@blamejs/pki 0.1.32 → 0.2.0

package/lib/path-validate.js

@@ -70,6 +70,7 @@ var OID = {
   emailAddress: oid.byName("emailAddress"),
   extKeyUsage: oid.byName("extKeyUsage"),
   anyExtendedKeyUsage: oid.byName("anyExtendedKeyUsage"),
+  cRLDistributionPoints: oid.byName("cRLDistributionPoints"),
 };
 
 // The set of extension OIDs the validator PROCESSES -- an unrecognized critical
@@ -80,9 +81,15 @@ var OID = {
 // is the caller's opt-in via opts.requiredEku (RFC 5280 6.1 defines no EKU
 // processing step -- the required purpose is application context).
 var PROCESSED_EXTENSIONS = {};
+// cRLDistributionPoints is processed: the CRL checker consults it for the
+// sec. 6.3.3 shard correspondence, and a critical instance (sec. 4.2.1.13 is a
+// SHOULD-non-critical) is structurally validated by
+// validateCriticalExtensionStructure via the registered decoder. freshestCRL
+// stays OUT: sec. 4.2.1.15 requires it non-critical and the validator does not
+// consult it (no delta merge), so a critical instance fails unrecognized.
 [OID.basicConstraints, OID.keyUsage, OID.nameConstraints, OID.certificatePolicies,
  OID.policyMappings, OID.policyConstraints, OID.inhibitAnyPolicy, OID.subjectAltName,
- OID.extKeyUsage].
+ OID.extKeyUsage, OID.cRLDistributionPoints].
   forEach(function (o) { PROCESSED_EXTENSIONS[o] = true; });
 
 // ---- signature verify bridge (NEW 6) ---------------------------------------
@@ -318,7 +325,7 @@ function builtinVerify(state, cert) {
   } catch (e) { return Promise.resolve({ ok: false, code: pathCode(e, "path/unsupported-algorithm"), error: e }); }
   // The signature is an octet-aligned BIT STRING (no unused bits) for every
   // supported algorithm; a non-zero unused-bit count is malformed.
-  if (cert.signatureValue.unusedBits !== 0) return Promise.resolve({ ok: false, code: "path/bad-signature" });
+  if (!guard.crypto.isOctetAligned(cert.signatureValue)) return Promise.resolve({ ok: false, code: "path/bad-signature" });
   var key;
   return subtle.importKey("spki", state.workingPublicKey, d.imp, false, ["verify"]).then(function (k) {
     key = k;
@@ -1050,8 +1057,7 @@ async function validate(path, opts) {
   // Bound the per-cert asymmetric-verify work BEFORE parsing an untrusted bundle
   // (the policy-tree cap guards CVE-2023-0464-style blow-up; this guards linear
   // crypto amplification from an oversized path). Entry-point tier: throw.
-  var maxCerts = opts.maxPathCerts !== undefined ? opts.maxPathCerts : constants.LIMITS.PATH_MAX_CERTS;
-  if (typeof maxCerts !== "number" || !isFinite(maxCerts) || maxCerts < 1) throw E("path/bad-input", "validate: opts.maxPathCerts must be a positive number");
+  var maxCerts = guard.limits.cap(opts.maxPathCerts, "validate: opts.maxPathCerts", constants.LIMITS.PATH_MAX_CERTS, { E: E, code: "path/bad-input", min: 1 });
   if (path.length > maxCerts) throw E("path/bad-input", "validate: the certification path has " + path.length + " certificates, exceeding the maxPathCerts limit (" + maxCerts + ")");
   var certs = path.map(function (c) { return (c && c.tbsBytes) ? c : x509.parse(c); });
   var n = certs.length;
@@ -1064,9 +1070,9 @@ async function validate(path, opts) {
   }
   // Entry-point tier for the remaining 6.1.1 user-initial inputs: a bad value
   // throws here rather than silently disabling the behavior it configures.
-  if (opts.maxPolicyNodes !== undefined && (typeof opts.maxPolicyNodes !== "number" || !isFinite(opts.maxPolicyNodes) || opts.maxPolicyNodes < 1)) {
-    throw E("path/bad-input", "validate: opts.maxPolicyNodes must be a positive number");
-  }
+  // Validate-if-present (the default is applied where the policy state is built);
+  // the shared integer cap rejects a fractional / negative / non-numeric budget.
+  guard.limits.cap(opts.maxPolicyNodes, "validate: opts.maxPolicyNodes", undefined, { E: E, code: "path/bad-input", min: 1 });
   // user-initial-policy-set is a non-empty SET of policy OID strings (6.1.1(c)).
   // Membership is tested with indexOf, so a raw string here would be consulted
   // as a SUBSTRING match -- validated to an array of strings instead.
@@ -1074,6 +1080,11 @@ async function validate(path, opts) {
     var uipsOk = Array.isArray(opts.userInitialPolicySet) && opts.userInitialPolicySet.length > 0 &&
       opts.userInitialPolicySet.every(function (p) { return typeof p === "string" && p.length > 0; });
     if (!uipsOk) throw E("path/bad-input", "validate: opts.userInitialPolicySet must be a non-empty array of policy OID strings");
+    // Each entry is compared (indexOf) against canonical decoder output, so a
+    // non-canonical key would silently never match -- fail the typo closed here.
+    opts.userInitialPolicySet.forEach(function (p) {
+      guard.identifier.assertCanonicalOid(p, E, "path/bad-input", "validate: opts.userInitialPolicySet entry " + JSON.stringify(p));
+    });
   }
   var seeds = {
     permitted: checkedSubtreeSeeds(opts.initialPermittedSubtrees, "initialPermittedSubtrees"),
@@ -1089,12 +1100,33 @@ async function validate(path, opts) {
     }
     requiredEku = opts.requiredEku.map(function (p) {
       if (typeof p !== "string" || p.length === 0) throw E("path/bad-input", "validate: opts.requiredEku entries must be non-empty strings");
-      if (/^\d+(\.\d+)+$/.test(p)) return p;
+      // A dotted-form attempt (leads with a digit) must be a canonical OID -- a
+      // loose regex accepted a leading-zero / out-of-bounds key that would never
+      // match the canonical EKU the target advertises; anything else is a name.
+      if (/^[0-9]/.test(p)) return guard.identifier.assertCanonicalOid(p, E, "path/bad-input", "validate: opts.requiredEku entry " + JSON.stringify(p));
       var dotted = oid.byName(p);
       if (typeof dotted !== "string") throw E("path/bad-input", "validate: opts.requiredEku entry " + JSON.stringify(p) + " is not a registered OID name");
       return dotted;
     });
   }
+  // opts.checkPurpose -- the single key purpose the ANCHOR's NSS trust metadata
+  // (distrustAfter / purposes) is consulted for. Independent of requiredEku
+  // (which gates the leaf's own EKU extension): this selects the per-purpose
+  // key in the trust-anchor constraint contract. A purpose OID name (or a
+  // canonical dotted OID normalized to its name); a bad value throws here.
+  var checkPurpose = null;
+  if (opts.checkPurpose !== undefined) {
+    if (typeof opts.checkPurpose !== "string" || opts.checkPurpose.length === 0) {
+      throw E("path/bad-input", "validate: opts.checkPurpose must be a key-purpose OID name or dotted OID string");
+    }
+    if (/^[0-9]/.test(opts.checkPurpose)) {
+      var cpDotted = guard.identifier.assertCanonicalOid(opts.checkPurpose, E, "path/bad-input", "validate: opts.checkPurpose");
+      checkPurpose = oid.name(cpDotted) || cpDotted;   // normalize a dotted purpose OID to its name for the anchor map
+    } else {
+      if (typeof oid.byName(opts.checkPurpose) !== "string") throw E("path/bad-input", "validate: opts.checkPurpose " + JSON.stringify(opts.checkPurpose) + " is not a registered OID name");
+      checkPurpose = opts.checkPurpose;
+    }
+  }
 
