@blamejs/pki 0.3.24 → 0.3.26

package/lib/schema-pkix.js

@@ -221,6 +221,96 @@ function algorithmIdentifier(ns, opts) {
   });
 }
 
+// pbkdf2Params(ns): PBKDF2-params (RFC 8018 sec. 5.2) constrained to the RFC 9579 PBMAC1 profile -- the
+// salt uses the OCTET STRING choice and keyLength MUST be present (a MacData / PKIProtection consumer
+// cannot infer the derived MAC key size, RFC 9579 sec. 4.b/5). Shared by the PKCS#12 MacData reader and
+// the CMP PBMAC1 protection reader: one ns-parameterized decoder so neither format re-derives the shape.
+function pbkdf2Params(ns) {
+  return schema.seq([
+    schema.field("salt", schema.octetString()),
+    schema.field("iterationCount", schema.integerLeaf()),
+    schema.optional("keyLength", schema.integerLeaf(), { whenUniversal: [asn1.TAGS.INTEGER] }),
+    schema.optional("prf", algorithmIdentifier(ns), { whenUniversal: [asn1.TAGS.SEQUENCE] }),
+  ], {
+    assert: "sequence", code: ns.prefix + "/bad-mac-data", what: "PBKDF2-params",
+    build: function (m, ctx) {
+      var hmacSha1 = ctx.oid.byName("hmacWithSHA1");
+      if (!m.fields.keyLength.present) {
+        throw ctx.E(ctx.prefix + "/bad-mac-data", "PBMAC1 PBKDF2-params must carry keyLength (RFC 9579 sec. 5)");
+      }
+      // guard.range.positiveInt31 bounds + narrows each counter atomically -- a value past the bound
+      // would round silently and hand a verifier wrong inputs.
+      var iterationCount = guard.range.positiveInt31(m.fields.iterationCount.value, ctx.E, ctx.prefix + "/bad-mac-data", "PBKDF2 iterationCount");
+      var keyLength = guard.range.positiveInt31(m.fields.keyLength.value, ctx.E, ctx.prefix + "/bad-mac-data", "PBKDF2 keyLength");
+      var prf = m.fields.prf.present ? m.fields.prf.value.result : null;
+      // X.690 sec. 11.5 -- the prf DEFAULT is algid-hmacWithSHA1 (hmacWithSHA1 with NULL parameters,
+      // i.e. the 2-byte DER 05 00, RFC 8018 sec. 5.2); an explicit prf byte-equal to that default is
+      // non-canonical and rejects. hmacWithSHA1 with ABSENT parameters is a different value and decodes.
+      // This is a public structural check on the algorithm parameters -- not a secret compare -- so a
+      // direct byte test on the (fixed 2-octet) NULL encoding, not a timing-safe comparison.
+      var pp = prf ? prf.parameters : null;
+      // nosemgrep: pki-non-constant-time-secret-compare -- pp is the PUBLIC algorithm-identifier parameters
+      // field (a fixed 2-octet NULL encoding), not a MAC / tag / secret; a timing-safe compare is inapplicable.
+      if (prf && prf.oid === hmacSha1 && pp !== null && pp.length === 2 && pp[0] === 0x05 && pp[1] === 0x00) {
+        throw ctx.E(ctx.prefix + "/bad-mac-data", "a PBKDF2 prf equal to its DEFAULT algid-hmacWithSHA1 must be omitted (X.690 sec. 11.5, RFC 8018 sec. 5.2)");
+      }
+      // The PBKDF2 prf HMAC AlgorithmIdentifier likewise carries NULL (or absent) parameters (RFC 8018 App. B.1):
+      // reject a present-but-non-NULL prf parameter (e.g. an INTEGER) instead of discarding it, since the prf
+      // hash is dispatched by OID alone. (An absent prf, and hmacWithSHA1 with absent params, remain valid above.)
+      // nosemgrep: pki-non-constant-time-secret-compare -- pp is the PUBLIC algorithm-identifier parameters node.
+      if (prf && pp !== null && !(pp.length === 2 && pp[0] === 0x05 && pp[1] === 0x00)) {
+        throw ctx.E(ctx.prefix + "/bad-mac-data", "the PBKDF2 prf parameters must be absent or NULL (RFC 8018 App. B.1)");
+      }
+      return {
+        salt: m.fields.salt.value,
+        iterationCount: iterationCount,
+        keyLength: keyLength,
+        prfOid: prf ? prf.oid : hmacSha1,
+        prfName: prf ? prf.name : "hmacWithSHA1",
+      };
+    },
+  });
+}
+
+// pbmac1Params(ns): PBMAC1-params ::= SEQUENCE { keyDerivationFunc AlgorithmIdentifier{PBKDF2},
+// messageAuthScheme AlgorithmIdentifier } (RFC 8018 App. A.5 / RFC 9579 sec. 4). The PBKDF2 prf and the
+// messageAuthScheme HMAC are INDEPENDENT (a SHA-512 prf with a SHA-256 HMAC is legal). Shared by PKCS#12
+// MacData and CMP PBMAC1 protection; returns { kdf: { salt, iterationCount, keyLength, prfOid, prfName },
+// schemeOid, schemeName }.
+function pbmac1Params(ns) {
+  return schema.seq([
+    schema.field("keyDerivationFunc", schema.seq([
+      schema.field("algorithm", schema.oidLeaf()),
+      schema.field("parameters", pbkdf2Params(ns)),
+    ], { assert: "sequence", arity: { exact: 2 }, code: ns.prefix + "/bad-mac-data", what: "PBMAC1 keyDerivationFunc" })),
+    schema.field("messageAuthScheme", algorithmIdentifier(ns)),
+  ], {
+    assert: "sequence", arity: { exact: 2 }, code: ns.prefix + "/bad-mac-data", what: "PBMAC1-params",
+    build: function (m, ctx) {
+      var kdf = m.fields.keyDerivationFunc.value;
+      if (kdf.fields.algorithm.value !== ctx.oid.byName("pbkdf2")) {
+        throw ctx.E(ctx.prefix + "/bad-mac-data", "PBMAC1 keyDerivationFunc must be PBKDF2 (RFC 9579 sec. 4)");
+      }
+      var scheme = m.fields.messageAuthScheme.value.result;
+      // RFC 8018 App. B.1: an HMAC messageAuthScheme AlgorithmIdentifier carries NULL (or absent) parameters,
+      // matching the builder (_hmacAlgId emits the 2-byte 05 00). Reject any OTHER parameter encoding rather than
+      // silently discarding it -- _verifyMac dispatches by the scheme OID alone, so a mismatched / malformed
+      // parameter (e.g. an INTEGER) must not slip through unvalidated. A direct byte test on the fixed 2-octet
+      // NULL encoding of the PUBLIC parameters, not a secret compare.
+      var sp = scheme.parameters;
+      // nosemgrep: pki-non-constant-time-secret-compare -- sp is the PUBLIC algorithm-identifier parameters node.
+      if (sp !== null && !(sp.length === 2 && sp[0] === 0x05 && sp[1] === 0x00)) {
+        throw ctx.E(ctx.prefix + "/bad-mac-data", "the PBMAC1 messageAuthScheme parameters must be absent or NULL (RFC 8018 App. B.1)");
+      }
+      return {
+        kdf: kdf.fields.parameters.value.result,
+        schemeOid: scheme.oid,
+        schemeName: scheme.name,
+      };
+    },
+  });
+}
+
 // attrValueToString(ns): the AttributeValue decode-leaf. A malformed KNOWN
 // string type (invalid UTF-8, a non-IA5 byte, a PrintableString character
 // outside its set, ...) surfaces as an asn1/bad-* content error and must fail
@@ -809,6 +899,30 @@ function certExtensionDecoders(ns) {
     return schema.walk(generalNames(ns, { decodeValue: true, code: C }), n, ns).result;
   }
 
