@blamejs/pki 0.1.32 → 0.2.1

package/lib/oid.js

@@ -39,6 +39,10 @@ var guard = require("./guard-all");
 
 var OidError = frameworkError.OidError;
 
+// (code, message) -> OidError, the factory shape the composed guards throw
+// through so a malformed identifier keeps the oid/* typed verdict.
+function _oidError(c, m) { return new OidError(c, m); }
+
 // FAMILIES -- OIDs grouped by their shared base arc (the "similar starting
 // variable" that defines a class). A member is `name: leaf`, where leaf is a
 // trailing arc (number) or a short arc array for a multi-level leaf; the full
@@ -197,7 +201,14 @@ var FAMILIES = {
   // CEK-HKDF content-encryption wrapper (RFC 9709) a KEMRecipientInfo names, plus
   // the RSA-KEM SPKI algorithm (RFC 9690). Parameters are absent for the HKDFs.
   smimeAlg: { base: [1, 2, 840, 113549, 1, 9, 16, 3], of: {
-    "id-rsa-kem": 14, hkdfWithSha256: 28, hkdfWithSha384: 29, hkdfWithSha512: 30, cekHkdfSha256: 31 } },
+    "id-rsa-kem": 14, "id-alg-hss-lms-hashsig": 17,
+    hkdfWithSha256: 28, hkdfWithSha384: 29, hkdfWithSha512: 30, cekHkdfSha256: 31 } },
+
+  // PKIX algorithms arc -- the stateful hash-based signature algorithm
+  // identifiers (RFC 9802 sec. 4). HSS/LMS additionally has the SMIME
+  // id-alg-hss-lms-hashsig OID above (RFC 9708 / RFC 9802 share it).
+  pkixAlg: { base: [1, 3, 6, 1, 5, 5, 7, 6], of: {
+    "id-alg-xmss-hashsig": 34, "id-alg-xmssmt-hashsig": 35 } },
 
   // RSA-KEM key-transport algorithm (RFC 9690, obsoletes RFC 5990) on the ISO
   // 18033-2 arc -- the kem OID an RSA KEMRecipientInfo carries (distinct from the
@@ -302,11 +313,18 @@ Object.keys(FAMILIES).forEach(function (fam) {
 });
 
 function _assertDotted(dotted, who) {
-  // No leading-zero components: "01.2.840" is a key no decoded OID can match,
-  // and the arc converters round-trip it to a DIFFERENT OID ("1.2.840").
-  if (typeof dotted !== "string" || !/^(0|[1-9]\d*)(\.(0|[1-9]\d*))+$/.test(dotted)) {
-    throw new OidError("oid/bad-input", who + ": expected a dotted-decimal OID string (no leading-zero components)");
-  }
+  // SYNTAX only (canonical dotted form, no leading-zero arc that would round-trip
+  // to a DIFFERENT OID). For the LOOKUP entry points (name / has): a well-formed
+  // but non-encodable OID is simply not registered (a miss), not an error, so the
+  // X.660 arc bounds are waived (boundsCode null).
+  guard.identifier.assertCanonicalOid(dotted, _oidError, "oid/bad-input", who, null);
+}
+
+function _assertEncodable(dotted, who) {
+  // SYNTAX and the X.660 arc bounds -- for the paths that assert / convert a real
+  // encodable OID (toArcs / toDER / register), where an out-of-bounds arc is a
+  // hard reject (oid/bad-arc), so the string form agrees with the DER form.
+  guard.identifier.assertCanonicalOid(dotted, _oidError, "oid/bad-input", who, "oid/bad-arc");
 }
 
 // X.660 encodability: the root arc is 0..2 and, under roots 0 and 1, the
@@ -370,9 +388,11 @@ function has(dotted) {
  *   pki.oid.register("1.3.6.1.4.1.99999.1", "acmeWidgetPolicy");
  */
 function register(dotted, n) {
-  _assertDotted(dotted, "register");
+  // _assertDotted now enforces the X.660 arc bounds on the string form too, so
+  // the separate arc-based check register used to run is redundant here (it is
+  // kept for registerFamily, which validates arcs it assembles, not a string).
+  _assertEncodable(dotted, "register");
   if (typeof n !== "string" || n.length === 0) throw new OidError("oid/bad-input", "register: name must be a non-empty string");
-  _assertEncodableArcs(dotted.split(".").map(BigInt), "register");
   _index(dotted, n);
 }
 
