@blamejs/pki 0.2.21 → 0.2.22

package/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.2.22 — 2026-07-16
+
+The RFC 6960 OCSP producer and relying-party surface arrives as pki.ocsp: build and sign OCSP requests and responses, mint unsigned error responses, and verify a response end to end against the same hardened responder-authorization, signature, CertID, currency, and nonce gates the certification-path revocation checker runs.
+
+### Added
+
+- pki.ocsp is the RFC 6960 OCSP request/response surface. pki.ocsp.buildRequest(query, opts) builds an OCSPRequest (one or many { cert, issuer } queries; CertID under SHA-1 or SHA-2; optional RFC 9654 nonce; optional requestor signature; the RFC 5019 lightweight profile). pki.ocsp.sign(responseData, responder, opts) signs a BasicOCSPResponse over the exact ResponseData DER for the issuing CA or a delegated responder, with good / revoked / unknown per-certificate status and any pki.cms.sign signature algorithm (RSA, RSASSA-PSS, ECDSA, EdDSA, the post-quantum ML-DSA and SLH-DSA sets). pki.ocsp.buildErrorResponse(status) mints the unsigned section 2.3 error response. Transport-free; malformed input throws a typed OcspError.
+- pki.ocsp.verify(response, opts) verifies an OCSP response as a relying party, fail-closed: it binds the supplied issuer certificate to the target certificate (the target's issuer name must equal the issuer's subject and the target's signature must verify under the issuer's key), recomputes the CertID under its own hash algorithm to bind the checked certificate to its issuer, requires an authorized responder (the issuing CA, or a CA-issued delegate bearing id-kp-OCSPSigning and id-pkix-ocsp-nocheck that passes the full out-of-path certificate gates), verifies the signature over tbsResponseDataBytes, enforces thisUpdate / nextUpdate currency, and binds the request nonce (RFC 9654) under a constant-time comparison. A revoked status shadows good within a response; an unbound issuer, an unauthorized responder, a mismatched CertID, or a stale or unverifiable response returns { status: "unknown" } with granular responderAuthorized / signatureValid / matched flags -- never a silent accept. It runs the exact responder-authorization, signature, and currency gates pki.path.ocspChecker runs, through one shared core.
+- pki.path.verifyOcspResponse(parsedResponse, cert, issuerCert, time, opts) is the lower-level primitive pki.ocsp.verify composes: it verifies a single already-parsed OCSP response for one certificate against its already-parsed issuer, returning the same fail-closed granular verdict, for callers that have already decoded their inputs.
+
 ## v0.2.21 — 2026-07-15
 
 ML-KEM public keys in X.509 certificates and PKCS#8 private keys (RFC 9935 / FIPS 203) become a first-class, fail-closed surface: certification-path validation enforces the keyEncipherment-only key usage, key import validates the private-key CHOICE and rejects an inconsistent key with a typed error, and pki.lint gains the RFC 9935 certificate rows.

package/README.md

@@ -223,6 +223,7 @@ is callable today; nothing below is a stub.
 | `pki.path` | RFC 5280 §6 certification-path validation — `validate` runs the §6.1 state machine (signature chaining across RSA, ECDSA, EdDSA, ML-DSA, SLH-DSA and hybrid composite ML-DSA signatures — a composite is accepted only when **both** its post-quantum and traditional components verify; validity windows, name chaining, basic constraints and path length, key usage, name constraints, the certificate-policy tree) over an ordered path and a trust anchor, returning a structured verdict with per-check reason codes, and enforces a `pki.trust` anchor's per-purpose distrust-after dates and delegator purposes via `checkPurpose`; `crlChecker` supplies CRL-based revocation — including partitioned/sharded CRLs, whose §6.3.3 Distribution Point ↔ IDP correspondence lets a corresponding full-reason shard establish non-revocation — and `ocspChecker` supplies OCSP-based revocation (RFC 6960 — CertID binding, responder authorization, signature, currency) over the same pluggable hook. Pure and re-entrant, fail-closed — `validate`, `crlChecker`, `ocspChecker` |
 | `pki.cms` | RFC 5652 §5 CMS SignedData signing + signature verification — `sign(content, signers, opts)` produces a SignedData (attached or detached, one or many signers, RSA / RSASSA-PSS / ECDSA / EdDSA, the post-quantum ML-DSA-44/65/87 (RFC 9882) and SLH-DSA (all twelve FIPS 205 sets, RFC 9814), and composite ML-DSA (pairing ML-DSA with a traditional RSA / ECDSA / EdDSA — accepted only when **both** components verify — draft-ietf-lamps-cms-composite-sigs)); it builds the signed attributes (content-type, message-digest, signing-time) as canonical DER, signs the exact §5.4 preimage, and emits a DER `Buffer` or PEM. `verify(input, opts)` parses a SignedData over the strict `pki.schema.cms` codec, locates each SignerInfo's signer certificate by its issuerAndSerialNumber or subjectKeyIdentifier, and checks the signature over the exact §5.4 preimage: when signed attributes are present it confirms the message-digest attribute equals the content digest and verifies over the DER re-encoding of the SignedAttributes (the on-wire `[0]` tag replaced by a universal SET OF), otherwise directly over the content. It returns a per-signer verdict with the matched signer certificate; it does not chain that certificate to a trust anchor — that is the caller's step through `pki.path.validate`. Fail-closed with typed `cms/*` errors — `sign`, `verify` |
 | `pki.tsp` | RFC 3161 Time-Stamp Protocol — `sign(messageImprint, tsa, opts)` produces a TimeStampToken: a CMS SignedData (over `pki.cms.sign`) whose content is a `TSTInfo` carrying the timestamped message imprint, the TSA policy, a serial number, and `genTime` (with optional accuracy / nonce / ordering), plus the RFC 3161 §2.4.2 signing-certificate attribute binding the token to the TSA certificate (SHA-2 imprints, any `pki.cms.sign` TSA key). `request` / `parseRequest` build and parse the TimeStampReq a client sends (imprint, requested policy, nonce, certReq), `response` / `parseResponse` the TimeStampResp a TSA returns — a granted status wrapping a token, or a rejection with PKIStatus and failure info, the §2.4.2 status↔token coupling enforced in both directions. `verify(token, data, opts)` verifies a token fail-closed: the CMS signature over the exact signed bytes, the message imprint recomputed from the data, the TSTInfo content type, the ESSCertID(V2) binding to the TSA certificate, the §2.3 critical timeStamping-only extendedKeyUsage, the request nonce when used, and — with a trust anchor supplied — full certification-path validation of the TSA certificate at the token's `genTime`, returning `{ valid, genTime, serialNumber, tstInfo, … }` — `sign`, `request`, `parseRequest`, `response`, `parseResponse`, `verify` |
+| `pki.ocsp` | RFC 6960 Online Certificate Status Protocol — the responder and relying-party surface. `buildRequest(query, opts)` builds an OCSPRequest for one or more `{ cert, issuer }` pairs (CertID hashed under SHA-1 by default per the RFC 5019 lightweight profile, or SHA-2; optional RFC 9654 nonce, optional requestor signature). `sign(responseData, responder, opts)` produces a signed BasicOCSPResponse over the exact `ResponseData` DER — the issuing CA directly or a delegated responder, any `pki.cms.sign` key including the post-quantum ML-DSA / SLH-DSA sets, with `good` / `revoked` (reason + time) / `unknown` per-certificate status, and `buildErrorResponse(status)` the unsigned §2.3 error (`tryLater` / `unauthorized` / …). `verify(response, opts)` verifies a response fail-closed against the same hardened gates `pki.path.ocspChecker` runs: the CertID binding, responder authorization (the issuing CA or a CA-issued delegate bearing id-kp-OCSPSigning **and** id-pkix-ocsp-nocheck, passing the full out-of-path certificate gates), the signature over `tbsResponseDataBytes`, currency (`thisUpdate`/`nextUpdate`), and the request-nonce echo — returning `{ status: "good" / "revoked" / "unknown", … }`, never a silent accept. Transport-free — `buildRequest`, `sign`, `buildErrorResponse`, `verify` |
 | `pki.ct` | RFC 6962 Certificate Transparency SCTs — `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries in the SCT extension (a TLS-presentation-language payload inside the §3.3 double DER wrap) into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature; `reconstructSignedData` rebuilds the exact `digitally-signed` preimage; `verifySct` verifies an SCT signature against a log's public key by reconstructing the signed data, routing an ECDSA signature through the strict DER-conformance gate, and verifying through the crypto engine — resolving true or false, and throwing a typed error on a structural fault. Structure decoded, crypto fail-closed — `parseSctList`, `reconstructSignedData`, `verifySct` |
 | `pki.merkle` | RFC 6962 / RFC 9162 Merkle-tree proof verification — `leafHash` / `nodeHash` / `emptyRootHash` build the domain-separated (0x00 leaf / 0x01 node) SHA-256 tree hashes; `verifyInclusion` folds an audit proof back to a root and `verifyConsistency` reconstructs both the old and new root (the append-only guarantee), each constant-time-compared to a trusted checkpoint root. Fail-closed on bad geometry, sync hashing, transport-free — `leafHash`, `nodeHash`, `emptyRootHash`, `verifyInclusion`, `verifyConsistency` |
 | `pki.trust` | Mozilla / CCADB trust-store ingestion — `parseCertdata` reads the NSS `certdata.txt` object stream and `parseCcadbCsv` the CCADB CSV export into one identical constraint-carrying anchor shape: the per-purpose trust bits (only `CKT_NSS_TRUSTED_DELEGATOR` grants) and the per-purpose distrust-after dates the bare root list omits. Certificate and trust objects pair by byte-exact issuer + serial (never adjacency) and are cross-checked against the parsed DER, so metadata can never attach to the wrong root; `anchor()` hands an entry to `pki.path.validate({ trustAnchor, checkPurpose })`. Offline, fail-closed, bounded — `parseCertdata`, `parseCcadbCsv`, `anchor` |

