@blamejs/pki 0.4.2 → 0.4.4

package/lib/schema-c509.js

@@ -97,6 +97,12 @@ var EXT_BY_INT = {
   29: _name("freshestCRL"),
   30: _name("inhibitAnyPolicy"),
   31: _name("subjectInfoAccess"),
+  // RFC 3779 resource-delegation extensions, and their RFC 8360 "v2" twins, which the draft
+  // encodes "exactly like" the originals -- same two codecs, four registry rows (sec. 8.8).
+  32: _name("ipAddrBlocks"),
+  33: _name("autonomousSysIds"),
+  34: _name("ipAddrBlocksV2"),
+  35: _name("autonomousSysIdsV2"),
   36: _name("ocspNoCheck"),
   38: _name("tlsFeature"),
 };
@@ -108,6 +114,7 @@ var EXT_COMPACT = {
   subjectAltName: 1, issuerAltName: 1, nameConstraints: 1, cRLDistributionPoints: 1,
   freshestCRL: 1, authorityInfoAccess: 1, subjectInfoAccess: 1, certificatePolicies: 1,
   policyMappings: 1, policyConstraints: 1, subjectDirectoryAttributes: 1,
+  ipAddrBlocks: 1, autonomousSysIds: 1, ipAddrBlocksV2: 1, autonomousSysIdsV2: 1,
 };
 // sec. 8.12 Extended Key Usages registry (C509 int -> registered id-kp purpose name). A KeyPurposeId
 // outside this set encodes as an unwrapped ~oid; a C509 int outside it fails closed on decode.
@@ -555,6 +562,332 @@ function _ncIpFromDer(buf) {
   return Buffer.concat([buf.subarray(0, addrLen), Buffer.from([prefixLen])]);
 }
 
+// ---- RFC 3779 IPAddrBlocks / ASIdentifiers (draft sec. 3.3, ext ints 32-35) -----------------
+//
+// An RFC 3779 IPAddress is a BIT STRING whose unused-bit count carries the prefix length, so the
+// draft maps it to the byte sequence `unusedBits || value`, which "preserves the exact information
+// contained in the ASN.1 BIT STRING" -- lossless even for a prefix ending in zero bits. Per
+// IPAddressFamily the draft then picks ONE of two forms and makes the choice a SHALL: if any of the
+// family's byte sequences exceeds 8 octets the whole family uses the bytes form, otherwise the int
+// form. Accepting the wrong one would give one DER two CBOR encodings, so decode enforces it.
+//
+// The int form is the big-endian integer of `(unusedBits + 1) || value` -- the +1 guarantees a
+// non-zero leading octet, which is what makes the minimal big-endian representation unambiguous --
+// and every IPAddress after the first is stored as the DIFFERENCE from its predecessor. The chain
+// runs flat over each address in order (a range contributes min then max) and RESETS at each
+// family, so a family always opens with an absolute value.
+//
+// These integers reach 2^64-1: an IPv6 /48 already exceeds 2^53, and the draft's own A.5 vector
+// lands there. Everything below is BigInt end to end and bounds through guard.range.uint64 (the
+// BigInt-preserving guard) -- never the uint31 counter bound, which would reject a valid prefix.
+
+// An asn1 node exposes tagClass + tagNumber (never a combined `.tag`), so a universal-type test
+// has to check both -- a context-tagged [16] must not read as a SEQUENCE.
+function _isUniversal(n, tagNumber) { return !!n && n.tagClass === "universal" && n.tagNumber === tagNumber; }
+
+// `unusedBits || value` -> the (unusedBits+1)||value integer. Returns null if the sequence cannot
+// be one (empty, or an unused-bit count DER would not accept).
+function _ipSeqToInt(seq) {
+  if (!seq.length || seq[0] > 7) return null;
+  // One-shot base-256 parse of (unusedBits+1)||value. A per-byte shift-accumulate is quadratic in
+  // the operand width, so the toolkit builds a BigInt from its hex in a single call instead.
+  var head = Buffer.from([seq[0] + 1]);
+  return BigInt("0x" + Buffer.concat([head, seq.subarray(1)]).toString("hex"));
+}
+// The inverse: the minimal big-endian octets of `n`, with the leading octet decremented back to the
+// unused-bit count. Returns null when `n` cannot be an encoded IPAddress -- a leading octet outside
+// 1..8 is not a DER unused-bit count, and past 8 octets the family was required to use the bytes form.
