@blamejs/pki 0.3.1 → 0.3.3

package/lib/cms-sign.js

@@ -22,6 +22,7 @@ var frameworkError = require("./framework-error");
 
 var signScheme = require("./sign-scheme");
 var guard = require("./guard-all");
+var pkiBuild = require("./pki-build");
 var CmsError = frameworkError.CmsError;
 var b = asn1.build;
 function _err(code, message, cause) { return new CmsError(code, message, cause); }
@@ -47,14 +48,6 @@ function _digest(digestName, content) {
 }
 
 
-// The raw issuer Name TLV from a parsed certificate (byte-identical to the cert, so the sid the
-// verifier canonically compares matches exactly). The issuer is the Name after the optional
-// version [0] and the serial + signature AlgorithmIdentifier in the tbsCertificate.
-function _issuerBytes(cert) {
-  var tbs = asn1.decode(cert.tbsBytes);
-  var hasVersion = tbs.children[0].tagClass === "context" && tbs.children[0].tagNumber === 0;
-  return tbs.children[hasVersion ? 3 : 2].bytes;
-}
 // The cert's subjectKeyIdentifier extension value (the raw key id), or throws.
 function _skiValue(cert) {
   var ext = (cert.extensions || []).filter(function (e) { return e.oid === OID_SKI; })[0];
@@ -75,7 +68,7 @@ function _buildSignerInfo(signer, content, eContentType, opts) {
   var useSki = opts.sid === "ski";
   var sid = useSki
     ? b.contextPrimitive(0, _skiValue(cert))                                       // [0] IMPLICIT SubjectKeyIdentifier
-    : b.sequence([b.raw(_issuerBytes(cert)), b.integer(cert.serialNumber)]);        // IssuerAndSerialNumber
+    : b.sequence([b.raw(pkiBuild.tbsNameField(cert, "issuer")), b.integer(cert.serialNumber)]);   // IssuerAndSerialNumber
   var version = useSki ? 3 : 1;
 