package/index.js

@@ -38,6 +38,7 @@ var path      = require("./lib/path-validate");
 var ct        = require("./lib/ct");
 var cms       = require("./lib/cms-verify");
 var tsp       = require("./lib/tsp-sign");
+var ocsp      = require("./lib/ocsp");
 var merkle    = require("./lib/merkle");
 var shbs      = require("./lib/shbs");
 var hpke      = require("./lib/hpke");
@@ -77,6 +78,7 @@ module.exports = {
   ct:        ct,
   cms:       cms,
   tsp:       tsp,
+  ocsp:      ocsp,
   // `merkle` is the RFC 6962 / RFC 9162 Merkle-tree proof-verification core --
   // pki.merkle.leafHash / nodeHash / emptyRootHash build the domain-separated
   // (0x00 leaf / 0x01 node) SHA-256 tree hashes; pki.merkle.verifyInclusion and

package/lib/cms-sign.js

@@ -17,101 +17,25 @@ var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
-var pkcs8 = require("./schema-pkcs8");
 var pkix = require("./schema-pkix");
-var webcrypto = require("./webcrypto");
-var subtle = webcrypto.webcrypto.subtle;
-var validator = require("./validator-all");
-var compositeSig = require("./composite-sig");
 var frameworkError = require("./framework-error");
 
+var signScheme = require("./sign-scheme");
 var CmsError = frameworkError.CmsError;
 var b = asn1.build;
 function _err(code, message, cause) { return new CmsError(code, message, cause); }
+// The domain error factory the shared sign-scheme resolver/signer throws through (kind ->
+// cms/<kind>), so its faults keep the cms/* codes.
+function _signE(kind, message, cause) { return new CmsError("cms/" + kind, message, cause); }
 function O(name) { return oid.byName(name); }
 