+function _ipIntToSeq(n) {
+  if (n < 1n) return null;
+  var out = [];
+  for (var v = n; v > 0n; v >>= 8n) out.unshift(Number(v & 0xffn));
+  if (out.length > 9 || out[0] < 1 || out[0] > 8) return null;
+  out[0] -= 1;
+  return Buffer.from(out);
+}
+// The address width in octets of an address family, from its AFI (RFC 3779 sec. 2.2.3.3). Only a
+// family whose width is known can have its canonical form checked, so an unrecognized AFI yields
+// null and the caller declines to compact rather than compacting something it cannot verify.
+var _IP_WIDTH = { 1: 4, 2: 16 };
+
+// The lowest address an `unusedBits || value` sequence denotes, as `width` big-endian octets. DER
+// forces the unused bits to zero, so the value IS its own lowest address once zero-extended.
+function _ipLow(seq, width) {
+  var v = Buffer.alloc(width);
+  seq.subarray(1).copy(v);
+  return v;
+}
+// The highest address it denotes: the same prefix with every host bit set (RFC 3779 sec. 2.2.3.8 --
+// a range's max is likewise the prefix with its trailing bits taken as ones).
+function _ipHigh(seq, width) {
+  var v = _ipLow(seq, width);
+  var bits = (seq.length - 1) * 8 - seq[0];
+  for (var i = bits; i < width * 8; i++) v[i >> 3] |= 0x80 >> (i & 7);
+  return v;
+}
+// Big-endian octet-string compare, and "is `b` the immediate successor of `a`" -- the test that
+// distinguishes a legal gap from a contiguous pair the RFC requires be merged.
+function _ipOctCmp(a, b) {
+  for (var i = 0; i < a.length; i++) { if (a[i] !== b[i]) return a[i] - b[i]; }
+  return 0;
+}
+function _ipIsSuccessor(a, b) {
+  var carry = 1, inc = Buffer.from(a);
+  for (var i = inc.length - 1; i >= 0 && carry; i--) { var s = inc[i] + carry; inc[i] = s & 0xff; carry = s >> 8; }
+  if (carry) return false;                    // `a` was already the maximum address
+  return _ipOctCmp(inc, b) === 0;
+}
+
+// RFC 3779 sec. 2.2.3.7: "any range of addresses that can be encoded as a prefix MUST be encoded
+// using an IPAddress element", with the choice fixed by the spec's own pseudocode -- let N be the
+// count of matching leading bits of the low and high addresses; if every remaining bit of the low
+// is zero AND every remaining bit of the high is one, the span IS the N-bit prefix and the range
+// form is forbidden. Two encodings of one address span would otherwise both be legal.
+function _ipRangeIsPrefix(lo, hi) {
+  var bits = lo.length * 8, n = 0;
+  while (n < bits) {
+    var byteAt = n >> 3, mask = 0x80 >> (n & 7);
+    if ((lo[byteAt] & mask) !== (hi[byteAt] & mask)) break;
+    n++;
+  }
+  for (var i = n; i < bits; i++) {
+    var bt = i >> 3, mk = 0x80 >> (i & 7);
+    if ((lo[bt] & mk) !== 0) return false;        // a low-address host bit is set
+    if ((hi[bt] & mk) === 0) return false;        // a high-address host bit is clear
+  }
+  return true;
+}
+
+// RFC 3779 sec. 2.2.3.3 orders the families themselves: "There MUST be only one IPAddressFamily
+// SEQUENCE per unique combination of AFI and SAFI. Each SEQUENCE MUST be ordered by ascending
+// addressFamily values (treating the octets as unsigned quantities). An addressFamily without a
+// SAFI MUST precede one that contains an SAFI." A plain unsigned octet-string compare gives all
+// three at once, because a two-octet family is a PREFIX of the three-octet one sharing its AFI and
+// a prefix sorts first. Returns < 0, 0 or > 0; 0 means the same AFI/SAFI appeared twice.
+function _famOctCmp(a, b) {
+  var n = Math.min(a.length, b.length);
+  for (var i = 0; i < n; i++) { if (a[i] !== b[i]) return a[i] - b[i]; }
+  return a.length - b.length;
+}
+
+// Is `unusedBits || value` a sequence DER would accept as a BIT STRING? The declared unused low
+// bits MUST be zero (RFC 3779 sec. 2.2.3.8 restates the DER rule), and a value with no octets can
+// only declare zero unused bits. Checked HERE rather than left to the BIT STRING builder, because
+// the builder's fault is an asn1/* error surfacing out of a CBOR-layer decode -- a caller handed a
+// malformed compact value should see this module's own verdict, not the ASN.1 layer's.
