@blamejs/pki 0.1.9 → 0.1.11

package/CHANGELOG.md

@@ -4,6 +4,30 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.1.11 — 2026-07-05
+
+An OCSP request and response parser joins the pki.schema family.
+
+### Added
+
+- pki.schema.ocsp.parseRequest and pki.schema.ocsp.parseResponse — an OCSP request / response parser per RFC 6960 (§4.1 OCSPRequest, §4.2 OCSPResponse). parseRequest turns a DER Buffer or an 'OCSP REQUEST' PEM string into { tbsRequestBytes, version, requestorName, requestList, requestExtensions, optionalSignature }, each requestList entry carrying its CertID with the two issuer hashes raw. parseResponse turns a DER Buffer or an 'OCSP RESPONSE' PEM string into { responseStatus, responseBytes, basicResponse }; for a successful basic response, basicResponse carries { tbsResponseDataBytes, responderID, producedAt, responses, signatureAlgorithm, signature, certs } and each responses[i].certStatus is { type: 'good' | 'revoked' | 'unknown' } (a revoked entry adds its revocationTime and revocationReason). A malformed structure throws a typed OcspError (ocsp/*), an unsupported responseType throws ocsp/unsupported-response-type, and a leaf-level codec fault surfaces as asn1/*. pki.schema.ocsp.pemDecode handles the PEM envelope, and pki.schema.parse detect-and-routes both OCSP shapes.
+- pki.asn1.read.nullImplicit and the pki.schema.engine.implicitNull(tag) leaf — read a context-tagged IMPLICIT NULL (the shape the OCSP CertStatus good [0] and unknown [2] arms take), the primitive-leaf sibling of implicitBitString and implicitOctetString. It rejects a constructed or non-empty context node fail-closed.
+- An ocsp-parse coverage-guided fuzz harness joins the CI fuzzing matrix (jazzer.js + libFuzzer, per pull request and nightly), driving both OCSP entry points on mutated input.
+
+## v0.1.10 — 2026-07-05
+
+A CMS SignedData parser joins the pki.schema family; coverage-guided fuzzing now runs in CI.
+
+### Added
+
+- pki.schema.cms.parse — a CMS SignedData parser per RFC 5652 (§3 ContentInfo + §5 SignedData). It turns a DER Buffer or a 'CMS' PEM string into { version, digestAlgorithms, encapContentInfo, certificates, crls, signerInfos }. encapContentInfo.eContent is the raw content (or null when the signature is detached); each SignerInfo carries its raw signature and, when signed attributes are present, the on-wire signedAttrsBytes for external verification. The signer identifier is an issuerAndSerialNumber or a subjectKeyIdentifier, with the version-to-identifier rule (RFC 5652 §5.3) enforced, and a degenerate certificates-only SignedData (empty digest algorithms and signer infos) is accepted. A ContentInfo whose content type is not id-signedData throws cms/unsupported-content-type (a recognized PKCS#7 type) or cms/unknown-content-type; a malformed structure throws a typed CmsError (cms/*) and a leaf-level codec fault surfaces as asn1/*. pki.schema.cms.pemDecode / pemEncode handle the PEM envelope, and pki.schema.parse detect-and-routes a CMS message.
+- pki.asn1.read.octetStringImplicit and the pki.schema.engine.implicitOctetString(tag) leaf — read a context-tagged IMPLICIT OCTET STRING (the shape the CMS SignerIdentifier subjectKeyIdentifier [0] takes), the primitive-leaf sibling of implicitBitString.
+- Coverage-guided fuzzing in CI — a ClusterFuzzLite integration (.clusterfuzzlite/) plus pull-request and nightly-batch workflows run jazzer.js + libFuzzer against the pki.asn1.decode, pki.schema.x509.parse and pki.schema.cms.parse harnesses. A finding fails the run with the reproducer inline and uploads the crash input as an artifact. The integration is detectable by OpenSSF Scorecard's Fuzzing check.
+
+### Fixed
+
+- The OpenSSL interop runner counted a cross-check the oracle could not perform (for example, an OpenSSL predating ML-DSA) as a pass. Such a cross-check is now recorded as a skip and reported separately, so the interop pass count is not inflated by checks that never executed.
+
 ## v0.1.9 — 2026-07-05
 
 A PKCS#8 private-key parser joins the pki.schema family.

