@blamejs/pki 0.4.11 → 0.4.12

package/CHANGELOG.md

@@ -4,6 +4,26 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.4.12 — 2026-08-09
+
+A CMS message can no longer declare one content cipher and be opened with another: the declared algorithm's mode is now bound to the container that carries it, so an EnvelopedData naming an authenticated cipher is refused rather than opened, unauthenticated, under a result that reported it as authenticated.
+
+### Added
+
+- pki.lint reports the RFC 5280 sec. 4.2.1.4 rules for a certificate policy's user notice, at the strength the specification states each one: encoding a notice as VisibleString or BMPString is an error, since conforming CAs must not; a notice past 200 characters, an empty one, and one containing control characters are warnings; a UTF8String notice that is not in Unicode normalization form C is a notice. The length is measured in characters, so a conforming notice whose accented or emoji characters occupy more storage than 200 units is not reported, and a value whose contents do not decode under its own declared string type is not measured at all -- though the encoding rule, which the ASN.1 tag alone answers, still reports it. The rules live in the linter and not the decoder deliberately: the same section directs certificate users to handle an over-long notice gracefully, so a verifier that refused one would reject certificates that exist and are otherwise valid.
+- The two ends of the SIZE (1..200) bound are separate findings rather than one, because the section treats them differently: it directs certificate users to handle a notice ABOVE 200 characters gracefully and says nothing of the sort about an empty one, so suppressing the first must not silently suppress the second. Both cover a notice reference's organization as well as the explicit text, since the bound belongs to the DisplayText type rather than to one of the two fields that use it.
+
+### Changed
+
+- pki.inspect renders a certificate policy's user notice as text. A user notice is a constructed value, so it previously fell to the hexadecimal fallback and an operator could not read the notice the qualifier exists to display; its explicit text and its notice reference now render, the reference carrying its organization together with the notice numbers that identify which notice is meant.
+- pki.inspect renders an authority-information-access location given as a directory name. It previously printed a bare form tag, hiding the responder or issuer identity the entry exists to convey, while the same name form already printed as a distinguished name elsewhere in the report.
+- The producing entry points state their error contract completely. pki.x509.sign, pki.csr.sign, pki.crl.sign and pki.attrcert.sign accept raw DER for a name, a pre-encoded extension, or a public key; a structural fault in those bytes raises the format's own error, while a malformed leaf inside them raises the codec's, which the parsing entry points already documented and these did not.
+
+### Fixed
+
+- A CMS content cipher is now bound to the container that declares it. An EnvelopedData must name a CBC cipher and an AuthEnvelopedData an AEAD one, checked before the content-encryption key is used; a mismatch is refused as an unsupported algorithm naming both the cipher and the container. Previously only the cipher's key length was resolved, and because AES-CBC and AES-GCM share key lengths, an EnvelopedData whose algorithm identifier had been changed to the same-size AES-GCM identifier decrypted successfully as unauthenticated CBC while reporting the AEAD algorithm in its result -- so a caller inspecting contentEncryptionAlgorithm to establish that the content was authenticated was answered from a field the decryption had not honoured. The reverse pairing was refused only incidentally, by a later dereference of parameters the AEAD path expects, rather than by a stated rule.
+- The password-recipient inner cipher is resolved through the same identifier-keyed table. It previously required a CBC mode by matching the algorithm identifier's display name, which pki.oid.register can rebind, so a caller that had registered a name over a built-in one could change which ciphers that check admitted.
+
 ## v0.4.11 — 2026-08-09
 
 A WebAuthn attestation can now be bound to the roots the authenticator's own model actually registered, by reading a FIDO Metadata Service BLOB that is verified and chained to a root you supply before any of its contents are parsed.

