@blamejs/pki 0.4.10 → 0.4.12

package/lib/lint.js

@@ -274,6 +274,58 @@ function _ecCurveName(spki) {
   } catch (_e) { return null; }   // explicit / invalid EC parameters are not an approved named curve
 }
 
+// RFC 5280 marks several extensions MUST (error) or SHOULD (warn) be critical. The shape is
+// uniform: applies when the extension is present, fires when its raw `critical` flag is not
+// true. The rule reads `ctx.raw(name).critical` WITHOUT decoding the value -- criticality is
+// a structural property of the extension, independent of its contents.
+// ---- RFC 5280 4.2.1.4 userNotice DisplayText ----
+// certificatePolicies surfaces each policy's qualifiers as RAW bytes (an external verifier may hash
+// them), so the DisplayText values are read out of those bytes here. The UserNotice walk itself lives
+// in schema-pkix (pki.inspect renders the same values), so the two consumers cannot disagree about
+// which members are DisplayText or how a BMPString decodes.
+var OID_UNOTICE = oid.byName("unotice");
+var _T_BMP = asn1.TAGS.BMP_STRING, _T_VISIBLE = asn1.TAGS.VISIBLE_STRING, _T_UTF8 = asn1.TAGS.UTF8_STRING;
+// The C0 and C1 control ranges, tested by code point rather than a regex: the characters this rule is
+// ABOUT cannot appear in the source, and a regex holding them would be a control byte here.
+function _hasControlChar(str) {
+  for (var i = 0; i < str.length; i++) {
+    var c = str.charCodeAt(i);
+    if (c <= 0x1f || (c >= 0x7f && c <= 0x9f)) return true;
+  }
+  return false;
+}
+// Every DisplayText in the certificate's certificatePolicies. Both positions are collected --
+// explicitText AND NoticeReference.organization -- because the SIZE bound is on the DisplayText type,
+// so reporting only explicitText would leave its sibling unmeasured.
+// The two decodes below are fail-safe belts on the never-throw data path, not reachable paths: the
+// shared decoder ran pkix.assertPolicyQualifiers before surfacing qualifiersBytes, so the bytes are
+// already known to decode as a SEQUENCE whose every element is a two-member PolicyQualifierInfo led
+// by a readable OID. An undecodable extension never reaches here at all -- it is the separate
+// extension-undecodable finding.
+function _policyDisplayTexts(ctx) {
+  var d = ctx.decode("certificatePolicies");
+  if (!d || !Array.isArray(d.value)) return [];
+  var out = [];
+  d.value.forEach(function (pi) {
+    if (!pi.qualifiersBytes || !pi.qualifiersBytes.length) return;
+    var quals;
+    // allow:swallow-unverified re-decoding bytes that already decoded under assertPolicyQualifiers cannot throw
+    try { quals = asn1.decode(pi.qualifiersBytes).children; } catch (_e) { return; }
+    (quals || []).forEach(function (pq) {
+      var qid;
+      // allow:swallow-unverified assertPolicyQualifiers already read this OID, so re-reading it cannot throw
+      try { qid = asn1.read.oid(pq.children[0]); } catch (_e2) { return; }
+      if (qid !== OID_UNOTICE) return;
+      // Entries whose contents did not decode arrive with a null `text` and keep their tag: the rules
+      // below that read the text skip them, while the encoding rule -- which the ASN.1 tag alone
+      // answers -- still sees them.
+      out = out.concat(pkix.userNoticeTexts(pq.children[1]));
+    });
+  });
+  return out;
+}
+function _hasPolicyDisplayText(cert, ctx) { return _policyDisplayTexts(ctx).length > 0; }
+
 // RFC 5280 marks several extensions MUST (error) or SHOULD (warn) be critical. The shape is
 // uniform: applies when the extension is present, fires when its raw `critical` flag is not
 // true. The rule reads `ctx.raw(name).critical` WITHOUT decoding the value -- criticality is
@@ -413,6 +465,65 @@ var RFC5280_RULES = [
     appliesTo: function (cert, ctx) { var bc = ctx.decode("basicConstraints"); return !(bc && bc.value && bc.value.cA === true); },
     check: function (cert, ctx) { return ctx.raw("subjectKeyIdentifier") ? null : true; },