+function _ipSeqBitsClear(seq) {
+  var unused = seq[0], value = seq.subarray(1);
+  if (!value.length) return unused === 0;
+  if (unused === 0) return true;
+  return (value[value.length - 1] & ((1 << unused) - 1)) === 0;
+}
+
+// RFC 3779 sec. 2.2.3.6 fixes the canonical form of an address list: entries sorted on
+// `<lowest address> | <prefix length>` (which is neither the DER byte order nor the compact integer
+// order -- the RFC warns about the first and the second sorts the same wrong way), no pair
+// overlapping, and any contiguous pair combined into one entry. All three bind together: a list
+// violating any of them is not the one canonical encoding of its address set, so this codec
+// declines to compact it and the extension keeps its original bytes.
+// Two comparisons carry all three rules. `cur.lo > prev.hi` is the no-overlap rule AND the sort
+// rule at once: entries are already known to have lo <= hi, so an entry that started at or before
+// its predecessor's low address would also start at or before its high one. A separate ascending
+// test would therefore be a branch nothing can reach.
+function _ipRangesCanonical(bounds) {
+  for (var i = 1; i < bounds.length; i++) {
+    var prev = bounds[i - 1], cur = bounds[i];
+    if (_ipOctCmp(cur.lo, prev.hi) <= 0) return false;        // out of order, or overlapping
+    if (_ipIsSuccessor(prev.hi, cur.lo)) return false;        // contiguous: MUST have been merged
+  }
+  return true;
+}
+
+// One family's IntIPAddressChoice / IPAddressChoice -> the DER IPAddressOrRange SEQUENCE list.
+// The int form stores each address after the first as a DIFFERENCE from its predecessor, flat over
+// every address in order (a range contributes min then max); the chain resets at each family, which
+// is why `prev` starts null here rather than being threaded across families. The reconstructed
+// ABSOLUTE is what gets bounded -- the delta itself is an arbitrary CBOR int and bounding it would
+// miss a chain that walks out of range in steps.
+function _ipChoiceToDer(items, afi) {
+  var out = [], prev = null, sawBytes = false, sawInt = false, seqs = [];
+  // An address may not be wider than its family: RFC 3779 sec. 2.2.3.8 sizes an IPAddress by the
+  // family, so a 5-octet address under AFI 1 is not an IPv4 address at all. Without this, a native
+  // C509 would reconstruct into a DER carrying an over-wide address -- one the RFC forbids and an
+  // independent validator refuses -- from CBOR this codec had accepted. The mirror check lives on
+  // the encode side; both directions have to hold or the pair is not a bijection.
+  // Without the family's address width none of the RFC 3779 rules below can be evaluated: the
+  // width bound has nothing to compare against, and the low/high bounds that drive the order,
+  // overlap, adjacency and endpoint checks cannot be computed at all. Accepting such a family
+  // would therefore wave every one of those checks through -- so a family this codec cannot
+  // measure is refused outright, matching the encode side, which declines to compact it. An
+  // `inherit` family is unaffected: it carries no addresses and never reaches here.
+  var width = _IP_WIDTH[afi];
+  if (!width) throw _err("c509/bad-extensions", "address family " + afi + " has no known address width, so its addresses cannot be checked (RFC 3779 sec. 2.2.3.3)");
+  function widthOk(seq) { return seq.length - 1 <= width; }
+  function absolute(node) {
+    var seq;
+    if (node.majorType === 2) {                              // bytes form: the sequence verbatim
+      sawBytes = true;
+      if (node.content.length === 0) throw _err("c509/bad-extensions", "an IPAddress byte sequence must be non-empty");
+      if (node.content[0] > 7) throw _err("c509/bad-extensions", "an IPAddress unused-bit count must be 0..7 (DER)");
+      seq = node.content;
+    } else {
+      sawInt = true;
+      var d = _cborIntVal(node, "an IPAddress");
+      var abs = prev === null ? d : prev + d;
+      prev = abs;
+      // Bound the reconstructed absolute through the BigInt-preserving guard: this domain reaches
+      // 2^64-1, so narrowing to Number would corrupt the value being guarded.