   return Promise.resolve().then(function () {

package/lib/crmf-sign.js

@@ -0,0 +1,275 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+
+/**
+ * @module     pki.crmf
+ * @nav        Signing
+ * @title      Certificate request messages
+ * @intro The RFC 4211 certificate-request-message producing side. `pki.crmf.build` assembles a
+ *   `CertReqMessages` -- one or more `CertReqMsg`, each a `CertRequest` (a `CertTemplate` of the requested
+ *   certificate fields plus optional controls) paired with a proof of possession. The common proof is a
+ *   `POPOSigningKey` signature over the `CertRequest`, made with the private half of the key being
+ *   certified (the requester proves possession, exactly as a PKCS#10 CSR does). The message drops into a
+ *   CMP (RFC 9810) or EST enrollment body. Parsing lives at `pki.schema.crmf.parse`.
+ * @spec RFC 4211
+ * @card Build a CRMF CertReqMessages with a signature proof of possession.
+ */
+//
+// RFC 4211 App. B / RFC 5912 sec. 10 are DEFINITIONS IMPLICIT TAGS: a CertTemplate [0]..[9] field tag
+// REPLACES the base universal tag (built via asn1.build.implicit, preserving the primitive/constructed
+// bit); the shipped parser encodes issuer [3] / subject [5] Name IMPLICITLY (the dominant CMP/EST wire
+// form), so the builder does too. The two EXPLICIT exceptions are the OptionalValidity notBefore [0] /
+// notAfter [1] Time (a genuine UTCTime/GeneralizedTime CHOICE). The signature scheme resolves from the
+// requested publicKey through the shared sign-scheme registry; the Name / extension / SPKI encoders and
+// the post-sign self-check are the shared lib/pki-build primitives, bound to the crmf namespace.
+
+var asn1 = require("./asn1-der");
+var oid = require("./oid");
+var crmf = require("./schema-crmf");
+var signScheme = require("./sign-scheme");
+var pkix = require("./schema-pkix");
+var pkiBuild = require("./pki-build");
+var frameworkError = require("./framework-error");
+
+var CrmfError = frameworkError.CrmfError;
+var b = asn1.build;
+function _err(code, message, cause) { return new CrmfError(code, message, cause); }
+function _signE(kind, message, cause) { return new CrmfError("crmf/" + kind, message, cause); }
+function O(n) { return oid.byName(n); }
+
+var NS = pkix.makeNS("crmf", CrmfError, oid);
+var EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
+var _b = pkiBuild.makeBuilder({
+  ErrorClass: CrmfError, prefix: "crmf", O: O, NS: NS,
+  NAME_SCHEMA: pkix.name(NS), SPKI_SCHEMA: pkix.spki(NS), EXT_DECODERS: EXT_DECODERS,
+});
+
+var KNOWN_SPEC_KEYS = { certReqId: 1, certTemplate: 1, controls: 1, regInfo: 1, pop: 1 };
+var KNOWN_TEMPLATE_KEYS = { version: 1, subject: 1, publicKey: 1, validity: 1, extensions: 1, issuer: 1 };
+// The controls (RFC 4211 sec. 6) and regInfo (sec. 7) are DISJOINT AttributeTypeAndValue namespaces --
+// regToken/authenticator/oldCertID/protocolEncrKey are controls; utf8Pairs is regInfo -- so the object
+// form validates each key against its own field's registry (a control name is not a valid regInfo, and
+// vice versa). The key name equals the registered OID name; complex values (pkiPublicationInfo, certReq)
+// ride the pre-encoded escape hatch. Each entry is the value encoder for that OID.
+function _ctlUtf8(v) { return b.utf8(String(v)); }
+function _ctlSpki(v) { var k = _b.reqDer(v, "protocolEncrKey (an SPKI DER)"); _b.assertValidSpki(k, "protocolEncrKey"); return b.raw(k); }
+var CONTROL_VALUE = { regToken: _ctlUtf8, authenticator: _ctlUtf8, oldCertID: function (v) { return _encodeCertId(v); }, protocolEncrKey: _ctlSpki };
+var REGINFO_VALUE = { utf8Pairs: _ctlUtf8 };
+
+// ---- CertTemplate + POP structural encoders (byte-exact inverses of schema-crmf.js) ----
+
+// OptionalValidity [4] IMPLICIT SEQUENCE { notBefore [0] EXPLICIT Time, notAfter [1] EXPLICIT Time } --
+// at least one present (RFC 4211 sec. 5). Time is a CHOICE so [0]/[1] are EXPLICIT.
+function _encodeOptionalValidity(validity) {
+  if (!validity || typeof validity !== "object" || Buffer.isBuffer(validity)) throw _err("crmf/bad-validity", "validity must be an object { notBefore?, notAfter? }");
+  var nb = validity.notBefore, na = validity.notAfter;
+  if (nb == null && na == null) throw _err("crmf/bad-validity", "validity must contain notBefore or notAfter (RFC 4211 sec. 5)");
+  var parts = [];
+  // timeDer validates each instant (guard.time.assertValid throws on an Invalid Date) BEFORE the
+  // inverted-window comparison, so getTime() below cannot be NaN.
+  if (nb != null) parts.push(b.explicit(0, _b.timeDer(nb, "validity notBefore")));
+  if (na != null) parts.push(b.explicit(1, _b.timeDer(na, "validity notAfter")));
+  // allow:nan-date-comparison-unguarded -- both instants passed timeDer's guard.time.assertValid above.
+  if (nb != null && na != null && nb.getTime() > na.getTime()) throw _err("crmf/bad-validity", "notBefore must not be after notAfter");
+  return b.implicit(4, b.sequence(parts));
+}
+// CertTemplate ::= SEQUENCE { [0..9] all IMPLICIT OPTIONAL }. A REQUEST omits serialNumber [1] / signingAlg
+// [2] / issuerUID [7] / subjectUID [8] (CA-assigned or deprecated, RFC 4211 sec. 5) -- the builder never
+// emits them. Fields are emitted in ascending tag order.
+function _encodeCertTemplate(tpl) {
+  if (!tpl || typeof tpl !== "object" || Buffer.isBuffer(tpl)) throw _err("crmf/bad-cert-template", "certTemplate must be an object");
+  Object.keys(tpl).forEach(function (k) { if (!KNOWN_TEMPLATE_KEYS[k]) throw _err("crmf/bad-input", "unknown certTemplate field " + JSON.stringify(k)); });
+  var fields = [];
+  if (tpl.version != null) {
+    if (tpl.version !== 2) throw _err("crmf/bad-version", "certTemplate version MUST be 2 (v3) if supplied (RFC 4211 sec. 5)");
+    fields.push(b.implicit(0, b.integer(2n)));                                  // version [0]
+  }
+  // issuer [3] / subject [5] are EXPLICIT: Name is a CHOICE, and X.680 sec. 31.2.7 forces a context tag on
+  // a CHOICE to EXPLICIT even under the module's IMPLICIT TAGS default (the [3]/[5] wraps the RDNSequence
+  // SEQUENCE, it does not replace its tag). The parser accepts both forms; this is the conformant one.
+  if (tpl.issuer != null) fields.push(b.explicit(3, _b.encodeName(tpl.issuer)));    // issuer [3] EXPLICIT
+  if (tpl.validity != null) fields.push(_encodeOptionalValidity(tpl.validity));     // validity [4] IMPLICIT