   var state = initialize(certs, opts, seeds);
   state._n = n;
@@ -1233,6 +1265,22 @@ async function validate(path, opts) {
       // default). An ABSENT extension leaves the key unrestricted, so it
       // satisfies any required purpose.
       if (requiredEku && ekuPurposeFails(cert, requiredEku, checks)) failed = true;
+      // Trust-anchor constraint contract (NSS / CCADB metadata; gated so a bare
+      // anchor or an absent checkPurpose is byte-identical to today). The anchor's
+      // per-purpose distrust-after date and delegator purposes apply to the
+      // end-entity leaf it ultimately certifies.
+      var ta = opts.trustAnchor;
+      if (checkPurpose && ta.distrustAfter && ta.distrustAfter[checkPurpose] instanceof Date &&
+          cert.validity.notBefore > ta.distrustAfter[checkPurpose]) {
+        // STRICTLY > : a leaf whose notBefore == the distrust date stays trusted
+        // (Mozilla certverifier isDistrustedCertificateChain: endEntityNotBefore
+        // <= distrustAfterTime -> not distrusted; the end-of-day ...235959Z
+        // convention keeps the whole boundary day trusted).
+        checks.push({ name: "distrustAfter", ok: false, code: "path/distrusted-after" }); failed = true;
+      }
+      if (checkPurpose && ta.purposes && ta.purposes[checkPurpose] !== true) {
+        checks.push({ name: "purposeTrust", ok: false, code: "path/purpose-not-trusted" }); failed = true;
+      }
       updateWorkingKey(state, cert);   // 6.1.5(c),(d) -- key AND algorithm AND parameters
     }
 
