cpDotted) || cpDotted;   // normalize a dotted purpose OID to its name for the anchor map
+    } else {
+      if (typeof oid.byName(opts.checkPurpose) !== "string") throw E("path/bad-input", "validate: opts.checkPurpose " + JSON.stringify(opts.checkPurpose) + " is not a registered OID name");
+      checkPurpose = opts.checkPurpose;
+    }
+  }
 
   var state = initialize(certs, opts, seeds);
   state._n = n;
@@ -1257,6 +1265,22 @@ async function validate(path, opts) {
       // default). An ABSENT extension leaves the key unrestricted, so it
       // satisfies any required purpose.
       if (requiredEku && ekuPurposeFails(cert, requiredEku, checks)) failed = true;
+      // Trust-anchor constraint contract (NSS / CCADB metadata; gated so a bare
+      // anchor or an absent checkPurpose is byte-identical to today). The anchor's
+      // per-purpose distrust-after date and delegator purposes apply to the
+      // end-entity leaf it ultimately certifies.
+      var ta = opts.trustAnchor;
+      if (checkPurpose && ta.distrustAfter && ta.distrustAfter[checkPurpose] instanceof Date &&
+          cert.validity.notBefore > ta.distrustAfter[checkPurpose]) {
+        // STRICTLY > : a leaf whose notBefore == the distrust date stays trusted
+        // (Mozilla certverifier isDistrustedCertificateChain: endEntityNotBefore
+        // <= distrustAfterTime -> not distrusted; the end-of-day ...235959Z
+        // convention keeps the whole boundary day trusted).
+        checks.push({ name: "distrustAfter", ok: false, code: "path/distrusted-after" }); failed = true;
+      }
+      if (checkPurpose && ta.purposes && ta.purposes[checkPurpose] !== true) {
+        checks.push({ name: "purposeTrust", ok: false, code: "path/purpose-not-trusted" }); failed = true;
+      }
       updateWorkingKey(state, cert);   // 6.1.5(c),(d) -- key AND algorithm AND parameters
     }
 
@@ -1354,11 +1378,24 @@ var IDP_SCHEMA = schema.seq([
 function decodeIdp(ext) {
   // Surface the scope flags the checker gates on. ANY structural or value fault
   // -- non-SEQUENCE, unknown/duplicate/out-of-order field tag, a non-DER BOOLEAN,
-  // an encoded-FALSE default -- leaves the CRL's scope unknown: the CRL is
-  // unusable, never assumed unrestricted.
-  var out = { hasDistributionPoint: false, onlyUser: false, onlyCa: false, onlySomeReasons: null, indirect: false, onlyAttr: false, malformed: false };
+  // an encoded-FALSE default, a malformed DistributionPointName -- leaves the
+  // CRL's scope unknown: the CRL is unusable, never assumed unrestricted.
+  var out = { hasDistributionPoint: false, distributionPoint: null, onlyUser: false, onlyCa: false, onlySomeReasons: null, indirect: false, onlyAttr: false, malformed: false };
   var m;
-  try { m = schema.walk(IDP_SCHEMA, asn1.decode(ext.value), NS); }
+  try {
+    m = schema.walk(IDP_SCHEMA, asn1.decode(ext.value), NS);
+    if (m.fields.distributionPoint.present) {
+      // distributionPoint [0] EXPLICIT-wraps the DistributionPointName CHOICE
+      // (a context tag on a CHOICE-typed field is always EXPLICIT). The decoded
+      // name feeds the sec. 6.3.3(b)(2)(i) correspondence against the
+      // certificate's own DistributionPoints in the checker below.