package/README.md

@@ -243,9 +243,9 @@ is callable today; nothing below is a stub.
 | `pki.shbs` | Stateful hash-based signature **verification** — HSS/LMS (RFC 8554), carried in X.509 by RFC 9802 and CMS by RFC 9708, profiled by NIST SP 800-208 (CNSA 2.0 firmware signing). `verify` checks an HSS signature (every level must pass) and `verifyLms` a single-tree LMS, over the raw public-key / signature blobs the parsers already surface. Pure public-input SHA-256 / SHAKE256 hashing, a data-driven typecode registry, bounds-before-slice reads; a malformed blob throws a typed `ShbsError`, a well-formed-but-wrong signature returns `false`. **Verify only by design** — stateful signing needs atomic one-time-key state that belongs in an HSM — `verify`, `verifyLms` |
 | `pki.hpke` | Hybrid Public Key Encryption (RFC 9180) — the encrypt-to-a-public-key primitive behind TLS ECH, MLS, and OHTTP. `setupS`/`setupR` establish a sender/recipient context (KEM encapsulation + HKDF key schedule); the context's `seal`/`open` AEAD-encrypt with a sequence-counter nonce and `export` derives further secrets; `seal`/`open` are single-shot wrappers. DHKEM (P-256, P-521, X25519, X448) × HKDF-SHA256/SHA512 × AES-GCM/ChaCha20Poly1305/export-only × all four modes, proven against the RFC 9180 Appendix A vectors. DHKEM(P-384) and HKDF-SHA384 are RFC-registered but Appendix A ships no vector for them, so they fail closed until an authoritative KAT exists. Pure composition over `node:crypto`; ML-KEM / X-Wing are a registry data-row extension pending stable drafts — `suites`, `setupS`, `setupR`, `seal`, `open` |
 | `pki.sigstore` | Offline verifier for a Sigstore bundle — the exact artifact `npm publish --provenance` produces and the registry serves. `verifyBundle` composes five fail-closed legs against caller-pinned trust (Fulcio CA roots + Rekor log keys, never trusted from the bundle): the DSSE signature over its PAE preimage under the Fulcio leaf key; the ephemeral Fulcio certificate chain, validated as of the Rekor log time; the RFC 9162 inclusion proof folded to a Rekor-signed tree root; the log entry bound to this exact signature; and the in-toto SLSA subject digest the caller confirms against the published artifact. Zero runtime deps — reuses the X.509 parser, RFC 5280 path validator, and Merkle verifier; the net-new codecs are the DSSE PAE byte-builder and a fail-closed JSON reader. `pae`, `parseBundle`, `verifyBundle` |
-| `pki.inspect` | Human-readable inspection — the pure-JS equivalent of `openssl x509/crl/req/cms -text`. `certificate(pem \| der \| parsed)` renders a familiar OpenSSL-style report: version, serial, signature algorithm, issuer/subject distinguished names, validity, public-key details (curve or modulus size + the raw point/modulus), every decoded extension with its critical flag, and the signature. `crl` / `csr` / `cms` render the non-certificate formats the same way — a CRL like `openssl crl -text` (issuer, Last/Next Update, CRL extensions, each revoked entry with its serial, revocation date, and named reason), a CSR like `openssl req -text` (subject, key, requested extensions and attributes), and a CMS message like `openssl cms -cmsout -print` (a SignedData's content type, digest algorithms, embedded certificates, and each SignerInfo with its signer identifier, algorithms, attributes, and signature; a non-SignedData ContentInfo gets a stable summary) — and `any(input)` detects the format and routes to the right report. Built over the strict parsers and the two-way OID registry, reusing one set of field renderers, so it names extension/algorithm OIDs an OpenSSL build shows only as raw bytes and never drifts. No OpenSSL dependency; the format is stable and OpenSSL-familiar rather than pinned to one OpenSSL version; a malformed part falls back to a hex dump rather than throwing — `certificate`, `crl`, `csr`, `cms`, `any` |
+| `pki.inspect` | Human-readable inspection — the pure-JS equivalent of `openssl x509/crl/req/cms -text`. `certificate(pem \| der \| parsed)` renders a familiar OpenSSL-style report: version, serial, signature algorithm, issuer/subject distinguished names, validity, public-key details (curve or modulus size + the raw point/modulus), every decoded extension with its critical flag, and the signature. `crl` / `csr` / `cms` render the non-certificate formats the same way — a CRL like `openssl crl -text` (issuer, Last/Next Update, CRL extensions, each revoked entry with its serial, revocation date, and named reason), a CSR like `openssl req -text` (subject, key, requested extensions and attributes), and a CMS message like `openssl cms -cmsout -print` (a SignedData's content type, digest algorithms, embedded certificates, and each SignerInfo with its signer identifier, algorithms, attributes, and signature; a non-SignedData ContentInfo gets a stable summary) — and `any(input)` detects the format and routes to the right report. Built over the strict parsers and the two-way OID registry, reusing one set of field renderers, so it names extension/algorithm OIDs an OpenSSL build shows only as raw bytes and never drifts. No OpenSSL dependency; the format is stable and OpenSSL-familiar rather than pinned to one OpenSSL version; a certificate policy's user notice renders as text (its explicit text, and a notice reference with the notice numbers that identify it) rather than hex, and a malformed part falls back to a hex dump rather than throwing — `certificate`, `crl`, `csr`, `cms`, `any` |
 | `pki.webauthn` | WebAuthn / passkey attestation verification — offline trust evaluation of a W3C WebAuthn (Level 3) attestation. `parseAttestationObject(bytes)` decodes the CBOR attestation object + authenticatorData + COSE credential key over the strict `pki.cbor` codec; `verify(attestationObject, clientDataHash, opts)` checks the attestation-statement signature and each format's structural bindings for **packed / tpm / android-key / apple / fido-u2f / none** — the x5c leaf key, the apple nonce, the tpm `certInfo` Name/`extraData` over the `pubArea`, the android `KeyDescription`, the fido-u2f `verificationData` — binding the credential public key to each attestation (via the signed authenticatorData for packed/fido-u2f, or a cert/`pubArea`-key equality check for android-key/apple/tpm) and enforcing each leaf's certificate requirements. The credential-key check covers the full WebAuthn COSE algorithm set — ES256/384/512, RS256/384/512, PS256, EdDSA (Ed25519), and the RFC 9864 fully-specified identifiers **ESP256/384/512, Ed25519, and Ed448** — validating the public-key point on its curve, rejecting the compressed EC point form, and enforcing a minimally-encoded DER ECDSA signature. A verifier, not a ceremony client; fail-closed with typed `webauthn/*` errors. `verifyMetadataBlob(blob, opts)` reads a **FIDO Metadata Service (MDS v3)** BLOB — the signed catalogue of registered authenticator models — verifying its JWS and chaining its signer to an operator-supplied FIDO root **before** the payload is parsed, with sequence-number rollback and `nextUpdate` freshness checks; passing the result as `opts.metadata` to `verify` resolves the authenticator's registered attestation roots from its identifier and requires the trust path to fully validate to one of them, refusing an unlisted or revoked model. Both of the catalogue's key spaces are covered — an aaguid, and the attestation-certificate key identifiers a U2F authenticator is listed under instead. No FIDO root is bundled and there is no trust-on-first-use; retrieving the BLOB is out of scope — `parseAttestationObject`, `verify`, `verifyMetadataBlob`, `metadataFor`, `metadataAnchors` |
-| `pki.lint` | Certificate linting — the zlint / pkilint of JavaScript. `certificate(pem \| der \| parsed, opts)` walks a parsed certificate and emits graded, advisory findings — each with a stable id, a severity (`fatal` > `error` > `warn` > `notice`), a source, a spec-clause citation, and a message — against the RFC 5280 profile plus a representative CA/Browser Forum TLS BR subset (serial sign/size, validity ordering + the SC081v3 reducing validity schedule, keyCertSign coherence, extension criticality — basicConstraints/nameConstraints/policyConstraints/inhibitAnyPolicy must be critical and keyUsage should be, nameConstraints CA-scope, unknown critical extensions, empty-subject SAN, SKI/AKI presence including the end-entity subjectKeyIdentifier, SAN required + CN-in-SAN, dNSName syntax, serverAuth EKU, weak keys). Unlike every other entry the DATA path never throws: hostile bytes return a `fatal` `lint/unparseable` finding (with the strict parser's code) so a whole directory lints without a try/catch; only config-time misuse throws a typed `LintError`. `certificate`, `rules`, `profiles` |
+| `pki.lint` | Certificate linting — the zlint / pkilint of JavaScript. `certificate(pem \| der \| parsed, opts)` walks a parsed certificate and emits graded, advisory findings — each with a stable id, a severity (`fatal` > `error` > `warn` > `notice`), a source, a spec-clause citation, and a message — against the RFC 5280 profile plus a representative CA/Browser Forum TLS BR subset (serial sign/size, validity ordering + the SC081v3 reducing validity schedule, keyCertSign coherence, extension criticality — basicConstraints/nameConstraints/policyConstraints/inhibitAnyPolicy must be critical and keyUsage should be, nameConstraints CA-scope, unknown critical extensions, empty-subject SAN, SKI/AKI presence including the end-entity subjectKeyIdentifier, SAN required + CN-in-SAN, dNSName syntax, serverAuth EKU, weak keys, and the sec. 4.2.1.4 certificate-policy user-notice rules — a VisibleString/BMPString explicitText, a notice past 200 characters, an empty notice, control characters, and a non-NFC UTF8String notice, each at the strength the clause states). Unlike every other entry the DATA path never throws: hostile bytes return a `fatal` `lint/unparseable` finding (with the strict parser's code) so a whole directory lints without a try/catch; only config-time misuse throws a typed `LintError`. `certificate`, `rules`, `profiles` |
 | `pki.C` / `pki.constants` | Version-stable constants — functional scale helpers (`C.TIME.*`, `C.BYTES.*`), codec `LIMITS`, `version` |
 | `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError` / `TspError` / `AttrCertError` / `CrmfError` / `Pkcs12Error` / `CmpError` / `PathError` / `CtError` / `JoseError` / `AcmeError` / `WebauthnError` / `LintError`, each carrying a stable `code` in `domain/reason` form |
 | `pki` CLI | `pki version`, `pki oid <dotted\|name>`, `pki parse <cert>`, `pki inspect <cert>`, `pki lint <cert>`, `pki convert <file> --to der\|pem`, `pki verify <cert>... --anchor <cert>`, `pki sign <file> --cert <c> --key <k>` |