@@ -1330,11 +1378,24 @@ var IDP_SCHEMA = schema.seq([
 function decodeIdp(ext) {
   // Surface the scope flags the checker gates on. ANY structural or value fault
   // -- non-SEQUENCE, unknown/duplicate/out-of-order field tag, a non-DER BOOLEAN,
-  // an encoded-FALSE default -- leaves the CRL's scope unknown: the CRL is
-  // unusable, never assumed unrestricted.
-  var out = { hasDistributionPoint: false, onlyUser: false, onlyCa: false, onlySomeReasons: null, indirect: false, onlyAttr: false, malformed: false };
+  // an encoded-FALSE default, a malformed DistributionPointName -- leaves the
+  // CRL's scope unknown: the CRL is unusable, never assumed unrestricted.
+  var out = { hasDistributionPoint: false, distributionPoint: null, onlyUser: false, onlyCa: false, onlySomeReasons: null, indirect: false, onlyAttr: false, malformed: false };
   var m;
-  try { m = schema.walk(IDP_SCHEMA, asn1.decode(ext.value), NS); }
+  try {
+    m = schema.walk(IDP_SCHEMA, asn1.decode(ext.value), NS);
+    if (m.fields.distributionPoint.present) {
+      // distributionPoint [0] EXPLICIT-wraps the DistributionPointName CHOICE
+      // (a context tag on a CHOICE-typed field is always EXPLICIT). The decoded
+      // name feeds the sec. 6.3.3(b)(2)(i) correspondence against the
+      // certificate's own DistributionPoints in the checker below.
+      var dpnWrap = m.fields.distributionPoint.node;
+      if (!dpnWrap.children || dpnWrap.children.length !== 1) {
+        throw E("path/bad-idp", "IssuingDistributionPoint distributionPoint [0] must wrap exactly one DistributionPointName");
+      }
+      out.distributionPoint = pkix.distributionPointName(NS, dpnWrap.children[0], "path/bad-idp");
+    }
+  }
   catch (_e) { out.malformed = true; return out; }
   function flag(f) {
     if (!f.present) return false;
@@ -1353,6 +1414,58 @@ function decodeIdp(ext) {
   return out;
 }
 