   },
+  // 4.2.1.4 governs the userNotice qualifier's DisplayText with one MUST NOT and three SHOULD-level
+  // rules. None of them can live in the decoder: the section closes by directing certificate users to
+  // "gracefully handle explicitText with more than 200 characters", so a verifier that rejected these
+  // would refuse certificates that are in the wild and otherwise valid. Reporting them is exactly what
+  // a linter is for, so each rule carries the severity its normative word does.
+  {
+    // DisplayText is SIZE (1..200) -- both ends -- but the two ends get SEPARATE ids rather than one
+    // length rule, because the section treats them differently: it tells certificate users to handle a
+    // notice ABOVE 200 gracefully, and says nothing of the sort about an empty one. An operator acting
+    // on that advice suppresses the over-long finding; folding both into a single id would silently
+    // suppress the empty case along with it, which has no such carve-out.
+    id: "lint/rfc5280/explicit-text-too-long", severity: "warn", source: "rfc5280", citation: "RFC 5280 4.2.1.4",
+    message: "a userNotice DisplayText should not exceed 200 characters",
+    appliesTo: _hasPolicyDisplayText,
+    check: function (cert, ctx) {
+      var over = _policyDisplayTexts(ctx).filter(function (d) { return d.text !== null && d.chars > pkix.DISPLAY_TEXT_MAX; });
+      return over.length ? { context: { count: over.length, longest: Math.max.apply(null, over.map(function (d) { return d.chars; })) } } : null;
+    },
+  },
+  {
+    id: "lint/rfc5280/explicit-text-empty", severity: "warn", source: "rfc5280", citation: "RFC 5280 4.2.1.4",
+    message: "a userNotice DisplayText must not be empty (SIZE (1..200))",
+    appliesTo: _hasPolicyDisplayText,
+    check: function (cert, ctx) {
+      var empty = _policyDisplayTexts(ctx).filter(function (d) { return d.text !== null && d.chars < 1; });
+      return empty.length ? { context: { count: empty.length } } : null;
+    },
+  },
+  {
+    id: "lint/rfc5280/explicit-text-bad-encoding", severity: "error", source: "rfc5280", citation: "RFC 5280 4.2.1.4",
+    message: "conforming CAs must not encode explicitText as VisibleString or BMPString",
+    appliesTo: _hasPolicyDisplayText,
+    check: function (cert, ctx) {
+      var bad = _policyDisplayTexts(ctx).filter(function (d) { return d.field === "explicitText" && (d.tagNumber === _T_VISIBLE || d.tagNumber === _T_BMP); });
+      return bad.length ? { context: { count: bad.length, encoding: bad[0].tagNumber === _T_BMP ? "BMPString" : "VisibleString" } } : null;
+    },
+  },
+  {
+    id: "lint/rfc5280/explicit-text-control-chars", severity: "warn", source: "rfc5280", citation: "RFC 5280 4.2.1.4",
+    message: "an explicitText should not include control characters (U+0000 to U+001F, U+007F to U+009F)",
+    appliesTo: _hasPolicyDisplayText,
+    check: function (cert, ctx) {
+      var bad = _policyDisplayTexts(ctx).filter(function (d) { return d.field === "explicitText" && d.text !== null && _hasControlChar(d.text); });
+      return bad.length ? { context: { count: bad.length } } : null;
+    },
+  },
+  {
+    id: "lint/rfc5280/explicit-text-not-nfc", severity: "notice", source: "rfc5280", citation: "RFC 5280 4.2.1.4",
+    message: "a UTF8String explicitText should be normalized to Unicode normalization form C (NFC)",
+    appliesTo: _hasPolicyDisplayText,
+    check: function (cert, ctx) {
+      // Only the utf8String arm carries the NFC recommendation; the other arms cannot express the
+      // combining sequences the rule is about.
+      var bad = _policyDisplayTexts(ctx).filter(function (d) {
+        return d.field === "explicitText" && d.text !== null && d.tagNumber === _T_UTF8 && d.text.normalize("NFC") !== d.text;
+      });
+      return bad.length ? { context: { count: bad.length } } : null;
+    },
+  },
 ];
 