@@ -432,7 +452,7 @@ function all() {
 // Number where safe and BigInt where an arc exceeds 2^53 (rare, but a
 // UUID-based OID arc can), so the round-trip never loses precision.
 function toArcs(dotted) {
-  _assertDotted(dotted, "toArcs");
+  _assertEncodable(dotted, "toArcs");
   return dotted.split(".").map(function (p) {
     var b = BigInt(p);
     return b <= 9007199254740991n ? Number(b) : b;
@@ -453,7 +473,7 @@ function fromArcs(arcs) {
 
 // DER convenience -- thin pass-throughs to the codec so callers reach for
 // one namespace when they have a dotted string in hand.
-function toDER(dotted) { _assertDotted(dotted, "toDER"); return asn1.build.oid(dotted); }
+function toDER(dotted) { _assertEncodable(dotted, "toDER"); return asn1.build.oid(dotted); }
 function fromDER(input) {
   var buf = guard.bytes.view(input, OidError, "oid/bad-input", "fromDER");
   var node = asn1.decode(buf);
@@ -488,6 +508,9 @@ var _PARAMS_ABSENT = new Set();
   // HKDF key-derivation identifiers (RFC 8619 sec. 2: when any of these appear
   // within AlgorithmIdentifier, the parameters component SHALL be absent).
   "hkdfWithSha256", "hkdfWithSha384", "hkdfWithSha512",
+  // Stateful hash-based signatures (RFC 9802 sec. 4 / RFC 9708): the parameters
+  // field MUST be absent for HSS/LMS, XMSS, and XMSS^MT public keys and signatures.
+  "id-alg-hss-lms-hashsig", "id-alg-xmss-hashsig", "id-alg-xmssmt-hashsig",
 ].forEach(function (nm) {
   var d = byName(nm);
   // A seed-list typo must fail at module load -- admitting undefined would

package/lib/path-validate.js

@@ -70,6 +70,7 @@ var OID = {
   emailAddress: oid.byName("emailAddress"),
   extKeyUsage: oid.byName("extKeyUsage"),
   anyExtendedKeyUsage: oid.byName("anyExtendedKeyUsage"),
+  cRLDistributionPoints: oid.byName("cRLDistributionPoints"),
 };
 
 // The set of extension OIDs the validator PROCESSES -- an unrecognized critical
@@ -80,9 +81,15 @@ var OID = {
 // is the caller's opt-in via opts.requiredEku (RFC 5280 6.1 defines no EKU
 // processing step -- the required purpose is application context).
 var PROCESSED_EXTENSIONS = {};
+// cRLDistributionPoints is processed: the CRL checker consults it for the
+// sec. 6.3.3 shard correspondence, and a critical instance (sec. 4.2.1.13 is a
+// SHOULD-non-critical) is structurally validated by
+// validateCriticalExtensionStructure via the registered decoder. freshestCRL
+// stays OUT: sec. 4.2.1.15 requires it non-critical and the validator does not
+// consult it (no delta merge), so a critical instance fails unrecognized.
 [OID.basicConstraints, OID.keyUsage, OID.nameConstraints, OID.certificatePolicies,
  OID.policyMappings, OID.policyConstraints, OID.inhibitAnyPolicy, OID.subjectAltName,
- OID.extKeyUsage].
+ OID.extKeyUsage, OID.cRLDistributionPoints].
   forEach(function (o) { PROCESSED_EXTENSIONS[o] = true; });
 