+// RFC 5280 sec. 6.3.3(b)(2)(i): find the certificate DistributionPoint that
+// CORRESPONDS to a shard CRL's IDP distribution point name -- at least one
+// name in common between the two DistributionPointNames, compared by
+// BYTE-IDENTICAL DER encoding (Buffer.equals on the raw GeneralName / RDN
+// TLVs). sec. 5.2.5 pins the comparison key: "The identical encoding MUST be
+// used in the distributionPoint fields of the certificate and the CRL" -- so
+// a canonicalized or semantic comparison (which would equate two
+// differently-encoded names) is forbidden, and whole-set equality (which
+// would falsely reject a legitimate multi-URI DP sharing one name) is
+// over-strict. Mixed forms -- fullName on one side, nameRelativeToCRLIssuer
+// on the other -- never correspond here: resolving an RDN fragment against
+// the issuer DN is not attempted (fail closed). Per sec. 6.3.3(b)(1), a DP
+// naming a cRLIssuer participates only when that cRLIssuer is the certificate
+// issuer itself: the checker only consults CRLs issued BY the certificate
+// issuer and rejects indirect CRLs, so a DP delegated to another CRL issuer
+// is out of play. Returns the matched DP (its `reasons` feeds the coarse
+// reason-mask rule) or null.
+function correspondingCertDp(idpDpn, certDPs, issuerRdns) {
+  if (!idpDpn || !certDPs) return null;
+  for (var i = 0; i < certDPs.length; i++) {
+    var dp = certDPs[i];
+    if (!dp.distributionPoint) continue;
+    if (dp.cRLIssuer && !crlIssuerNamesIssuer(dp.cRLIssuer, issuerRdns)) continue;
+    var cdpn = dp.distributionPoint;
+    if (idpDpn.kind === "fullName" && cdpn.kind === "fullName") {
+      for (var a = 0; a < idpDpn.names.length; a++) {
+        for (var c = 0; c < cdpn.names.length; c++) {
+          if (idpDpn.names[a].equals(cdpn.names[c])) return dp;
+        }
+      }
+    } else if (idpDpn.kind === "rdn" && cdpn.kind === "rdn") {
+      if (idpDpn.bytes.equals(cdpn.bytes)) return dp;
+    }
+  }
+  return null;
+}
+
+// Does a DistributionPoint's cRLIssuer name the certificate issuer? True iff
+// one of its GeneralNames is a directoryName equal to the issuer DN under the
+// RFC 5280 sec. 7.1 comparison (the shared name guard, via this file's dnEqual
+// wrapper). Any fault -- a DN the comparison rejects for an embedded control
+// byte -- resolves false: the DP stays out of the correspondence (fail closed).
+function crlIssuerNamesIssuer(cRLIssuer, issuerRdns) {
+  for (var i = 0; i < cRLIssuer.names.length; i++) {
+    var n = cRLIssuer.names[i];
+    if (n.tagNumber !== 4 || !n.value || !n.value.rdns) continue;
+    try { if (dnEqual(n.value.rdns, issuerRdns)) return true; }
+    catch (_e) { return false; }
+  }
+  return false;
+}
+
 /**
  * @primitive  pki.path.crlChecker
  * @signature  pki.path.crlChecker(crls) -> RevocationChecker
@@ -1367,7 +1480,12 @@ function decodeIdp(ext) {
  * verifies the CRL signature over its `tbsBytes`, honors the issuing
  * distribution point scope and reason coverage, checks currency
  * (`thisUpdate`/`nextUpdate`), and reports `{ status: "good"|"revoked"|
- * "unknown" }`. An out-of-scope, stale, unauthorized, or unverifiable CRL
+ * "unknown" }`. A partitioned/sharded CRL (a critical IDP naming a
+ * distribution point) establishes "good" when it corresponds to one of the
+ * certificate's own cRLDistributionPoints -- at least one identically-encoded
+ * name in common (RFC 5280 sec. 6.3.3) -- and neither side restricts reason
+ * codes; a non-corresponding or reason-restricted shard is consulted for
+ * revocation only. An out-of-scope, stale, unauthorized, or unverifiable CRL
  * yields `unknown`, which the validator fails closed unless `softFail` is set.
  *
  * @example
@@ -1395,6 +1513,18 @@ function crlChecker(crls) {
       } catch (e) {
         certScopeFault = pathCode(e, "path/bad-extension-value");
       }
+      // The certificate's own cRLDistributionPoints, decoded once per check:
+      // the sec. 6.3.3(b)(2)(i) correspondence gate below needs the DP names.
+      // A decode fault leaves certDPs null -- every DP-scoped shard then stays
+      // revocation-only (no correspondence can be shown; fail closed) while
+      // the full-CRL path is unaffected (mirrors the basicConstraints
+      // handling above); the check never crashes on a malformed extension.
+      var certDPs = null;
+      var certCdpExt = findExt(cert, OID.cRLDistributionPoints);
+      if (certCdpExt) {
+        try { certDPs = EXT_DECODERS[OID.cRLDistributionPoints](certCdpExt.value); }
+        catch (_e) { certDPs = null; }
+      }
       // RFC 5280 sec. 6.3.3(f): IF a keyUsage extension is present in the CRL issuer's
       // certificate, the cRLSign bit must be VERIFIED set. An issuer that OMITS
       // keyUsage is unconstrained (the same rule the sec. 6.1.4(n) keyCertSign gate
@@ -1489,7 +1619,34 @@ function crlChecker(crls) {
           if (idp.onlyAttr) continue;                        // scoped to attribute certs, not this public-key cert
           if (idp.onlyCa && certIsCa !== true) continue;     // out of scope (or CA-ness undeterminable)
           if (idp.onlyUser && certIsCa !== false) continue;
-          if (idp.hasDistributionPoint || idp.onlySomeReasons) scopeRevocationOnly = true;
+          if (idp.hasDistributionPoint) {
+            // RFC 5280 sec. 6.3.3(b)(2)(i): a partition shard speaks for this
+            // certificate only when the IDP's distribution point shares at
+            // least one IDENTICALLY-ENCODED name with one of the certificate's
+            // own DistributionPoints (sec. 5.2.5: "The identical encoding MUST
+            // be used in the distributionPoint fields of the certificate and
+            // the CRL"). The IDP must also be CRITICAL to be relied on for
+            // scope: sec. 5.2.5 defines the IDP as "a critical CRL extension"
+            // (descriptive phrasing, not an imperative MUST), and a partition
+            // scope a non-supporting relying party would ignore is not a scope
+            // to build "good" on -- a deliberate fail-closed decision. A
+            // non-corresponding shard cannot establish "good" but is still
+            // consulted for revocation below: serials are unique per issuer,
+            // so a listed serial is a genuine revocation (fail closed toward
+            // revoked).
+            var matchedDp = idpExt.critical === true
+              ? correspondingCertDp(idp.distributionPoint, certDPs, cert.issuer.rdns)
+              : null;
+            if (!matchedDp) scopeRevocationOnly = true;
+            // sec. 6.3.3(d)(3): a matched DP carrying `reasons` bounds the
+            // interim reason mask below all-reasons -- under the coarse rule
+            // ("good" only at the (d)(4) all-reasons case) that shard is
+            // revocation-only.
+            else if (matchedDp.reasons) scopeRevocationOnly = true;
+          }
+          // sec. 6.3.3(d)(1)/(d)(2): any onlySomeReasons restriction keeps the
+          // interim reason mask below all-reasons -- revocation-only (coarse).
+          if (idp.onlySomeReasons) scopeRevocationOnly = true;
         }
         if (theCrl.thisUpdate > time) continue;              // not yet valid
         // A CRL with no nextUpdate has no bounded validity -- its currency
@@ -1582,7 +1739,7 @@ function _verifyWithSpki(sigAlg, rawSig, spkiBytes, tbsBytes) {
 }
 
 function verifyCrlSignature(theCrl, issuer) {
-  if (theCrl.signatureValue.unusedBits !== 0) return Promise.resolve(false);   // non-octet-aligned signature
+  if (!guard.crypto.isOctetAligned(theCrl.signatureValue)) return Promise.resolve(false);   // non-octet-aligned signature
   return _verifyWithSpki(theCrl.signatureAlgorithm, theCrl.signatureValue.bytes, issuer.workingPublicKey, theCrl.tbsBytes);
 }
 