package/README.md

@@ -195,9 +195,11 @@ is callable today; nothing below is a stub.
 | `pki.schema.crl` | Parse DER / PEM X.509 CRLs per RFC 5280 §5 — revoked serials with real-`Date` revocation times, named + partly-decoded extensions, fail-closed — `parse`, `pemDecode` |
 | `pki.schema.csr` | Parse DER / PEM PKCS#10 certification requests per RFC 2986 — subject DN, public key, requested attributes, signature, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.pkcs8` | Parse DER / PEM PKCS#8 private keys per RFC 5208 / 5958 — algorithm, raw key bytes, attributes, optional public key, fail-closed; encrypted keys recognized (not decrypted) — `parse`, `parseEncrypted`, `pemDecode`, `pemEncode` |
+| `pki.schema.cms` | Parse DER / PEM CMS SignedData per RFC 5652 — encapsulated content, signer infos, raw signed-attribute bytes for external verification, certificates / CRLs kept raw, fail-closed; non-SignedData content types recognized (not decoded) — `parse`, `pemDecode`, `pemEncode` |
+| `pki.schema.ocsp` | Parse DER / PEM OCSP requests and responses per RFC 6960 — per-certificate status (good / revoked / unknown), responder identity, raw tbs bytes for external verification, certificates kept raw, fail-closed; non-basic response types recognized (not decoded) — `parseRequest`, `parseResponse`, `pemDecode` |
 | `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk` plus the schema combinators |
 | `pki.C` / `pki.constants` | Version-stable constants — functional scale helpers (`C.TIME.*`, `C.BYTES.*`), codec `LIMITS`, `version` |
-| `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error`, each carrying a stable `code` in `domain/reason` form |
+| `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError`, each carrying a stable `code` in `domain/reason` form |
 | `pki` CLI | `pki version`, `pki oid <dotted\|name>`, `pki parse <cert>` |
 
 ### CLI
@@ -219,6 +221,63 @@ composites) are on the roadmap and ride this same core. See
 [ROADMAP.md](ROADMAP.md) for the full plan and current status of each area, and
 [CHANGELOG.md](CHANGELOG.md) for what has landed.
 
+## Architecture
+
+Every PKI format is a thin, declarative schema over one shared engine. A parser
+declares the ASN.1 structure as data and hands it to `walk`; it never advances a
+child cursor, re-checks a tag, or re-rolls PEM handling by hand. So each
+structural rule — bounds-checked positional reads, optional / context-tagged
+field ordering, SET-OF ascending-order and uniqueness, arity, and fail-closed
+typed errors — is written **once** in the engine, and no new format can
+reintroduce the bug class it prevents. Adding a format is a schema declaration
+plus a documentation comment block, not new parse logic.
+
+```
+  Detect + route     pki.schema.parse ── detects the format, routes to a sibling
+                              │
+  Format parsers     x509   crl   csr   pkcs8   cms   ocsp      (siblings)
+  (one schema each)    └──────┴─────┴──────┴──────┴─────┘
+                              │  every sibling COMPOSES ↓
+  Shared structure   pki.schema.engine        PKIX sub-schemas
+                     walk + combinators   ·   AlgorithmIdentifier · Name ·
+                     (positional reads,       Extension · version reader ·
+                      tag ordering, SET-OF     the one coerce → decode → walk
+                      uniqueness, arity,       parse-entry (PEM cap + DER
+                      fail-closed errors)      wrapping shared, never copied)
+                              │  built on ↓
+  Foundation         pki.asn1       pki.oid          pki.errors       pki.C
+                     DER codec  ·   OID registry  ·  PkiError     ·   constants
+                     (strict,       (two-way,        taxonomy         (LIMITS,
+                      bounded)       PQC-seeded)      (domain/reason)   scale)
+
+  Crypto             pki.webcrypto ──▶ node:crypto
+                     W3C SubtleCrypto over the platform: the classical set +
+                     post-quantum ML-DSA / SLH-DSA signatures + ML-KEM keygen
+```
+
+**Foundation.** The strict, bounded DER codec (`pki.asn1`), the two-way OID
+registry (`pki.oid`), the `PkiError` taxonomy (`pki.errors`), and the
+version-stable constants (`pki.C`). These have no PKI knowledge; they are the
+bytes-and-names layer everything else stands on.
+
+**Shared structure.** The declarative schema engine (`pki.schema.engine`) and the
+PKIX sub-schemas it is fed — `AlgorithmIdentifier`, `Name`, `Extension`, the
+bounded version reader, and the single coerce → decode → walk parse-entry that
+every format's `parse` is bound to. Because input coercion, the PEM size cap, and
+the DER-decode wrapping live here once, a format cannot diverge on a guard.
+
+**Format parsers.** `x509`, `crl`, `csr`, `pkcs8`, `cms`, and `ocsp` are siblings:
+each is a schema declaration composed from the shared pieces, emitting its own
+typed `domain/reason` error codes. `pki.schema.parse` inspects a decoded root and
+detect-and-routes to the matching sibling; the detectors are mutually exclusive by
+construction, so routing is unambiguous regardless of registration order.
+
+**Crypto.** `pki.webcrypto` is a W3C `SubtleCrypto` engine over `node:crypto`,
+carrying the classical suite plus post-quantum ML-DSA / SLH-DSA signatures and
+ML-KEM key generation. Sign/verify resolves algorithms through the same OID
+registry the parsers read, so the signing surface and the parsing surface share
+one algorithm vocabulary.
+
 ## Security posture
 