+      var dpnWrap = m.fields.distributionPoint.node;
+      if (!dpnWrap.children || dpnWrap.children.length !== 1) {
+        throw E("path/bad-idp", "IssuingDistributionPoint distributionPoint [0] must wrap exactly one DistributionPointName");
+      }
+      out.distributionPoint = pkix.distributionPointName(NS, dpnWrap.children[0], "path/bad-idp");
+    }
+  }
   catch (_e) { out.malformed = true; return out; }
   function flag(f) {
     if (!f.present) return false;
@@ -1377,6 +1414,58 @@ function decodeIdp(ext) {
   return out;
 }
 
+// RFC 5280 sec. 6.3.3(b)(2)(i): find the certificate DistributionPoint that
+// CORRESPONDS to a shard CRL's IDP distribution point name -- at least one
+// name in common between the two DistributionPointNames, compared by
+// BYTE-IDENTICAL DER encoding (Buffer.equals on the raw GeneralName / RDN
+// TLVs). sec. 5.2.5 pins the comparison key: "The identical encoding MUST be
+// used in the distributionPoint fields of the certificate and the CRL" -- so
+// a canonicalized or semantic comparison (which would equate two
+// differently-encoded names) is forbidden, and whole-set equality (which
+// would falsely reject a legitimate multi-URI DP sharing one name) is
+// over-strict. Mixed forms -- fullName on one side, nameRelativeToCRLIssuer
+// on the other -- never correspond here: resolving an RDN fragment against
+// the issuer DN is not attempted (fail closed). Per sec. 6.3.3(b)(1), a DP
+// naming a cRLIssuer participates only when that cRLIssuer is the certificate
+// issuer itself: the checker only consults CRLs issued BY the certificate
+// issuer and rejects indirect CRLs, so a DP delegated to another CRL issuer
+// is out of play. Returns the matched DP (its `reasons` feeds the coarse
+// reason-mask rule) or null.
+function correspondingCertDp(idpDpn, certDPs, issuerRdns) {
+  if (!idpDpn || !certDPs) return null;
+  for (var i = 0; i < certDPs.length; i++) {
+    var dp = certDPs[i];
+    if (!dp.distributionPoint) continue;
+    if (dp.cRLIssuer && !crlIssuerNamesIssuer(dp.cRLIssuer, issuerRdns)) continue;
+    var cdpn = dp.distributionPoint;
+    if (idpDpn.kind === "fullName" && cdpn.kind === "fullName") {
+      for (var a = 0; a < idpDpn.names.length; a++) {
+        for (var c = 0; c < cdpn.names.length; c++) {
+          if (idpDpn.names[a].equals(cdpn.names[c])) return dp;
+        }
+      }
+    } else if (idpDpn.kind === "rdn" && cdpn.kind === "rdn") {
+      if (idpDpn.bytes.equals(cdpn.bytes)) return dp;
+    }
+  }
+  return null;
+}
+
+// Does a DistributionPoint's cRLIssuer name the certificate issuer? True iff
+// one of its GeneralNames is a directoryName equal to the issuer DN under the
+// RFC 5280 sec. 7.1 comparison (the shared name guard, via this file's dnEqual
+// wrapper). Any fault -- a DN the comparison rejects for an embedded control
+// byte -- resolves false: the DP stays out of the correspondence (fail closed).
+function crlIssuerNamesIssuer(cRLIssuer, issuerRdns) {
+  for (var i = 0; i < cRLIssuer.names.length; i++) {
+    var n = cRLIssuer.names[i];
+    if (n.tagNumber !== 4 || !n.value || !n.value.rdns) continue;
+    try { if (dnEqual(n.value.rdns, issuerRdns)) return true; }
+    catch (_e) { return false; }
+  }
+  return false;
+}
+
 /**
  * @primitive  pki.path.crlChecker
  * @signature  pki.path.crlChecker(crls) -> RevocationChecker
@@ -1391,7 +1480,12 @@ function decodeIdp(ext) {
  * verifies the CRL signature over its `tbsBytes`, honors the issuing
  * distribution point scope and reason coverage, checks currency
  * (`thisUpdate`/`nextUpdate`), and reports `{ status: "good"|"revoked"|
- * "unknown" }`. An out-of-scope, stale, unauthorized, or unverifiable CRL
+ * "unknown" }`. A partitioned/sharded CRL (a critical IDP naming a
+ * distribution point) establishes "good" when it corresponds to one of the
+ * certificate's own cRLDistributionPoints -- at least one identically-encoded
+ * name in common (RFC 5280 sec. 6.3.3) -- and neither side restricts reason
+ * codes; a non-corresponding or reason-restricted shard is consulted for
+ * revocation only. An out-of-scope, stale, unauthorized, or unverifiable CRL
  * yields `unknown`, which the validator fails closed unless `softFail` is set.