 function _isTls(cert, ctx) { return ctx.isTlsServerCert; }

package/lib/path-validate.js

@@ -1137,7 +1137,9 @@ function validateCriticalExtensionStructure(cert) {
  *   var cert = pki.schema.x509.parse(der);
  *   var res = await pki.path.validate([cert], {
  *     time: new Date("2020-01-01T00:00:00Z"),
- *     trustAnchor: { name: cert.issuer, publicKey: cert.subjectPublicKeyInfo.bytes, algorithm: cert.signatureAlgorithm.oid },
+ *     // the anchor's own key algorithm, not the algorithm its issuer signed it with
+ *     trustAnchor: { name: cert.issuer, publicKey: cert.subjectPublicKeyInfo.bytes,
+ *       algorithm: cert.subjectPublicKeyInfo.algorithm.oid },
  *   });
  *   res.valid;  // boolean; res.results[0].checks carries the per-check codes
  */

package/lib/pbes2.js

@@ -26,8 +26,15 @@ var PRF_NODE_BY_NAME = { hmacWithSHA1: "sha1", hmacWithSHA256: "sha256", hmacWit
 var PRF_NODE_BY_OID = {}; Object.keys(PRF_NODE_BY_NAME).forEach(function (n) { PRF_NODE_BY_OID[O(n)] = PRF_NODE_BY_NAME[n]; });
 
 // content-encryption OID -> AES key bits (CBC + GCM). The PBES2 encryptionScheme + CMS content cipher table.
-var CONTENT_KEYBITS = {};
-[["aes128-CBC", 128], ["aes192-CBC", 192], ["aes256-CBC", 256], ["aes128-GCM", 128], ["aes192-GCM", 192], ["aes256-GCM", 256]].forEach(function (r) { CONTENT_KEYBITS[O(r[0])] = r[1]; });
+// CONTENT_MODE rides the SAME rows so a cipher can never be present for its key length but absent for its
+// mode: key length alone does not distinguish an AEAD cipher from a plain one, and a consumer that resolves
+// only the length would open content in the wrong mode whenever the two happen to share a key size.
+var CONTENT_KEYBITS = {}, CONTENT_MODE = {};
+[["aes128-CBC", 128, "cbc"], ["aes192-CBC", 192, "cbc"], ["aes256-CBC", 256, "cbc"],
+  ["aes128-GCM", 128, "gcm"], ["aes192-GCM", 192, "gcm"], ["aes256-GCM", 256, "gcm"]].forEach(function (r) {
+  CONTENT_KEYBITS[O(r[0])] = r[1];
+  CONTENT_MODE[O(r[0])] = r[2];
+});
 