 - **Zero npm runtime dependencies, nothing vendored.** The cryptography runs on

package/lib/asn1-der.js

@@ -360,6 +360,20 @@ function readOctetString(node) {
   return node.content;
 }
 
+// Read a [tag] IMPLICIT OCTET STRING — a context-class PRIMITIVE node whose
+// content is the octet-string body (the IMPLICIT tag replaces the universal one,
+// so there is no inner universal node). Primitive-only, like its universal
+// counterpart, so the BER constructed/streamed form is rejected. Used for the CMS
+// SignerIdentifier subjectKeyIdentifier [0] (RFC 5652 §5.3).
+function readOctetStringImplicit(node, tag) {
+  if (node.tagClass !== "context" || node.tagNumber !== tag) {
+    throw new Asn1Error("asn1/unexpected-tag", "readOctetStringImplicit: expected context tag [" + tag +
+      "], got " + node.tagClass + "/" + node.tagNumber);
+  }
+  _expectPrimitive(node, "readOctetStringImplicit");
+  return node.content;
+}
+
 function readNull(node) {
   _expectUniversal(node, TAGS.NULL, "readNull");
   _expectPrimitive(node, "readNull");
@@ -367,6 +381,20 @@ function readNull(node) {
   return null;
 }
 
+// Read a [tag] IMPLICIT NULL — a context-class PRIMITIVE node with empty content.
+// The IMPLICIT tag replaces the universal NULL tag, so there is no inner universal
+// node. The empty-content and primitive-form rules of a universal NULL still hold.
+// Used for the OCSP CertStatus good [0] / unknown [2] arms (RFC 6960 §4.2.1).
+function readNullImplicit(node, tag) {
+  if (node.tagClass !== "context" || node.tagNumber !== tag) {
+    throw new Asn1Error("asn1/unexpected-tag", "readNullImplicit: expected context tag [" + tag +
+      "], got " + node.tagClass + "/" + node.tagNumber);
+  }
+  _expectPrimitive(node, "readNullImplicit");
+  if (node.content.length !== 0) throw new Asn1Error("asn1/bad-null", "IMPLICIT NULL must have empty content");
+  return null;
+}
+
 /**
  * @primitive  pki.asn1.readOid
  * @signature  pki.asn1.read.oid(node) -> "1.2.840.113549.1.1.11"
@@ -794,7 +822,9 @@ module.exports = {
     bitString:    readBitString,
     bitStringImplicit: readBitStringImplicit,
     octetString:  readOctetString,
+    octetStringImplicit: readOctetStringImplicit,
     nullValue:    readNull,
+    nullImplicit: readNullImplicit,
     oid:          readOid,
     string:       readString,
     time:         readTime,

package/lib/framework-error.js

@@ -137,6 +137,14 @@ var CsrError = defineClass("CsrError", { withCause: true });
 // OneAsymmetricKey or EncryptedPrivateKeyInfo (RFC 5208 §5, RFC 5958 §2/§3).
 var Pkcs8Error = defineClass("Pkcs8Error", { withCause: true });
 
+// CmsError — a byte sequence that is not a well-formed CMS ContentInfo /
+// SignedData (RFC 5652). Carries the underlying leaf fault as `.cause`.
+var CmsError = defineClass("CmsError", { withCause: true });
+
+// OcspError — a byte sequence that is not a well-formed OCSP request or response
+// (OCSPRequest / OCSPResponse — RFC 6960 §4). Carries the leaf fault as `.cause`.
+var OcspError = defineClass("OcspError", { withCause: true });
+
 module.exports = {
   PkiError:         PkiError,
   defineClass:      defineClass,
@@ -149,4 +157,6 @@ module.exports = {
   SchemaError:      SchemaError,
   CsrError:         CsrError,
   Pkcs8Error:       Pkcs8Error,
+  CmsError:         CmsError,
+  OcspError:        OcspError,
 };

package/lib/oid.js

@@ -65,13 +65,38 @@ var FAMILIES = {
   // PKIX private extensions (authorityInfoAccess et al).
   pkixAccess: { base: [1, 3, 6, 1, 5, 5, 7, 1], of: { authorityInfoAccess: 1 } },
 