+  // authorityInfoAccess ::= AuthorityInfoAccessSyntax ::= SEQUENCE SIZE(1..MAX) OF AccessDescription
+  // (RFC 5280 sec. 4.2.2.1); AccessDescription ::= SEQUENCE { accessMethod OBJECT IDENTIFIER, accessLocation
+  // GeneralName }. Surfaces [{ accessMethod: <dotted OID>, accessLocation: { tag, value } }] in wire order --
+  // accessLocation is the shared generalName leaf (its context tag number + decoded value, so a control-byte
+  // URI is rejected by the CVE-2009-2408 guard). BOTH accessMethods surface (id-ad-caIssuers AND id-ad-ocsp):
+  // a consumer filters by accessMethod (caIssuers for issuer fetching, ocsp for responder discovery). An empty
+  // SEQUENCE violates SIZE(1..MAX) and is malformed. A composed decoder + registry row, not a hand-roll.
+  function authorityInfoAccess(buf) {
+    var C = ns.prefix + "/bad-extension-value";
+    var descs = seqChildren(buf, C, "AuthorityInfoAccessSyntax");
+    if (descs.length < 1) throw ns.E(C, "AuthorityInfoAccessSyntax must contain at least one AccessDescription (RFC 5280 sec. 4.2.2.1, SIZE(1..MAX))");
+    var GN = generalName(ns, { decodeValue: true, code: C });
+    return descs.map(function (d) {
+      if (d.tagClass !== "universal" || d.tagNumber !== _T.SEQUENCE || !d.children || d.children.length !== 2) {
+        throw ns.E(C, "AccessDescription must be a SEQUENCE { accessMethod, accessLocation } (RFC 5280 sec. 4.2.2.1)");
+      }
+      var method;
+      try { method = asn1.read.oid(d.children[0]); }
+      catch (e) { throw ns.E(C, "AccessDescription accessMethod must be an OBJECT IDENTIFIER", e); }
+      var loc = schema.walk(GN, d.children[1], ns);   // a decode leaf returns its value directly (no .result wrapper)
+      return { accessMethod: method, accessLocation: { tag: loc.tagNumber, value: loc.value } };
+    });
+  }
+
   // extKeyUsage ::= SEQUENCE SIZE(1..MAX) OF KeyPurposeId (OID)
   function extKeyUsage(buf) {
     var C = ns.prefix + "/bad-extension-value";
@@ -1105,6 +1219,7 @@ function certExtensionDecoders(ns) {
   byOid[O("precertificatePoison")] = precertPoison;
   byOid[O("cRLDistributionPoints")] = crlDistributionPoints;
   byOid[O("freshestCRL")] = crlDistributionPoints;
+  byOid[O("authorityInfoAccess")] = authorityInfoAccess;
   byOid[O("msCertificateTemplate")] = msCertificateTemplate;
   byOid[O("msEnrollCertType")] = msEnrollCertType;
   byOid[O("msCaVersion")] = msCaVersion;
@@ -1294,7 +1409,32 @@ function signedEnvelope(ns, tbsSchema, opts) {
   });
 }
 