 // ---- signature verify bridge (NEW 6) ---------------------------------------
@@ -318,7 +325,7 @@ function builtinVerify(state, cert) {
   } catch (e) { return Promise.resolve({ ok: false, code: pathCode(e, "path/unsupported-algorithm"), error: e }); }
   // The signature is an octet-aligned BIT STRING (no unused bits) for every
   // supported algorithm; a non-zero unused-bit count is malformed.
-  if (cert.signatureValue.unusedBits !== 0) return Promise.resolve({ ok: false, code: "path/bad-signature" });
+  if (!guard.crypto.isOctetAligned(cert.signatureValue)) return Promise.resolve({ ok: false, code: "path/bad-signature" });
   var key;
   return subtle.importKey("spki", state.workingPublicKey, d.imp, false, ["verify"]).then(function (k) {
     key = k;
@@ -1050,8 +1057,7 @@ async function validate(path, opts) {
   // Bound the per-cert asymmetric-verify work BEFORE parsing an untrusted bundle
   // (the policy-tree cap guards CVE-2023-0464-style blow-up; this guards linear
   // crypto amplification from an oversized path). Entry-point tier: throw.
-  var maxCerts = opts.maxPathCerts !== undefined ? opts.maxPathCerts : constants.LIMITS.PATH_MAX_CERTS;
-  if (typeof maxCerts !== "number" || !isFinite(maxCerts) || maxCerts < 1) throw E("path/bad-input", "validate: opts.maxPathCerts must be a positive number");
+  var maxCerts = guard.limits.cap(opts.maxPathCerts, "validate: opts.maxPathCerts", constants.LIMITS.PATH_MAX_CERTS, { E: E, code: "path/bad-input", min: 1 });
   if (path.length > maxCerts) throw E("path/bad-input", "validate: the certification path has " + path.length + " certificates, exceeding the maxPathCerts limit (" + maxCerts + ")");
   var certs = path.map(function (c) { return (c && c.tbsBytes) ? c : x509.parse(c); });
   var n = certs.length;
@@ -1064,9 +1070,9 @@ async function validate(path, opts) {
   }
   // Entry-point tier for the remaining 6.1.1 user-initial inputs: a bad value
   // throws here rather than silently disabling the behavior it configures.
-  if (opts.maxPolicyNodes !== undefined && (typeof opts.maxPolicyNodes !== "number" || !isFinite(opts.maxPolicyNodes) || opts.maxPolicyNodes < 1)) {
-    throw E("path/bad-input", "validate: opts.maxPolicyNodes must be a positive number");
-  }
+  // Validate-if-present (the default is applied where the policy state is built);
+  // the shared integer cap rejects a fractional / negative / non-numeric budget.
+  guard.limits.cap(opts.maxPolicyNodes, "validate: opts.maxPolicyNodes", undefined, { E: E, code: "path/bad-input", min: 1 });
   // user-initial-policy-set is a non-empty SET of policy OID strings (6.1.1(c)).
   // Membership is tested with indexOf, so a raw string here would be consulted
   // as a SUBSTRING match -- validated to an array of strings instead.
@@ -1074,6 +1080,11 @@ async function validate(path, opts) {
     var uipsOk = Array.isArray(opts.userInitialPolicySet) && opts.userInitialPolicySet.length > 0 &&
       opts.userInitialPolicySet.every(function (p) { return typeof p === "string" && p.length > 0; });
     if (!uipsOk) throw E("path/bad-input", "validate: opts.userInitialPolicySet must be a non-empty array of policy OID strings");
+    // Each entry is compared (indexOf) against canonical decoder output, so a
+    // non-canonical key would silently never match -- fail the typo closed here.
+    opts.userInitialPolicySet.forEach(function (p) {
+      guard.identifier.assertCanonicalOid(p, E, "path/bad-input", "validate: opts.userInitialPolicySet entry " + JSON.stringify(p));
+    });
   }
   var seeds = {
     permitted: checkedSubtreeSeeds(opts.initialPermittedSubtrees, "initialPermittedSubtrees"),
@@ -1089,12 +1100,33 @@ async function validate(path, opts) {
     }
     requiredEku = opts.requiredEku.map(function (p) {
       if (typeof p !== "string" || p.length === 0) throw E("path/bad-input", "validate: opts.requiredEku entries must be non-empty strings");
-      if (/^\d+(\.\d+)+$/.test(p)) return p;
+      // A dotted-form attempt (leads with a digit) must be a canonical OID -- a
+      // loose regex accepted a leading-zero / out-of-bounds key that would never
+      // match the canonical EKU the target advertises; anything else is a name.
+      if (/^[0-9]/.test(p)) return guard.identifier.assertCanonicalOid(p, E, "path/bad-input", "validate: opts.requiredEku entry " + JSON.stringify(p));
       var dotted = oid.byName(p);
       if (typeof dotted !== "string") throw E("path/bad-input", "validate: opts.requiredEku entry " + JSON.stringify(p) + " is not a registered OID name");
       return dotted;
     });
   }
+  // opts.checkPurpose -- the single key purpose the ANCHOR's NSS trust metadata
+  // (distrustAfter / purposes) is consulted for. Independent of requiredEku
+  // (which gates the leaf's own EKU extension): this selects the per-purpose
+  // key in the trust-anchor constraint contract. A purpose OID name (or a
+  // canonical dotted OID normalized to its name); a bad value throws here.
+  var checkPurpose = null;
+  if (opts.checkPurpose !== undefined) {
+    if (typeof opts.checkPurpose !== "string" || opts.checkPurpose.length === 0) {
+      throw E("path/bad-input", "validate: opts.checkPurpose must be a key-purpose OID name or dotted OID string");
+    }
+    if (/^[0-9]/.test(opts.checkPurpose)) {
+      var cpDotted = guard.identifier.assertCanonicalOid(opts.checkPurpose, E, "path/bad-input", "validate: opts.checkPurpose");
+      checkPurpose = oid.name(cpDotted) || cpDotted;   // normalize a dotted purpose OID to its name for the anchor map
+    } else {
+      if (typeof oid.byName(opts.checkPurpose) !== "string") throw E("path/bad-input", "validate: opts.checkPurpose " + JSON.stringify(opts.checkPurpose) + " is not a registered OID name");
+      checkPurpose = opts.checkPurpose;
+    }
+  }
 