+  // PKIX Access Descriptor methods (id-ad, RFC 5280 §4.2.2.1/§4.2.2.2). id-ad-ocsp
+  // is the arc the OCSP responder OIDs hang under; id-ad-caIssuers names the AIA
+  // CA-issuers access method.
+  adAccess: { base: [1, 3, 6, 1, 5, 5, 7, 48], of: { ocsp: 1, caIssuers: 2 } },
+
+  // OCSP (RFC 6960) on the id-pkix-ocsp arc (= id-ad-ocsp). id-pkix-ocsp-basic is
+  // the ResponseBytes.responseType this build decodes; id-pkix-ocsp-nonce (§4.4.1)
+  // names the nonce extension; the remaining members name the other OCSP extensions
+  // (CRL references, acceptable-response-types, archive-cutoff, service-locator,
+  // preferred-signature-algorithms, extended-revoke — RFC 6960 §4.4, RFC 9654).
+  ocsp: { base: [1, 3, 6, 1, 5, 5, 7, 48, 1], of: {
+    ocspBasic: 1, ocspNonce: 2, ocspCrl: 3, ocspResponse: 4, ocspNoCheck: 5,
+    ocspArchiveCutoff: 6, ocspServiceLocator: 7, ocspPrefSigAlgs: 8, ocspExtendedRevoke: 9 } },
+
   // PKCS#1 RSA public-key + RSASSA signature algorithms.
   rsa: { base: [1, 2, 840, 113549, 1, 1], of: {
     rsaEncryption: 1, rsassaPss: 10, sha256WithRSAEncryption: 11,
     sha384WithRSAEncryption: 12, sha512WithRSAEncryption: 13 } },
 
-  // PKCS#9 attribute types.
-  pkcs9: { base: [1, 2, 840, 113549, 1, 9], of: { emailAddress: 1, challengePassword: 7, extensionRequest: 14 } },
+  // PKCS#7 / CMS content types (RFC 5652 §4, RFC 2315). id-signedData is the one
+  // this toolkit structurally decodes; the rest are recognized-and-deferred.
+  pkcs7: { base: [1, 2, 840, 113549, 1, 7], of: {
+    data: 1, signedData: 2, envelopedData: 3, signedAndEnvelopedData: 4,
+    digestedData: 5, encryptedData: 6 } },
+
+  // PKCS#9 attribute types — incl. the CMS signed-attribute OIDs (RFC 5652 §11).
+  pkcs9: { base: [1, 2, 840, 113549, 1, 9], of: {
+    emailAddress: 1, contentType: 3, messageDigest: 4, signingTime: 5,
+    challengePassword: 7, extensionRequest: 14 } },
+
+  // S/MIME content types on the PKCS#9 smime arc (RFC 5652, RFC 3161): id-ct.
+  smimeCt: { base: [1, 2, 840, 113549, 1, 9, 16, 1], of: { authData: 2, tSTInfo: 4 } },
 
   // ANSI X9.62 EC public key, named curve, and ECDSA signatures.
   ansiX962: { base: [1, 2, 840, 10045], of: {
@@ -84,6 +109,10 @@ var FAMILIES = {
   // Edwards / Montgomery curves (RFC 8410).
   edwards: { base: [1, 3, 101], of: { X25519: 110, X448: 111, Ed25519: 112, Ed448: 113 } },
 