+// dNSName syntax (RFC 5280 sec. 4.2.1.6 / RFC 1034 preferred name syntax, a representative CABF check): no
+// whitespace, no leading/trailing dot, no empty label, no underscore, LDH labels (1-63 octets, no leading /
+// trailing hyphen), <= 253 octets, an optional leftmost "*" wildcard. Returns a reason string, or null when
+// well-formed. The shared home so the linter AND an identity comparator (case-fold only a valid dNSName) agree.
+function dnsNameProblem(s) {
+  if (typeof s !== "string" || !s.length) return "empty";
+  if (s.length > 253) return "exceeds 253 octets";
+  if (/\s/.test(s)) return "whitespace";
+  if (s.charAt(0) === "." || s.charAt(s.length - 1) === ".") return "leading/trailing dot";
+  if (s.indexOf("_") !== -1) return "underscore forbidden in dNSName";
+  var labels = s.split(".");
+  for (var i = 0; i < labels.length; i++) {
+    var label = labels[i];
+    if (label.length === 0) return "empty label";
+    if (label.length > 63) return "label exceeds 63 octets";
+    if (i === 0 && label === "*") {
+      if (labels.length < 2) return "bare wildcard";
+      continue;
+    }
+    if (!/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/i.test(label)) return "invalid label syntax";
+  }
+  return null;
+}
+
 module.exports = {
+  dnsNameProblem: dnsNameProblem,
   pemDecode: pemDecode,
   pemDecodeAll: pemDecodeAll,
   pemEncode: pemEncode,
@@ -1306,6 +1446,8 @@ module.exports = {
   DN_SHORT: DN_SHORT,
   time: time,
   algorithmIdentifier: algorithmIdentifier,
+  pbkdf2Params: pbkdf2Params,
+  pbmac1Params: pbmac1Params,
   spki: spki,
   makeParser: makeParser,
   signedEnvelopeTbs: signedEnvelopeTbs,