 // A password is an octet string (RFC 8018 sec. 2): a string is UTF-8-encoded deterministically (correct for
 // non-ASCII, and byte-identical to OpenSSL), a Buffer/Uint8Array used verbatim.
@@ -211,6 +218,6 @@ module.exports = {
   prfNodeByName: prfNodeByName, prfNodeByOid: prfNodeByOid,
   pbkdf2ParamsSeq: pbkdf2ParamsSeq, pbes2AlgId: pbes2AlgId, parsePbkdf2Params: parsePbkdf2Params,
   requireChildren: requireChildren, seqChildren: seqChildren,
-  cbcEncrypt: cbcEncrypt, cbcDecrypt: cbcDecrypt, pbes2Encrypt: pbes2Encrypt, pbes2Decrypt: pbes2Decrypt, CONTENT_KEYBITS: CONTENT_KEYBITS,
+  cbcEncrypt: cbcEncrypt, cbcDecrypt: cbcDecrypt, pbes2Encrypt: pbes2Encrypt, pbes2Decrypt: pbes2Decrypt, CONTENT_KEYBITS: CONTENT_KEYBITS, CONTENT_MODE: CONTENT_MODE,
   pbmac1AlgId: pbmac1AlgId, pbmac1: pbmac1,
 };

package/lib/pki-build.js

@@ -168,9 +168,7 @@ function makeBuilder(ctx) {
     if (bc.cA != null && typeof bc.cA !== "boolean") throw E("bad-input", "basicConstraints cA must be a boolean");
     if (bc.critical != null && typeof bc.critical !== "boolean") throw E("bad-input", "basicConstraints critical must be a boolean");
     if (bc.pathLen != null) pathLen(bc.pathLen);
-    Object.keys(bc).forEach(function (k) {
-      if (k !== "cA" && k !== "pathLen" && k !== "critical") throw E("bad-input", "unknown basicConstraints field " + JSON.stringify(k));
-    });
+    guard.identifier.assertKnownKeys(bc, BC_KEYS, E, "bad-input", "unknown basicConstraints field ");
   }
   function extBasicConstraints(spec) {
     var children = [];
@@ -270,6 +268,7 @@ function makeBuilder(ctx) {
   // request that carries requested extensions (a PKCS#10 extensionRequest attribute, a CRMF CertTemplate
   // extensions [9]); a request REQUESTS extensions, so there are no CA cross-field gates. `spki` feeds the
   // subjectKeyIdentifier auto-derive.
+  var BC_KEYS = { cA: 1, pathLen: 1, critical: 1 };
   var REQ_EXT_KEYS = {
     subjectAltName: 1, keyUsage: 1, keyUsageCritical: 1, extendedKeyUsage: 1, extendedKeyUsageCritical: 1,
     basicConstraints: 1, certificatePolicies: 1, certificatePoliciesCritical: 1, subjectKeyIdentifier: 1,
@@ -295,8 +294,8 @@ function makeBuilder(ctx) {
       }));
     }
     if (!extSpec || typeof extSpec !== "object") throw E("bad-input", "requested extensions must be an object or an array of pre-encoded Extension DER");
-    Object.keys(extSpec).forEach(function (k) {
-      if (!REQ_EXT_KEYS[k]) throw E("bad-input", "unknown requested extension " + JSON.stringify(k) + "; pass a pre-encoded Extension DER via the array form for a custom extension");
+    guard.identifier.assertKnownKeys(extSpec, REQ_EXT_KEYS, E, "bad-input", function (k) {
+      return "unknown requested extension " + JSON.stringify(k) + "; pass a pre-encoded Extension DER via the array form for a custom extension";
     });
     var out = [];
     if (extSpec.subjectKeyIdentifier != null) {

package/lib/schema-c509.js

@@ -1031,7 +1031,11 @@ function _qualifierToDer(qidNode, qtextNode) {
   if (qtextNode.majorType !== 3) throw _err("c509/bad-extensions", "a policyQualifier value must be a CBOR text string");
   var text = cbor.read.textString(qtextNode);
   if (qi === 1) return b.sequence([b.oid(oid.byName("cps")), _ia5Universal(text, "a CPSuri")]);   // CPSuri ::= IA5String
-  // id-qt-unotice: UserNotice ::= SEQUENCE { explicitText utf8String } -- noticeRef omitted, DisplayText SIZE 1..200 floor.
+  // id-qt-unotice: UserNotice ::= SEQUENCE { explicitText utf8String } -- noticeRef omitted. Only the SIZE
+  // (1..200) FLOOR is enforced: an empty explicitText is a degenerate value no encoder can have produced,
+  // while RFC 5280 sec. 4.2.1.4 directs certificate users to gracefully handle a notice ABOVE 200
+  // characters, and draft-20 sec. 3.3's compact predicate is SIZE-silent -- so an over-long notice
+  // transcodes rather than being refused.
   if (text.length === 0) throw _err("c509/bad-extensions", "a UserNotice explicitText must be non-empty (DisplayText SIZE 1..200)");
   return b.sequence([b.oid(oid.byName("unotice")), b.sequence([b.utf8(text)])]);
 }