   var state = initialize(certs, opts, seeds);
   state._n = n;
@@ -1233,6 +1265,22 @@ async function validate(path, opts) {
       // default). An ABSENT extension leaves the key unrestricted, so it
       // satisfies any required purpose.
       if (requiredEku && ekuPurposeFails(cert, requiredEku, checks)) failed = true;
+      // Trust-anchor constraint contract (NSS / CCADB metadata; gated so a bare
+      // anchor or an absent checkPurpose is byte-identical to today). The anchor's
+      // per-purpose distrust-after date and delegator purposes apply to the
+      // end-entity leaf it ultimately certifies.
+      var ta = opts.trustAnchor;
+      if (checkPurpose && ta.distrustAfter && ta.distrustAfter[checkPurpose] instanceof Date &&
+          cert.validity.notBefore > ta.distrustAfter[checkPurpose]) {
+        // STRICTLY > : a leaf whose notBefore == the distrust date stays trusted
+        // (Mozilla certverifier isDistrustedCertificateChain: endEntityNotBefore
+        // <= distrustAfterTime -> not distrusted; the end-of-day ...235959Z
+        // convention keeps the whole boundary day trusted).
+        checks.push({ name: "distrustAfter", ok: false, code: "path/distrusted-after" }); failed = true;
+      }
+      if (checkPurpose && ta.purposes && ta.purposes[checkPurpose] !== true) {
+        checks.push({ name: "purposeTrust", ok: false, code: "path/purpose-not-trusted" }); failed = true;
+      }
       updateWorkingKey(state, cert);   // 6.1.5(c),(d) -- key AND algorithm AND parameters
     }
 