+  if (tpl.subject != null) fields.push(b.explicit(5, _b.encodeName(tpl.subject)));  // subject [5] EXPLICIT
+  var spki = null;
+  if (tpl.publicKey != null) {
+    spki = _b.reqDer(tpl.publicKey, "certTemplate.publicKey (the SPKI DER of the requested key)");
+    _b.assertValidSpki(spki, "certTemplate.publicKey");
+    fields.push(b.implicit(6, spki));                                             // publicKey [6]
+  }
+  if (tpl.extensions != null) fields.push(b.implicit(9, _b.requestedExtensions(tpl.extensions, spki)));   // extensions [9]
+  return { der: b.sequence(fields), spki: spki, complete: tpl.subject != null && tpl.publicKey != null };
+}
+
+// Controls / regInfo ::= SEQUENCE SIZE(1..MAX) OF AttributeTypeAndValue { type OID, value ANY }. Object
+// form maps recognized names to typed value encoders; any other (or a pre-encoded AttributeTypeAndValue
+// DER array) rides the escape hatch, shape-validated.
+function _buildAttrTypeAndValues(spec, code, label, valueMap) {
+  if (Array.isArray(spec)) {
+    if (!spec.length) throw _err(code, label + " must carry at least one entry");
+    var seenA = {};
+    return b.sequence(spec.map(function (e, i) {
+      var der = _b.reqDer(e, label + " [" + i + "]");
+      var n;
+      try { n = asn1.decode(der); } catch (err) { throw _err("crmf/bad-input", "pre-encoded " + label + " [" + i + "] is not valid DER", err); }
+      if (n.tagNumber !== asn1.TAGS.SEQUENCE || n.tagClass !== "universal" || !n.children || n.children.length !== 2) throw _err("crmf/bad-input", "pre-encoded " + label + " [" + i + "] must be a SEQUENCE { type OID, value }");
+      var t;
+      try { t = asn1.read.oid(n.children[0]); } catch (err) { throw _err("crmf/bad-input", "pre-encoded " + label + " [" + i + "] type is not an OBJECT IDENTIFIER", err); }
+      if (seenA[t]) throw _err(code, "duplicate " + label + " type " + (oid.name(t) || t));
+      seenA[t] = true;
+      return b.raw(der);
+    }));
+  }
+  if (!spec || typeof spec !== "object") throw _err("crmf/bad-input", label + " must be an object or an array of pre-encoded AttributeTypeAndValue DER");
+  var out = [], seen = {};
+  Object.keys(spec).forEach(function (k) {
+    var enc = valueMap[k];
+    if (!enc) throw _err("crmf/bad-input", "unknown " + label + " " + JSON.stringify(k) + "; pass a pre-encoded AttributeTypeAndValue DER via the array form for a " + label + " entry outside " + Object.keys(valueMap).join("/"));
+    var typeOid = O(k);
+    if (seen[typeOid]) throw _err(code, "duplicate " + label + " type " + k);
+    seen[typeOid] = true;
+    out.push(b.sequence([b.oid(typeOid), enc(spec[k])]));
+  });
+  if (!out.length) throw _err(code, label + " must carry at least one entry");
+  return b.sequence(out);
+}
+// certReqId is a signed INTEGER, value UNCONSTRAINED (the RFC 9483 -1 sentinel and 0 are both legal). A
+// number must be a safe integer (a fractional or > 2^53 number loses precision through BigInt); a BigInt
+// or a decimal / 0x-hex string carries an arbitrary value.
+function _certReqId(v) {
+  if (v == null) return 0n;
+  if (typeof v === "bigint") return v;
+  if (typeof v === "number") { if (!Number.isSafeInteger(v)) throw _err("crmf/bad-input", "certReqId number must be a safe integer (pass a BigInt or a string for a larger value)"); return BigInt(v); }
+  if (typeof v === "string") { try { return BigInt(v); } catch (e) { throw _err("crmf/bad-input", "certReqId string must be a decimal or 0x-hex integer", e); } }
+  throw _err("crmf/bad-input", "certReqId must be a BigInt, a safe integer, or a string");
+}
+// CertId ::= SEQUENCE { issuer GeneralName, serialNumber INTEGER } (RFC 4211 sec. 6.4, oldCertID value).
+function _encodeCertId(id) {
+  if (!id || typeof id !== "object" || id.issuer == null || id.serialNumber == null) throw _err("crmf/bad-input", "oldCertID must be { issuer: GeneralName, serialNumber }");
+  return b.sequence([_b.encodeGeneralName(id.issuer), _b.serialInteger(id.serialNumber)]);
+}
+
+// ProofOfPossession. The signature arm (the default when a key is given): when the template carries BOTH
+// subject and publicKey (complete), sign the CertRequest DER and OMIT poposkInput; otherwise build a
+// POPOSigningKeyInput (authInfo sender [0] GeneralName + the requested publicKey), sign its SEQUENCE, and
+// carry it as poposkInput [0] (RFC 4211 sec. 4.1). raVerified is emitted only on an explicit opt-in.
+function _buildProofOfPossession(pop, certReqDer, template, signingKey, opts) {
+  if (pop != null && (typeof pop !== "object" || Buffer.isBuffer(pop))) throw _err("crmf/bad-input", "spec.pop must be an object (e.g. { type: 'signature' } or { type: 'raVerified', raVerified: true })");
+  var mode = (pop && pop.type) || (signingKey != null ? "signature" : null);
+  if (mode == null) return null;   // no POP requested and no key -> omit popo (an RA supplies it out of band)
+  if (mode === "raVerified") {
+    if (!(pop && pop.raVerified === true)) throw _err("crmf/bad-popo", "raVerified must be explicitly opted into (pop: { type: 'raVerified', raVerified: true }) -- a requester does not normally assert it (RFC 4211 sec. 4)");
+    return b.implicit(0, b.nullValue());   // raVerified [0] IMPLICIT NULL
+  }
+  if (mode !== "signature") throw _err("crmf/bad-popo", "unsupported proof-of-possession type " + JSON.stringify(mode) + " (supported: 'signature', 'raVerified')");
+  if (signingKey == null) throw _err("crmf/bad-input", "a signature proof of possession requires the requester's private key");
+  if (template.spki == null) throw _err("crmf/bad-input", "a signature proof of possession requires certTemplate.publicKey");
+  var scheme = signScheme.resolveSignScheme(_b.certLikeFromSpki(template.spki), { combinedRsaSig: true, pss: opts.pss, digestAlgorithm: opts.digestAlgorithm }, true, _signE);
+  var signedRegion, poposkInputField = null;
+  if (template.complete) {
+    signedRegion = certReqDer;   // sec. 4.1: complete template -> sign the CertRequest, poposkInput omitted
+  } else {
+    // POPOSigningKeyInput ::= SEQUENCE { authInfo CHOICE { sender [0] GeneralName, publicKeyMAC }, publicKey }.
+    var sender = pop && pop.sender;
+    if (sender == null) throw _err("crmf/bad-popo", "an incomplete template (missing subject or publicKey) requires pop.sender (a GeneralName) for the POPOSigningKeyInput authInfo (RFC 4211 sec. 4.1)");