package/lib/schema-pkix.js

@@ -703,6 +703,108 @@ function assertPolicyQualifiers(qNode, fail) {
   });
 }
 
+// DisplayText ::= CHOICE { ia5String, visibleString, bmpString, utf8String } each SIZE (1..200)
+// -- RFC 5280 sec. 4.2.1.4. The bound is deliberately NOT enforced here, and that is a normative
+// requirement rather than a gap: the same section closes with "While the explicitText has a maximum
+// size of 200 characters, some non-conforming CAs exceed this limit. Therefore, certificate users
+// SHOULD gracefully handle explicitText with more than 200 characters." A decoder IS the certificate
+// user that note addresses, so refusing an over-long notice would violate a SHOULD and reject
+// certificates that are in the wild and otherwise valid. The bound belongs to the two layers that
+// can act on it: an issuer, which must not MINT one, and pki.lint, which reports it as an advisory.
+//
+// Measured in CHARACTERS, not octets: a conforming 200-character UTF8String notice can occupy 800
+// octets, so `.length` (UTF-16 units) or a byte count would misjudge a valid value. Exported so
+// every layer that reports the bound counts it identically instead of keeping its own copy.
+var DISPLAY_TEXT_MAX = 200;
+function displayTextChars(str) { return Array.from(str).length; }
+
+// @internal
+// userNoticeTexts(qualifier) -- the DisplayText values of a decoded UserNotice qualifier, as
+// [{ field, tagNumber, text, chars }] in encounter order. `field` is "explicitText" or
+// "organization" (the NoticeReference member), so a caller that must treat the two alike (the
+// SIZE bound applies to both) and one that must not (only explicitText carries the encoding and
+// normalization rules) can each select correctly.
+//
+// UserNotice ::= SEQUENCE { noticeRef NoticeReference OPTIONAL, explicitText DisplayText OPTIONAL }
+// NoticeReference ::= SEQUENCE { organization DisplayText, noticeNumbers SEQUENCE OF INTEGER }
+// Both members are OPTIONAL and distinguished by tag, so a leading SEQUENCE is the noticeRef and any
+// DisplayText member is the explicitText. Returns [] for a qualifier that is not a UserNotice --
+// this reads an already-decoded node for display and reporting, and is never a validity verdict.
+var _DISPLAY_TEXT_TAGS = null;
+function _isDisplayTextNode(n) {
+  if (!_DISPLAY_TEXT_TAGS) {
+    _DISPLAY_TEXT_TAGS = {};
+    _DISPLAY_TEXT_TAGS[_T.IA5_STRING] = 1; _DISPLAY_TEXT_TAGS[_T.VISIBLE_STRING] = 1;
+    _DISPLAY_TEXT_TAGS[_T.BMP_STRING] = 1; _DISPLAY_TEXT_TAGS[_T.UTF8_STRING] = 1;
+  }
+  return !!n && n.tagClass === "universal" && _DISPLAY_TEXT_TAGS[n.tagNumber] === 1;
+}
+// Decoded through the STRICT reader, which validates each arm against its own declared string type
+// (invalid UTF-8, a high bit in an IA5String, an odd-length or lone-surrogate BMPString all throw).
+// Reading the content bytes directly would repair the value instead: `toString("utf8")` substitutes
+// U+FFFD for invalid sequences and a hand-rolled UCS-2 loop drops a trailing odd octet, so a caller
+// would render or measure text the certificate does not contain. Returns null when the value does
+// not decode, so the caller can take its own fallback rather than trust a repair.
+// An undecodable value yields an entry whose `text` and `chars` are null but whose `field` and
+// `tagNumber` are still present. The two are separable facts: which ASN.1 string type was used is
+// established by the tag alone, so a rule about the ENCODING stays answerable even when the contents
+// do not decode, while every rule that reads the TEXT must skip the entry rather than analyze a
+// repair. Collapsing both into "not analyzable" would let a prohibited encoding escape its finding
+// by also being malformed inside.
+function _dtEntry(field, node) {
+  var text;
+  // allow:swallow-unverified an undecodable DisplayText keeps its tag and drops its text; the callers branch on text === null