@@ -1330,11 +1378,24 @@ var IDP_SCHEMA = schema.seq([
 function decodeIdp(ext) {
   // Surface the scope flags the checker gates on. ANY structural or value fault
   // -- non-SEQUENCE, unknown/duplicate/out-of-order field tag, a non-DER BOOLEAN,
-  // an encoded-FALSE default -- leaves the CRL's scope unknown: the CRL is
-  // unusable, never assumed unrestricted.
-  var out = { hasDistributionPoint: false, onlyUser: false, onlyCa: false, onlySomeReasons: null, indirect: false, onlyAttr: false, malformed: false };
+  // an encoded-FALSE default, a malformed DistributionPointName -- leaves the
+  // CRL's scope unknown: the CRL is unusable, never assumed unrestricted.
+  var out = { hasDistributionPoint: false, distributionPoint: null, onlyUser: false, onlyCa: false, onlySomeReasons: null, indirect: false, onlyAttr: false, malformed: false };
   var m;
-  try { m = schema.walk(IDP_SCHEMA, asn1.decode(ext.value), NS); }
+  try {
+    m = schema.walk(IDP_SCHEMA, asn1.decode(ext.value), NS);
+    if (m.fields.distributionPoint.present) {
+      // distributionPoint [0] EXPLICIT-wraps the DistributionPointName CHOICE
+      // (a context tag on a CHOICE-typed field is always EXPLICIT). The decoded
+      // name feeds the sec. 6.3.3(b)(2)(i) correspondence against the
+      // certificate's own DistributionPoints in the checker below.
+      var dpnWrap = m.fields.distributionPoint.node;
+      if (!dpnWrap.children || dpnWrap.children.length !== 1) {
+        throw E("path/bad-idp", "IssuingDistributionPoint distributionPoint [0] must wrap exactly one DistributionPointName");
+      }
+      out.distributionPoint = pkix.distributionPointName(NS, dpnWrap.children[0], "path/bad-idp");
+    }
+  }
   catch (_e) { out.malformed = true; return out; }
   function flag(f) {
     if (!f.present) return false;
@@ -1353,6 +1414,58 @@ function decodeIdp(ext) {
   return out;
 }
 