+  // OIW Secsig SHA-1 (1.3.14.3.2.26) — the most common OCSP CertID hashAlgorithm;
+  // nistHash covers only SHA-256 and above.
+  oiwSecsig: { base: [1, 3, 14, 3, 2], of: { sha1: 26 } },
+
   // NIST hash functions (SHA-2, SHA-3, SHAKE).
   nistHash: { base: [2, 16, 840, 1, 101, 3, 4, 2], of: {
     sha256: 1, sha384: 2, sha512: 3, "sha3-256": 8, "sha3-512": 10, shake256: 12 } },

package/lib/schema-all.js

@@ -12,7 +12,7 @@
  * @intro
  *   The schema family: a declarative ASN.1 structure-schema engine and the
  *   per-format parsers built on it. Every format (X.509 certificates, CRLs,
- *   PKCS#10 certification requests, and — as they land — CMS / PKCS#8) is a
+ *   PKCS#10 certification requests, PKCS#8 private keys, and CMS SignedData) is a
  *   member that COMPOSES the
  *   shared engine and the shared PKIX sub-schemas (AlgorithmIdentifier, Name,
  *   Extension), so a structural rule — bounds-checked positional reads,
@@ -36,6 +36,8 @@ var x509 = require("./schema-x509");
 var crl = require("./schema-crl");
 var csr = require("./schema-csr");
 var pkcs8 = require("./schema-pkcs8");
+var cms = require("./schema-cms");
+var ocsp = require("./schema-ocsp");
 var frameworkError = require("./framework-error");
 
 var SchemaError = frameworkError.SchemaError;
@@ -52,6 +54,38 @@ var ENTRY = { pemLabel: null, PemError: PemError, ErrorClass: SchemaError, prefi
 // logic. Order matters: the most specific detector wins, so a new member is
 // inserted ahead of any more-permissive one.
 var FORMATS = [
+  {
+    // CMS ContentInfo (RFC 5652 §3) — the only registered root that leads with an
+    // OBJECT IDENTIFIER child (a SEQUENCE of exactly 2: contentType OID + a
+    // context [0] EXPLICIT content wrapper). Disjoint from the INTEGER-first pkcs8
+    // and the tbs-SEQUENCE-first signed-envelope trio, so it detects unambiguously.
+    // A non-SignedData content type routes here and gets a precise
+    // cms/unsupported-content-type rather than schema/unknown-format.
+    name: "cms",
+    module: cms,
+    detect: cms.matches,
+    parse: function (input) { return cms.parse(input); },
+  },
+  {
+    // OCSPRequest ::= SEQUENCE { tbsRequest SEQUENCE, optionalSignature [0] EXPLICIT
+    // OPTIONAL } — a SEQUENCE of 1-2 whose first child is the tbsRequest SEQUENCE.
+    // Leads with a SEQUENCE like the signed-envelope trio, but is excluded by arity
+    // (the trio is EXACTLY 3 children; an OCSPRequest is 1-2), so it detects
+    // unambiguously regardless of registry order (RFC 6960 §4.1.1).
+    name: "ocsp-request",
+    module: ocsp,
+    detect: ocsp.matchesRequest,
+    parse: function (input) { return ocsp.parseRequest(input); },
+  },
+  {
+    // OCSPResponse ::= SEQUENCE { responseStatus ENUMERATED, responseBytes [0]
+    // EXPLICIT OPTIONAL } — the only registered root that leads with an ENUMERATED
+    // child, so it is disjoint from every other format (RFC 6960 §4.2.1).
+    name: "ocsp-response",
+    module: ocsp,
+    detect: ocsp.matchesResponse,
+    parse: function (input) { return ocsp.parseResponse(input); },
+  },
   {
     // PKCS#8 PrivateKeyInfo / OneAsymmetricKey — SEQUENCE whose first child is an
     // INTEGER (version) and third an OCTET STRING (privateKey); disjoint from the
@@ -107,7 +141,7 @@ var FORMATS = [
  * The names of every registered format, in detection order.
  *
  * @example
- *   pki.schema.all();  // → ["pkcs8", "csr", "crl", "x509"]
+ *   pki.schema.all();  // → ["cms", "ocsp-request", "ocsp-response", "pkcs8", "csr", "crl", "x509"]
  */
 function all() { return FORMATS.map(function (f) { return f.name; }); }
 
@@ -149,6 +183,8 @@ module.exports = {
   crl:  { parse: crl.parse,  pemDecode: crl.pemDecode },
   csr:  { parse: csr.parse,  pemDecode: csr.pemDecode, pemEncode: csr.pemEncode },
   pkcs8: { parse: pkcs8.parse, parseEncrypted: pkcs8.parseEncrypted, pemDecode: pkcs8.pemDecode, pemEncode: pkcs8.pemEncode },
+  cms:  { parse: cms.parse, pemDecode: cms.pemDecode, pemEncode: cms.pemEncode },
+  ocsp: { parseRequest: ocsp.parseRequest, parseResponse: ocsp.parseResponse, pemDecode: ocsp.pemDecode },
   all: all,
   parse: parse,
 };