-// A digest-algorithm name -> the WebCrypto hash (sign path). SHAKE256 has no WebCrypto hash, so
-// the message digest is always computed with node:crypto (below), uniform across the family.
-var HASH = { sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" };
 var NODE_DIGEST = { sha256: "sha256", sha384: "sha384", sha512: "sha512", shake128: "shake128", shake256: "shake256" };
 var SHAKE_OUT = { shake128: 32, shake256: 64 };   // SHAKE output lengths: SHAKE128 256-bit (RFC 9814 sec. 4), SHAKE256 512-bit (RFC 8419 sec. 2.3 / RFC 9814)
-var PSS_SALT = { "SHA-256": 32, "SHA-384": 48, "SHA-512": 64 };
-var ECDSA_ALG = { sha256: "ecdsaWithSHA256", sha384: "ecdsaWithSHA384", sha512: "ecdsaWithSHA512" };
-var HASH_NAME_BY_OID = {};
-HASH_NAME_BY_OID[O("sha256")] = "sha256";
-HASH_NAME_BY_OID[O("sha384")] = "sha384";
-HASH_NAME_BY_OID[O("sha512")] = "sha512";
-var EC_BY_CURVE_OID = {};
-EC_BY_CURVE_OID[O("prime256v1")] = { curve: "P-256", coordLen: 32 };
-EC_BY_CURVE_OID[O("secp384r1")] = { curve: "P-384", coordLen: 48 };
-EC_BY_CURVE_OID[O("secp521r1")] = { curve: "P-521", coordLen: 66 };
-// ML-DSA (RFC 9882): the signer cert SPKI algorithm OID -> its WebCrypto name. Registry-keyed
-// (Hard rule #2, no dotted-decimal literal). The same OID identifies both the key and the signature.
-var MLDSA_BY_OID = {};
-MLDSA_BY_OID[O("id-ml-dsa-44")] = "ML-DSA-44";
-MLDSA_BY_OID[O("id-ml-dsa-65")] = "ML-DSA-65";
-MLDSA_BY_OID[O("id-ml-dsa-87")] = "ML-DSA-87";
-// The message-digest algorithms suitable for each ML-DSA parameter set (RFC 9882 sec. 3.3 /
-// Table 1): a digest MUST offer at least the parameter set's collision strength (lambda) and at
-// least 2*lambda bits of output. SHA-512 is suitable for all sets; SHAKE256 (512-bit output) too.
-// Below-strength digests downgrade the signature to the weaker of the two (the whichever-is-lower
-// rule), so they are refused fail-closed on sign and verify -- the RFC's "verifiers MAY reject".
-var MLDSA_SUITABLE_DIGEST = {
-  "ML-DSA-44": { sha256: 1, sha384: 1, sha512: 1, shake256: 1 },
-  "ML-DSA-65": { sha384: 1, sha512: 1, shake256: 1 },
-  "ML-DSA-87": { sha512: 1, shake256: 1 },
-};
-// SLH-DSA (RFC 9814): the twelve pure FIPS 205 sets. The signer cert SPKI algorithm OID -> its
-// WebCrypto set name ("SLH-DSA-"+SET, mirroring webcrypto's SLH_DSA_NODE / path-validate) + the
-// RFC 9814 sec. 4 pinned message digest for that set. The sig and key share one OID; the digest is
-// FIXED per set (no caller choice, unlike ML-DSA's suitable-set). Registry-keyed (Hard rule #2).
-var SLHDSA_BY_OID = {};
-[["sha2-128s", "sha256"], ["sha2-128f", "sha256"], ["sha2-192s", "sha512"], ["sha2-192f", "sha512"],
- ["sha2-256s", "sha512"], ["sha2-256f", "sha512"], ["shake-128s", "shake128"], ["shake-128f", "shake128"],
- ["shake-192s", "shake256"], ["shake-192f", "shake256"], ["shake-256s", "shake256"], ["shake-256f", "shake256"]
-].forEach(function (r) { SLHDSA_BY_OID[O("id-slh-dsa-" + r[0])] = { wc: "SLH-DSA-" + r[0].toUpperCase(), digest: r[1] }; });
 
 var OID_DATA = O("data");
 var OID_SIGNED_DATA = O("signedData");
 var OID_SKI = O("subjectKeyIdentifier");
 
-// An AlgorithmIdentifier { OID } (absent parameters) or { OID, NULL }.
-function _algId(name, shape) { return shape === "null" ? b.sequence([b.oid(O(name)), b.nullValue()]) : b.sequence([b.oid(O(name))]); }
-// The RSASSA-PSS AlgorithmIdentifier with the params SEQUENCE cms.verify's _resolvePss accepts:
-// an explicit SHA-2 hashAlgorithm, MGF1 keyed to the same hash, the hash-length saltLength, and
-// the default trailerField (omitted). RFC 4055.
-function _pssAlgId(digestName) {
-  var hashAlg = b.sequence([b.oid(O(digestName)), b.nullValue()]);
-  var mgf = b.sequence([b.oid(O("mgf1")), hashAlg]);
-  var params = b.sequence([b.explicit(0, hashAlg), b.explicit(1, mgf), b.explicit(2, b.integer(BigInt(PSS_SALT[HASH[digestName]])))]);
-  return b.sequence([b.oid(O("rsassaPss")), params]);
-}
-
-// An id-RSASSA-PSS SubjectPublicKeyInfo MAY pin the permitted hash in its RSASSA-PSS-params
-// (RFC 4055 sec. 1.2 / sec. 3.1): a key generated for SHA-384 cannot sign under SHA-256. Read the
-// pinned digest name from the SPKI algorithm parameters so signing honors the key's restriction
-// instead of hard-coding SHA-256. Absent params (an unrestricted key) or an unrecognized hash
-// returns null -- the caller then falls back to its opts.digestAlgorithm or the SHA-256 default.
-function _pssHashFromSpki(cert) {
-  var params = cert.subjectPublicKeyInfo.algorithm.parameters;
-  if (params == null) return null;                              // an unrestricted id-RSASSA-PSS key
-  // params is the raw parameters TLV the strict codec already validated when it parsed the cert,
-  // so re-decoding a single valid TLV cannot throw. Read the pinned hash structurally, defaulting
-  // to null (caller falls back) whenever the shape is not the expected RSASSA-PSS-params.
-  var node = asn1.decode(params);
-  if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children) return null;
-  var hashField = node.children.filter(function (c) { return c.tagClass === "context" && c.tagNumber === 0; })[0];
-  if (!hashField || !hashField.children || !hashField.children[0] || !hashField.children[0].children) return null;
-  var oidNode = hashField.children[0].children[0];             // [0] EXPLICIT AlgorithmIdentifier { hash OID, ... }
-  if (!oidNode || oidNode.tagClass !== "universal" || oidNode.tagNumber !== asn1.TAGS.OBJECT_IDENTIFIER) return null;
-  var pinnedOid = asn1.read.oid(oidNode);
-  var name = HASH_NAME_BY_OID[pinnedOid];
-  // A recognized SHA-2 pin resolves to its name; an unsupported pinned hash (e.g. SHA-3) fails
-  // closed -- we cannot honor the key's restriction, so we never silently sign under a different
-  // digest the key forbids.
-  if (!name) throw _err("cms/unsupported-algorithm", "the id-RSASSA-PSS signer key pins an unsupported hash algorithm (" + pinnedOid + ")");
-  return name;
-}
 
 // The message digest of the content under the digest algorithm (SHA-2 or SHAKE256).
 function _digest(digestName, content) {
@@ -121,83 +45,6 @@ function _digest(digestName, content) {
   return h.update(content).digest();
 }
 