+// RFC 5280 sec. 6.3.3(b)(2)(i): find the certificate DistributionPoint that
+// CORRESPONDS to a shard CRL's IDP distribution point name -- at least one
+// name in common between the two DistributionPointNames, compared by
+// BYTE-IDENTICAL DER encoding (Buffer.equals on the raw GeneralName / RDN
+// TLVs). sec. 5.2.5 pins the comparison key: "The identical encoding MUST be
+// used in the distributionPoint fields of the certificate and the CRL" -- so
+// a canonicalized or semantic comparison (which would equate two
+// differently-encoded names) is forbidden, and whole-set equality (which
+// would falsely reject a legitimate multi-URI DP sharing one name) is
+// over-strict. Mixed forms -- fullName on one side, nameRelativeToCRLIssuer
+// on the other -- never correspond here: resolving an RDN fragment against
+// the issuer DN is not attempted (fail closed). Per sec. 6.3.3(b)(1), a DP
+// naming a cRLIssuer participates only when that cRLIssuer is the certificate
+// issuer itself: the checker only consults CRLs issued BY the certificate
+// issuer and rejects indirect CRLs, so a DP delegated to another CRL issuer
+// is out of play. Returns the matched DP (its `reasons` feeds the coarse
+// reason-mask rule) or null.
+function correspondingCertDp(idpDpn, certDPs, issuerRdns) {
+  if (!idpDpn || !certDPs) return null;
+  for (var i = 0; i < certDPs.length; i++) {
+    var dp = certDPs[i];
+    if (!dp.distributionPoint) continue;
+    if (dp.cRLIssuer && !crlIssuerNamesIssuer(dp.cRLIssuer, issuerRdns)) continue;
+    var cdpn = dp.distributionPoint;
+    if (idpDpn.kind === "fullName" && cdpn.kind === "fullName") {
+      for (var a = 0; a < idpDpn.names.length; a++) {
+        for (var c = 0; c < cdpn.names.length; c++) {
+          if (idpDpn.names[a].equals(cdpn.names[c])) return dp;
+        }
+      }
+    } else if (idpDpn.kind === "rdn" && cdpn.kind === "rdn") {
+      if (idpDpn.bytes.equals(cdpn.bytes)) return dp;
+    }
+  }
+  return null;
+}
+
+// Does a DistributionPoint's cRLIssuer name the certificate issuer? True iff
+// one of its GeneralNames is a directoryName equal to the issuer DN under the
+// RFC 5280 sec. 7.1 comparison (the shared name guard, via this file's dnEqual
+// wrapper). Any fault -- a DN the comparison rejects for an embedded control
+// byte -- resolves false: the DP stays out of the correspondence (fail closed).
+function crlIssuerNamesIssuer(cRLIssuer, issuerRdns) {
+  for (var i = 0; i < cRLIssuer.names.length; i++) {
+    var n = cRLIssuer.names[i];
+    if (n.tagNumber !== 4 || !n.value || !n.value.rdns) continue;
+    try { if (dnEqual(n.value.rdns, issuerRdns)) return true; }
+    catch (_e) { return false; }
+  }
+  return false;
+}
+
 /**
  * @primitive  pki.path.crlChecker
  * @signature  pki.path.crlChecker(crls) -> RevocationChecker
@@ -1367,7 +1480,12 @@ function decodeIdp(ext) {
  * verifies the CRL signature over its `tbsBytes`, honors the issuing
  * distribution point scope and reason coverage, checks currency
  * (`thisUpdate`/`nextUpdate`), and reports `{ status: "good"|"revoked"|
- * "unknown" }`. An out-of-scope, stale, unauthorized, or unverifiable CRL
+ * "unknown" }`. A partitioned/sharded CRL (a critical IDP naming a
+ * distribution point) establishes "good" when it corresponds to one of the
+ * certificate's own cRLDistributionPoints -- at least one identically-encoded
+ * name in common (RFC 5280 sec. 6.3.3) -- and neither side restricts reason
+ * codes; a non-corresponding or reason-restricted shard is consulted for
+ * revocation only. An out-of-scope, stale, unauthorized, or unverifiable CRL
  * yields `unknown`, which the validator fails closed unless `softFail` is set.
  *
  * @example
@@ -1395,6 +1513,18 @@ function crlChecker(crls) {
       } catch (e) {
         certScopeFault = pathCode(e, "path/bad-extension-value");
       }
+      // The certificate's own cRLDistributionPoints, decoded once per check:
+      // the sec. 6.3.3(b)(2)(i) correspondence gate below needs the DP names.
+      // A decode fault leaves certDPs null -- every DP-scoped shard then stays
+      // revocation-only (no correspondence can be shown; fail closed) while
+      // the full-CRL path is unaffected (mirrors the basicConstraints
+      // handling above); the check never crashes on a malformed extension.
+      var certDPs = null;
+      var certCdpExt = findExt(cert, OID.cRLDistributionPoints);
+      if (certCdpExt) {
+        try { certDPs = EXT_DECODERS[OID.cRLDistributionPoints](certCdpExt.value); }
+        catch (_e) { certDPs = null; }
+      }
       // RFC 5280 sec. 6.3.3(f): IF a keyUsage extension is present in the CRL issuer's
       // certificate, the cRLSign bit must be VERIFIED set. An issuer that OMITS
       // keyUsage is unconstrained (the same rule the sec. 6.1.4(n) keyCertSign gate
@@ -1489,7 +1619,34 @@ function crlChecker(crls) {
           if (idp.onlyAttr) continue;                        // scoped to attribute certs, not this public-key cert
           if (idp.onlyCa && certIsCa !== true) continue;     // out of scope (or CA-ness undeterminable)
           if (idp.onlyUser && certIsCa !== false) continue;
-          if (idp.hasDistributionPoint || idp.onlySomeReasons) scopeRevocationOnly = true;
+          if (idp.hasDistributionPoint) {
+            // RFC 5280 sec. 6.3.3(b)(2)(i): a partition shard speaks for this
+            // certificate only when the IDP's distribution point shares at
+            // least one IDENTICALLY-ENCODED name with one of the certificate's
+            // own DistributionPoints (sec. 5.2.5: "The identical encoding MUST
+            // be used in the distributionPoint fields of the certificate and
+            // the CRL"). The IDP must also be CRITICAL to be relied on for
+            // scope: sec. 5.2.5 defines the IDP as "a critical CRL extension"
+            // (descriptive phrasing, not an imperative MUST), and a partition
+            // scope a non-supporting relying party would ignore is not a scope
+            // to build "good" on -- a deliberate fail-closed decision. A
+            // non-corresponding shard cannot establish "good" but is still
+            // consulted for revocation below: serials are unique per issuer,
+            // so a listed serial is a genuine revocation (fail closed toward
+            // revoked).
+            var matchedDp = idpExt.critical === true
+              ? correspondingCertDp(idp.distributionPoint, certDPs, cert.issuer.rdns)
+              : null;
+            if (!matchedDp) scopeRevocationOnly = true;
+            // sec. 6.3.3(d)(3): a matched DP carrying `reasons` bounds the
+            // interim reason mask below all-reasons -- under the coarse rule
+            // ("good" only at the (d)(4) all-reasons case) that shard is
+            // revocation-only.
+            else if (matchedDp.reasons) scopeRevocationOnly = true;
+          }
+          // sec. 6.3.3(d)(1)/(d)(2): any onlySomeReasons restriction keeps the
+          // interim reason mask below all-reasons -- revocation-only (coarse).
+          if (idp.onlySomeReasons) scopeRevocationOnly = true;
         }
         if (theCrl.thisUpdate > time) continue;              // not yet valid
         // A CRL with no nextUpdate has no bounded validity -- its currency
@@ -1582,7 +1739,7 @@ function _verifyWithSpki(sigAlg, rawSig, spkiBytes, tbsBytes) {
 }
 