package/lib/attrcert-sign.js

@@ -428,7 +428,9 @@ function _buildExtensions(extSpec, aaSpki) {
  * attribute certificate is never self-signed. The signature algorithm is resolved from the AA key (RSA
  * PKCS#1 v1.5 or PSS, ECDSA, EdDSA, ML-DSA, SLH-DSA, or a composite arm), and the signature is verified
  * under the AA public key before the certificate is returned. Returns DER, or a PEM `ATTRIBUTE
- * CERTIFICATE` with `opts.pem`. Malformed input throws a typed `AttrCertError`. The AA certificate's own
+ * CERTIFICATE` with `opts.pem`. Malformed input throws a typed `AttrCertError`; where the spec carries
+ * raw DER -- a holder or issuer `Name` Buffer, a pre-encoded `Extension` -- a malformed leaf inside
+ * those bytes throws `Asn1Error`. The AA certificate's own
  * profile (RFC 5755 sec. 4.5) and validity are a verification-layer concern -- validate the AA
  * certificate with `pki.path.validate` before trusting the attribute certificate. Parsing is
  * `pki.schema.attrcert.parse`.

package/lib/cms-decrypt.js

@@ -36,6 +36,7 @@ function _err(code, message, cause) { return new CmsError(code, message, cause);
 function _fail() { return new CmsError("cms/decrypt-failed", "the CMS content could not be decrypted (uniform by design -- padding / integrity / key-unwrap failures are indistinguishable to defeat oracles)"); }
 
 var CONTENT_KEYBITS = pbes2.CONTENT_KEYBITS; // content-encryption OID -> key bits (the shared PBES2 table)
+var CONTENT_MODE = pbes2.CONTENT_MODE;       // the same rows' cipher mode ("cbc" | "gcm")
 
 // ---- entry -----------------------------------------------------------------
 async function decrypt(input, keyMaterial, opts) {
@@ -63,6 +64,13 @@ async function decryptEnvelopedData(parsed, keyMaterial, opts, contentTypeName)
   var recips = parsed.recipientInfos || [];
   var candidates = _selectCandidates(recips, keyMaterial, opts);   // stage 1 (typed, distinct)
   var eci = parsed.encryptedContentInfo;
+  // The content cipher's MODE is a structural property of the message -- readable from the algorithm
+  // identifier with no key material at all -- so it is decided HERE, before any recipient is tried.
+  // Deciding it per candidate would make a structural verdict depend on key acquisition succeeding
+  // first: several password or KEK recipients can match the same key material, so the distinct
+  // cms/unsupported-algorithm would be swallowed by the ambiguous-candidate loop below and the caller
+  // told their key was wrong, after repeating a PBKDF2 derivation for every candidate to learn it.
+  _assertContentCipherMode(eci, ct);
   // Password- and KEK-based recipients carry no rid, so several may match the same key material; try
   // each until one yields a CEK that opens the content. A single candidate propagates its exact
   // verdict; multiple ambiguous candidates collapse to the uniform verdict so nothing is leaked.
@@ -274,7 +282,9 @@ async function _pwriCek(ri, km, opts) {
   var inner = asn1.decode(kea.parameters);                 // inner AES-CBC AlgorithmIdentifier
   var innerOid = asn1.read.oid(inner.children[0]);
   var innerBits = CONTENT_KEYBITS[innerOid];
-  if (!innerBits || !/CBC/.test(oid.name(innerOid) || "")) throw _err("cms/unsupported-algorithm", "unsupported pwri inner cipher");
+  // The mode comes from the OID-keyed table, not from the OID's display NAME: pki.oid.register() can
+  // override a built-in name, and a name-matched mode check would then admit a non-CBC inner cipher.
+  if (!innerBits || CONTENT_MODE[innerOid] !== "cbc") throw _err("cms/unsupported-algorithm", "unsupported pwri inner cipher");
   var iv = asn1.read.octetString(inner.children[1]);
   var kek = nodeCrypto.pbkdf2Sync(pbes2.passwordBytes(km.password, _err, "cms"), pb.salt, pb.iterations, innerBits / 8, pb.prfNode);
   return _pwriUnwrap(kek, ri.encryptedKey, iv, innerBits);
@@ -304,6 +314,22 @@ async function _kemriCek(ri, km) {
   return await _aesKwUnwrap(kek, k.encryptedKey);
 }
 