@@ -1703,7 +1860,7 @@ async function ocspAuthorizeResponder(basicResponse, cert, issuer, issuerKeyBits
     try { issuedByCa = dnEqual(rc.issuer.rdns, cert.issuer.rdns); }
     catch (_e) { continue; }
     if (!issuedByCa) continue;
-    if (rc.signatureValue.unusedBits !== 0) continue;
+    if (!guard.crypto.isOctetAligned(rc.signatureValue)) continue;
     if (!(await _verifyWithSpki(rc.signatureAlgorithm, rc.signatureValue.bytes, issuer.workingPublicKey, rc.tbsBytes))) continue;
     // The delegate certificate MUST itself be valid at the validation instant.
     if (time < rc.validity.notBefore || time > rc.validity.notAfter) continue;

package/lib/schema-attrcert.js

@@ -37,6 +37,7 @@ var asn1 = require("./asn1-der");
 var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
 var oid = require("./oid");
+var guard = require("./guard-all");
 var frameworkError = require("./framework-error");
 
 var AttrCertError = frameworkError.AttrCertError;
@@ -119,6 +120,10 @@ var OBJECT_DIGEST_INFO = schema.seq([
     if (m.fields.otherObjectTypeID.present) {
       throw ctx.E("attrcert/bad-object-digest-info", "otherObjectTypeID is only valid with otherObjectTypes(2), which RFC 5755 sec. 7.3 forbids");
     }
+    // The objectDigest is a whole-octet digest over the identified object; a
+    // non-octet-aligned BIT STRING is malformed (RFC 5755 sec. 4.1) and has no
+    // in-tree verify layer to catch it later, so reject it at parse.
+    guard.crypto.assertOctetAligned(m.fields.objectDigest.value, ctx.E, "attrcert/bad-object-digest-info", "objectDigest");
     return {
       digestedObjectType: t,
       otherObjectTypeID: null,

package/lib/schema-cms.js

@@ -214,7 +214,13 @@ function _assertContentTypeMatchesAttrs(attrs, eContentType) {
   for (var i = 0; i < attrs.length; i++) {
     if (attrs[i].type !== OID_CONTENT_TYPE) continue;
     if (attrs[i].values.length !== 1) throw NS.E("cms/bad-content-type-attr", "the content-type attribute must be single-valued (RFC 5652 sec. 11.1)");
-    var ctv = asn1.read.oid(asn1.decode(attrs[i].values[0]));
+    // ContentType ::= OBJECT IDENTIFIER -- validate the value's full syntax (tag AND
+    // minimal base-128 OID content) with the CMS typed verdict, so a malformed value
+    // on a path that does not run _checkContentBindingAttrs (AuthEnvelopedData,
+    // RFC 5083 sec. 2.1) surfaces cms/bad-content-type-attr, not the raw asn1/* error.
+    var ctv;
+    try { ctv = asn1.read.oid(asn1.decode(attrs[i].values[0])); }
+    catch (e) { throw NS.E("cms/bad-content-type-attr", "the content-type attribute value must be a valid OBJECT IDENTIFIER", e); }
     if (ctv !== eContentType) throw NS.E("cms/content-type-mismatch", "the content-type attribute (" + ctv + ") must equal the eContentType (" + eContentType + ") (RFC 5652 sec. 5.3)");
   }
 }
@@ -1155,6 +1161,20 @@ function walkEnvelopedData(node) { return schema.walk(ENVELOPED_DATA, node, NS).
 function walkSignedData(node) { return schema.walk(SIGNED_DATA, node, NS).result; }
 function walkEncryptedData(node) { return schema.walk(ENCRYPTED_DATA, node, NS).result; }
 
+// assertAttachedCiphertext(eci, E, code, label): reject an EnvelopedData /
+// EncryptedData encryptedContentInfo whose encryptedContent (the payload itself)
+// is absent OR zero-length. RFC 5652 sec. 6.1 / RFC 5083 permit DETACHED content,
+// so this is NOT enforced in the base walker -- it is a per-PROFILE opt-in for a
+// consumer that requires the ciphertext to be present (an EST server-generated
+// key, a PKCS#12 shrouded bag): a valid envelope that delivers NOTHING is
+// verification-of-nothing (CWE-20). E is the caller's (code, message) factory.
+function assertAttachedCiphertext(eci, E, code, label) {
+  if (!eci || eci.encryptedContent === null || eci.encryptedContent.length === 0) {
+    throw E(code, (label || "encrypted content") + " must carry a non-empty attached ciphertext (RFC 5652 sec. 6.1), not be detached or empty");
+  }
+  return eci;
+}
+
 module.exports = {
   parse: parse,
   pemDecode: pemDecode,
@@ -1163,4 +1183,5 @@ module.exports = {
   walkEnvelopedData: walkEnvelopedData,
   walkSignedData: walkSignedData,
   walkEncryptedData: walkEncryptedData,
+  assertAttachedCiphertext: assertAttachedCiphertext,
 };

