@blamejs/pki 0.3.25 → 0.3.26

package/lib/est.js

@@ -697,9 +697,30 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
   var redirects = 0;
   var authTried = false;
   var initialOrigin = url.origin;   // the origin the caller intended to authenticate to
-  var tls = budgets.tls;            // narrowed (mTLS client identity stripped) on a cross-origin hop
+  // The per-hop TLS: the origin-specific identity (mTLS cert/key + pinned SNI) is sent ONLY to the caller's
+  // configured origin; a cross-origin hop gets a narrowed copy with those stripped (checkServerIdentity kept).
+  // Derived FRESH from budgets.tls each hop (the ACME _tlsFor model) so a redirect back to the original origin
+  // restores its identity rather than permanently losing the SNI at the first cross-origin boundary.
+  function _tlsFor(u) {
+    var t = budgets.tls;
+    if (t && u.origin !== initialOrigin && (t.cert != null || t.key != null || t.servername != null)) {
+      t = Object.assign({}, t);
+      delete t.cert; delete t.key; delete t.servername;
+    }
+    return t;
+  }
+  // The per-hop Authorization: the HTTP Basic credential (established after a 401 on the caller's origin) is
+  // sent ONLY to that origin. A cross-origin hop travels unauthenticated, but a redirect back to the origin
+  // restores it -- so an authenticated flow that bounces off-origin and returns still completes (mirrors _tlsFor).
+  var authValue = null;
+  function _headersFor(u) {
+    if (!authValue || u.origin !== initialOrigin) return headers;
+    var hh = Object.assign({}, headers);
+    hh.authorization = authValue;
+    return hh;
+  }
   function step() {
-    return transport({ method: method, url: url.href, headers: headers, body: body, tls: tls, timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }).then(function (res) {
+    return transport({ method: method, url: url.href, headers: _headersFor(url), body: body, tls: _tlsFor(url), timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }).then(function (res) {
       res = res || {};
       // Measure an injected string body as UTF-8 -- the byte width the body is decoded/transfer-decoded at,
       // and what the real socket transport counts -- so a non-ASCII body (multi-byte chars are ~half the
@@ -722,16 +743,10 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
           body = null;
           if (headers["content-type"]) { headers = Object.assign({}, headers); delete headers["content-type"]; }
         }
-        var prevOrigin = url.origin;
         url = _redirectTarget(url, h.location, method, opts);
-        // Credentials MUST NOT cross an origin boundary. A redirect to a different web origin (even a
-        // permitted cross-origin GET) drops BOTH the HTTP Basic Authorization header AND the mTLS
-        // client identity (cert/key), so a prior 401's password and the caller's certificate + proof
-        // of private-key possession are never presented to a different server.
-        if (url.origin !== prevOrigin) {
-          if (headers.authorization) { headers = Object.assign({}, headers); delete headers.authorization; }
-          if (tls && (tls.cert || tls.key)) { tls = Object.assign({}, tls); delete tls.cert; delete tls.key; }
-        }
+        // Credentials MUST NOT cross an origin boundary: the HTTP Basic Authorization header and the
+        // ORIGIN-SPECIFIC TLS identity (mTLS cert/key + pinned SNI) are BOTH scoped per hop (_headersFor /
+        // _tlsFor), so each is absent off-origin but restored on a hop back to the caller's configured origin.
         redirects += 1;
         return step();
       }
@@ -744,7 +759,9 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
         var www = String(h["www-authenticate"] || "");
         if (!_hasBasicChallenge(www)) throw E("est/auth-required", "the server requires an unsupported HTTP authentication scheme (only Basic is supported): " + www);
         if (opts.username === undefined && opts.password === undefined) throw E("est/auth-required", "the server requires HTTP authentication but no credentials were supplied (RFC 7030 sec. 3.2.3)");
-        headers = Object.assign({}, headers, { authorization: "Basic " + Buffer.from((opts.username || "") + ":" + (opts.password || ""), "utf8").toString("base64") });
+        // Establish the credential as origin-scoped state (_headersFor attaches it only on the initial origin),
+        // never a mutation of the shared headers that would leak across a cross-origin redirect.
+        authValue = "Basic " + Buffer.from((opts.username || "") + ":" + (opts.password || ""), "utf8").toString("base64");
         authTried = true;
         return step();
       }