  *
  * @example
@@ -1419,6 +1513,18 @@ function crlChecker(crls) {
       } catch (e) {
         certScopeFault = pathCode(e, "path/bad-extension-value");
       }
+      // The certificate's own cRLDistributionPoints, decoded once per check:
+      // the sec. 6.3.3(b)(2)(i) correspondence gate below needs the DP names.
+      // A decode fault leaves certDPs null -- every DP-scoped shard then stays
+      // revocation-only (no correspondence can be shown; fail closed) while
+      // the full-CRL path is unaffected (mirrors the basicConstraints
+      // handling above); the check never crashes on a malformed extension.
+      var certDPs = null;
+      var certCdpExt = findExt(cert, OID.cRLDistributionPoints);
+      if (certCdpExt) {
+        try { certDPs = EXT_DECODERS[OID.cRLDistributionPoints](certCdpExt.value); }
+        catch (_e) { certDPs = null; }
+      }
       // RFC 5280 sec. 6.3.3(f): IF a keyUsage extension is present in the CRL issuer's
       // certificate, the cRLSign bit must be VERIFIED set. An issuer that OMITS
       // keyUsage is unconstrained (the same rule the sec. 6.1.4(n) keyCertSign gate
@@ -1513,7 +1619,34 @@ function crlChecker(crls) {
           if (idp.onlyAttr) continue;                        // scoped to attribute certs, not this public-key cert
           if (idp.onlyCa && certIsCa !== true) continue;     // out of scope (or CA-ness undeterminable)
           if (idp.onlyUser && certIsCa !== false) continue;
-          if (idp.hasDistributionPoint || idp.onlySomeReasons) scopeRevocationOnly = true;
+          if (idp.hasDistributionPoint) {
+            // RFC 5280 sec. 6.3.3(b)(2)(i): a partition shard speaks for this
+            // certificate only when the IDP's distribution point shares at
+            // least one IDENTICALLY-ENCODED name with one of the certificate's
+            // own DistributionPoints (sec. 5.2.5: "The identical encoding MUST
+            // be used in the distributionPoint fields of the certificate and
+            // the CRL"). The IDP must also be CRITICAL to be relied on for
+            // scope: sec. 5.2.5 defines the IDP as "a critical CRL extension"
+            // (descriptive phrasing, not an imperative MUST), and a partition
+            // scope a non-supporting relying party would ignore is not a scope
+            // to build "good" on -- a deliberate fail-closed decision. A
+            // non-corresponding shard cannot establish "good" but is still
+            // consulted for revocation below: serials are unique per issuer,
+            // so a listed serial is a genuine revocation (fail closed toward
+            // revoked).
+            var matchedDp = idpExt.critical === true
+              ? correspondingCertDp(idp.distributionPoint, certDPs, cert.issuer.rdns)
+              : null;
+            if (!matchedDp) scopeRevocationOnly = true;
+            // sec. 6.3.3(d)(3): a matched DP carrying `reasons` bounds the
+            // interim reason mask below all-reasons -- under the coarse rule
+            // ("good" only at the (d)(4) all-reasons case) that shard is
+            // revocation-only.