-// Resolve the sign scheme from the signer certificate's public-key algorithm + per-signer opts:
-// the digest, the digestAlgorithm and signatureAlgorithm AlgorithmIdentifiers (with the exact
-// parameter shape cms.verify requires), and the WebCrypto import + sign algorithms.
-function _scheme(cert, so, noSignedAttrs) {
-  var alg = cert.subjectPublicKeyInfo.algorithm;
-  var keyOid = alg.oid;
-  var comp = compositeSig.COMPOSITE_ALGS[keyOid];
-  if (comp) {
-    // Composite ML-DSA (draft-ietf-lamps-cms-composite-sigs): the arm DICTATES the CMS
-    // digestAlgorithm (its pre-hash, Table 1) -- unlike RSA/ECDSA the digest is not a caller
-    // choice, so a conflicting so.digestAlgorithm is rejected. The 3 arms Node's WebCrypto surface
-    // cannot sign (brainpool curves; the SHAKE256/64 pre-hash) fail closed at config time -- never
-    // a partial single-component signature.
-    if (comp.trad.unsupported) throw _err("cms/unsupported-algorithm", "composite " + comp.name + ": " + comp.trad.unsupported);
-    if (so.digestAlgorithm && so.digestAlgorithm !== comp.phCms) throw _err("cms/bad-input", "composite " + comp.name + " fixes the digestAlgorithm to " + comp.phCms + " (draft-ietf-lamps-cms-composite-sigs sec. 3.4); " + JSON.stringify(so.digestAlgorithm) + " conflicts");
-    return { composite: comp, digest: comp.phCms, digestAlgId: _algId(comp.phCms, "absent"), sigAlgId: _algId(comp.name, "absent") };
-  }
-  if (keyOid === O("rsaEncryption") || keyOid === O("rsassaPss")) {
-    var isPssKey = keyOid === O("rsassaPss");
-    // An id-RSASSA-PSS key MAY pin its permitted hash in the SPKI params (RFC 4055 sec. 1.2): honor
-    // that over the SHA-256 default so Node/OpenSSL does not reject the otherwise-valid signer with
-    // ERR_OSSL_DIGEST_NOT_ALLOWED. An explicit digestAlgorithm that contradicts the pin is rejected
-    // fail-closed rather than silently signed under a digest the key forbids.
-    var pinned = isPssKey ? _pssHashFromSpki(cert) : null;
-    if (pinned && so.digestAlgorithm && so.digestAlgorithm !== pinned) throw _err("cms/bad-input", "the signer key restricts the RSASSA-PSS digest to " + pinned + ", but digestAlgorithm " + JSON.stringify(so.digestAlgorithm) + " was requested");
-    var d = so.digestAlgorithm || pinned || "sha256";
-    if (!HASH[d]) throw _err("cms/unsupported-algorithm", "unsupported RSA digest algorithm " + JSON.stringify(d));
-    // A general rsaEncryption key signs PKCS#1 v1.5 by default, or RSASSA-PSS when opts.pss is set.
-    if (so.pss || isPssKey) return { digest: d, digestAlgId: _algId(d, "absent"), sigAlgId: _pssAlgId(d), imp: { name: "RSA-PSS", hash: HASH[d] }, sign: { name: "RSA-PSS", saltLength: PSS_SALT[HASH[d]] }, ecdsaDer: false };
-    return { digest: d, digestAlgId: _algId(d, "absent"), sigAlgId: _algId("rsaEncryption", "null"), imp: { name: "RSASSA-PKCS1-v1_5", hash: HASH[d] }, sign: { name: "RSASSA-PKCS1-v1_5" }, ecdsaDer: false };
-  }
-  if (keyOid === O("ecPublicKey")) {
-    var curveOid;
-    try { curveOid = asn1.read.oid(asn1.decode(alg.parameters)); }
-    catch (e) { throw _err("cms/unsupported-algorithm", "the signer EC key parameters are not a named-curve OID", e); }
-    var ec = EC_BY_CURVE_OID[curveOid];
-    if (!ec) throw _err("cms/unsupported-algorithm", "the signer key is on an unsupported EC curve");
-    var de = so.digestAlgorithm || "sha256";
-    if (!HASH[de]) throw _err("cms/unsupported-algorithm", "unsupported ECDSA digest algorithm " + JSON.stringify(de));
-    return { digest: de, digestAlgId: _algId(de, "absent"), sigAlgId: _algId(ECDSA_ALG[de], "absent"), imp: { name: "ECDSA", namedCurve: ec.curve }, sign: { name: "ECDSA", hash: HASH[de] }, ecdsaDer: true, coordLen: ec.coordLen };
-  }
-  if (keyOid === O("Ed25519") || keyOid === O("Ed448")) {
-    var name = keyOid === O("Ed25519") ? "Ed25519" : "Ed448";
-    var dd = so.digestAlgorithm || (name === "Ed25519" ? "sha512" : "shake256");
-    if (!NODE_DIGEST[dd]) throw _err("cms/unsupported-algorithm", "unsupported " + name + " digest algorithm " + JSON.stringify(dd));
-    return { digest: dd, digestAlgId: _algId(dd, "absent"), sigAlgId: _algId(name, "absent"), imp: { name: name }, sign: { name: name }, ecdsaDer: false };
-  }
-  if (MLDSA_BY_OID[keyOid]) {
-    // ML-DSA (RFC 9882): a one-shot post-quantum signature, pure mode, empty context. The signature
-    // covers the same sec. 5.4 preimage as every other scheme; digestAlgorithm names the message-
-    // digest algorithm (SHA-512 by default -- the sec. 3.3 MUST / interop default), which must be
-    // suitable for the parameter set (Q1 -- enforced on sign, refusing a below-strength digest).
-    var mlName = MLDSA_BY_OID[keyOid];
-    // RFC 9882 sec. 3.3: without signed attributes the digestAlgorithm has no meaning, but the
-    // signer MUST still emit SHA-512 to avoid an interoperability failure -- so force it (ignoring
-    // any caller digestAlgorithm) rather than carry a value a strict peer would reject. With signed
-    // attributes the digest must be suitable for the parameter set (Q1 -- enforced on sign).
-    var md;
-    if (noSignedAttrs) {
-      md = "sha512";
-    } else {
-      md = so.digestAlgorithm || "sha512";
-      if (!NODE_DIGEST[md]) throw _err("cms/unsupported-algorithm", "unsupported ML-DSA message digest " + JSON.stringify(md));
-      if (!MLDSA_SUITABLE_DIGEST[mlName][md]) throw _err("cms/unsupported-algorithm", "the " + md + " message digest is below the security strength of " + mlName + " (RFC 9882 sec. 3.3)");
-    }
-    return { digest: md, digestAlgId: _algId(md, "absent"), sigAlgId: _algId(oid.name(keyOid), "absent"), imp: { name: mlName }, sign: { name: mlName }, ecdsaDer: false };
-  }
-  if (SLHDSA_BY_OID[keyOid]) {
-    // SLH-DSA (RFC 9814): a one-shot post-quantum signature, pure mode, empty context. The message
-    // digest is FIXED per parameter set (sec. 4) -- emit it, and reject a contradicting caller
-    // digestAlgorithm fail-closed rather than carry a non-conformant digest.
-    var slh = SLHDSA_BY_OID[keyOid];
-    if (so.digestAlgorithm && so.digestAlgorithm !== slh.digest) throw _err("cms/bad-input", "SLH-DSA " + slh.wc + " requires the " + slh.digest + " message digest (RFC 9814 sec. 4); digestAlgorithm " + JSON.stringify(so.digestAlgorithm) + " conflicts");
-    return { digest: slh.digest, digestAlgId: _algId(slh.digest, "absent"), sigAlgId: _algId(oid.name(keyOid), "absent"), imp: { name: slh.wc }, sign: { name: slh.wc }, ecdsaDer: false };
-  }
-  throw _err("cms/unsupported-algorithm", "unsupported signer key algorithm " + keyOid);
-}
 