+  try { text = asn1.read.string(node); } catch (_e) { text = null; }
+  return { field: field, tagNumber: node.tagNumber, text: text, chars: text === null ? null : displayTextChars(text) };
+}
+// A NoticeReference names its notice by ORGANIZATION **and** NUMBER -- the organization alone does not
+// identify which notice is meant, so a consumer that surfaced only the text would lose the lookup key.
+// Returns null when the numbers are absent, wrongly shaped, or contain a member that is not a readable
+// INTEGER: an incompletely decoded reference must NOT be presentable, because dropping the members that
+// failed would render a partial reference indistinguishable from a whole one -- the same defect as
+// omitting the numbers entirely, in a form that is harder to notice. Numbers are decimal strings.
+function _noticeNumbers(node) {
+  if (!node || node.tagClass !== "universal" || node.tagNumber !== _T.SEQUENCE || !node.children) return null;
+  var nums = [], ok = true;
+  node.children.forEach(function (n) {
+    // allow:swallow-unverified a non-INTEGER member makes the whole reference undecodable; the caller falls back rather than rendering part of it
+    try { nums.push(String(asn1.read.integer(n))); } catch (_e) { ok = false; }
+  });
+  return ok ? nums : null;
+}
+// Every DisplayText member is returned, including one whose contents did not decode -- that entry
+// carries its tag with a null `text`. A caller that RENDERS the notice must check that every entry
+// decoded before showing any of it (a partial notice is indistinguishable from a complete one); a
+// caller that only classifies the encoding can read the tags regardless.
+// The LAYOUT is validated before any member is read: UserNotice fixes the order (noticeRef first) and
+// the cardinality (each member at most once, nothing else present). Collecting every recognized member
+// and ignoring the rest would accept a duplicated explicitText, a reversed order, or an extra member,
+// and the caller -- which can only see whether the entries it got look complete -- would then present
+// a structurally invalid notice as a whole one. A malformed layout yields NO entries, so a renderer
+// falls back to hex and a reporter measures nothing.
+function userNoticeTexts(qualifier) {
+  if (!qualifier || qualifier.tagClass !== "universal" || qualifier.tagNumber !== _T.SEQUENCE || !qualifier.children) return [];
+  var kids = qualifier.children;
+  if (kids.length > 2) return [];
+  var i = 0, out = [];
+  // noticeRef [absent | first]: a SEQUENCE of { organization DisplayText, noticeNumbers }.
+  if (i < kids.length && kids[i].tagClass === "universal" && kids[i].tagNumber === _T.SEQUENCE) {
+    var nr = kids[i];
+    if (!nr.children || nr.children.length !== 2 || !_isDisplayTextNode(nr.children[0])) return [];
+    var org = _dtEntry("organization", nr.children[0]);
+    org.noticeNumbers = _noticeNumbers(nr.children[1]);
+    out.push(org);
+    i++;
+  }
+  // explicitText [absent | last]: a DisplayText. Anything else remaining is not a UserNotice member.
+  if (i < kids.length) {
+    if (!_isDisplayTextNode(kids[i])) return [];
+    out.push(_dtEntry("explicitText", kids[i]));
+    i++;
+  }
+  return i === kids.length ? out : [];
+}
+
 // Shared imperative decode helpers for the certExtensionDecoders + attrValueDecoders factories. Both
 // take the caller's ns, so the helpers close over ns.E / ns.oid; extracted once so the two factories
 // share one copy (a per-OID value-decoder body is the identical idiom to a per-OID extension body).
@@ -1468,6 +1570,9 @@ module.exports = {
   signedEnvelopeTbs: signedEnvelopeTbs,
   rootSequenceChildren: rootSequenceChildren,
   assertPolicyQualifiers: assertPolicyQualifiers,
+  DISPLAY_TEXT_MAX: DISPLAY_TEXT_MAX,
+  displayTextChars: displayTextChars,
+  userNoticeTexts: userNoticeTexts,
   signedEnvelope: signedEnvelope,
   attrValueToString: attrValueToString,
   attributeTypeAndValue: attributeTypeAndValue,