+// The declared cipher MODE must match the container's authentication model: an AEAD cipher belongs in
+// AuthEnvelopedData and a plain CBC cipher in EnvelopedData (RFC 5083 sec. 2.1 / RFC 5084 sec. 3). Key
+// length alone does not separate them, so without this an EnvelopedData naming AES-GCM was opened as
+// unauthenticated CBC while the result still reported the AEAD algorithm -- telling the caller the
+// content was authenticated when nothing had authenticated it. The mirror case dereferenced AEAD
+// parameters the parser leaves null for a non-AEAD algorithm, faulting instead of failing closed.
+// An unresolvable OID is left to _openContent, which names it as the unsupported algorithm it is.
+function _assertContentCipherMode(eci, ct) {
+  var oidStr = eci.contentEncryptionAlgorithm.oid;
+  if (!CONTENT_MODE[oidStr]) return;
+  var wantMode = ct === "authEnvelopedData" ? "gcm" : "cbc";
+  if (CONTENT_MODE[oidStr] !== wantMode) {
+    throw _err("cms/unsupported-algorithm", "contentEncryptionAlgorithm " + oidStr + " is not a " + wantMode.toUpperCase() + " cipher, which " + ct + " requires (RFC 5083 sec. 2.1 / RFC 5084 sec. 3)");
+  }
+}
+
 // ---- stage 3: open the content (uniform failure) ---------------------------
 async function _openContent(parsed, eci, cek, ct) {
   var alg = eci.contentEncryptionAlgorithm;

package/lib/crl-sign.js

@@ -478,7 +478,8 @@ function _sign(spec, issuer, opts) {
  * empty revocation list omits `revokedCertificates` rather than emitting an empty SEQUENCE (sec. 5.1.2.6);
  * `reasonCode` is an ENUMERATED and `invalidityDate` is always GeneralizedTime (sec. 5.3.1/5.3.2);
  * per-extension criticality is fixed by the RFC; and the produced signature is verified under the issuer
- * key before return. A violation throws a typed `CrlError`.
+ * key before return. A violation throws a typed `CrlError`; where the spec carries raw DER -- an issuer
+ * `Name` Buffer or a pre-encoded `Extension` -- a malformed leaf inside those bytes throws `Asn1Error`.
  *
  * @opts
  *   - `pem` (boolean) -- return a PEM `X509 CRL` string instead of DER.

package/lib/csr-sign.js

@@ -82,7 +82,9 @@ function _challengePassword(pw) {
  * to prove possession of the private half of `subjectPublicKey`, and that proof is verified before the
  * request is returned. The signature algorithm is resolved from the subject key (RSA PKCS#1 v1.5 or PSS,
  * ECDSA, EdDSA, ML-DSA, SLH-DSA, or a composite arm). Returns DER, or a PEM `CERTIFICATE REQUEST` with
- * `opts.pem`. Malformed input throws a typed `CsrError`. Certificate-request parsing is `pki.schema.csr.parse`.
+ * `opts.pem`. Malformed input throws a typed `CsrError`; where the spec carries raw DER -- a `Name`
+ * Buffer, a pre-encoded requested `Extension` or `Attribute` -- a malformed leaf inside those bytes
+ * throws `Asn1Error` instead. Certificate-request parsing is `pki.schema.csr.parse`.
  *
  * @opts
  *   - `pem` (boolean) -- return a PEM `CERTIFICATE REQUEST` string instead of DER.

package/lib/inspect.js

@@ -46,6 +46,9 @@ function _err(code, message, cause) { return new InspectError(code, message, cau
 // caught by the renderer and fall back to a hex dump (inspection is best-effort).
 var NS = pkix.makeNS("inspect", InspectError, oid);
 var EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
+// Dispatch on the stable OID, not the display name: pki.oid.register() can override a built-in
+// name, which would silently skip the userNotice rendering and hex-dump the notice instead.
+var OID_UNOTICE = oid.byName("unotice");
 
 // ---- formatting helpers ------------------------------------------------------
 