 // The raw issuer Name TLV from a parsed certificate (byte-identical to the cert, so the sid the
 // verifier canonically compares matches exactly). The issuer is the Name after the optional
@@ -215,30 +62,6 @@ function _skiValue(cert) {
   catch (e) { throw _err("cms/no-ski", "the signer certificate's subjectKeyIdentifier extension value is not an OCTET STRING", e); }
 }
 
-// A caller-supplied CryptoKey carries its OWN algorithm (name, and for RSA the baked-in hash,
-// for ECDSA the curve). A PKCS#8 key is imported under the resolved scheme, so it always agrees;
-// but a pre-imported CryptoKey whose algorithm disagrees with the certificate's scheme would
-// silently sign under a different hash than the digestAlgorithm advertises -- an inconsistent,
-// non-verifiable CMS. Reject the mismatch fail-closed.
-function _assertKeyMatchesScheme(key, imp) {
-  var ka = key.algorithm || {};
-  if (ka.name !== imp.name) throw _err("cms/bad-input", "the signer CryptoKey algorithm (" + ka.name + ") does not match the certificate's key algorithm (" + imp.name + ")");
-  if (imp.hash && (!ka.hash || ka.hash.name !== imp.hash)) throw _err("cms/bad-input", "the signer CryptoKey hash (" + (ka.hash && ka.hash.name) + ") does not match the signing digest (" + imp.hash + ")");
-  if (imp.namedCurve && ka.namedCurve !== imp.namedCurve) throw _err("cms/bad-input", "the signer CryptoKey curve (" + ka.namedCurve + ") does not match the certificate curve (" + imp.namedCurve + ")");
-}
-// Import the signer private key: a CryptoKey passed through, or a PKCS#8 DER Buffer / PEM string.
-function _importKey(key, imp) {
-  if (key && typeof key === "object" && !Buffer.isBuffer(key) && !(key instanceof Uint8Array) && key.type === "private") {
-    _assertKeyMatchesScheme(key, imp);
-    return Promise.resolve(key);
-  }
-  var der;
-  if (Buffer.isBuffer(key)) der = key;
-  else if (key instanceof Uint8Array) der = Buffer.from(key);
-  else if (typeof key === "string") { try { der = pkcs8.pemDecode(key); } catch (e) { throw _err("cms/bad-input", "the signer PEM private key could not be decoded", e); } }
-  else throw _err("cms/bad-input", "a signer key must be a CryptoKey, a PKCS#8 DER Buffer, or a PKCS#8 PEM string");
-  return subtle.importKey("pkcs8", der, imp, false, ["sign"]);
-}
 
 // Build one SignerInfo (RFC 5652 sec. 5.3) and sign it. Resolves the SignerInfo (as a build
 // node) plus its digestAlgorithm AlgorithmIdentifier and the signer certificate DER (for the
@@ -247,7 +70,7 @@ function _buildSignerInfo(signer, content, eContentType, opts) {
   var so = signer || {};
   var certDer = _normCertDer(so.cert);
   var cert = x509.parse(certDer);
-  var scheme = _scheme(cert, so, opts.signedAttributes === false);
+  var scheme = signScheme.resolveSignScheme(cert, so, opts.signedAttributes === false, _signE);
   var useSki = opts.sid === "ski";
   var sid = useSki
     ? b.contextPrimitive(0, _skiValue(cert))                                       // [0] IMPLICIT SubjectKeyIdentifier
@@ -282,7 +105,7 @@ function _buildSignerInfo(signer, content, eContentType, opts) {
     return { setOf: setOf, wire: wire };
   }).then(function (toSign) {
     var signedBytes = toSign.setOf ? toSign.setOf : toSign;   // SET-OF form for signing (sec. 5.4)
-    return _signScheme(scheme, so, signedBytes).then(function (sig) {
+    return signScheme.signOverTbs(scheme, so.key, signedBytes, _signE).then(function (sig) {
       var fields = [b.integer(BigInt(version)), sid, scheme.digestAlgId];
       if (toSign.wire) fields.push(toSign.wire);              // [0] IMPLICIT signedAttrs
       fields.push(scheme.sigAlgId, b.octetString(sig));
@@ -291,38 +114,7 @@ function _buildSignerInfo(signer, content, eContentType, opts) {
   });
 }
 
-// Sign the sec. 5.4 preimage under the resolved scheme -> the raw signature bytes for the
-// SignerInfo signature OCTET STRING. The classical path imports the single signer key and signs
-// (re-encoding ECDSA to canonical DER); the composite path signs BOTH component keys over the
-// domain-separated M' and returns mldsaSig || tradSig (composite-sig.js owns the construction).
-function _signScheme(scheme, so, signedBytes) {
-  if (scheme.composite) {
-    return compositeSig.compositeSign(scheme.composite, _normCompositeKeys(so.key, scheme.composite), signedBytes).then(function (sig) { return Buffer.from(sig); });
-  }
-  return _importKey(so.key, scheme.imp).then(function (priv) {
-    return subtle.sign(scheme.sign, priv, signedBytes).then(function (sigRaw) {
-      var sig = Buffer.from(sigRaw);
-      if (scheme.ecdsaDer) sig = validator.sig.rawToEcdsaDer(sig, scheme.coordLen);
-      return sig;
-    });
-  });
-}
 