 function verifyCrlSignature(theCrl, issuer) {
-  if (theCrl.signatureValue.unusedBits !== 0) return Promise.resolve(false);   // non-octet-aligned signature
+  if (!guard.crypto.isOctetAligned(theCrl.signatureValue)) return Promise.resolve(false);   // non-octet-aligned signature
   return _verifyWithSpki(theCrl.signatureAlgorithm, theCrl.signatureValue.bytes, issuer.workingPublicKey, theCrl.tbsBytes);
 }
 
@@ -1703,7 +1860,7 @@ async function ocspAuthorizeResponder(basicResponse, cert, issuer, issuerKeyBits
     try { issuedByCa = dnEqual(rc.issuer.rdns, cert.issuer.rdns); }
     catch (_e) { continue; }
     if (!issuedByCa) continue;
-    if (rc.signatureValue.unusedBits !== 0) continue;
+    if (!guard.crypto.isOctetAligned(rc.signatureValue)) continue;
     if (!(await _verifyWithSpki(rc.signatureAlgorithm, rc.signatureValue.bytes, issuer.workingPublicKey, rc.tbsBytes))) continue;
     // The delegate certificate MUST itself be valid at the validation instant.
     if (time < rc.validity.notBefore || time > rc.validity.notAfter) continue;

package/lib/schema-attrcert.js

@@ -37,6 +37,7 @@ var asn1 = require("./asn1-der");
 var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
 var oid = require("./oid");
+var guard = require("./guard-all");
 var frameworkError = require("./framework-error");
 
 var AttrCertError = frameworkError.AttrCertError;
@@ -119,6 +120,10 @@ var OBJECT_DIGEST_INFO = schema.seq([
     if (m.fields.otherObjectTypeID.present) {
       throw ctx.E("attrcert/bad-object-digest-info", "otherObjectTypeID is only valid with otherObjectTypes(2), which RFC 5755 sec. 7.3 forbids");
     }
+    // The objectDigest is a whole-octet digest over the identified object; a
+    // non-octet-aligned BIT STRING is malformed (RFC 5755 sec. 4.1) and has no
+    // in-tree verify layer to catch it later, so reject it at parse.
+    guard.crypto.assertOctetAligned(m.fields.objectDigest.value, ctx.E, "attrcert/bad-object-digest-info", "objectDigest");
     return {
       digestedObjectType: t,
       otherObjectTypeID: null,

package/lib/schema-cms.js

@@ -214,7 +214,13 @@ function _assertContentTypeMatchesAttrs(attrs, eContentType) {
   for (var i = 0; i < attrs.length; i++) {
     if (attrs[i].type !== OID_CONTENT_TYPE) continue;
     if (attrs[i].values.length !== 1) throw NS.E("cms/bad-content-type-attr", "the content-type attribute must be single-valued (RFC 5652 sec. 11.1)");
-    var ctv = asn1.read.oid(asn1.decode(attrs[i].values[0]));
+    // ContentType ::= OBJECT IDENTIFIER -- validate the value's full syntax (tag AND
+    // minimal base-128 OID content) with the CMS typed verdict, so a malformed value
+    // on a path that does not run _checkContentBindingAttrs (AuthEnvelopedData,
+    // RFC 5083 sec. 2.1) surfaces cms/bad-content-type-attr, not the raw asn1/* error.
+    var ctv;
+    try { ctv = asn1.read.oid(asn1.decode(attrs[i].values[0])); }
+    catch (e) { throw NS.E("cms/bad-content-type-attr", "the content-type attribute value must be a valid OBJECT IDENTIFIER", e); }
     if (ctv !== eContentType) throw NS.E("cms/content-type-mismatch", "the content-type attribute (" + ctv + ") must equal the eContentType (" + eContentType + ") (RFC 5652 sec. 5.3)");
   }
 }
@@ -1155,6 +1161,20 @@ function walkEnvelopedData(node) { return schema.walk(ENVELOPED_DATA, node, NS).
 function walkSignedData(node) { return schema.walk(SIGNED_DATA, node, NS).result; }
 function walkEncryptedData(node) { return schema.walk(ENCRYPTED_DATA, node, NS).result; }
 