package/lib/lint.js

@@ -191,32 +191,9 @@ function _serialOctets(cert) {
   return buf.length;
 }
 
-// dNSName syntax (a representative CABF check): no whitespace, no leading/trailing dot,
-// no empty label, and no underscore (forbidden in a dNSName). IDN must already be an
-// A-label (we do not transcode). Returns a reason string, or null when well-formed.
-function _dnsNameProblem(s) {
-  if (typeof s !== "string" || !s.length) return "empty";
-  if (s.length > 253) return "exceeds 253 octets";
-  if (/\s/.test(s)) return "whitespace";
-  if (s.charAt(0) === "." || s.charAt(s.length - 1) === ".") return "leading/trailing dot";
-  if (s.indexOf("_") !== -1) return "underscore forbidden in dNSName";
-  var labels = s.split(".");
-  for (var i = 0; i < labels.length; i++) {
-    var label = labels[i];
-    if (label.length === 0) return "empty label";
-    if (label.length > 63) return "label exceeds 63 octets";
-    // A leftmost "*" wildcard label is permitted only when at least one more label follows
-    // (a bare "*" is not a domain name).
-    if (i === 0 && label === "*") {
-      if (labels.length < 2) return "bare wildcard";
-      continue;
-    }
-    // RFC 1034 preferred name syntax: an LDH label that neither begins nor ends with a
-    // hyphen. Rejects "-bad" / "bad-" and any non-letter/digit/hyphen character.
-    if (!/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/i.test(label)) return "invalid label syntax";
-  }
-  return null;
-}
+// dNSName syntax check -- the shared RFC 5280 sec. 4.2.1.6 / RFC 1034 preferred-name validator (pkix), reused
+// so the linter and the identity comparators agree on what a well-formed dNSName is. Returns a reason or null.
+function _dnsNameProblem(s) { return pkix.dnsNameProblem(s); }
 
 // A genuine IPv4 or IPv6 literal -- a CN validated against an iPAddress SAN rather than a
 // dNSName. Routed through the shared strict validator (no node:net, so the toolkit needs no

package/lib/path-validate.js

@@ -40,6 +40,7 @@ var crl = require("./schema-crl");
 var ocsp = require("./schema-ocsp");
 var ocspVerify = require("./ocsp-verify");
 var crlVerify = require("./crl-verify");
+var cmpVerify = require("./cmp-verify");
 var guard = require("./guard-all");
 var constants = require("./constants");
 var validator = require("./validator-all");
@@ -1880,6 +1881,13 @@ var ocspCore = ocspVerify.makeOcspVerify({
   dnEqual: dnEqual,
 });
 
+// Inject this validator's signature engine + full path build/validate into the internal cmp-verify seam,
+// so pki.cmp.verify routes incoming CMP signature protection through the SAME engine (never a second, weaker
+// CMP verifier; never build's self-check, which skips the EdDSA low-order-point gate) and chains an
+// out-of-path signer certificate through the FULL RFC 5280 sec. 6.1 path validation -- without exposing any
+// of it on the public pki.path surface (index.js exports the whole path-validate module).
+cmpVerify.setEngine({ verifyWithSpki: _verifyWithSpki, build: build, validate: validate });
+
 /**
  * @primitive  pki.path.ocspChecker
  * @signature  pki.path.ocspChecker(responses) -> RevocationChecker