@@ -196,14 +199,17 @@ function _ipString(buf) {
 // their structural separators are left as-is, matching OpenSSL (a GeneralName has no
 // RFC 4514-equivalent escaping profile, and escaping a legitimate comma in a URI
 // would misrepresent it).
+// The DN of a decoded directoryName GeneralName value. Shared so every renderer that meets this
+// form -- the SAN/AKI GeneralName path and the AIA/SIA accessLocation path, which carry different
+// decoded shapes -- prints the same DN rather than one of them falling back to a bare tag number.
+function _gnDn(value) {
+  return (value && Array.isArray(value.rdns)) ? _dnString(value) : ((value && value.dn) || "");
+}
 function _gn(g) {
   if (!g || typeof g !== "object") return "";
   var t = g.tagNumber;
   if (t === 7 && Buffer.isBuffer(g.value)) return "IP Address:" + _ipString(g.value);
-  if (t === 4) {
-    var dn = (g.value && Array.isArray(g.value.rdns)) ? _dnString(g.value) : ((g.value && g.value.dn) || "");
-    return "DirName:" + dn;
-  }
+  if (t === 4) return "DirName:" + _gnDn(g.value);
   if (t === 0) return "othername:" + (Buffer.isBuffer(g.bytes) ? _hexColon(g.bytes, {}) : "<unsupported>");
   var kind = GN_KIND[t] || ("tag" + t);
   var v = (typeof g.value === "string") ? _clean(g.value)
@@ -368,6 +374,30 @@ var EXT_RENDERERS = {
           var label = null;
           try { label = oid.name(qid); }
           catch (_e) { /* unregistered qualifier */ }
+          // A userNotice is a constructed SEQUENCE, so the printable-content test below can never
+          // read it and it would hex-dump -- leaving the operator unable to read the very text the
+          // qualifier exists to display. Render its DisplayText members through the shared pkix
+          // reader (the same one pki.lint measures), so both agree on what the notice says.
+          if (qid === OID_UNOTICE) {
+            // Render only when EVERY member decoded under its declared string type. A null text means
+            // the value did not, and showing the members that happened to decode would present a
+            // partial notice as a complete one -- so the whole qualifier falls through to the hex
+            // dump, where the operator sees the bytes the certificate actually holds.
+            // A null noticeNumbers means the reference did not fully decode, and is refused for the
+            // same reason as a null text: a partially decoded notice must not be shown as a whole one.
+            var texts = pkix.userNoticeTexts(q);
+            if (texts.length && texts.every(function (t) {
+              return t.text !== null && (t.field !== "organization" || t.noticeNumbers !== null);
+            })) {
+              texts.forEach(function (t) {
+                // A NoticeReference is identified by organization AND number, so the numbers ride with
+                // the organization -- printing the text alone would drop the key that names the notice.
+                var nums = (t.noticeNumbers && t.noticeNumbers.length) ? " #" + t.noticeNumbers.join(", ") : "";
+                lines.push(inner + "  " + (label || qid) + " " + t.field + ": " + _clean(t.text) + nums);
+              });
+              return;
+            }
+          }
           var val = (q && !q.constructed && Buffer.isBuffer(q.content) && _printable(q.content))
             ? _clean(q.content.toString("latin1"))
             : _hexColon(q && Buffer.isBuffer(q.bytes) ? q.bytes : Buffer.alloc(0), {});
@@ -397,6 +427,10 @@ var EXT_RENDERERS = {
       else if (loc.tag === 2) lv = "DNS:" + loc.value;
       else if (loc.tag === 1) lv = "email:" + loc.value;
       else if (loc.tag === 7) lv = "IP:" + _ipString(loc.value);
+      // A directoryName accessLocation carries a decoded Name, so print the DN. Without this it fell
+      // to the bracketed-tag fallback and rendered a bare "[4]", hiding the responder/issuer identity
+      // the entry exists to convey -- while the same form already printed as DirName elsewhere.
+      else if (loc.tag === 4) lv = "DirName:" + _gnDn(loc.value);
       else lv = typeof loc.value === "string" ? loc.value : "[" + loc.tag + "]";
       return inner + (LABEL[m] || m || ad.accessMethod) + " - " + lv;
     }).join("\n");

package/lib/lint.js

@@ -274,6 +274,58 @@ function _ecCurveName(spki) {
   } catch (_e) { return null; }   // explicit / invalid EC parameters are not an approved named curve
 }
 