+            else if (matchedDp.reasons) scopeRevocationOnly = true;
+          }
+          // sec. 6.3.3(d)(1)/(d)(2): any onlySomeReasons restriction keeps the
+          // interim reason mask below all-reasons -- revocation-only (coarse).
+          if (idp.onlySomeReasons) scopeRevocationOnly = true;
         }
         if (theCrl.thisUpdate > time) continue;              // not yet valid
         // A CRL with no nextUpdate has no bounded validity -- its currency
@@ -1583,23 +1716,295 @@ function crlEntryReason(entry) {
   return null;
 }
 
-function verifyCrlSignature(theCrl, issuer) {
+// Verify a raw signature over tbsBytes with an SPKI public key -- the shared core
+// of every certificate / CRL / OCSP signature check. Resolve the algorithm
+// descriptor, enforce the key-OID <-> sig-OID binding (the algorithm-confusion
+// guard, RFC 9814 sec. 4), import the SPKI, bridge an ECDSA DER signature to
+// P1363, and verify. Any fault -- an unresolvable/forbidden algorithm, a
+// key/sig mismatch, an import or verify failure -- resolves false: a signature
+// check never throws out of this path, it fails closed. `rawSig` is the raw
+// signature octets (the caller has already unwrapped any BIT STRING and rejected
+// a non-octet-aligned one).
+function _verifyWithSpki(sigAlg, rawSig, spkiBytes, tbsBytes) {
   var d;
   try {
-    d = resolveDescriptor(theCrl.signatureAlgorithm);
-    assertKeyMatchesSigAlg(issuer.workingPublicKey, theCrl.signatureAlgorithm.oid, d);
+    d = resolveDescriptor(sigAlg);
+    assertKeyMatchesSigAlg(spkiBytes, sigAlg.oid, d);
   } catch (_e) { return Promise.resolve(false); }
-  if (theCrl.signatureValue.unusedBits !== 0) return Promise.resolve(false);   // non-octet-aligned signature
-  var key;
-  return subtle.importKey("spki", issuer.workingPublicKey, d.imp, false, ["verify"]).then(function (k) {
-    key = k;
-    var sig = theCrl.signatureValue.bytes;
+  return subtle.importKey("spki", spkiBytes, d.imp, false, ["verify"]).then(function (key) {
+    var sig = rawSig;
     if (d.ecdsa) sig = ecdsaDerToP1363(sig, key.algorithm.namedCurve);
-    return subtle.verify(d.verify, key, sig, theCrl.tbsBytes);
+    return subtle.verify(d.verify, key, sig, tbsBytes);
   }).then(function (ok) { return ok === true; }, function () { return false; });
 }
 
+function verifyCrlSignature(theCrl, issuer) {
+  if (!guard.crypto.isOctetAligned(theCrl.signatureValue)) return Promise.resolve(false);   // non-octet-aligned signature
+  return _verifyWithSpki(theCrl.signatureAlgorithm, theCrl.signatureValue.bytes, issuer.workingPublicKey, theCrl.tbsBytes);
+}
+
+// ---- the OCSP revocation checker (RFC 6960) -------------------------------
+
+// CertID identity-hash algorithms (RFC 6960 sec. 4.1.1). Kept SEPARATE from the
+// signature SIG_ALGS/HASH_BY_OID set (which omits SHA-1 -- a SHA-1 *signature* is
+// refused, SHAttered): a CertID hash is an identity binding of an already-known
+// issuer, not a signature, so collision resistance is irrelevant to the lookup
+// and RFC 6960's default SHA-1 CertID MUST interoperate. A hash OID outside this
+// set cannot be reproduced -> no CertID match (fail closed), never an assumption.