+// assertAttachedCiphertext(eci, E, code, label): reject an EnvelopedData /
+// EncryptedData encryptedContentInfo whose encryptedContent (the payload itself)
+// is absent OR zero-length. RFC 5652 sec. 6.1 / RFC 5083 permit DETACHED content,
+// so this is NOT enforced in the base walker -- it is a per-PROFILE opt-in for a
+// consumer that requires the ciphertext to be present (an EST server-generated
+// key, a PKCS#12 shrouded bag): a valid envelope that delivers NOTHING is
+// verification-of-nothing (CWE-20). E is the caller's (code, message) factory.
+function assertAttachedCiphertext(eci, E, code, label) {
+  if (!eci || eci.encryptedContent === null || eci.encryptedContent.length === 0) {
+    throw E(code, (label || "encrypted content") + " must carry a non-empty attached ciphertext (RFC 5652 sec. 6.1), not be detached or empty");
+  }
+  return eci;
+}
+
 module.exports = {
   parse: parse,
   pemDecode: pemDecode,
@@ -1163,4 +1183,5 @@ module.exports = {
   walkEnvelopedData: walkEnvelopedData,
   walkSignedData: walkSignedData,
   walkEncryptedData: walkEncryptedData,
+  assertAttachedCiphertext: assertAttachedCiphertext,
 };

package/lib/schema-crmf.js

@@ -255,11 +255,9 @@ function popoPrivKey(type) {
       }
       // The encrypted key material MUST be present -- CMS allows a detached
       // EnvelopedData (encryptedContent OPTIONAL), but a POP with no key to verify
-      // or archive is meaningless. A zero-length attached ciphertext is the same
-      // fault as a detached one (the rule the CMP encryptedKey arm also holds).
-      if (env.encryptedContentInfo.encryptedContent == null || env.encryptedContentInfo.encryptedContent.length === 0) {
-        throw ctx.E("crmf/bad-popo", "encryptedKey [4] EnvelopedData MUST carry a non-empty encrypted key in encryptedContent (RFC 4211 sec. 4.2)");
-      }
+      // or archive is meaningless. The shared CMS assert rejects a null OR
+      // zero-length attached ciphertext (the rule the EST / PKCS#12 siblings hold).
+      cms.assertAttachedCiphertext(env.encryptedContentInfo, ctx.E, "crmf/bad-popo", "encryptedKey [4] EnvelopedData");
     }
     return { type: type, method: POPOPRIVKEY_METHODS[inner.tagNumber], bytes: n.bytes };
   });

package/lib/schema-ocsp.js

@@ -37,6 +37,7 @@ var asn1 = require("./asn1-der");
 var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
 var oid = require("./oid");
+var constants = require("./constants");
 var frameworkError = require("./framework-error");
 
 var OcspError = frameworkError.OcspError;
@@ -119,7 +120,10 @@ function _rawSignature(field) {
 
 // certs [0] EXPLICIT SEQUENCE OF Certificate -- each element raw. Shared by the
 // request Signature and the BasicOCSPResponse.
-var CERTS = schema.seqOf(certificateBytes(), { assert: "sequence", code: "ocsp/bad-certs", what: "certs" });
+// The certs list is capped: the delegated-responder authorization loop verifies
+// each candidate BEFORE the response signature is checked, so an unbounded list in
+// a relayed / stapled response would drive unbounded pre-auth signature verifies.
+var CERTS = schema.seqOf(certificateBytes(), { assert: "sequence", code: "ocsp/bad-certs", what: "certs", max: constants.LIMITS.OCSP_MAX_CERTS, maxCode: "ocsp/too-many-certs" });
 
 // Validate the OCSP protocol extension values in a decoded extension list --
 // applied to every extension surface (request / single-request / response /