package/lib/schema-pkcs12.js

@@ -73,11 +73,6 @@ var OID_X509_CRL = oid.byName("x509CRL");
 var OID_FRIENDLY_NAME = oid.byName("friendlyName");
 var OID_LOCAL_KEY_ID = oid.byName("localKeyId");
 var OID_PBMAC1 = oid.byName("pbmac1");
-// The PBKDF2-params prf DEFAULT is algid-hmacWithSHA1 -- hmacWithSHA1 with NULL
-// parameters (RFC 8018 sec. 5.2) -- needed for the encoded-DEFAULT rejection below.
-var OID_HMAC_SHA1 = oid.byName("hmacWithSHA1");
-var DER_NULL = asn1.build.nullValue();
-
 // DigestInfo ::= SEQUENCE { digestAlgorithm AlgorithmIdentifier, digest OCTET STRING }.
 var DIGEST_INFO = schema.seq([
   schema.field("digestAlgorithm", pkix.algorithmIdentifier(NS)),
@@ -89,67 +84,11 @@ var DIGEST_INFO = schema.seq([
   },
 });
 
-// PBKDF2-params (RFC 8018 sec. 5.2), constrained to the RFC 9579 PBMAC1 profile:
-// the salt MUST use the specified (OCTET STRING) choice and keyLength MUST be
-// present (sec. 4.b / sec. 5 -- a MacData consumer cannot infer the MAC key size).
-var PBKDF2_PARAMS = schema.seq([
-  schema.field("salt", schema.octetString()),
-  schema.field("iterationCount", schema.integerLeaf()),
-  schema.optional("keyLength", schema.integerLeaf(), { whenUniversal: [TAGS.INTEGER] }),
-  schema.optional("prf", pkix.algorithmIdentifier(NS), { whenUniversal: [TAGS.SEQUENCE] }),
-], {
-  assert: "sequence", code: "pkcs12/bad-mac-data", what: "PBKDF2-params",
-  build: function (m, ctx) {
-    if (!m.fields.keyLength.present) {
-      throw ctx.E("pkcs12/bad-mac-data", "PBMAC1 PBKDF2-params must carry keyLength (RFC 9579 sec. 5)");
-    }
-    // guard.range.positiveInt31 bounds + narrows each counter atomically -- a
-    // value past the bound would round silently and hand a verifier wrong inputs.
-    var iterationCount = guard.range.positiveInt31(m.fields.iterationCount.value, ctx.E, "pkcs12/bad-mac-data", "PBKDF2 iterationCount");
-    var keyLength = guard.range.positiveInt31(m.fields.keyLength.value, ctx.E, "pkcs12/bad-mac-data", "PBKDF2 keyLength");
-    var prf = m.fields.prf.present ? m.fields.prf.value.result : null;
-    // X.690 sec. 11.5 -- a DEFAULT-valued component must be omitted from a DER
-    // encoding, and the prf DEFAULT is algid-hmacWithSHA1: hmacWithSHA1 with
-    // NULL parameters (RFC 8018 sec. 5.2). An explicit prf byte-equal to that
-    // default is non-canonical and rejects -- the structured-value analogue of
-    // the MacData iterations rule below. hmacWithSHA1 with ABSENT parameters
-    // is a different value from the NULL-parameters default and decodes.
-    if (prf && prf.oid === OID_HMAC_SHA1 && prf.parameters !== null && prf.parameters.equals(DER_NULL)) {
-      throw ctx.E("pkcs12/bad-mac-data", "a PBKDF2 prf equal to its DEFAULT algid-hmacWithSHA1 must be omitted (X.690 sec. 11.5, RFC 8018 sec. 5.2)");
-    }
-    return {
-      salt: m.fields.salt.value,
-      iterationCount: iterationCount,
-      keyLength: keyLength,
-      prfOid: prf ? prf.oid : OID_HMAC_SHA1,
-      prfName: prf ? prf.name : "hmacWithSHA1",
-    };
-  },
-});
-
-// PBMAC1-params ::= SEQUENCE { keyDerivationFunc AlgorithmIdentifier{PBKDF2},
-// messageAuthScheme AlgorithmIdentifier } (RFC 8018 sec. A.5 / RFC 9579 sec. 4).
-var PBMAC1_PARAMS = schema.seq([
-  schema.field("keyDerivationFunc", schema.seq([
-    schema.field("algorithm", schema.oidLeaf()),
-    schema.field("parameters", PBKDF2_PARAMS),
-  ], { assert: "sequence", arity: { exact: 2 }, code: "pkcs12/bad-mac-data", what: "PBMAC1 keyDerivationFunc" })),
-  schema.field("messageAuthScheme", pkix.algorithmIdentifier(NS)),
-], {
-  assert: "sequence", arity: { exact: 2 }, code: "pkcs12/bad-mac-data", what: "PBMAC1-params",
-  build: function (m, ctx) {
-    var kdf = m.fields.keyDerivationFunc.value;
-    if (kdf.fields.algorithm.value !== oid.byName("pbkdf2")) {
-      throw ctx.E("pkcs12/bad-mac-data", "PBMAC1 keyDerivationFunc must be PBKDF2 (RFC 9579 sec. 4)");
-    }
-    var scheme = m.fields.messageAuthScheme.value.result;
-    return {
-      kdf: kdf.fields.parameters.value.result,
-      schemeOid: scheme.oid,
-      schemeName: scheme.name,
-    };
-  },
-});
+// PBKDF2-params + PBMAC1-params (RFC 8018 sec. 5.2 / App. A.5, RFC 9579 sec. 4) constrained to the PBMAC1
+// profile -- keyLength MUST be present, the prf DEFAULT is enforced non-canonical. Shared with CMP PBMAC1
+// protection verification, so the reader lives once in schema-pkix (ns-parameterized) rather than a second
+// copy per format; composed here with the pkcs12 namespace so it emits pkcs12/bad-mac-data.
+var PBMAC1_PARAMS = pkix.pbmac1Params(NS);
 