+var OCSP_CERTID_HASHES = {};
+OCSP_CERTID_HASHES[oid.byName("sha1")] = "SHA-1";
+OCSP_CERTID_HASHES[oid.byName("sha256")] = "SHA-256";
+OCSP_CERTID_HASHES[oid.byName("sha384")] = "SHA-384";
+OCSP_CERTID_HASHES[oid.byName("sha512")] = "SHA-512";
+var OID_OCSP_SIGNING = oid.byName("ocspSigning");
+var OID_OCSP_NOCHECK = oid.byName("ocspNoCheck");
+
+// The subjectPublicKey BIT STRING VALUE (excluding the unused-bits octet) of an
+// SPKI DER -- the exact bytes an OCSP CertID issuerKeyHash / byKey KeyHash hash
+// over (RFC 6960 sec. 4.1.1). Throws on a malformed SPKI; the caller fails closed.
+function ocspKeyValue(spkiDer) {
+  return asn1.read.bitString(asn1.decode(spkiDer).children[1]).bytes;
+}
+
+// The delegate responder's importable SPKI. If its key omits algorithm parameters
+// and inherits them from the issuing CA (same key algorithm -- an EC public key
+// whose SPKI omits the namedCurve, RFC 5280 sec. 4.1.2.7), splice the issuer's
+// parameters in so importKey("spki", ...) has a complete key; otherwise a valid
+// response would verify as unknown. Mirrors updateWorkingKey's inheritance.
+function ocspResponderSpki(rc, issuer) {
+  var keyAlg = rc.subjectPublicKeyInfo.algorithm;
+  if (!isNullOrAbsentParams(keyAlg.parameters)) return rc.subjectPublicKeyInfo.bytes;
+  var issuerOid, issuerParams;
+  try {
+    var alg = asn1.decode(issuer.workingPublicKey).children[0];
+    issuerOid = asn1.read.oid(alg.children[0]);
+    issuerParams = alg.children[1] ? alg.children[1].bytes : null;
+  } catch (_e) { return rc.subjectPublicKeyInfo.bytes; }
+  if (issuerOid === keyAlg.oid && !isNullOrAbsentParams(issuerParams)) {
+    return spliceSpkiParameters(rc.subjectPublicKeyInfo, keyAlg.oid, issuerParams);
+  }
+  return rc.subjectPublicKeyInfo.bytes;
+}
+function ocspDigest(alg, buf) { return subtle.digest(alg, buf).then(function (h) { return Buffer.from(h); }); }
+
+// The checker implements NO OCSP response-extension semantics (the nonce is the
+// live client's, RFC 6960 sec. 4.4.1; CRL References / Archive Cutoff / Service
+// Locator are not consulted), so a CRITICAL responseExtension / singleExtension
+// may change a response's meaning in a way this code cannot honor -- treat it as
+// unusable (RFC 6960 sec. 4.4 / the RFC 5280 critical-extension contract, the OCSP
+// analogue of the crlChecker unhandled-critical skip). Returns true if `extList`
+// carries any critical extension.
+function ocspHasCriticalExtension(extList) {
+  if (!extList) return false;
+  for (var i = 0; i < extList.length; i++) if (extList[i].critical) return true;
+  return false;
+}
+
+// A SingleResponse's CertID names the target cert IFF its serial equals the
+// target's AND issuerNameHash + issuerKeyHash, recomputed under the CertID's OWN
+// hashAlgorithm, match the issuer (RFC 6960 sec. 4.1.1). A serial-only match would
+// let a "good" for issuer A serial N answer a query for issuer B serial N
+// (cross-CA substitution), so BOTH issuer hashes must match under the responder's
+// chosen algorithm -- never an assumed SHA-1.
+//
+// `issuerNameCandidates` is every byte encoding of the (name-chaining-validated)
+// issuer DN to try: the checked cert's issuer field (RFC 6960 sec. 4.1.1) plus,
+// when available, the issuer certificate's own subject encoding. These are RFC
+// 5280 sec. 7.1-equal (they chained) but MAY differ in DER -- case, whitespace, a
+// PrintableString-vs-UTF8String DirectoryString choice -- and a responder MAY have
+// hashed any of them; matching the CertID against any is still the SAME validated
+// issuer, because the issuerKeyHash + serial + authorized signature carry the
+// binding. The key (raw octets, no encoding variance) is matched once.