+      guard.range.uint64(abs, _err, "c509/bad-extensions", "an IPAddress");
+      seq = _ipIntToSeq(abs);
+      if (!seq) throw _err("c509/bad-extensions", "an IPAddress integer does not encode a DER BIT STRING (sec. 3.3)");
+    }
+    if (!widthOk(seq)) {
+      throw _err("c509/bad-extensions", "an IPAddress is wider than address family " + afi + " permits (RFC 3779 sec. 2.2.3.8)");
+    }
+    if (!_ipSeqBitsClear(seq)) {
+      throw _err("c509/bad-extensions", "an IPAddress must leave its declared unused bits zero (RFC 3779 sec. 2.2.3.8)");
+    }
+    return seq;
+  }
+  var bounds = [];
+  for (var i = 0; i < items.length; i++) {
+    var it = items[i];
+    if (it.majorType === 4) {                                 // [min, max] -> an addressRange
+      if (!it.children || it.children.length !== 2) throw _err("c509/bad-extensions", "an IPAddress range must be exactly [min, max]");
+      var lo = absolute(it.children[0]), hi = absolute(it.children[1]);
+      seqs.push(lo); seqs.push(hi);
+      var rlo = _ipLow(lo, width), rhi = _ipHigh(hi, width);
+      {
+        // A span expressible as a prefix MUST use the prefix form (RFC 3779 sec. 2.2.3.7), or one
+        // address span would have two legal encodings.
+        if (_ipRangeIsPrefix(rlo, rhi)) throw _err("c509/bad-extensions", "an address range that is exactly a prefix must use the prefix form (RFC 3779 sec. 2.2.3.7)");
+        bounds.push({ lo: rlo, hi: rhi });
+      }
+      out.push(b.sequence([b.bitString(lo.subarray(1), lo[0]), b.bitString(hi.subarray(1), hi[0])]));
+    } else {                                                  // a single addressPrefix
+      var pfx = absolute(it);
+      seqs.push(pfx);
+      bounds.push({ lo: _ipLow(pfx, width), hi: _ipHigh(pfx, width) });
+      out.push(b.bitString(pfx.subarray(1), pfx[0]));
+    }
+  }
+  // The form choice is a SHALL, so the wrong one would give one DER two CBOR encodings. A family
+  // mixing the two arms is not a choice either admits; a bytes-form family whose every sequence
+  // fits 8 octets was required to use the int form.
+  if (sawBytes && sawInt) throw _err("c509/bad-extensions", "an IPAddressFamily must use one address form throughout (sec. 3.3)");
+  if (sawBytes && !seqs.some(function (s) { return s.length > 8; })) {
+    throw _err("c509/bad-extensions", "an IPAddressFamily whose addresses all fit 8 octets must use the integer form (sec. 3.3)");
+  }
+  // The SAME RFC 3779 sec. 2.2.3.6 canonical form the encode side requires, enforced here too.
+  // draft sec. 3.3 says "The limitations specified in [RFC3779] apply here as well", so a compact
+  // list that is unsorted, overlapping, or unmerged is malformed C509 -- and reconstructing it
+  // would emit a certificate an independent validator refuses, from CBOR this codec had accepted.
+  // Both directions must hold or the pair is not a bijection.
+  for (var r = 0; r < bounds.length; r++) {
+    if (_ipOctCmp(bounds[r].lo, bounds[r].hi) > 0) throw _err("c509/bad-extensions", "an IPAddress range must not end below its start (RFC 3779 sec. 2.2.3.9)");
+  }
+  if (!_ipRangesCanonical(bounds)) {
+    throw _err("c509/bad-extensions", "an IPAddressFamily must be sorted, non-overlapping and maximally merged (RFC 3779 sec. 2.2.3.6)");
+  }
+  return out;
+}
+
+// DER IPAddressChoice (a SEQUENCE of BIT STRING / SEQUENCE-of-two-BIT-STRING) -> the compact CBOR
+// array. The form is chosen per family and is a SHALL: the bytes form applies to the WHOLE family
+// as soon as any one sequence exceeds 8 octets, otherwise every member takes the delta-coded int
+// form. Returns null on any shape the compact form cannot carry exactly.
+function _ipChoiceFromDer(ch, afi) {
+  if (!_isUniversal(ch, asn1.TAGS.SEQUENCE) || !ch.children || ch.children.length === 0) return null;
+  // Collect each address as its `unusedBits || value` sequence, keeping the range grouping.