 // MacData ::= SEQUENCE { mac DigestInfo, macSalt OCTET STRING,
 //                        iterations INTEGER DEFAULT 1 }.

package/lib/schema-pkix.js

@@ -221,6 +221,96 @@ function algorithmIdentifier(ns, opts) {
   });
 }
 
+// pbkdf2Params(ns): PBKDF2-params (RFC 8018 sec. 5.2) constrained to the RFC 9579 PBMAC1 profile -- the
+// salt uses the OCTET STRING choice and keyLength MUST be present (a MacData / PKIProtection consumer
+// cannot infer the derived MAC key size, RFC 9579 sec. 4.b/5). Shared by the PKCS#12 MacData reader and
+// the CMP PBMAC1 protection reader: one ns-parameterized decoder so neither format re-derives the shape.
+function pbkdf2Params(ns) {
+  return schema.seq([
+    schema.field("salt", schema.octetString()),
+    schema.field("iterationCount", schema.integerLeaf()),
+    schema.optional("keyLength", schema.integerLeaf(), { whenUniversal: [asn1.TAGS.INTEGER] }),
+    schema.optional("prf", algorithmIdentifier(ns), { whenUniversal: [asn1.TAGS.SEQUENCE] }),
+  ], {
+    assert: "sequence", code: ns.prefix + "/bad-mac-data", what: "PBKDF2-params",
+    build: function (m, ctx) {
+      var hmacSha1 = ctx.oid.byName("hmacWithSHA1");
+      if (!m.fields.keyLength.present) {
+        throw ctx.E(ctx.prefix + "/bad-mac-data", "PBMAC1 PBKDF2-params must carry keyLength (RFC 9579 sec. 5)");
+      }
+      // guard.range.positiveInt31 bounds + narrows each counter atomically -- a value past the bound
+      // would round silently and hand a verifier wrong inputs.
+      var iterationCount = guard.range.positiveInt31(m.fields.iterationCount.value, ctx.E, ctx.prefix + "/bad-mac-data", "PBKDF2 iterationCount");
+      var keyLength = guard.range.positiveInt31(m.fields.keyLength.value, ctx.E, ctx.prefix + "/bad-mac-data", "PBKDF2 keyLength");
+      var prf = m.fields.prf.present ? m.fields.prf.value.result : null;
+      // X.690 sec. 11.5 -- the prf DEFAULT is algid-hmacWithSHA1 (hmacWithSHA1 with NULL parameters,
+      // i.e. the 2-byte DER 05 00, RFC 8018 sec. 5.2); an explicit prf byte-equal to that default is
+      // non-canonical and rejects. hmacWithSHA1 with ABSENT parameters is a different value and decodes.
+      // This is a public structural check on the algorithm parameters -- not a secret compare -- so a
+      // direct byte test on the (fixed 2-octet) NULL encoding, not a timing-safe comparison.
+      var pp = prf ? prf.parameters : null;
+      // nosemgrep: pki-non-constant-time-secret-compare -- pp is the PUBLIC algorithm-identifier parameters
+      // field (a fixed 2-octet NULL encoding), not a MAC / tag / secret; a timing-safe compare is inapplicable.
+      if (prf && prf.oid === hmacSha1 && pp !== null && pp.length === 2 && pp[0] === 0x05 && pp[1] === 0x00) {
+        throw ctx.E(ctx.prefix + "/bad-mac-data", "a PBKDF2 prf equal to its DEFAULT algid-hmacWithSHA1 must be omitted (X.690 sec. 11.5, RFC 8018 sec. 5.2)");
+      }
+      // The PBKDF2 prf HMAC AlgorithmIdentifier likewise carries NULL (or absent) parameters (RFC 8018 App. B.1):
+      // reject a present-but-non-NULL prf parameter (e.g. an INTEGER) instead of discarding it, since the prf
+      // hash is dispatched by OID alone. (An absent prf, and hmacWithSHA1 with absent params, remain valid above.)