+async function ocspCertIdMatches(certID, cert, issuerNameCandidates, issuerKeyBits) {
+  if (certID.serialNumberHex !== cert.serialNumberHex) return false;
+  var hashName = OCSP_CERTID_HASHES[certID.hashAlgorithm.oid];
+  if (!hashName) return false;   // an unreproducible hash -> the match cannot be confirmed
+  var keyHash = await ocspDigest(hashName, issuerKeyBits);
+  if (!certID.issuerKeyHash.equals(keyHash)) return false;
+  for (var i = 0; i < issuerNameCandidates.length; i++) {
+    if (certID.issuerNameHash.equals(await ocspDigest(hashName, issuerNameCandidates[i]))) return true;
+  }
+  return false;
+}
+
+// Resolve the signer of a BasicOCSPResponse to an AUTHORIZED responder's SPKI DER,
+// or null when none is authorized (RFC 6960 sec. 4.2.2.2). Two models: the issuing
+// CA signing directly (responderID identifies the issuer), or a CA-delegated
+// responder -- a certificate in `certs` issued by the SAME CA, valid at `time`,
+// bearing id-kp-OCSPSigning in its extendedKeyUsage. anyExtendedKeyUsage and an
+// ABSENT EKU do NOT authorize an OCSP delegate (the opposite of the path-validation
+// EKU default), so an ordinary leaf the CA issued cannot forge revocation status.
+// Fails closed at every branch (a malformed delegate, a control-byte DN, an
+// unreadable EKU -> skip that candidate).
+async function ocspAuthorizeResponder(basicResponse, cert, issuer, issuerKeyBits, time) {
+  var rid = basicResponse.responderID;
+  var matchesIssuer = false;
+  try {
+    if (rid.byName) matchesIssuer = dnEqual(rid.byName.rdns, cert.issuer.rdns);
+    else if (rid.byKey) matchesIssuer = rid.byKey.equals(await ocspDigest("SHA-1", issuerKeyBits));
+  } catch (_e) { matchesIssuer = false; }
+  if (matchesIssuer) return issuer.workingPublicKey;
+
+  for (var i = 0; i < basicResponse.certs.length; i++) {
+    var rc;
+    try { rc = x509.parse(basicResponse.certs[i]); }
+    catch (_e) { continue; }
+    var identifies = false;
+    try {
+      if (rid.byName) identifies = dnEqual(rid.byName.rdns, rc.subject.rdns);
+      else if (rid.byKey) identifies = rid.byKey.equals(await ocspDigest("SHA-1", ocspKeyValue(rc.subjectPublicKeyInfo.bytes)));
+    } catch (_e) { identifies = false; }
+    if (!identifies) continue;
+    // The delegate MUST be issued directly by the CA that issued the target.
+    var issuedByCa;
+    try { issuedByCa = dnEqual(rc.issuer.rdns, cert.issuer.rdns); }
+    catch (_e) { continue; }
+    if (!issuedByCa) continue;
+    if (!guard.crypto.isOctetAligned(rc.signatureValue)) continue;
+    if (!(await _verifyWithSpki(rc.signatureAlgorithm, rc.signatureValue.bytes, issuer.workingPublicKey, rc.tbsBytes))) continue;
+    // The delegate certificate MUST itself be valid at the validation instant.
+    if (time < rc.validity.notBefore || time > rc.validity.notAfter) continue;
+    // The delegate MUST assert id-kp-OCSPSigning; anyEKU / an absent EKU do not.
+    var eku;
+    try { eku = decodeExt(rc, OID.extKeyUsage); }
+    catch (_e) { continue; }
+    if (!eku || eku.value.indexOf(OID_OCSP_SIGNING) === -1) continue;
+    // A delegate asserting keyUsage MUST permit digitalSignature -- signing an OCSP
+    // response is a digitalSignature operation (RFC 5280 sec. 4.2.1.3); an absent
+    // keyUsage is unrestricted, an unreadable one is not authoritative.