package/lib/schema-crmf.js

@@ -255,11 +255,9 @@ function popoPrivKey(type) {
       }
       // The encrypted key material MUST be present -- CMS allows a detached
       // EnvelopedData (encryptedContent OPTIONAL), but a POP with no key to verify
-      // or archive is meaningless. A zero-length attached ciphertext is the same
-      // fault as a detached one (the rule the CMP encryptedKey arm also holds).
-      if (env.encryptedContentInfo.encryptedContent == null || env.encryptedContentInfo.encryptedContent.length === 0) {
-        throw ctx.E("crmf/bad-popo", "encryptedKey [4] EnvelopedData MUST carry a non-empty encrypted key in encryptedContent (RFC 4211 sec. 4.2)");
-      }
+      // or archive is meaningless. The shared CMS assert rejects a null OR
+      // zero-length attached ciphertext (the rule the EST / PKCS#12 siblings hold).
+      cms.assertAttachedCiphertext(env.encryptedContentInfo, ctx.E, "crmf/bad-popo", "encryptedKey [4] EnvelopedData");
     }
     return { type: type, method: POPOPRIVKEY_METHODS[inner.tagNumber], bytes: n.bytes };
   });

package/lib/schema-ocsp.js

@@ -37,6 +37,7 @@ var asn1 = require("./asn1-der");
 var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
 var oid = require("./oid");
+var constants = require("./constants");
 var frameworkError = require("./framework-error");
 
 var OcspError = frameworkError.OcspError;
@@ -119,7 +120,10 @@ function _rawSignature(field) {
 
 // certs [0] EXPLICIT SEQUENCE OF Certificate -- each element raw. Shared by the
 // request Signature and the BasicOCSPResponse.
-var CERTS = schema.seqOf(certificateBytes(), { assert: "sequence", code: "ocsp/bad-certs", what: "certs" });
+// The certs list is capped: the delegated-responder authorization loop verifies
+// each candidate BEFORE the response signature is checked, so an unbounded list in
+// a relayed / stapled response would drive unbounded pre-auth signature verifies.
+var CERTS = schema.seqOf(certificateBytes(), { assert: "sequence", code: "ocsp/bad-certs", what: "certs", max: constants.LIMITS.OCSP_MAX_CERTS, maxCode: "ocsp/too-many-certs" });
 
 // Validate the OCSP protocol extension values in a decoded extension list --
 // applied to every extension surface (request / single-request / response /

package/lib/schema-pkix.js

@@ -47,11 +47,8 @@ function pemDecode(text, label, PemError) {
   if (!m) throw new PemError("pem/no-block", "no PEM block found");
   if (label && m[1] !== label) throw new PemError("pem/label-mismatch", "expected " + JSON.stringify(label) + " block, got " + JSON.stringify(m[1]));
   var b64 = m[2].replace(/[\r\n\t ]+/g, "");
-  if (!/^[A-Za-z0-9+/]*={0,2}$/.test(b64)) throw new PemError("pem/bad-base64", "PEM body is not valid base64");
-  if (b64.length % 4 !== 0) throw new PemError("pem/bad-base64", "PEM base64 body must be whole 4-character groups (RFC 4648 sec. 3.5)");
-  var der = Buffer.from(b64, "base64");
-  if (der.toString("base64") !== b64) throw new PemError("pem/bad-base64", "PEM base64 body is not canonical (RFC 4648 sec. 3.5)");
-  return der;
+  // Strict canonical base64 (RFC 4648 sec. 3.5) via the shared encoding guard.
+  return guard.encoding.base64(b64, null, function (c, msg) { return new PemError(c, msg); }, "pem/bad-base64", "PEM base64 body");
 }
 