+    var poposkSeq = b.sequence([b.explicit(0, _b.encodeGeneralName(sender)), b.raw(template.spki)]);
+    signedRegion = poposkSeq;
+    poposkInputField = b.implicit(0, poposkSeq);   // poposkInput [0] IMPLICIT POPOSigningKeyInput
+  }
+  return signScheme.signOverTbs(scheme, signingKey, signedRegion, _signE).then(function (sig) {
+    return Promise.resolve(_b.assertSignatureVerifies(signedRegion, sig, template.spki, scheme)).then(function () {
+      var popoChildren = [];
+      if (poposkInputField) popoChildren.push(poposkInputField);
+      popoChildren.push(scheme.sigAlgId);
+      popoChildren.push(b.bitString(sig, 0));
+      return b.implicit(1, b.sequence(popoChildren));   // signature [1] IMPLICIT POPOSigningKey
+    });
+  }, function (e) {
+    if (e instanceof CrmfError) throw e;
+    throw _err("crmf/bad-input", "signing the proof of possession failed -- the key does not match the requested public key or is invalid", e);
+  });
+}
+
+/**
+ * @primitive pki.crmf.build
+ * @signature pki.crmf.build(spec, key?, opts?) -> Promise<Buffer|string>
+ * @since 0.3.3
+ * @status experimental
+ * @spec RFC 4211
+ * @defends forged-certificate-request (CWE-347)
+ * @related pki.schema.crmf.parse, pki.csr.sign
+ *
+ * Build and DER-encode an RFC 4211 `CertReqMessages`. `spec` describes one certificate request message (or
+ * pass `spec.messages` -- an array of specs -- for a batch): `certReqId` (an integer, default 0; the RFC
+ * 9483 `-1` sentinel is allowed), `certTemplate` (the requested certificate fields -- `subject`, `publicKey`
+ * (the SPKI DER of the key being certified), `validity` ({ notBefore, notAfter } Dates), `extensions` (an
+ * object of subjectAltName / keyUsage / extendedKeyUsage / basicConstraints / certificatePolicies /
+ * subjectKeyIdentifier, or pre-encoded Extension DER), and an optional `version` (2)), optional `controls`
+ * and `regInfo` (an object of regToken / authenticator / utf8Pairs / oldCertID / protocolEncrKey, or
+ * pre-encoded AttributeTypeAndValue DER), and an optional `pop` selector. `key` (or `{ key }`) is the
+ * REQUESTER's private key -- the private half of `certTemplate.publicKey`; the message carries a
+ * `POPOSigningKey` proof of possession signed with it (verified before the message is returned), exactly
+ * as a PKCS#10 CSR proves possession. The signature algorithm is resolved from the requested public key
+ * (RSA PKCS#1 v1.5 / PSS, ECDSA, EdDSA, ML-DSA, SLH-DSA, or a composite arm). `key` is optional -- omit it
+ * for a `raVerified` proof (opt in with `pop: { type: 'raVerified', raVerified: true }`). Returns DER, or a
+ * PEM block with `opts.pem` (the label is required). Malformed input throws a typed `CrmfError`.
+ * Certificate-request-message parsing is `pki.schema.crmf.parse`.
+ *
+ * @opts
+ *   - `pem` (string) -- return a PEM block with this label instead of DER (e.g. "CERTIFICATE REQUEST MESSAGE").
+ *   - `pss` (boolean) -- sign an RSA key with RSASSA-PSS rather than PKCS#1 v1.5.
+ *   - `digestAlgorithm` (string) -- override the message digest where the algorithm permits a choice.
+ * @example
+ *   var msg = await pki.crmf.build(
+ *     { certReqId: 0, certTemplate: { subject: "device-42", publicKey: signerSpki } },
+ *     { key: signerKeyPkcs8 });
+ *   pki.schema.crmf.parse(msg).messages[0].certReq.certTemplate.subject.dn;   // "CN=device-42"
+ */
+function build(spec, key, opts) {
+  return Promise.resolve().then(function () { return _build(spec, key, opts); });
+}
+
+function _buildCertReqMsg(spec, key, opts) {
+  if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("crmf/bad-input", "each certificate-request-message spec must be an object");
+  Object.keys(spec).forEach(function (k) { if (!KNOWN_SPEC_KEYS[k]) throw _err("crmf/bad-input", "unknown spec field " + JSON.stringify(k)); });
+  if (spec.certTemplate == null) throw _err("crmf/bad-input", "spec.certTemplate is required");
+
+  var signingKey = (key && typeof key === "object" && !Buffer.isBuffer(key) && !(key instanceof Uint8Array) && key.type == null && "key" in key) ? key.key : key;
+  var template = _encodeCertTemplate(spec.certTemplate);
+  var certReqChildren = [b.integer(_certReqId(spec.certReqId)), template.der];
+  if (spec.controls != null) certReqChildren.push(_buildAttrTypeAndValues(spec.controls, "crmf/bad-controls", "controls", CONTROL_VALUE));
+  var certReqDer = b.sequence(certReqChildren);
+
+  return Promise.resolve(_buildProofOfPossession(spec.pop, certReqDer, template, signingKey, opts)).then(function (popoDer) {
+    var msgChildren = [certReqDer];
+    if (popoDer) msgChildren.push(popoDer);
+    if (spec.regInfo != null) msgChildren.push(_buildAttrTypeAndValues(spec.regInfo, "crmf/bad-reg-info", "regInfo", REGINFO_VALUE));
+    return b.sequence(msgChildren);   // CertReqMsg
+  });
+}
+
+function _build(spec, key, opts) {
+  opts = opts || {};
+  if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("crmf/bad-input", "the certificate-request-message spec must be an object");
+  var specs;
+  if (spec.messages != null) {
+    // Batch form: the envelope carries ONLY `messages` -- reject a stray field so a request spec written at
+    // the wrong nesting level (e.g. certTemplate alongside messages) is not silently dropped.
+    if (!Array.isArray(spec.messages)) throw _err("crmf/bad-input", "spec.messages must be an array of certificate-request-message specs");
+    Object.keys(spec).forEach(function (k) { if (k !== "messages") throw _err("crmf/bad-input", "unknown batch-envelope field " + JSON.stringify(k) + " -- a batch spec carries only 'messages'"); });
+    specs = spec.messages;
+  } else {
+    specs = [spec];
+  }
+  if (!specs.length) throw _err("crmf/bad-input", "at least one certificate request message is required (RFC 4211 sec. 3)");
+  return Promise.all(specs.map(function (s) { return _buildCertReqMsg(s, key, opts); })).then(function (msgs) {
+    var der = b.sequence(msgs);   // CertReqMessages ::= SEQUENCE SIZE(1..MAX) OF CertReqMsg
+    if (opts.pem != null) {
+      if (typeof opts.pem !== "string" || !opts.pem) throw _err("crmf/bad-input", "opts.pem must be a non-empty PEM label string");
+      return crmf.pemEncode(der, opts.pem);
+    }
+    return der;
+  });
+}
+
+module.exports = { build: build };