+    var ku;
+    try { ku = decodeExt(rc, OID.keyUsage); }
+    catch (_e) { continue; }
+    if (ku && ku.value.digitalSignature !== true) continue;
+    // A delegate carrying a critical extension this code does not process is
+    // unusable, the same fail-closed rule the path validator applies to any cert
+    // (RFC 5280 sec. 6.1.4(o)) -- an unknown critical constraint must not be ignored
+    // while its key is trusted to authenticate revocation status. A RECOGNIZED
+    // critical extension whose value is malformed is likewise rejected via the
+    // shared structure validation, exactly as the path validator rejects it.
+    if (unrecognizedCriticalExtension(rc, false)) continue;
+    if (validateCriticalExtensionStructure(rc)) continue;
+    // The delegate MUST carry id-pkix-ocsp-nocheck (RFC 6960 sec. 4.2.2.2.1): a
+    // transport-free checker cannot otherwise confirm the responder certificate has
+    // not itself been revoked, and a revoked OCSP-signing certificate would keep
+    // signing "good" until its notAfter. A deployment that instead supplies the
+    // responder's own status opts in through a future checker; absent nocheck, fail
+    // closed (unknown) rather than trust an unvalidated responder.
+    if (!findExt(rc, OID_OCSP_NOCHECK)) continue;
+    return ocspResponderSpki(rc, issuer);
+  }
+  return null;
+}
+
+/**
+ * @primitive  pki.path.ocspChecker
+ * @signature  pki.path.ocspChecker(responses) -> RevocationChecker
+ * @since      0.1.32
+ * @status     experimental
+ * @spec       RFC 6960
+ * @related    pki.path.validate, pki.schema.ocsp.parseResponse, pki.path.crlChecker
+ *
+ * Build an OCSP-backed `RevocationChecker` for `pki.path.validate`'s
+ * `revocationChecker` option from a set of pre-fetched OCSP responses (DER/PEM
+ * or already-parsed). For each certificate it locates a SingleResponse whose
+ * CertID binds this cert's serial to its issuer -- recomputing `issuerNameHash`
+ * and `issuerKeyHash` under the CertID's own hashAlgorithm (SHA-1 or SHA-2), so
+ * a response using either matches -- confirms the responder is authorized (the
+ * issuing CA directly, or a valid CA-issued delegate bearing both id-kp-OCSPSigning
+ * and id-pkix-ocsp-nocheck), verifies the response signature over
+ * `tbsResponseDataBytes`, checks currency
+ * (`thisUpdate`/`nextUpdate`), and reports `{ status: "good"|"revoked"|
+ * "unknown" }`. A wrong-issuer CertID, an unauthorized responder, a stale,
+ * not-yet-valid, nextUpdate-less, non-successful, or unverifiable response
+ * yields `unknown`, which the validator fails closed unless `softFail` is set;
+ * a `revoked` status surfaces its `revocationReason`. It is transport-free: the
+ * caller supplies bytes it collected (an OCSP fetch or a stapled response), so
+ * nonce anti-replay is the live client's responsibility and the residual replay
+ * defense is the `thisUpdate`/`nextUpdate` currency window.
+ *
+ * @example
+ *   var checker = pki.path.ocspChecker([]);   // no responses -> every cert is "unknown"
+ *   typeof checker.check;                       // "function"
+ */
+function ocspChecker(responses) {
+  var parsed = (responses || []).map(function (r) { return (r && r.responseStatus) ? r : ocsp.parseResponse(r); });
+  return {
+    check: async function (cert, issuer, ctx) {
+      var time = ctx.time;
+      var historical = ctx.historicalMode === true;
+      // Issuer DN candidates to match the CertID against (RFC 6960 sec. 4.1.1 names
+      // the checked cert's issuer field; a response MAY instead carry the issuer
+      // certificate's own subject encoding -- sec. 7.1-equal but not byte-identical).