+// RFC 5280 marks several extensions MUST (error) or SHOULD (warn) be critical. The shape is
+// uniform: applies when the extension is present, fires when its raw `critical` flag is not
+// true. The rule reads `ctx.raw(name).critical` WITHOUT decoding the value -- criticality is
+// a structural property of the extension, independent of its contents.
+// ---- RFC 5280 4.2.1.4 userNotice DisplayText ----
+// certificatePolicies surfaces each policy's qualifiers as RAW bytes (an external verifier may hash
+// them), so the DisplayText values are read out of those bytes here. The UserNotice walk itself lives
+// in schema-pkix (pki.inspect renders the same values), so the two consumers cannot disagree about
+// which members are DisplayText or how a BMPString decodes.
+var OID_UNOTICE = oid.byName("unotice");
+var _T_BMP = asn1.TAGS.BMP_STRING, _T_VISIBLE = asn1.TAGS.VISIBLE_STRING, _T_UTF8 = asn1.TAGS.UTF8_STRING;
+// The C0 and C1 control ranges, tested by code point rather than a regex: the characters this rule is
+// ABOUT cannot appear in the source, and a regex holding them would be a control byte here.
+function _hasControlChar(str) {
+  for (var i = 0; i < str.length; i++) {
+    var c = str.charCodeAt(i);
+    if (c <= 0x1f || (c >= 0x7f && c <= 0x9f)) return true;
+  }
+  return false;
+}
+// Every DisplayText in the certificate's certificatePolicies. Both positions are collected --
+// explicitText AND NoticeReference.organization -- because the SIZE bound is on the DisplayText type,
+// so reporting only explicitText would leave its sibling unmeasured.
+// The two decodes below are fail-safe belts on the never-throw data path, not reachable paths: the
+// shared decoder ran pkix.assertPolicyQualifiers before surfacing qualifiersBytes, so the bytes are
+// already known to decode as a SEQUENCE whose every element is a two-member PolicyQualifierInfo led
+// by a readable OID. An undecodable extension never reaches here at all -- it is the separate
+// extension-undecodable finding.
+function _policyDisplayTexts(ctx) {
+  var d = ctx.decode("certificatePolicies");
+  if (!d || !Array.isArray(d.value)) return [];
+  var out = [];
+  d.value.forEach(function (pi) {
+    if (!pi.qualifiersBytes || !pi.qualifiersBytes.length) return;
+    var quals;
+    // allow:swallow-unverified re-decoding bytes that already decoded under assertPolicyQualifiers cannot throw
+    try { quals = asn1.decode(pi.qualifiersBytes).children; } catch (_e) { return; }
+    (quals || []).forEach(function (pq) {
+      var qid;
+      // allow:swallow-unverified assertPolicyQualifiers already read this OID, so re-reading it cannot throw
+      try { qid = asn1.read.oid(pq.children[0]); } catch (_e2) { return; }
+      if (qid !== OID_UNOTICE) return;
+      // Entries whose contents did not decode arrive with a null `text` and keep their tag: the rules
+      // below that read the text skip them, while the encoding rule -- which the ASN.1 tag alone
+      // answers -- still sees them.
+      out = out.concat(pkix.userNoticeTexts(pq.children[1]));
+    });
+  });
+  return out;
+}
+function _hasPolicyDisplayText(cert, ctx) { return _policyDisplayTexts(ctx).length > 0; }
+
 // RFC 5280 marks several extensions MUST (error) or SHOULD (warn) be critical. The shape is
 // uniform: applies when the extension is present, fires when its raw `critical` flag is not
 // true. The rule reads `ctx.raw(name).critical` WITHOUT decoding the value -- criticality is
@@ -413,6 +465,65 @@ var RFC5280_RULES = [
     appliesTo: function (cert, ctx) { var bc = ctx.decode("basicConstraints"); return !(bc && bc.value && bc.value.cA === true); },
     check: function (cert, ctx) { return ctx.raw("subjectKeyIdentifier") ? null : true; },
   },
+  // 4.2.1.4 governs the userNotice qualifier's DisplayText with one MUST NOT and three SHOULD-level
+  // rules. None of them can live in the decoder: the section closes by directing certificate users to
+  // "gracefully handle explicitText with more than 200 characters", so a verifier that rejected these
+  // would refuse certificates that are in the wild and otherwise valid. Reporting them is exactly what
+  // a linter is for, so each rule carries the severity its normative word does.
+  {
+    // DisplayText is SIZE (1..200) -- both ends -- but the two ends get SEPARATE ids rather than one
+    // length rule, because the section treats them differently: it tells certificate users to handle a
+    // notice ABOVE 200 gracefully, and says nothing of the sort about an empty one. An operator acting
+    // on that advice suppresses the over-long finding; folding both into a single id would silently
+    // suppress the empty case along with it, which has no such carve-out.
+    id: "lint/rfc5280/explicit-text-too-long", severity: "warn", source: "rfc5280", citation: "RFC 5280 4.2.1.4",
+    message: "a userNotice DisplayText should not exceed 200 characters",
+    appliesTo: _hasPolicyDisplayText,
+    check: function (cert, ctx) {
+      var over = _policyDisplayTexts(ctx).filter(function (d) { return d.text !== null && d.chars > pkix.DISPLAY_TEXT_MAX; });
+      return over.length ? { context: { count: over.length, longest: Math.max.apply(null, over.map(function (d) { return d.chars; })) } } : null;
+    },
+  },
+  {
+    id: "lint/rfc5280/explicit-text-empty", severity: "warn", source: "rfc5280", citation: "RFC 5280 4.2.1.4",
+    message: "a userNotice DisplayText must not be empty (SIZE (1..200))",
+    appliesTo: _hasPolicyDisplayText,
+    check: function (cert, ctx) {
+      var empty = _policyDisplayTexts(ctx).filter(function (d) { return d.text !== null && d.chars < 1; });
+      return empty.length ? { context: { count: empty.length } } : null;
+    },
+  },
+  {
+    id: "lint/rfc5280/explicit-text-bad-encoding", severity: "error", source: "rfc5280", citation: "RFC 5280 4.2.1.4",
+    message: "conforming CAs must not encode explicitText as VisibleString or BMPString",
+    appliesTo: _hasPolicyDisplayText,
+    check: function (cert, ctx) {
+      var bad = _policyDisplayTexts(ctx).filter(function (d) { return d.field === "explicitText" && (d.tagNumber === _T_VISIBLE || d.tagNumber === _T_BMP); });
+      return bad.length ? { context: { count: bad.length, encoding: bad[0].tagNumber === _T_BMP ? "BMPString" : "VisibleString" } } : null;
+    },
+  },
+  {
+    id: "lint/rfc5280/explicit-text-control-chars", severity: "warn", source: "rfc5280", citation: "RFC 5280 4.2.1.4",
+    message: "an explicitText should not include control characters (U+0000 to U+001F, U+007F to U+009F)",
+    appliesTo: _hasPolicyDisplayText,
+    check: function (cert, ctx) {
+      var bad = _policyDisplayTexts(ctx).filter(function (d) { return d.field === "explicitText" && d.text !== null && _hasControlChar(d.text); });
+      return bad.length ? { context: { count: bad.length } } : null;
+    },
+  },
+  {
+    id: "lint/rfc5280/explicit-text-not-nfc", severity: "notice", source: "rfc5280", citation: "RFC 5280 4.2.1.4",
+    message: "a UTF8String explicitText should be normalized to Unicode normalization form C (NFC)",
+    appliesTo: _hasPolicyDisplayText,
+    check: function (cert, ctx) {
+      // Only the utf8String arm carries the NFC recommendation; the other arms cannot express the
+      // combining sequences the rule is about.
+      var bad = _policyDisplayTexts(ctx).filter(function (d) {
+        return d.field === "explicitText" && d.text !== null && d.tagNumber === _T_UTF8 && d.text.normalize("NFC") !== d.text;
+      });
+      return bad.length ? { context: { count: bad.length } } : null;
+    },
+  },
 ];
 
 function _isTls(cert, ctx) { return ctx.isTlsServerCert; }

package/lib/pbes2.js

@@ -26,8 +26,15 @@ var PRF_NODE_BY_NAME = { hmacWithSHA1: "sha1", hmacWithSHA256: "sha256", hmacWit
 var PRF_NODE_BY_OID = {}; Object.keys(PRF_NODE_BY_NAME).forEach(function (n) { PRF_NODE_BY_OID[O(n)] = PRF_NODE_BY_NAME[n]; });
 
 // content-encryption OID -> AES key bits (CBC + GCM). The PBES2 encryptionScheme + CMS content cipher table.
-var CONTENT_KEYBITS = {};
-[["aes128-CBC", 128], ["aes192-CBC", 192], ["aes256-CBC", 256], ["aes128-GCM", 128], ["aes192-GCM", 192], ["aes256-GCM", 256]].forEach(function (r) { CONTENT_KEYBITS[O(r[0])] = r[1]; });
+// CONTENT_MODE rides the SAME rows so a cipher can never be present for its key length but absent for its
+// mode: key length alone does not distinguish an AEAD cipher from a plain one, and a consumer that resolves
+// only the length would open content in the wrong mode whenever the two happen to share a key size.
+var CONTENT_KEYBITS = {}, CONTENT_MODE = {};
+[["aes128-CBC", 128, "cbc"], ["aes192-CBC", 192, "cbc"], ["aes256-CBC", 256, "cbc"],
+  ["aes128-GCM", 128, "gcm"], ["aes192-GCM", 192, "gcm"], ["aes256-GCM", 256, "gcm"]].forEach(function (r) {
+  CONTENT_KEYBITS[O(r[0])] = r[1];
+  CONTENT_MODE[O(r[0])] = r[2];
+});
 