package/lib/csr-sign.js

@@ -42,12 +42,6 @@ var _b = pkiBuild.makeBuilder({
   NAME_SCHEMA: pkix.name(NS), SPKI_SCHEMA: pkix.spki(NS), EXT_DECODERS: EXT_DECODERS,
 });
 
-// The requested-extension object keys (a CSR REQUESTS extensions; it does NOT enforce issuance policy,
-// so there are no CA cross-field gates and no authorityKeyIdentifier auto-derivation).
-var KNOWN_REQ_EXT_KEYS = {
-  subjectAltName: 1, keyUsage: 1, keyUsageCritical: 1, extendedKeyUsage: 1, extendedKeyUsageCritical: 1,
-  basicConstraints: 1, certificatePolicies: 1, certificatePoliciesCritical: 1, subjectKeyIdentifier: 1,
-};
 // challengePassword DirectoryString charset (PrintableString set); anything else uses UTF8String.
 var PRINTABLE_RE = /^[A-Za-z0-9 '()+,\-./:=?]*$/;
 
@@ -57,43 +51,9 @@ function _implicitSetOf0(members) {
   return b.contextConstructed(0, Buffer.concat(members.slice().sort(Buffer.compare)));
 }
 
-// The requested v3 Extensions (a bare SEQUENCE OF Extension, RFC 2985 sec. 5.4.2) from the object form,
-// or an array of pre-encoded Extension DER. Reuses the shared extension-value encoders; no CA gates.
-function _buildRequestedExtensions(extSpec, subjectSpki) {
-  if (Array.isArray(extSpec)) {
-    if (!extSpec.length) throw _err("csr/bad-input", "extensionRequest must carry at least one extension");
-    var seen = {};
-    return b.sequence(extSpec.map(function (e, i) {
-      var der = _b.reqDer(e, "extension");
-      _b.assertValidExtension(der, i);
-      var n = asn1.decode(der);
-      var extnId = asn1.read.oid(n.children[0]);
-      if (seen[extnId]) throw _err("csr/bad-input", "duplicate extension " + extnId + " in extensionRequest (RFC 5280 sec. 4.2)");
-      seen[extnId] = true;
-      // Fully validate a RECOGNIZED extension via its real RFC 5280 sec. 4.2.1 value decoder (a malformed
-      // value fails closed with the decoder's typed code); an unrecognized extension stays opaque.
-      var dec = EXT_DECODERS[extnId];
-      if (dec) {
-        try { dec(asn1.read.octetString(n.children[n.children.length - 1])); }
-        catch (err) { if (err instanceof CsrError) throw err; throw _err("csr/bad-input", "pre-encoded " + (oid.name(extnId) || extnId) + " extension value is malformed", err); }
-      }
-      return b.raw(der);
-    }));
-  }
-  if (!extSpec || typeof extSpec !== "object") throw _err("csr/bad-input", "extensionRequest must be an object or an array of pre-encoded Extension DER");
-  Object.keys(extSpec).forEach(function (k) {
-    if (!KNOWN_REQ_EXT_KEYS[k]) throw _err("csr/bad-input", "unknown extensionRequest extension " + JSON.stringify(k) + "; pass a pre-encoded Extension DER via the array form for a custom extension");
-  });
-  var out = [];
-  if (extSpec.subjectKeyIdentifier != null) out.push(_b.ext(O("subjectKeyIdentifier"), false, _b.extSki(_b.skiKeyId(extSpec.subjectKeyIdentifier, subjectSpki))));
-  if (extSpec.keyUsage != null) out.push(_b.ext(O("keyUsage"), extSpec.keyUsageCritical !== false, _b.extKeyUsage(extSpec.keyUsage)));
-  if (extSpec.extendedKeyUsage != null) out.push(_b.ext(O("extKeyUsage"), !!extSpec.extendedKeyUsageCritical, _b.extExtKeyUsage(extSpec.extendedKeyUsage)));
-  if (extSpec.basicConstraints != null) { _b.validateBcSpec(extSpec.basicConstraints); out.push(_b.ext(O("basicConstraints"), extSpec.basicConstraints.critical !== false, _b.extBasicConstraints(extSpec.basicConstraints))); }
-  if (extSpec.subjectAltName != null) out.push(_b.ext(O("subjectAltName"), false, _b.extSan(extSpec.subjectAltName)));
-  if (extSpec.certificatePolicies != null) out.push(_b.ext(O("certificatePolicies"), !!extSpec.certificatePoliciesCritical, _b.extCertPolicies(extSpec.certificatePolicies)));
-  if (!out.length) throw _err("csr/bad-input", "extensionRequest must request at least one extension");
-  return b.sequence(out);
-}
+// The requested v3 Extensions (a bare SEQUENCE OF Extension, RFC 2985 sec. 5.4.2) -- the shared builder
+// primitive (a CSR REQUESTS extensions; no CA gates), object form or a pre-encoded Extension DER array.
+function _buildRequestedExtensions(extSpec, subjectSpki) { return _b.requestedExtensions(extSpec, subjectSpki); }
 
 // challengePassword ::= DirectoryString bounded 1..255 (RFC 2985 sec. 5.4.1). PrintableString when the
 // value is in that charset, else UTF8String; never a Teletex/BMP/Universal string for a new value.

package/lib/pki-build.js

@@ -13,6 +13,8 @@
 var asn1 = require("./asn1-der");
 var schema = require("./schema-engine");
 var compositeSig = require("./composite-sig");
+var guard = require("./guard-all");
+var oid = require("./oid");
 var nodeCrypto = require("crypto");
 
 var b = asn1.build;
@@ -31,6 +33,17 @@ function makeBuilder(ctx) {
   var NAME_SCHEMA = ctx.NAME_SCHEMA, SPKI_SCHEMA = ctx.SPKI_SCHEMA;
   function E(kind, message, cause) { return new ErrorClass(ctx.prefix + "/" + kind, message, cause); }
   function code(kind) { return ctx.prefix + "/" + kind; }
+  // A full-code error factory (guard.* helpers invoke E as `E(fullCode, msg)`, not `E(kind, msg)`).
+  function rawErr(fullCode, message, cause) { return new ErrorClass(fullCode, message, cause); }
+
+  // RFC 5280 sec. 4.1.2.5 -- UTCTime for 1950..2049, GeneralizedTime otherwise (UTCTime's two-digit year
+  // only represents that window). The shared cutover so a certificate / CRMF / any validity encoder cannot
+  // drift on the boundary. `which` labels the instant in a validation error.
+  function timeDer(date, which) {
+    guard.time.assertValid(date, rawErr, code("bad-input"), which);
+    var y = date.getUTCFullYear();
+    return (y >= 1950 && y <= 2049) ? b.utcTime(date) : b.generalizedTime(date);
+  }
 