+      var issuerNameCandidates = [cert.issuer.bytes];
+      function addNameCandidate(nm) {
+        if (nm && nm.bytes && !issuerNameCandidates.some(function (e) { return e.equals(nm.bytes); })) issuerNameCandidates.push(nm.bytes);
+      }
+      if (issuer.issuerCert) addNameCandidate(issuer.issuerCert.subject);
+      addNameCandidate(issuer.workingIssuerName);
+      var issuerKeyBits;
+      try { issuerKeyBits = ocspKeyValue(issuer.workingPublicKey); }
+      catch (_e) { return { status: "unknown", reason: "the issuer public key could not be read to recompute the OCSP CertID" }; }
+
+      // A serial is revoked if ANY authoritative, verified, current response says
+      // so -- a clean response must never shadow a revoking one (the crlChecker
+      // fail-closed law). "good" needs at least one authoritative match; every
+      // other outcome is undetermined.
+      var revokedResult = null;
+      var sawGood = false;
+      var sawUnknownStatus = false;
+
+      for (var k = 0; k < parsed.length; k++) {
+        var resp = parsed[k];
+        if (resp.responseStatus.code !== 0) continue;   // non-successful -> conveys no status
+        var br = resp.basicResponse;
+        if (!br) continue;
+        var signerSpki = await ocspAuthorizeResponder(br, cert, issuer, issuerKeyBits, time);
+        if (!signerSpki) continue;                       // unauthorized responder
+        if (!(await _verifyWithSpki(br.signatureAlgorithm, br.signature, signerSpki, br.tbsResponseDataBytes))) continue;
+        // A critical responseExtension changes the meaning of the WHOLE response
+        // and this code processes none -> the response is unusable.
+        if (ocspHasCriticalExtension(br.responseExtensions)) continue;
+        for (var s = 0; s < br.responses.length; s++) {
+          var sr = br.responses[s];
+          if (!(await ocspCertIdMatches(sr.certID, cert, issuerNameCandidates, issuerKeyBits))) continue;   // not about this cert
+          if (ocspHasCriticalExtension(sr.singleExtensions)) continue;   // a critical per-response extension this code cannot process -> skip
+          if (sr.thisUpdate > time) continue;                    // not yet valid
+          if (!sr.nextUpdate || sr.nextUpdate < time) continue;  // no bounded validity / stale -> fail closed
+          var st = sr.certStatus;
+          if (st.type === "revoked") {
+            // A revocation is effective as of its revocationTime. Present-time
+            // validation revokes regardless (a future revocationTime is
+            // post-dating/skew, never "good"); only an EXPLICIT historical
+            // validation defers a strictly-future revocation.
+            if (historical && st.revocationTime instanceof Date && st.revocationTime.getTime() > time.getTime()) { sawGood = true; }
+            else {
+              revokedResult = {
+                status: "revoked",
+                revocationReason: st.revocationReason || null,
+                reason: "certificate reported revoked by an authorized OCSP responder" + (st.revocationReason ? " (" + st.revocationReason + ")" : ""),
+              };
+            }
+          } else if (st.type === "good") {
+            sawGood = true;
+          } else {
+            sawUnknownStatus = true;   // an explicit responder "unknown"
+          }
+        }
+      }
+      if (revokedResult) return revokedResult;
+      if (sawGood) return { status: "good" };
+      return {
+        status: "unknown",
+        reason: sawUnknownStatus
+          ? "the OCSP responder reported certStatus unknown for this certificate"
+          : "no authoritative, current, in-scope OCSP response covers this certificate",
+      };
+    },
+  };
+}
+
 module.exports = {
   validate: validate,
   crlChecker: crlChecker,
+  ocspChecker: ocspChecker,
 };