 // pemDecodeAll(text, label, PemError): decode EVERY PEM block under the STRICT
@@ -72,10 +69,7 @@ function pemDecodeAll(text, label, PemError) {
     if (/\S/.test(text.slice(lastEnd, m.index))) throw new PemError("pem/explanatory-text", "explanatory text is not permitted around PEM blocks (RFC 8555 sec. 9.1)");
     if (m[1] !== label) throw new PemError("pem/label-mismatch", "expected " + JSON.stringify(label) + " block, got " + JSON.stringify(m[1]));
     var b64 = m[2].replace(/[\r\n\t ]+/g, "");
-    if (!/^[A-Za-z0-9+/]*={0,2}$/.test(b64) || b64.length % 4 !== 0) throw new PemError("pem/bad-base64", "PEM body is not canonical base64 (RFC 4648 sec. 3.5)");
-    var der = Buffer.from(b64, "base64");
-    if (der.toString("base64") !== b64) throw new PemError("pem/bad-base64", "PEM base64 body is not canonical (RFC 4648 sec. 3.5)");
-    blocks.push(der);
+    blocks.push(guard.encoding.base64(b64, null, function (c, msg) { return new PemError(c, msg); }, "pem/bad-base64", "PEM base64 body"));
     lastEnd = re.lastIndex;
   }
   if (blocks.length === 0) throw new PemError("pem/no-block", "no PEM block found");
@@ -92,7 +86,10 @@ function pemEncode(der, label, PemError) {
   if (typeof label !== "string" || !/^[A-Z0-9]+( [A-Z0-9]+)*$/.test(label)) {
     throw new PemError("pem/bad-label", "pemEncode requires an uppercase A-Z0-9 label with single spaces");
   }
-  var buf = Buffer.isBuffer(der) ? der : Buffer.from(der);
+  // Re-view through the byte guard: a string input would silently utf8-armor into
+  // a bogus PEM, and a detached-backed Buffer would armor an empty body -- both
+  // fail closed (a Uint8Array / Buffer of real DER re-views cleanly).
+  var buf = guard.bytes.view(der, PemError, "pem/bad-input", "pemEncode DER input");
   var b64 = buf.toString("base64").replace(/(.{64})/g, "$1\n").replace(/\n$/, "");
   return "-----BEGIN " + label + "-----\n" + b64 + "\n-----END " + label + "-----\n";
 }
@@ -270,10 +267,12 @@ function attrValueToString(ns) {
     if (typeof value === "string" && value.charAt(0) === "\\") return asn1.build.utf8(value.slice(1));
     if (typeof value === "string" && value.charAt(0) === "#") {
       var hex = value.slice(1);
-      if (!/^(?:[0-9A-Fa-f]{2})+$/.test(hex)) {
+      if (hex.length === 0) {
         throw ns.E(ns.prefix + "/bad-atv", "a #hex attribute value must be a non-empty even run of hex digits (RFC 4514 sec. 2.4)");
       }
-      var raw = Buffer.from(hex, "hex");
+      // Strict canonical hex via the shared encoding guard (even-length, canonical,
+      // no silent truncation at the first non-hex character).
+      var raw = guard.encoding.hex(hex, null, ns.E, ns.prefix + "/bad-atv", "a #hex attribute value");
       try { asn1.decode(raw); }
       catch (e) { throw ns.E(ns.prefix + "/bad-atv", "a #hex attribute value must encode exactly one DER TLV", e); }
       return raw;
@@ -550,6 +549,36 @@ function generalNames(ns, opts) {
   return schema.seqOf(gn, { assert: "sequence", min: 1, code: code, what: opts.what || "GeneralNames", build: build });
 }
 
+// DistributionPointName ::= CHOICE { fullName [0] IMPLICIT GeneralNames,
+// nameRelativeToCRLIssuer [1] IMPLICIT RelativeDistinguishedName } (RFC 5280
+// sec. 4.2.1.13). The caller hands the CHOICE node itself -- the alternative
+// INSIDE the [0]-tagged distributionPoint field wrapper (a context tag on a
+// CHOICE-typed field is always EXPLICIT, so the wire nests [0]{ [0]|[1] ... }).
+// fullName surfaces each element's RAW GeneralName DER as { kind: "fullName",
+// names: [Buffer, ...] } -- the byte-exact comparison key the sec. 5.2.5
+// "identical encoding MUST be used" correspondence rule requires;
+// nameRelativeToCRLIssuer surfaces its full [1]-tagged TLV as { kind: "rdn",
+// bytes: Buffer } (byte-identical [1] TLVs are byte-identical RDN fragments).
+// An empty fullName (GeneralNames is SIZE 1..MAX), a malformed element, or any
+// other alternative throws the caller's `code`. Shared by the
+// cRLDistributionPoints / freshestCRL extension decoders and the CRL checker's
+// IssuingDistributionPoint decode, so the two sides of the sec. 6.3.3(b)(2)(i)
+// correspondence comparison cannot drift.
+function distributionPointName(ns, node, code) {
+  if (node && node.tagClass === "context" && node.tagNumber === 0) {
+    var gns = schema.walk(generalNames(ns, { implicitTag: 0, code: code, what: "DistributionPointName fullName" }), node, ns).result;
+    return { kind: "fullName", names: gns.names.map(function (n) { return n.bytes; }) };
+  }
+  if (node && node.tagClass === "context" && node.tagNumber === 1) {
+    // [1] IMPLICIT RelativeDistinguishedName -- the context tag replaces the
+    // SET tag, so the node's direct children are the AttributeTypeAndValues.
+    schema.walk(schema.implicitSetOf(1, attributeTypeAndValue(ns), {
+      min: 1, code: code, what: "DistributionPointName nameRelativeToCRLIssuer" }), node, ns);
+    return { kind: "rdn", bytes: node.bytes };
+  }
+  throw ns.E(code, "DistributionPointName must be fullName [0] or nameRelativeToCRLIssuer [1] (RFC 5280 sec. 4.2.1.13)");
+}
+
 // certExtensionDecoders(ns) -- the ns-parameterized RFC 5280 sec. 4.2.1 extension
 // VALUE decoders. `x509.parse` surfaces each extension as { oid, name, critical,
 // value } with `value` the raw inner OCTET-STRING content (a Buffer); the path
@@ -837,6 +866,54 @@ function certExtensionDecoders(ns) {
     return { poison: true };
   }
 