   // ---- distinguished name encoding (RFC 5280 sec. 4.1.2.4) ----
   // countryName is a PrintableString SIZE(2), emailAddress an IA5String; every other new-name attribute
@@ -144,10 +157,18 @@ function makeBuilder(ctx) {
   }
   function extSki(keyid) { return b.octetString(keyid); }
   function extAki(keyid) { return b.sequence([b.contextPrimitive(0, keyid)]); }   // keyIdentifier [0] IMPLICIT OCTET STRING
-  function extSan(entries) {
-    if (!Array.isArray(entries) || !entries.length) throw E("bad-input", "subjectAltName must carry at least one GeneralName");
-    return b.sequence(entries.map(encodeGeneralName));
+  // GeneralNames ::= SEQUENCE SIZE(1..MAX) OF GeneralName. With no implicitTag it is a universal SEQUENCE
+  // (subjectAltName / issuerAltName / IssuerSerial.issuer). With an implicitTag it is a context-constructed
+  // [n] whose tag REPLACES the SEQUENCE tag (RFC 5755 IMPLICIT TAGS -- Holder.entityName [1],
+  // RoleSyntax.roleAuthority [0], IetfAttrSyntax.policyAuthority [0]); the [n] node's children ARE the
+  // GeneralName members, no inner SEQUENCE wrapper.
+  function encodeGeneralNames(entries, implicitTag) {
+    if (!Array.isArray(entries) || !entries.length) throw E("bad-input", "a GeneralNames must carry at least one GeneralName");
+    var members = entries.map(encodeGeneralName);
+    if (implicitTag == null) return b.sequence(members);
+    return b.contextConstructed(implicitTag, Buffer.concat(members));
   }
+  function extSan(entries) { return encodeGeneralNames(entries); }
   function extCertPolicies(names) {
     if (!Array.isArray(names) || !names.length) throw E("bad-input", "certificatePolicies must list at least one policy OID");
     var seen = {};
@@ -218,6 +239,76 @@ function makeBuilder(ctx) {
     var last = n.children[n.children.length - 1];
     if (last.tagNumber !== asn1.TAGS.OCTET_STRING || last.tagClass !== "universal") throw E("bad-input", "pre-encoded extension [" + idx + "] extnValue must be an OCTET STRING");
   }
+  // The requested v3 Extensions (a bare SEQUENCE OF Extension) from an object of the recognized keys, or
+  // an array of pre-encoded Extension DER (shape- + recognized-value-validated). Shared by every enrollment
+  // request that carries requested extensions (a PKCS#10 extensionRequest attribute, a CRMF CertTemplate
+  // extensions [9]); a request REQUESTS extensions, so there are no CA cross-field gates. `spki` feeds the
+  // subjectKeyIdentifier auto-derive.
+  var REQ_EXT_KEYS = {
+    subjectAltName: 1, keyUsage: 1, keyUsageCritical: 1, extendedKeyUsage: 1, extendedKeyUsageCritical: 1,
+    basicConstraints: 1, certificatePolicies: 1, certificatePoliciesCritical: 1, subjectKeyIdentifier: 1,
+  };
+  function requestedExtensions(extSpec, spki) {
+    var EXT_DECODERS = ctx.EXT_DECODERS;
+    if (Array.isArray(extSpec)) {
+      if (!extSpec.length) throw E("bad-input", "the requested extensions list must carry at least one extension");
+      var seen = {};
+      return b.sequence(extSpec.map(function (e, i) {
+        var der = reqDer(e, "extension");
+        assertValidExtension(der, i);
+        var n = asn1.decode(der);
+        var extnId = asn1.read.oid(n.children[0]);
+        if (seen[extnId]) throw E("bad-input", "duplicate requested extension " + extnId + " (RFC 5280 sec. 4.2)");
+        seen[extnId] = true;
+        var dec = EXT_DECODERS && EXT_DECODERS[extnId];
+        if (dec) {
+          try { dec(asn1.read.octetString(n.children[n.children.length - 1])); }
+          catch (err) { if (err instanceof ErrorClass) throw err; throw E("bad-input", "pre-encoded " + (oid.name(extnId) || extnId) + " extension value is malformed", err); }
+        }
+        return b.raw(der);
+      }));
+    }
+    if (!extSpec || typeof extSpec !== "object") throw E("bad-input", "requested extensions must be an object or an array of pre-encoded Extension DER");
+    Object.keys(extSpec).forEach(function (k) {
+      if (!REQ_EXT_KEYS[k]) throw E("bad-input", "unknown requested extension " + JSON.stringify(k) + "; pass a pre-encoded Extension DER via the array form for a custom extension");
+    });
+    var out = [];
+    if (extSpec.subjectKeyIdentifier != null) {
+      // Auto-deriving the SKI (subjectKeyIdentifier: true) hashes the subject public key, so it needs one;
+      // reject the request when no public key is available (supply a Buffer key id instead).
+      if (extSpec.subjectKeyIdentifier === true && spki == null) throw E("bad-input", "subjectKeyIdentifier auto-derive (true) requires the public key -- supply a Buffer key id, or include the public key");
+      out.push(ext(O("subjectKeyIdentifier"), false, extSki(skiKeyId(extSpec.subjectKeyIdentifier, spki))));
+    }
+    if (extSpec.keyUsage != null) out.push(ext(O("keyUsage"), extSpec.keyUsageCritical !== false, extKeyUsage(extSpec.keyUsage)));
+    if (extSpec.extendedKeyUsage != null) out.push(ext(O("extKeyUsage"), !!extSpec.extendedKeyUsageCritical, extExtKeyUsage(extSpec.extendedKeyUsage)));
+    if (extSpec.basicConstraints != null) { validateBcSpec(extSpec.basicConstraints); out.push(ext(O("basicConstraints"), extSpec.basicConstraints.critical !== false, extBasicConstraints(extSpec.basicConstraints))); }
+    if (extSpec.subjectAltName != null) out.push(ext(O("subjectAltName"), false, extSan(extSpec.subjectAltName)));
+    if (extSpec.certificatePolicies != null) out.push(ext(O("certificatePolicies"), !!extSpec.certificatePoliciesCritical, extCertPolicies(extSpec.certificatePolicies)));
+    if (!out.length) throw E("bad-input", "the requested extensions object must request at least one extension");
+    return b.sequence(out);
+  }
+
+  // A positive, non-zero INTEGER of at most 20 content octets (RFC 5280 sec. 4.1.2.2 / RFC 5755 sec.
+  // 4.2.5 -- the identical serial rule for a certificate and an attribute certificate). A random 20-octet
+  // positive serial is generated when none is supplied. Accepts a BigInt, a safe integer, a decimal /
+  // 0x-hex string, or a raw magnitude Buffer.
+  function serialInteger(serial) {
+    var v;
+    if (serial == null) {
+      var rnd = nodeCrypto.randomBytes(20);
+      rnd[0] &= 0x7f;                      // keep the top bit clear so the magnitude stays <= 20 octets and positive
+      if (rnd[0] === 0) rnd[0] = 0x01;     // never all-zero leading -> non-zero and no redundant sign octet
+      v = BigInt("0x" + rnd.toString("hex"));
+    } else if (typeof serial === "bigint") { v = serial; }
+    else if (typeof serial === "number") { if (!Number.isSafeInteger(serial)) throw E("bad-serial", "serialNumber number must be a safe integer (pass a BigInt, hex string, or Buffer for a value above 2^53-1)"); v = BigInt(serial); }
+    else if (typeof serial === "string") { try { v = BigInt(serial); } catch (e) { throw E("bad-serial", "serialNumber string must be a decimal or 0x-hex integer", e); } }
+    else if (Buffer.isBuffer(serial)) { v = serial.length ? BigInt("0x" + serial.toString("hex")) : 0n; }
+    else { throw E("bad-serial", "serialNumber must be a BigInt, integer, hex string, or Buffer"); }
+    if (v <= 0n) throw E("bad-serial", "serialNumber must be a positive integer (RFC 5280 sec. 4.1.2.2)");
+    var tlv = b.integer(v);
+    if (asn1.decode(tlv).content.length > 20) throw E("bad-serial", "serialNumber must not exceed 20 octets (RFC 5280 sec. 4.1.2.2)");
+    return tlv;
+  }
   // Synthesize the parsed-cert shape resolveSignScheme reads (subjectPublicKeyInfo.algorithm) from a raw SPKI.
   function certLikeFromSpki(spkiDer) {
     var spki = asn1.decode(spkiDer);
@@ -258,6 +349,8 @@ function makeBuilder(ctx) {
   return {
     E: E, code: code, KU_BIT: KU_BIT,
     encodeName: encodeName, isEmptyName: isEmptyName, encodeGeneralName: encodeGeneralName,
+    encodeGeneralNames: encodeGeneralNames, serialInteger: serialInteger, timeDer: timeDer,
+    requestedExtensions: requestedExtensions,
     extKeyUsage: extKeyUsage, extExtKeyUsage: extExtKeyUsage, validateBcSpec: validateBcSpec,
     extBasicConstraints: extBasicConstraints, pathLen: pathLen, extSki: extSki, extAki: extAki,
     extSan: extSan, extCertPolicies: extCertPolicies, ext: ext,
@@ -267,4 +360,14 @@ function makeBuilder(ctx) {
   };
 }
 