-// A composite signer key is the two component private keys { mldsa, trad } as PKCS#8 (Node has no
-// single composite key type; the CMS draft is silent on key import). A missing/wrong-typed
-// component fails closed at config time -- never a partial single-component signature.
-function _normCompositeKeys(key, comp) {
-  if (!key || typeof key !== "object" || Buffer.isBuffer(key) || key instanceof Uint8Array || key.mldsa == null || key.trad == null) {
-    throw _err("cms/bad-input", "a composite " + comp.name + " signer key must be { mldsa: <PKCS#8>, trad: <PKCS#8> }");
-  }
-  return { mldsa: _normPkcs8(key.mldsa, "the composite ML-DSA component key"), trad: _normPkcs8(key.trad, "the composite traditional component key") };
-}
-function _normPkcs8(k, label) {
-  if (Buffer.isBuffer(k)) return k;
-  if (k instanceof Uint8Array) return Buffer.from(k);
-  if (typeof k === "string") { try { return pkcs8.pemDecode(k); } catch (e) { throw _err("cms/bad-input", label + " PEM could not be decoded", e); } }
-  throw _err("cms/bad-input", label + " must be a PKCS#8 DER Buffer, Uint8Array, or PEM string");
-}
 
 // A signing-time Time value: UTCTime before 2050, GeneralizedTime from 2050 (RFC 5652 sec. 11.3 /
 // RFC 5280 sec. 4.1.2.5). A caller Date overrides; false omits the attribute (handled above).
@@ -415,7 +207,4 @@ function _toBuf(v, what) {
 //   * `_assertKeyMatchesScheme`'s `!ka.hash` guard -- an `imp.hash` is set only for an RSA
 //     scheme, which requires `ka.name` to already equal the RSA name (else the earlier name
 //     check throws); an RSA CryptoKey always carries a `hash`, so `!ka.hash` never fires.
-// MLDSA_SUITABLE_DIGEST is shared with cms-verify (which requires this module) so the per-
-// parameter-set digest-strength policy has ONE home -- a digest accepted on sign is exactly the
-// set accepted on verify, and neither side can drift from the other (RFC 9882 sec. 3.3).
-module.exports = { sign: sign, MLDSA_SUITABLE_DIGEST: MLDSA_SUITABLE_DIGEST, SLHDSA_BY_OID: SLHDSA_BY_OID };
+module.exports = { sign: sign };

package/lib/cms-verify.js

@@ -35,8 +35,9 @@ var webcrypto = require("./webcrypto");
 var subtle = webcrypto.webcrypto.subtle;
 var edwardsPoint = require("./edwards-point");
 var cmsSign = require("./cms-sign");
-var MLDSA_SUITABLE_DIGEST = cmsSign.MLDSA_SUITABLE_DIGEST;   // shared sign/verify digest-strength policy (RFC 9882 sec. 3.3)
-var SLHDSA_BY_OID = cmsSign.SLHDSA_BY_OID;                   // shared SLH-DSA set -> { wc, digest } (RFC 9814 sec. 4 pinned digest)
+var signScheme = require("./sign-scheme");
+var MLDSA_SUITABLE_DIGEST = signScheme.MLDSA_SUITABLE_DIGEST;   // shared sign/verify digest-strength policy (RFC 9882 sec. 3.3)
+var SLHDSA_BY_OID = signScheme.SLHDSA_BY_OID;                   // shared SLH-DSA set -> { wc, digest } (RFC 9814 sec. 4 pinned digest)
 var validator = require("./validator-all");
 var compositeSig = require("./composite-sig");
 var guard = require("./guard-all");