+      // nosemgrep: pki-non-constant-time-secret-compare -- pp is the PUBLIC algorithm-identifier parameters node.
+      if (prf && pp !== null && !(pp.length === 2 && pp[0] === 0x05 && pp[1] === 0x00)) {
+        throw ctx.E(ctx.prefix + "/bad-mac-data", "the PBKDF2 prf parameters must be absent or NULL (RFC 8018 App. B.1)");
+      }
+      return {
+        salt: m.fields.salt.value,
+        iterationCount: iterationCount,
+        keyLength: keyLength,
+        prfOid: prf ? prf.oid : hmacSha1,
+        prfName: prf ? prf.name : "hmacWithSHA1",
+      };
+    },
+  });
+}
+
+// pbmac1Params(ns): PBMAC1-params ::= SEQUENCE { keyDerivationFunc AlgorithmIdentifier{PBKDF2},
+// messageAuthScheme AlgorithmIdentifier } (RFC 8018 App. A.5 / RFC 9579 sec. 4). The PBKDF2 prf and the
+// messageAuthScheme HMAC are INDEPENDENT (a SHA-512 prf with a SHA-256 HMAC is legal). Shared by PKCS#12
+// MacData and CMP PBMAC1 protection; returns { kdf: { salt, iterationCount, keyLength, prfOid, prfName },
+// schemeOid, schemeName }.
+function pbmac1Params(ns) {
+  return schema.seq([
+    schema.field("keyDerivationFunc", schema.seq([
+      schema.field("algorithm", schema.oidLeaf()),
+      schema.field("parameters", pbkdf2Params(ns)),
+    ], { assert: "sequence", arity: { exact: 2 }, code: ns.prefix + "/bad-mac-data", what: "PBMAC1 keyDerivationFunc" })),
+    schema.field("messageAuthScheme", algorithmIdentifier(ns)),
+  ], {
+    assert: "sequence", arity: { exact: 2 }, code: ns.prefix + "/bad-mac-data", what: "PBMAC1-params",
+    build: function (m, ctx) {
+      var kdf = m.fields.keyDerivationFunc.value;
+      if (kdf.fields.algorithm.value !== ctx.oid.byName("pbkdf2")) {
+        throw ctx.E(ctx.prefix + "/bad-mac-data", "PBMAC1 keyDerivationFunc must be PBKDF2 (RFC 9579 sec. 4)");
+      }
+      var scheme = m.fields.messageAuthScheme.value.result;
+      // RFC 8018 App. B.1: an HMAC messageAuthScheme AlgorithmIdentifier carries NULL (or absent) parameters,
+      // matching the builder (_hmacAlgId emits the 2-byte 05 00). Reject any OTHER parameter encoding rather than
+      // silently discarding it -- _verifyMac dispatches by the scheme OID alone, so a mismatched / malformed
+      // parameter (e.g. an INTEGER) must not slip through unvalidated. A direct byte test on the fixed 2-octet
+      // NULL encoding of the PUBLIC parameters, not a secret compare.
+      var sp = scheme.parameters;
+      // nosemgrep: pki-non-constant-time-secret-compare -- sp is the PUBLIC algorithm-identifier parameters node.
+      if (sp !== null && !(sp.length === 2 && sp[0] === 0x05 && sp[1] === 0x00)) {
+        throw ctx.E(ctx.prefix + "/bad-mac-data", "the PBMAC1 messageAuthScheme parameters must be absent or NULL (RFC 8018 App. B.1)");
+      }
+      return {
+        kdf: kdf.fields.parameters.value.result,
+        schemeOid: scheme.oid,
+        schemeName: scheme.name,
+      };
+    },
+  });
+}
+
 // attrValueToString(ns): the AttributeValue decode-leaf. A malformed KNOWN
 // string type (invalid UTF-8, a non-IA5 byte, a PrintableString character
 // outside its set, ...) surfaces as an asn1/bad-* content error and must fail
@@ -1319,7 +1409,32 @@ function signedEnvelope(ns, tbsSchema, opts) {
   });
 }
 