package/lib/webcrypto.js

@@ -516,7 +516,35 @@ function _requireDeriveLength(length, who) {
 // caller must hold differs by entry point (deriveBits requires "deriveBits",
 // deriveKey requires "deriveKey"), so each public method checks its own
 // usage and then routes the actual derivation through here.
-function _deriveBitsRaw(alg, key, length) {
+// PBKDF2 on the libuv threadpool (crypto.pbkdf2, NOT pbkdf2Sync): an attacker-controlled iteration count must
+// never block the Node event loop (CWE-400 DoS) -- a network peer can request the maximum iterations without
+// knowing the secret (e.g. an unauthenticated PBMAC1 message), so the derivation runs off the main thread.
+// Concurrency is CAPPED so many high-iteration jobs cannot monopolize the whole worker pool and starve
+// unrelated DNS / filesystem / crypto work: at least two pool threads are left free (default pool is four),
+// and derivations beyond the cap queue and run as slots free. The cap tracks UV_THREADPOOL_SIZE when raised.
+var _PBKDF2_MAX_CONCURRENT = Math.max(1, (parseInt(process.env.UV_THREADPOOL_SIZE, 10) || 4) - 2);
+var _pbkdf2InFlight = 0;
+var _pbkdf2Waiters = [];
+function _pbkdf2Async(pw, salt, iterations, keylen, digest) {
+  return new Promise(function (resolve, reject) {
+    function start() {
+      _pbkdf2InFlight++;
+      function done(err, derived) {   // release the slot + admit the next waiter, THEN settle
+        _pbkdf2InFlight--;
+        var next = _pbkdf2Waiters.shift();
+        if (next) next();
+        if (err) reject(err); else resolve(derived);
+      }
+      // A SYNCHRONOUS argument fault (e.g. iterations 0) never reaches the async callback, so release the slot
+      // in the catch too -- otherwise a leaked slot would permanently shrink the pool and queue every later job.
+      try { nodeCrypto.pbkdf2(pw, salt, iterations, keylen, digest, done); }
+      catch (e) { done(e); }
+    }
+    if (_pbkdf2InFlight < _PBKDF2_MAX_CONCURRENT) start(); else _pbkdf2Waiters.push(start);
+  });
+}
+
+async function _deriveBitsRaw(alg, key, length) {
   var name = alg.name;
   if (name === "ECDH" || name === "X25519" || name === "X448") {
     _requireAlgMatch(alg, alg.public, name + " public key");
@@ -538,7 +566,7 @@ function _deriveBitsRaw(alg, key, length) {
   }
   if (name === "PBKDF2") {
     _requireDeriveLength(length, "PBKDF2");
-    var out = nodeCrypto.pbkdf2Sync(_secretBytes(key), _toBuf(alg.salt, "PBKDF2 salt"), alg.iterations, length / 8, _hashNode(alg.hash, "PBKDF2"));
+    var out = await _pbkdf2Async(_secretBytes(key), _toBuf(alg.salt, "PBKDF2 salt"), alg.iterations, length / 8, _hashNode(alg.hash, "PBKDF2"));
     return _toArrayBuffer(out);
   }
   if (name === "X963KDF") {
@@ -603,7 +631,7 @@ SubtleCrypto.prototype.deriveKey = async function deriveKey(algorithm, baseKey,
     // material; a KDF base has no implicit output size and fails closed.
     bits = dk.length != null ? dk.length : null;
   }
-  var raw = _deriveBitsRaw(alg, baseKey, bits);
+  var raw = await _deriveBitsRaw(alg, baseKey, bits);
   return this.importKey("raw", raw, dk, extractable, keyUsages);
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.3.24",
+  "version": "0.3.26",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:342eb0a5-bbfa-46f5-9b51-912a21d97f53",
+  "serialNumber": "urn:uuid:2d9fa8bb-e93e-450a-991c-ef2f3b3fb9e2",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-26T21:06:05.598Z",
+    "timestamp": "2026-07-30T20:38:00.777Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.3.24",
+      "bom-ref": "@blamejs/pki@0.3.26",
       "type": "application",
       "name": "pki",
-      "version": "0.3.24",
+      "version": "0.3.26",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.3.24",
+      "purl": "pkg:npm/%40blamejs/pki@0.3.26",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.3.24",
+      "ref": "@blamejs/pki@0.3.26",
       "dependsOn": []
     }
   ]