package/lib/ocsp-verify.js

@@ -0,0 +1,226 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The documented surfaces are pki.path.ocspChecker
+// (revocation during path validation) and pki.ocsp.verify (standalone RFC 6960 sec. 3.2 client
+// acceptance), which BOTH compose this ONE verify core. There is deliberately no second, weaker
+// OCSP response-verification path: a standalone verify that re-derived the responder-authorization
+// gates would be the exact fail-open the out-of-path-signer-cert-full-validation discipline exists
+// to prevent.
+//
+// The core is a factory over an INJECTED `deps` seam so it has no back-edge into path-validate:
+// the signature engine (`verifyWithSpki`) and the RFC 5280 cert-profile gates
+// (`decodeExt`/`findExt`/`unrecognizedCriticalExtension`/`validateCriticalExtensionStructure`/
+// `compositeKeyUsageCheck`/`isNullOrAbsentParams`/`spliceSpkiParameters`/`dnEqual`) are supplied by
+// the caller that owns them; everything OCSP-specific (CertID hash binding, responder
+// authorization, currency, status) lives here.
+//
+// Rule set (gap-checked verbatim against RFC 6960 sec. 3.2 / 4.1.1 / 4.2.2.2 / 4.2.2.2.1):
+//   - authorizeResponder: the issuing CA directly (responderID identifies the issuer) OR a
+//     CA-issued delegate valid at `time` bearing id-kp-OCSPSigning (anyEKU / absent EKU do NOT
+//     authorize), keyUsage-permits-signing, no unknown/malformed critical extension, and
+//     id-pkix-ocsp-nocheck (a transport-free verify cannot otherwise confirm the responder is
+//     unrevoked); the delegate's own issuance signature is verified under the issuer key.
+//   - certIdMatches: serial + issuerNameHash + issuerKeyHash under the CertID's OWN hashAlgorithm
+//     (a serial-only match is a cross-CA substitution and is rejected).
+//   - currency: thisUpdate <= time and a bounded nextUpdate > time (a nextUpdate-less response is
+//     unusable per the lightweight profile).
+
+var asn1 = require("./asn1-der");
+var oid = require("./oid");
+var x509 = require("./schema-x509");
+var compositeSig = require("./composite-sig");
+var webcrypto = require("./webcrypto");
+var subtle = webcrypto.webcrypto.subtle;
+
+// CertID identity-hash algorithms (RFC 6960 sec. 4.1.1). SEPARATE from the signature HASH set
+// (which omits SHA-1, SHAttered): a CertID hash is an identity binding of an already-known issuer,
+// not a signature, so RFC 6960's default SHA-1 CertID MUST interoperate. A hash outside this set
+// cannot be reproduced -> no CertID match (fail closed).
+var OCSP_CERTID_HASHES = {};
+OCSP_CERTID_HASHES[oid.byName("sha1")] = "SHA-1";
+OCSP_CERTID_HASHES[oid.byName("sha256")] = "SHA-256";
+OCSP_CERTID_HASHES[oid.byName("sha384")] = "SHA-384";
+OCSP_CERTID_HASHES[oid.byName("sha512")] = "SHA-512";
+var OID_OCSP_SIGNING = oid.byName("ocspSigning");
+var OID_OCSP_NOCHECK = oid.byName("ocspNoCheck");
+var OID_EKU = oid.byName("extKeyUsage");
+var OID_KEY_USAGE = oid.byName("keyUsage");
+
+function ocspDigest(alg, buf) { return subtle.digest(alg, buf).then(function (h) { return Buffer.from(h); }); }
+
+// The subjectPublicKey BIT STRING VALUE (past the unused-bits octet) of an SPKI DER -- the exact
+// bytes an OCSP CertID issuerKeyHash / byKey KeyHash hash over (RFC 6960 sec. 4.1.1). Throws on a
+// malformed SPKI; the caller fails closed.
+function ocspKeyValue(spkiDer) {
+  return asn1.read.bitString(asn1.decode(spkiDer).children[1]).bytes;
+}
+
+// makeOcspVerify(deps) -> the bound OCSP verify core. deps = { verifyWithSpki, decodeExt, findExt,
+// unrecognizedCriticalExtension, validateCriticalExtensionStructure, compositeKeyUsageCheck,
+// isNullOrAbsentParams, spliceSpkiParameters, dnEqual } -- the signature engine + RFC 5280
+// cert-profile gates owned by the caller.
+function makeOcspVerify(deps) {
+  var verifyWithSpki = deps.verifyWithSpki;
+  var decodeExt = deps.decodeExt;
+  var findExt = deps.findExt;
+  var unrecognizedCriticalExtension = deps.unrecognizedCriticalExtension;
+  var validateCriticalExtensionStructure = deps.validateCriticalExtensionStructure;
+  var compositeKeyUsageCheck = deps.compositeKeyUsageCheck;
+  var isNullOrAbsentParams = deps.isNullOrAbsentParams;
+  var spliceSpkiParameters = deps.spliceSpkiParameters;
+  var dnEqual = deps.dnEqual;
+
+  // The delegate responder's importable SPKI, splicing the issuer's algorithm parameters in when
+  // the delegate key inherits them (an EC SPKI that omits the namedCurve, RFC 5280 sec. 4.1.2.7).
+  function ocspResponderSpki(rc, issuer) {
+    var keyAlg = rc.subjectPublicKeyInfo.algorithm;
+    if (!isNullOrAbsentParams(keyAlg.parameters)) return rc.subjectPublicKeyInfo.bytes;
+    var issuerOid, issuerParams;
+    // Coverage residual -- the catch is unreachable: this runs only after the delegate's signature
+    // verified under issuer.workingPublicKey, so that SPKI already imported and decodes cleanly.
+    try {
+      var alg = asn1.decode(issuer.workingPublicKey).children[0];
+      issuerOid = asn1.read.oid(alg.children[0]);
+      issuerParams = alg.children[1] ? alg.children[1].bytes : null;
+    } catch (_e) { return rc.subjectPublicKeyInfo.bytes; }
+    if (issuerOid === keyAlg.oid && !isNullOrAbsentParams(issuerParams)) {
+      return spliceSpkiParameters(rc.subjectPublicKeyInfo, keyAlg.oid, issuerParams);
+    }
+    return rc.subjectPublicKeyInfo.bytes;
+  }
+
+  // Returns true if `extList` carries any critical extension (this code processes no OCSP
+  // response/single extension semantics, so a critical one makes the response unusable).
+  function ocspHasCriticalExtension(extList) {
+    if (!extList) return false;
+    for (var i = 0; i < extList.length; i++) if (extList[i].critical) return true;
+    return false;
+  }
+
+  // A SingleResponse's CertID names the target cert IFF serial AND issuerNameHash + issuerKeyHash
+  // (under the CertID's OWN hashAlgorithm) match the issuer. `issuerNameCandidates` is every RFC
+  // 5280 sec. 7.1-equal byte encoding of the validated issuer DN to try.
+  async function ocspCertIdMatches(certID, cert, issuerNameCandidates, issuerKeyBits) {
+    if (certID.serialNumberHex !== cert.serialNumberHex) return false;
+    var hashName = OCSP_CERTID_HASHES[certID.hashAlgorithm.oid];
+    if (!hashName) return false;
+    var keyHash = await ocspDigest(hashName, issuerKeyBits);
+    if (!certID.issuerKeyHash.equals(keyHash)) return false;
+    for (var i = 0; i < issuerNameCandidates.length; i++) {
+      if (certID.issuerNameHash.equals(await ocspDigest(hashName, issuerNameCandidates[i]))) return true;
+    }
+    return false;
+  }
+
+  // Resolve the signer of a BasicOCSPResponse to an AUTHORIZED responder SPKI DER, or null. Two
+  // models: the issuing CA directly, or a CA-delegated responder (RFC 6960 sec. 4.2.2.2). Fails
+  // closed at every branch.
+  async function ocspAuthorizeResponder(basicResponse, cert, issuer, issuerKeyBits, time) {