+  // cRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
+  // (RFC 5280 sec. 4.2.1.13); DistributionPoint ::= SEQUENCE {
+  // distributionPoint [0] DistributionPointName OPTIONAL, reasons [1]
+  // ReasonFlags OPTIONAL, cRLIssuer [2] GeneralNames OPTIONAL }. "a
+  // DistributionPoint MUST NOT consist of only the reasons field; either
+  // distributionPoint or cRLIssuer MUST be present" -- a reasons-only (or
+  // empty) DistributionPoint is malformed. The DistributionPointName is
+  // surfaced through the shared helper (raw name encodings -- the sec. 5.2.5
+  // correspondence key); `reasons` stays a raw BIT STRING ({ unusedBits,
+  // bytes }); cRLIssuer is a validated GeneralNames with decoded values.
+  // FreshestCRL ::= CRLDistributionPoints (sec. 4.2.1.15), so the SAME decoder
+  // serves both OIDs -- one codec, both registry rows.
+  function crlDistributionPoints(buf) {
+    var C = ns.prefix + "/bad-crl-distribution-points";
+    var kids = seqChildren(buf, C, "CRLDistributionPoints");
+    if (kids.length < 1) throw ns.E(C, "CRLDistributionPoints must contain at least one DistributionPoint (RFC 5280 sec. 4.2.1.13)");
+    return kids.map(function (dp) {
+      if (dp.tagClass !== "universal" || dp.tagNumber !== _T.SEQUENCE || !dp.children) {
+        throw ns.E(C, "DistributionPoint must be a SEQUENCE { distributionPoint?, reasons?, cRLIssuer? }");
+      }
+      var out = { distributionPoint: null, reasons: null, cRLIssuer: null };
+      var lastTag = -1;
+      dp.children.forEach(function (f) {
+        if (f.tagClass !== "context") throw ns.E(C, "DistributionPoint fields are context-tagged [0]/[1]/[2]");
+        if (f.tagNumber <= lastTag) throw ns.E(C, "DistributionPoint fields must be unique and in ascending order (DER)");
+        lastTag = f.tagNumber;
+        if (f.tagNumber === 0) {
+          // distributionPoint [0] EXPLICIT-wraps the DistributionPointName CHOICE.
+          if (!f.children || f.children.length !== 1) throw ns.E(C, "DistributionPoint distributionPoint [0] must wrap exactly one DistributionPointName");
+          out.distributionPoint = distributionPointName(ns, f.children[0], C);
+        } else if (f.tagNumber === 1) {
+          var bs;
+          try { bs = asn1.read.bitStringImplicit(f, 1); }
+          catch (e) { throw ns.E(C, "DistributionPoint reasons [1] must be an IMPLICIT ReasonFlags BIT STRING", e); }
+          out.reasons = { unusedBits: bs.unusedBits, bytes: bs.bytes };
+        } else if (f.tagNumber === 2) {
+          out.cRLIssuer = schema.walk(generalNames(ns, { implicitTag: 2, decodeValue: true, code: C, what: "DistributionPoint cRLIssuer" }), f, ns).result;
+        } else {
+          throw ns.E(C, "DistributionPoint has an unexpected field [" + f.tagNumber + "]");
+        }
+      });
+      if (out.distributionPoint === null && out.cRLIssuer === null) {
+        throw ns.E(C, "a DistributionPoint must include distributionPoint or cRLIssuer -- it MUST NOT consist of only the reasons field (RFC 5280 sec. 4.2.1.13)");
+      }
+      return out;
+    });
+  }
+
   // byName returns undefined for an unregistered name; keying a decoder row
   // under "undefined" would silently drop that extension from dispatch (the
   // consumer would treat the extension as structurally unvalidated / absent),
@@ -861,6 +938,8 @@ function certExtensionDecoders(ns) {
   byOid[O("subjectKeyIdentifier")] = subjectKeyIdentifier;
   byOid[O("signedCertificateTimestampList")] = sctList;
   byOid[O("precertificatePoison")] = precertPoison;
+  byOid[O("cRLDistributionPoints")] = crlDistributionPoints;
+  byOid[O("freshestCRL")] = crlDistributionPoints;
   return { byOid: byOid };
 }
 
@@ -1069,6 +1148,7 @@ module.exports = {
   name: name,
   generalName: generalName,
   generalNames: generalNames,
+  distributionPointName: distributionPointName,
   generalizedTime: generalizedTime,
   utf8Text: utf8Text,
   rawNonEmptySequence: rawNonEmptySequence,