+  var groups = [], flat = [];
+  for (var i = 0; i < ch.children.length; i++) {
+    var el = ch.children[i], pair;
+    if (_isUniversal(el, asn1.TAGS.BIT_STRING)) {
+      var bs = asn1.read.bitString(el);
+      pair = [Buffer.concat([Buffer.from([bs.unusedBits]), bs.bytes])];
+    } else if (_isUniversal(el, asn1.TAGS.SEQUENCE) && el.children && el.children.length === 2 &&
+               _isUniversal(el.children[0], asn1.TAGS.BIT_STRING) && _isUniversal(el.children[1], asn1.TAGS.BIT_STRING)) {
+      var lo = asn1.read.bitString(el.children[0]), hi = asn1.read.bitString(el.children[1]);
+      pair = [Buffer.concat([Buffer.from([lo.unusedBits]), lo.bytes]),
+              Buffer.concat([Buffer.from([hi.unusedBits]), hi.bytes])];
+    } else return null;
+    groups.push(pair);
+    for (var k = 0; k < pair.length; k++) flat.push(pair[k]);
+  }
+  // The list must be in RFC 3779 sec. 2.2.3.6 canonical form -- sorted, non-overlapping, and with
+  // every contiguous pair already merged. A list that is not is not the one canonical encoding of
+  // its address set, so it is NOT re-encoded into a conforming one: this returns null and the
+  // extension rides the byte-string form, keeping its exact bytes and leaving the defect visible to
+  // a validator. Checking overlap and adjacency needs the family's address width, so a family whose
+  // AFI this codec does not know declines too, rather than compacting what it cannot verify.
+  // Defense-in-depth, and deliberately explicit: without the width the bound arithmetic below would
+  // fault and the caller's catch would produce the same fallback, so this line changes no observable
+  // verdict and no vector can isolate it. It stays because a fallback that depends on an exception
+  // being raised somewhere downstream is one refactor away from becoming an accepted value.
+  var width = _IP_WIDTH[afi];
+  if (!width) return null;
+  var bounds = [];
+  for (var g = 0; g < groups.length; g++) {
+    var bg = groups[g];
+    if (bg[0].length - 1 > width || bg[bg.length - 1].length - 1 > width) return null;   // longer than the family's addresses
+    var blo = _ipLow(bg[0], width), bhi = _ipHigh(bg[bg.length - 1], width);
+    // The mirror of the decode-side rule: a range that is exactly a prefix had to be written as one.
+    // No vector can isolate this line today, because the encode path's round-trip self-verify
+    // re-parses what it produced and the decode rule rejects it there, yielding the same fallback.
+    // It stays explicit because that makes encode's correctness depend on decode continuing to
+    // throw -- soften the decode rule and this path would silently start compacting again.
+    if (bg.length === 2 && _ipRangeIsPrefix(blo, bhi)) return null;
+    bounds.push({ lo: blo, hi: bhi });
+  }
+  // A range's own endpoints must ascend too, which a single-entry list has no chance to violate.
+  for (var r = 0; r < bounds.length; r++) {
+    if (_ipOctCmp(bounds[r].lo, bounds[r].hi) > 0) return null;
+  }
+  if (!_ipRangesCanonical(bounds)) return null;
+  var useBytes = flat.some(function (s) { return s.length > 8; });
+  var out = [];
+  if (useBytes) {
+    groups.forEach(function (p) {
+      out.push(p.length === 1 ? cbor.build.byteString(p[0])
+        : cbor.build.array([cbor.build.byteString(p[0]), cbor.build.byteString(p[1])]));
+    });
+    return cbor.build.array(out);
+  }
+  var prev = null;
+  function delta(seq) {
+    var n = _ipSeqToInt(seq);
+    if (n === null) return null;
+    var d = prev === null ? n : n - prev;
+    prev = n;
+    return cbor.build.int(d);
+  }
+  for (var gi = 0; gi < groups.length; gi++) {
+    var grp = groups[gi];
+    if (grp.length === 1) {
+      var one = delta(grp[0]);
+      if (!one) return null;
+      out.push(one);
+    } else {
+      var dlo = delta(grp[0]);
+      var dhi = dlo ? delta(grp[1]) : null;
+      if (!dlo || !dhi) return null;
+      out.push(cbor.build.array([dlo, dhi]));
+    }
+  }
+  return cbor.build.array(out);
+}
+
+// One ASId in the delta chain -> its absolute value, bounded to the RFC 3779 32-bit ASId domain.
+// Safe to narrow here (2^32-1 < 2^53), unlike the IP domain.
+function _asDelta(node, prev) {
+  var d = _cborIntVal(node, "an ASIdentifier");
+  var abs = prev === null ? d : prev + d;
+  // Bound only -- the narrowed Number the guard returns is deliberately discarded, because the
+  // chain's next step adds a BigInt delta to this value and mixing the two throws.