+// dNSName syntax (RFC 5280 sec. 4.2.1.6 / RFC 1034 preferred name syntax, a representative CABF check): no
+// whitespace, no leading/trailing dot, no empty label, no underscore, LDH labels (1-63 octets, no leading /
+// trailing hyphen), <= 253 octets, an optional leftmost "*" wildcard. Returns a reason string, or null when
+// well-formed. The shared home so the linter AND an identity comparator (case-fold only a valid dNSName) agree.
+function dnsNameProblem(s) {
+  if (typeof s !== "string" || !s.length) return "empty";
+  if (s.length > 253) return "exceeds 253 octets";
+  if (/\s/.test(s)) return "whitespace";
+  if (s.charAt(0) === "." || s.charAt(s.length - 1) === ".") return "leading/trailing dot";
+  if (s.indexOf("_") !== -1) return "underscore forbidden in dNSName";
+  var labels = s.split(".");
+  for (var i = 0; i < labels.length; i++) {
+    var label = labels[i];
+    if (label.length === 0) return "empty label";
+    if (label.length > 63) return "label exceeds 63 octets";
+    if (i === 0 && label === "*") {
+      if (labels.length < 2) return "bare wildcard";
+      continue;
+    }
+    if (!/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/i.test(label)) return "invalid label syntax";
+  }
+  return null;
+}
+
 module.exports = {
+  dnsNameProblem: dnsNameProblem,
   pemDecode: pemDecode,
   pemDecodeAll: pemDecodeAll,
   pemEncode: pemEncode,
@@ -1331,6 +1446,8 @@ module.exports = {
   DN_SHORT: DN_SHORT,
   time: time,
   algorithmIdentifier: algorithmIdentifier,
+  pbkdf2Params: pbkdf2Params,
+  pbmac1Params: pbmac1Params,
   spki: spki,
   makeParser: makeParser,
   signedEnvelopeTbs: signedEnvelopeTbs,