 // A password is an octet string (RFC 8018 sec. 2): a string is UTF-8-encoded deterministically (correct for
 // non-ASCII, and byte-identical to OpenSSL), a Buffer/Uint8Array used verbatim.
@@ -211,6 +218,6 @@ module.exports = {
   prfNodeByName: prfNodeByName, prfNodeByOid: prfNodeByOid,
   pbkdf2ParamsSeq: pbkdf2ParamsSeq, pbes2AlgId: pbes2AlgId, parsePbkdf2Params: parsePbkdf2Params,
   requireChildren: requireChildren, seqChildren: seqChildren,
-  cbcEncrypt: cbcEncrypt, cbcDecrypt: cbcDecrypt, pbes2Encrypt: pbes2Encrypt, pbes2Decrypt: pbes2Decrypt, CONTENT_KEYBITS: CONTENT_KEYBITS,
+  cbcEncrypt: cbcEncrypt, cbcDecrypt: cbcDecrypt, pbes2Encrypt: pbes2Encrypt, pbes2Decrypt: pbes2Decrypt, CONTENT_KEYBITS: CONTENT_KEYBITS, CONTENT_MODE: CONTENT_MODE,
   pbmac1AlgId: pbmac1AlgId, pbmac1: pbmac1,
 };

package/lib/schema-c509.js

@@ -1031,7 +1031,11 @@ function _qualifierToDer(qidNode, qtextNode) {
   if (qtextNode.majorType !== 3) throw _err("c509/bad-extensions", "a policyQualifier value must be a CBOR text string");
   var text = cbor.read.textString(qtextNode);
   if (qi === 1) return b.sequence([b.oid(oid.byName("cps")), _ia5Universal(text, "a CPSuri")]);   // CPSuri ::= IA5String
-  // id-qt-unotice: UserNotice ::= SEQUENCE { explicitText utf8String } -- noticeRef omitted, DisplayText SIZE 1..200 floor.
+  // id-qt-unotice: UserNotice ::= SEQUENCE { explicitText utf8String } -- noticeRef omitted. Only the SIZE
+  // (1..200) FLOOR is enforced: an empty explicitText is a degenerate value no encoder can have produced,
+  // while RFC 5280 sec. 4.2.1.4 directs certificate users to gracefully handle a notice ABOVE 200
+  // characters, and draft-20 sec. 3.3's compact predicate is SIZE-silent -- so an over-long notice
+  // transcodes rather than being refused.
   if (text.length === 0) throw _err("c509/bad-extensions", "a UserNotice explicitText must be non-empty (DisplayText SIZE 1..200)");
   return b.sequence([b.oid(oid.byName("unotice")), b.sequence([b.utf8(text)])]);
 }