package/lib/validator-tpm.js

@@ -168,6 +168,7 @@ var TPM_POLICY_PROFILES = Object.assign(Object.create(null), {
   "hardware-bound": { fixedTPM: true, fixedParent: true, sensitiveDataOrigin: true, sign: true, restricted: false, x509sign: false },
 });
 var _TPM_POLICY_KEYS = Object.assign(Object.create(null), { profile: 1, objectAttributes: 1, reservedBitsClear: 1, consistency: 1, authPolicy: 1 });
+var _AUTH_POLICY_KEYS = Object.assign(Object.create(null), { present: 1, allow: 1 });
 
 // Config-time validation of opts.tpmPolicy: a typo must never silently disable a check, so an
 // unknown key or attribute name throws at the boundary rather than being ignored.
@@ -177,9 +178,7 @@ var _TPM_POLICY_KEYS = Object.assign(Object.create(null), { profile: 1, objectAt
 function normalizeObjectAttributePolicy(policy, E, code) {
   if (policy === undefined) return null;
   if (!policy || typeof policy !== "object" || Array.isArray(policy)) throw new E(code, "opts.tpmPolicy must be an object");
-  Object.keys(policy).forEach(function (k) {
-    if (!_TPM_POLICY_KEYS[k]) throw new E(code, "opts.tpmPolicy has an unknown key " + JSON.stringify(k));
-  });
+  guard.identifier.assertKnownKeys(policy, _TPM_POLICY_KEYS, function (c, m) { return new E(c, m); }, code, "opts.tpmPolicy has an unknown key ");
   var want = {};
   if (policy.profile !== undefined) {
     var preset = TPM_POLICY_PROFILES[policy.profile];
@@ -212,9 +211,7 @@ function normalizeObjectAttributePolicy(policy, E, code) {
     // The nested keys are enumerated for the same reason the top-level ones are: a misspelled
     // `alow` would leave the allow-list unset, and the assertion would then impose no digest
     // restriction at all -- the caller's policy silently doing nothing.
-    Object.keys(ap).forEach(function (k) {
-      if (k !== "present" && k !== "allow") throw new E(code, "opts.tpmPolicy.authPolicy has an unknown key " + JSON.stringify(k));
-    });
+    guard.identifier.assertKnownKeys(ap, _AUTH_POLICY_KEYS, function (c, m) { return new E(c, m); }, code, "opts.tpmPolicy.authPolicy has an unknown key ");
     if (ap.present !== undefined && typeof ap.present !== "boolean") throw new E(code, "opts.tpmPolicy.authPolicy.present must be a boolean");
     if (ap.allow !== undefined) {
       if (!Array.isArray(ap.allow)) throw new E(code, "opts.tpmPolicy.authPolicy.allow must be an array");