package/lib/webcrypto.js

@@ -516,7 +516,35 @@ function _requireDeriveLength(length, who) {
 // caller must hold differs by entry point (deriveBits requires "deriveBits",
 // deriveKey requires "deriveKey"), so each public method checks its own
 // usage and then routes the actual derivation through here.
-function _deriveBitsRaw(alg, key, length) {
+// PBKDF2 on the libuv threadpool (crypto.pbkdf2, NOT pbkdf2Sync): an attacker-controlled iteration count must
+// never block the Node event loop (CWE-400 DoS) -- a network peer can request the maximum iterations without
+// knowing the secret (e.g. an unauthenticated PBMAC1 message), so the derivation runs off the main thread.
+// Concurrency is CAPPED so many high-iteration jobs cannot monopolize the whole worker pool and starve
+// unrelated DNS / filesystem / crypto work: at least two pool threads are left free (default pool is four),
+// and derivations beyond the cap queue and run as slots free. The cap tracks UV_THREADPOOL_SIZE when raised.
+var _PBKDF2_MAX_CONCURRENT = Math.max(1, (parseInt(process.env.UV_THREADPOOL_SIZE, 10) || 4) - 2);
+var _pbkdf2InFlight = 0;
+var _pbkdf2Waiters = [];
+function _pbkdf2Async(pw, salt, iterations, keylen, digest) {
+  return new Promise(function (resolve, reject) {
+    function start() {
+      _pbkdf2InFlight++;
+      function done(err, derived) {   // release the slot + admit the next waiter, THEN settle
+        _pbkdf2InFlight--;
+        var next = _pbkdf2Waiters.shift();
+        if (next) next();
+        if (err) reject(err); else resolve(derived);
+      }
+      // A SYNCHRONOUS argument fault (e.g. iterations 0) never reaches the async callback, so release the slot
+      // in the catch too -- otherwise a leaked slot would permanently shrink the pool and queue every later job.
+      try { nodeCrypto.pbkdf2(pw, salt, iterations, keylen, digest, done); }
+      catch (e) { done(e); }
+    }
+    if (_pbkdf2InFlight < _PBKDF2_MAX_CONCURRENT) start(); else _pbkdf2Waiters.push(start);
+  });
+}
+
+async function _deriveBitsRaw(alg, key, length) {
   var name = alg.name;
   if (name === "ECDH" || name === "X25519" || name === "X448") {
     _requireAlgMatch(alg, alg.public, name + " public key");
@@ -538,7 +566,7 @@ function _deriveBitsRaw(alg, key, length) {
   }
   if (name === "PBKDF2") {
     _requireDeriveLength(length, "PBKDF2");
-    var out = nodeCrypto.pbkdf2Sync(_secretBytes(key), _toBuf(alg.salt, "PBKDF2 salt"), alg.iterations, length / 8, _hashNode(alg.hash, "PBKDF2"));
+    var out = await _pbkdf2Async(_secretBytes(key), _toBuf(alg.salt, "PBKDF2 salt"), alg.iterations, length / 8, _hashNode(alg.hash, "PBKDF2"));
     return _toArrayBuffer(out);
   }
   if (name === "X963KDF") {
@@ -603,7 +631,7 @@ SubtleCrypto.prototype.deriveKey = async function deriveKey(algorithm, baseKey,
     // material; a KDF base has no implicit output size and fails closed.
     bits = dk.length != null ? dk.length : null;
   }
-  var raw = _deriveBitsRaw(alg, baseKey, bits);
+  var raw = await _deriveBitsRaw(alg, baseKey, bits);
   return this.importKey("raw", raw, dk, extractable, keyUsages);
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.3.25",
+  "version": "0.3.26",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:5e29cae0-edec-47f9-be9b-305be03dd73c",
+  "serialNumber": "urn:uuid:2d9fa8bb-e93e-450a-991c-ef2f3b3fb9e2",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-27T02:30:05.287Z",
+    "timestamp": "2026-07-30T20:38:00.777Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.3.25",
+      "bom-ref": "@blamejs/pki@0.3.26",
       "type": "application",
       "name": "pki",
-      "version": "0.3.25",
+      "version": "0.3.26",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.3.25",
+      "purl": "pkg:npm/%40blamejs/pki@0.3.26",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.3.25",
+      "ref": "@blamejs/pki@0.3.26",
       "dependsOn": []
     }
   ]