-module.exports = { makeBuilder: makeBuilder, KU_BIT: KU_BIT };
+// The raw issuer / subject Name TLV of a parsed X.509 certificate (byte-identical). tbs field layout:
+// [version?] serial(0) signature(1) issuer(2) validity(3) subject(4). Used where a producer must chain a
+// name to an existing certificate exactly -- an issued certificate's issuer, a CMS SignerInfo issuer, an
+// attribute certificate's issuerName / holder baseCertificateID.
+function tbsNameField(cert, which) {
+  var tbs = asn1.decode(cert.tbsBytes);
+  var hasVersion = tbs.children[0].tagClass === "context" && tbs.children[0].tagNumber === 0;
+  return tbs.children[(hasVersion ? 1 : 0) + (which === "subject" ? 4 : 2)].bytes;
+}
+
+module.exports = { makeBuilder: makeBuilder, KU_BIT: KU_BIT, tbsNameField: tbsNameField };

package/lib/schema-attrcert.js

@@ -666,6 +666,21 @@ _AC_EXT_DECODERS[_Oav("noRevAvail")] = _noRevAvail;
 _AC_EXT_DECODERS[_Oav("aaControls")] = _aaControls;
 _AC_EXT_DECODERS[_Oav("acProxying")] = _acProxying;
 
+// @internal -- validate a pre-encoded AC attribute value / AC extension value against the SAME decoder
+// the parser runs, so the attrcert-sign escape hatches (a caller's pre-encoded Attribute / Extension DER)
+// cannot embed a structurally-malformed recognized value the strict parser would then reject. `type` /
+// `extnOid` are dotted-OID strings; `valueDer` / `extnValueDer` are the raw AttributeValue / extnValue
+// content Buffers (exactly what the parse loop passes). An unrecognized type returns null (stays opaque,
+// no validation); a recognized-but-malformed value throws the frozen attrcert/bad-* code.
+function validateAttributeValue(type, valueDer) {
+  var dec = _ATTR_VALUE_DECODERS[type];
+  return dec ? dec(valueDer) : null;
+}
+function validateExtensionValue(extnOid, extnValueDer) {
+  var dec = _AC_EXT_DECODERS[extnOid];
+  return dec ? dec(extnValueDer) : null;
+}
+
 module.exports = {
   parse: parse,
   parseV1: parseV1,
@@ -673,4 +688,6 @@ module.exports = {
   pemEncode: pemEncode,
   matches: matches,
   matchesV1: matchesV1,
+  validateAttributeValue: validateAttributeValue,
+  validateExtensionValue: validateExtensionValue,
 };

package/lib/x509-sign.js

@@ -21,7 +21,6 @@
 // cms/tsp/ocsp producing pattern); the strict schema-x509 decoder round-trips it, and that round-trip
 // -- plus OpenSSL interop -- is the divergence guard.
 