+    var rid = basicResponse.responderID;
+    var matchesIssuer = false;
+    try {
+      if (rid.byName) matchesIssuer = dnEqual(rid.byName.rdns, cert.issuer.rdns);
+      else if (rid.byKey) matchesIssuer = rid.byKey.equals(await ocspDigest("SHA-1", issuerKeyBits));
+    } catch (_e) { matchesIssuer = false; }
+    if (matchesIssuer) return issuer.workingPublicKey;
+
+    for (var i = 0; i < basicResponse.certs.length; i++) {
+      var rc;
+      try { rc = x509.parse(basicResponse.certs[i]); }
+      catch (_e) { continue; }
+      var identifies = false;
+      try {
+        if (rid.byName) identifies = dnEqual(rid.byName.rdns, rc.subject.rdns);
+        else if (rid.byKey) identifies = rid.byKey.equals(await ocspDigest("SHA-1", ocspKeyValue(rc.subjectPublicKeyInfo.bytes)));
+      } catch (_e) { identifies = false; }
+      if (!identifies) continue;
+      // The delegate MUST be issued directly by the CA that issued the target.
+      var issuedByCa;
+      try { issuedByCa = dnEqual(rc.issuer.rdns, cert.issuer.rdns); }
+      catch (_e) { continue; }
+      if (!issuedByCa) continue;
+      if (!isOctetAligned(rc.signatureValue)) continue;
+      if (!(await verifyWithSpki(rc.signatureAlgorithm, rc.signatureValue.bytes, issuer.workingPublicKey, rc.tbsBytes))) continue;
+      // The delegate cert MUST itself be valid at the validation instant.
+      if (time < rc.validity.notBefore || time > rc.validity.notAfter) continue;
+      // The delegate MUST assert id-kp-OCSPSigning; anyEKU / an absent EKU do not.
+      var eku;
+      try { eku = decodeExt(rc, OID_EKU); }
+      catch (_e) { continue; }
+      if (!eku || eku.value.indexOf(OID_OCSP_SIGNING) === -1) continue;
+      // A delegate asserting keyUsage MUST permit digitalSignature; an absent keyUsage is
+      // unrestricted, an unreadable one is not authoritative.
+      var ku;
+      try { ku = decodeExt(rc, OID_KEY_USAGE); }
+      catch (_e) { continue; }
+      if (ku && ku.value.digitalSignature !== true) continue;
+      // An unknown critical extension (or a recognized-but-malformed one) makes the delegate
+      // unusable, the same fail-closed rule the path validator applies.
+      if (unrecognizedCriticalExtension(rc, false)) continue;
+      if (validateCriticalExtensionStructure(rc)) continue;
+      // The delegate MUST carry id-pkix-ocsp-nocheck (RFC 6960 sec. 4.2.2.2.1): a transport-free
+      // checker cannot otherwise confirm the responder cert is unrevoked.
+      if (!findExt(rc, OID_OCSP_NOCHECK)) continue;
+      // A composite-keyed delegate gets the same composite keyUsage gate the path certs do.
+      if (compositeSig.COMPOSITE_ALGS[rc.subjectPublicKeyInfo.algorithm.oid] && !compositeKeyUsageCheck(rc).ok) continue;
+      return ocspResponderSpki(rc, issuer);
+    }
+    return null;
+  }
+
+  // A BIT STRING is octet-aligned iff its unused-bits count is 0 -- reused from the caller's
+  // guard so a non-octet-aligned responder signature is never verified.
+  function isOctetAligned(bitString) { return !!bitString && bitString.unusedBits === 0; }
+
+  // evaluateResponse(resp, cert, issuer, issuerKeyBits, issuerNameCandidates, time, historical) ->
+  // a granular per-response SUMMARY for ONE parsed OCSPResponse, aggregating over ALL of its
+  // matching SingleResponses (a revoked SingleResponse shadows a good one WITHIN the response, the
+  // same fail-closed law the multi-response aggregator applies). Never throws (fail-closed):
+  //   { applicable, responderAuthorized, signatureValid, matched, revoked:{reason,revocationReason}?,
+  //     sawGood, sawUnknownStatus, thisUpdate?, nextUpdate?, reason }
+  async function evaluateResponse(resp, cert, issuer, issuerKeyBits, issuerNameCandidates, time, historical) {
+    if (resp.responseStatus.code !== 0) return { applicable: false, matched: false, reason: "non-successful OCSP responseStatus (" + resp.responseStatus.code + ")" };
+    var br = resp.basicResponse;
+    // Coverage residual -- unreachable for a parsed response (schema-ocsp enforces the
+    // successful<->responseBytes biconditional); backstop for a hand-built object.
+    if (!br) return { applicable: false, matched: false, reason: "successful OCSP response carries no BasicOCSPResponse" };
+    var signerSpki = await ocspAuthorizeResponder(br, cert, issuer, issuerKeyBits, time);
+    if (!signerSpki) return { applicable: true, matched: false, responderAuthorized: false, reason: "no authorized OCSP responder signs this response (RFC 6960 sec. 4.2.2.2)" };
+    if (!(await verifyWithSpki(br.signatureAlgorithm, br.signature, signerSpki, br.tbsResponseDataBytes))) {
+      return { applicable: true, matched: false, responderAuthorized: true, signatureValid: false, reason: "the OCSP response signature does not verify over tbsResponseData" };
+    }
+    if (ocspHasCriticalExtension(br.responseExtensions)) {
+      return { applicable: true, matched: false, responderAuthorized: true, signatureValid: true, reason: "the OCSP response carries an unrecognized critical extension" };
+    }
+    var out = { applicable: true, matched: false, responderAuthorized: true, signatureValid: true, revoked: null, sawGood: false, sawUnknownStatus: false, reason: "no current SingleResponse names this certificate" };
+    for (var s = 0; s < br.responses.length; s++) {
+      var sr = br.responses[s];
+      if (!(await ocspCertIdMatches(sr.certID, cert, issuerNameCandidates, issuerKeyBits))) continue;
+      if (ocspHasCriticalExtension(sr.singleExtensions)) continue;
+      if (sr.thisUpdate > time) continue;
+      if (!sr.nextUpdate || sr.nextUpdate < time) continue;
+      out.matched = true; out.thisUpdate = sr.thisUpdate; out.nextUpdate = sr.nextUpdate;
+      var st = sr.certStatus;
+      if (st.type === "revoked") {
+        // Present-time validation revokes regardless of a future revocationTime (skew/post-dating);
+        // only explicit historical validation defers a strictly-future revocation (reports good).
+        if (historical && st.revocationTime instanceof Date && st.revocationTime.getTime() > time.getTime()) { out.sawGood = true; }
+        else if (!out.revoked) { out.revoked = { revocationReason: st.revocationReason || null, reason: "certificate reported revoked by an authorized OCSP responder" + (st.revocationReason ? " (" + st.revocationReason + ")" : "") }; }
+      } else if (st.type === "good") { out.sawGood = true; }
+      else { out.sawUnknownStatus = true; }
+    }
+    return out;
+  }
+
+  return {
+    evaluateResponse: evaluateResponse,
+    authorizeResponder: ocspAuthorizeResponder,
+    certIdMatches: ocspCertIdMatches,
+    hasCriticalExtension: ocspHasCriticalExtension,
+    responderSpki: ocspResponderSpki,
+  };
+}
+
+module.exports = { makeOcspVerify: makeOcspVerify, ocspKeyValue: ocspKeyValue, ocspDigest: ocspDigest, OCSP_CERTID_HASHES: OCSP_CERTID_HASHES };