package/lib/schema-pkix.js

@@ -703,6 +703,108 @@ function assertPolicyQualifiers(qNode, fail) {
   });
 }
 
+// DisplayText ::= CHOICE { ia5String, visibleString, bmpString, utf8String } each SIZE (1..200)
+// -- RFC 5280 sec. 4.2.1.4. The bound is deliberately NOT enforced here, and that is a normative
+// requirement rather than a gap: the same section closes with "While the explicitText has a maximum
+// size of 200 characters, some non-conforming CAs exceed this limit. Therefore, certificate users
+// SHOULD gracefully handle explicitText with more than 200 characters." A decoder IS the certificate
+// user that note addresses, so refusing an over-long notice would violate a SHOULD and reject
+// certificates that are in the wild and otherwise valid. The bound belongs to the two layers that
+// can act on it: an issuer, which must not MINT one, and pki.lint, which reports it as an advisory.
+//
+// Measured in CHARACTERS, not octets: a conforming 200-character UTF8String notice can occupy 800
+// octets, so `.length` (UTF-16 units) or a byte count would misjudge a valid value. Exported so
+// every layer that reports the bound counts it identically instead of keeping its own copy.
+var DISPLAY_TEXT_MAX = 200;
+function displayTextChars(str) { return Array.from(str).length; }
+
+// @internal
+// userNoticeTexts(qualifier) -- the DisplayText values of a decoded UserNotice qualifier, as
+// [{ field, tagNumber, text, chars }] in encounter order. `field` is "explicitText" or
+// "organization" (the NoticeReference member), so a caller that must treat the two alike (the
+// SIZE bound applies to both) and one that must not (only explicitText carries the encoding and
+// normalization rules) can each select correctly.
+//
+// UserNotice ::= SEQUENCE { noticeRef NoticeReference OPTIONAL, explicitText DisplayText OPTIONAL }
+// NoticeReference ::= SEQUENCE { organization DisplayText, noticeNumbers SEQUENCE OF INTEGER }
+// Both members are OPTIONAL and distinguished by tag, so a leading SEQUENCE is the noticeRef and any
+// DisplayText member is the explicitText. Returns [] for a qualifier that is not a UserNotice --
+// this reads an already-decoded node for display and reporting, and is never a validity verdict.
+var _DISPLAY_TEXT_TAGS = null;
+function _isDisplayTextNode(n) {
+  if (!_DISPLAY_TEXT_TAGS) {
+    _DISPLAY_TEXT_TAGS = {};
+    _DISPLAY_TEXT_TAGS[_T.IA5_STRING] = 1; _DISPLAY_TEXT_TAGS[_T.VISIBLE_STRING] = 1;
+    _DISPLAY_TEXT_TAGS[_T.BMP_STRING] = 1; _DISPLAY_TEXT_TAGS[_T.UTF8_STRING] = 1;
+  }
+  return !!n && n.tagClass === "universal" && _DISPLAY_TEXT_TAGS[n.tagNumber] === 1;
+}
+// Decoded through the STRICT reader, which validates each arm against its own declared string type
+// (invalid UTF-8, a high bit in an IA5String, an odd-length or lone-surrogate BMPString all throw).
+// Reading the content bytes directly would repair the value instead: `toString("utf8")` substitutes
+// U+FFFD for invalid sequences and a hand-rolled UCS-2 loop drops a trailing odd octet, so a caller
+// would render or measure text the certificate does not contain. Returns null when the value does
+// not decode, so the caller can take its own fallback rather than trust a repair.
+// An undecodable value yields an entry whose `text` and `chars` are null but whose `field` and
+// `tagNumber` are still present. The two are separable facts: which ASN.1 string type was used is
+// established by the tag alone, so a rule about the ENCODING stays answerable even when the contents
+// do not decode, while every rule that reads the TEXT must skip the entry rather than analyze a
+// repair. Collapsing both into "not analyzable" would let a prohibited encoding escape its finding
+// by also being malformed inside.
+function _dtEntry(field, node) {
+  var text;
+  // allow:swallow-unverified an undecodable DisplayText keeps its tag and drops its text; the callers branch on text === null
+  try { text = asn1.read.string(node); } catch (_e) { text = null; }
+  return { field: field, tagNumber: node.tagNumber, text: text, chars: text === null ? null : displayTextChars(text) };
+}
+// A NoticeReference names its notice by ORGANIZATION **and** NUMBER -- the organization alone does not
+// identify which notice is meant, so a consumer that surfaced only the text would lose the lookup key.
+// Returns null when the numbers are absent, wrongly shaped, or contain a member that is not a readable
+// INTEGER: an incompletely decoded reference must NOT be presentable, because dropping the members that
+// failed would render a partial reference indistinguishable from a whole one -- the same defect as
+// omitting the numbers entirely, in a form that is harder to notice. Numbers are decimal strings.
+function _noticeNumbers(node) {
+  if (!node || node.tagClass !== "universal" || node.tagNumber !== _T.SEQUENCE || !node.children) return null;
+  var nums = [], ok = true;
+  node.children.forEach(function (n) {
+    // allow:swallow-unverified a non-INTEGER member makes the whole reference undecodable; the caller falls back rather than rendering part of it
+    try { nums.push(String(asn1.read.integer(n))); } catch (_e) { ok = false; }
+  });
+  return ok ? nums : null;
+}
+// Every DisplayText member is returned, including one whose contents did not decode -- that entry
+// carries its tag with a null `text`. A caller that RENDERS the notice must check that every entry
+// decoded before showing any of it (a partial notice is indistinguishable from a complete one); a
+// caller that only classifies the encoding can read the tags regardless.
+// The LAYOUT is validated before any member is read: UserNotice fixes the order (noticeRef first) and
+// the cardinality (each member at most once, nothing else present). Collecting every recognized member
+// and ignoring the rest would accept a duplicated explicitText, a reversed order, or an extra member,
+// and the caller -- which can only see whether the entries it got look complete -- would then present
+// a structurally invalid notice as a whole one. A malformed layout yields NO entries, so a renderer
+// falls back to hex and a reporter measures nothing.
+function userNoticeTexts(qualifier) {
+  if (!qualifier || qualifier.tagClass !== "universal" || qualifier.tagNumber !== _T.SEQUENCE || !qualifier.children) return [];
+  var kids = qualifier.children;
+  if (kids.length > 2) return [];
+  var i = 0, out = [];
+  // noticeRef [absent | first]: a SEQUENCE of { organization DisplayText, noticeNumbers }.
+  if (i < kids.length && kids[i].tagClass === "universal" && kids[i].tagNumber === _T.SEQUENCE) {
+    var nr = kids[i];
+    if (!nr.children || nr.children.length !== 2 || !_isDisplayTextNode(nr.children[0])) return [];
+    var org = _dtEntry("organization", nr.children[0]);
+    org.noticeNumbers = _noticeNumbers(nr.children[1]);
+    out.push(org);
+    i++;
+  }
+  // explicitText [absent | last]: a DisplayText. Anything else remaining is not a UserNotice member.
+  if (i < kids.length) {
+    if (!_isDisplayTextNode(kids[i])) return [];
+    out.push(_dtEntry("explicitText", kids[i]));
+    i++;
+  }
+  return i === kids.length ? out : [];
+}
+
 // Shared imperative decode helpers for the certExtensionDecoders + attrValueDecoders factories. Both
 // take the caller's ns, so the helpers close over ns.E / ns.oid; extracted once so the two factories
 // share one copy (a per-OID value-decoder body is the identical idiom to a per-OID extension body).
@@ -1468,6 +1570,9 @@ module.exports = {
   signedEnvelopeTbs: signedEnvelopeTbs,
   rootSequenceChildren: rootSequenceChildren,
   assertPolicyQualifiers: assertPolicyQualifiers,
+  DISPLAY_TEXT_MAX: DISPLAY_TEXT_MAX,
+  displayTextChars: displayTextChars,
+  userNoticeTexts: userNoticeTexts,
   signedEnvelope: signedEnvelope,
   attrValueToString: attrValueToString,
   attributeTypeAndValue: attributeTypeAndValue,

package/lib/x509-sign.js

@@ -245,6 +245,9 @@ function _hasCriticalSan(extSpec) {
  * (positive, <= 20 octets), the validity UTCTime/GeneralizedTime cutover, the DER DEFAULT omissions
  * (v1 tag, `critical=FALSE`, `cA=FALSE`), and the CA cross-field rules (keyCertSign and
  * pathLenConstraint require cA=TRUE) are all enforced; a violation throws a typed `CertificateError`.
+ * Where the spec carries raw DER -- a `Name` Buffer, a pre-encoded `Extension`, an issuer `publicKey`
+ * SPKI -- a structural fault throws `CertificateError`, while a malformed leaf inside those bytes
+ * throws `Asn1Error`, the same two-error contract the parsers present.
  *
  * @opts
  *   - `pem` (boolean) -- return a PEM `CERTIFICATE` string instead of DER.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.4.11",
+  "version": "0.4.12",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:37941dc8-becd-4983-b264-d6897e595ed1",
+  "serialNumber": "urn:uuid:14a71e45-54e7-49bd-8fe1-ac576a769036",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-09T10:47:07.155Z",
+    "timestamp": "2026-08-10T02:28:13.520Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.4.11",
+      "bom-ref": "@blamejs/pki@0.4.12",
       "type": "application",
       "name": "pki",
-      "version": "0.4.11",
+      "version": "0.4.12",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.4.11",
+      "purl": "pkg:npm/%40blamejs/pki@0.4.12",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.4.11",
+      "ref": "@blamejs/pki@0.4.12",
       "dependsOn": []
     }
   ]