-var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
@@ -69,7 +68,7 @@ var _encodeName = _b.encodeName, _isEmptyName = _b.isEmptyName, _reqDer = _b.req
   _ext = _b.ext, _extBasicConstraints = _b.extBasicConstraints, _validateBcSpec = _b.validateBcSpec,
   _extKeyUsage = _b.extKeyUsage, _extExtKeyUsage = _b.extExtKeyUsage, _extSki = _b.extSki,
   _extAki = _b.extAki, _extSan = _b.extSan, _extCertPolicies = _b.extCertPolicies,
-  _skiKeyId = _b.skiKeyId, _spkiKeyId = _b.spkiKeyId;
+  _skiKeyId = _b.skiKeyId, _spkiKeyId = _b.spkiKeyId, _serialInteger = _b.serialInteger;
 
 // ---- issuer-side extension helpers (subjectKeyIdentifier lookup + authorityKeyIdentifier) ----
 
@@ -166,41 +165,9 @@ function _buildExtensions(extSpec, ctx) {
 
 // ---- serial + validity + key plumbing --------------------------------------
 
-// RFC 5280 sec. 4.1.2.2 -- a positive, non-zero INTEGER of at most 20 content octets. A random
-// 20-octet positive serial is generated when none is supplied.
-function _serialInteger(serial) {
-  var v;
-  if (serial == null) {
-    var rnd = nodeCrypto.randomBytes(20);
-    rnd[0] &= 0x7f;                      // keep the top bit clear so the magnitude stays <= 20 octets and positive
-    if (rnd[0] === 0) rnd[0] = 0x01;     // never all-zero leading -> non-zero and no redundant sign octet
-    v = BigInt("0x" + rnd.toString("hex"));
-  } else if (typeof serial === "bigint") { v = serial; }
-  else if (typeof serial === "number") { if (!Number.isInteger(serial)) throw _err("x509/bad-serial", "serialNumber must be an integer"); v = BigInt(serial); }
-  else if (typeof serial === "string") { try { v = BigInt(serial); } catch (e) { throw _err("x509/bad-serial", "serialNumber string must be a decimal or 0x-hex integer", e); } }
-  else if (Buffer.isBuffer(serial)) { v = serial.length ? BigInt("0x" + serial.toString("hex")) : 0n; }
-  else { throw _err("x509/bad-serial", "serialNumber must be a BigInt, integer, hex string, or Buffer"); }
-  if (v <= 0n) throw _err("x509/bad-serial", "serialNumber must be a positive integer (RFC 5280 sec. 4.1.2.2)");
-  var tlv = b.integer(v);
-  if (asn1.decode(tlv).content.length > 20) throw _err("x509/bad-serial", "serialNumber must not exceed 20 octets (RFC 5280 sec. 4.1.2.2)");
-  return tlv;
-}
-// RFC 5280 sec. 4.1.2.5 -- UTCTime for 1950..2049, GeneralizedTime otherwise. UTCTime's two-digit year
-// only represents 1950..2049 (sec. 4.1.2.5.1), so a pre-1950 date MUST use GeneralizedTime (the same
-// arm as a date from 2050 on); using UTCTime for a pre-1950 year would be unrepresentable.
-function _timeDer(date, which) {
-  guard.time.assertValid(date, _err, "x509/bad-input", "certificate " + which);
-  var y = date.getUTCFullYear();
-  return (y >= 1950 && y <= 2049) ? b.utcTime(date) : b.generalizedTime(date);
-}
-// The raw subject Name TLV of a parsed CA certificate (byte-identical, so the child issuer chains to
-// the CA subject exactly). The subject follows the optional version [0], serial, signature, issuer,
-// and validity in the tbsCertificate.
-function _caSubjectBytes(caCert) {
-  var tbs = asn1.decode(caCert.tbsBytes);
-  var hasVersion = tbs.children[0].tagClass === "context" && tbs.children[0].tagNumber === 0;
-  return tbs.children[(hasVersion ? 1 : 0) + 4].bytes;   // [version?] serial(0) sig(1) issuer(2) validity(3) SUBJECT(4)
-}
+// RFC 5280 sec. 4.1.2.5 UTCTime/GeneralizedTime cutover -- the shared builder primitive (pki-build), a
+// thin wrapper here so the certificate validity label reads "certificate notBefore/notAfter".
+function _timeDer(date, which) { return _b.timeDer(date, "certificate " + which); }
 // A supplied issuer certificate MUST be a CA that may sign certificates: basicConstraints present AND
 // critical AND cA=TRUE (RFC 5280 sec. 4.2.1.9), and -- when a keyUsage extension is present -- the
 // keyCertSign bit (sec. 4.2.1.3). Refuse a non-CA issuer rather than mint a certificate that will not
@@ -316,7 +283,7 @@ function _sign(spec, issuer, opts) {
     issuerCert = (Buffer.isBuffer(issuer.cert) || typeof issuer.cert === "string") ? x509.parse(issuer.cert) : issuer.cert;
     if (!issuerCert || !issuerCert.tbsBytes) throw _err("x509/bad-input", "issuer.cert must be a certificate DER/PEM or a parsed certificate");
     issuerPathLen = _assertIssuerIsCa(issuerCert);
-    issuerDer = _caSubjectBytes(issuerCert);
+    issuerDer = pkiBuild.tbsNameField(issuerCert, "subject");
     issuerSpki = issuerCert.subjectPublicKeyInfo.bytes;
   } else {
     issuerDer = _encodeName(issuer.name == null ? [] : issuer.name);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",