+  guard.range.int(abs, 0n, 4294967295n, _err, "c509/bad-extensions", "an ASIdentifier");
+  return abs;
+}
+
 // GeneralSubtrees = [ + GeneralName ] (the flat int/value array) <-> the concatenated GeneralSubtree
 // SEQUENCEs (RFC 5280 sec. 4.2.1.10: SEQUENCE { base, minimum [0] DEFAULT 0, maximum [1] OPTIONAL }); the
 // C509 profile omits minimum/maximum, so each GeneralSubtree is base-only.
@@ -799,6 +1132,82 @@ function _extValueToDer(name, node, isNative) {
       if (node.majorType === 3) return b.sequence([b.sequence([b.explicit(0, b.contextConstructed(0, b.contextPrimitive(6, _ia5Bytes(node, 6))))])]);
       if (node.majorType !== 4 || !node.children || node.children.length < 1) throw _err("c509/bad-extensions", "a " + name + " value must be a CBOR array of DistributionPoints or a bare URI text (sec. 3.3)");
       return b.sequence(node.children.map(function (dp) { return _dpToDer(dp, isNative); }));
+    // IPAddrBlocks (and its RFC 8360 v2 twin): a FLAT array of (AFI, SAFI, choice) triples --
+    // IPAddressFamily is a parenthesized CDDL group, so it splices rather than nesting.
+    case "ipAddrBlocks":
+    case "ipAddrBlocksV2": {
+      if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "an IPAddrBlocks value must be a CBOR array");
+      var ipKids = node.children;
+      if (ipKids.length === 0 || ipKids.length % 3 !== 0) throw _err("c509/bad-extensions", "an IPAddrBlocks array must be non-empty (AFI, SAFI, addresses) triples (sec. 3.3)");
+      var families = [], prevFam = null;
+      for (var fi = 0; fi + 2 < ipKids.length; fi += 3) {
+        var afi = _cborUint(ipKids[fi], "an IPAddrBlocks AFI");
+        if (afi > 0xffffn) throw _err("c509/bad-extensions", "an IPAddrBlocks AFI must fit two octets (RFC 3779 sec. 2.2.3.3)");
+        var safiNode = ipKids[fi + 1], famBytes = [Number(afi >> 8n) & 0xff, Number(afi & 0xffn)];
+        if (!_isCborNull(safiNode)) {
+          var safi = _cborUint(safiNode, "an IPAddrBlocks SAFI");
+          if (safi > 0xffn) throw _err("c509/bad-extensions", "an IPAddrBlocks SAFI must fit one octet (RFC 3779 sec. 2.2.3.3)");
+          famBytes.push(Number(safi));
+        }
+        // The families themselves are ordered and unique (RFC 3779 sec. 2.2.3.3), the same way the
+        // addresses inside one are. Without this a value could name AFI 2 before AFI 1, or repeat a
+        // family, and reconstruct a certificate an independent validator refuses.
+        var famOct = Buffer.from(famBytes);
+        if (prevFam !== null && _famOctCmp(prevFam, famOct) >= 0) {
+          throw _err("c509/bad-extensions", "IPAddrBlocks address families must be unique and in ascending addressFamily order (RFC 3779 sec. 2.2.3.3)");
+        }
+        prevFam = famOct;
+        var choice = ipKids[fi + 2], famFields = [b.octetString(famOct)];
+        if (_isCborNull(choice)) {                          // null -> inherit
+          famFields.push(b.nullValue());
+        } else {
+          if (choice.majorType !== 4 || !choice.children || choice.children.length === 0) {
+            throw _err("c509/bad-extensions", "an IPAddrBlocks address choice must be null (inherit) or a non-empty CBOR array");
+          }
+          famFields.push(b.sequence(_ipChoiceToDer(choice.children, Number(afi))));
+        }
+        families.push(b.sequence(famFields));
+      }
+      return b.sequence(families);
+    }
+    // ASIdentifiers (and its v2 twin): null = inherit, else a flat array of uint / [min,max].
+    // Only the asnum field is representable -- a present rdi has no compact form (sec. 3.3), so a
+    // certificate carrying one rides the ~oid byte-string form and never reaches this arm.
+    case "autonomousSysIds":
+    case "autonomousSysIdsV2": {
+      if (_isCborNull(node)) return b.sequence([b.explicit(0, b.nullValue())]);   // asnum inherit
+      if (node.majorType !== 4 || !node.children || node.children.length === 0) {
+        throw _err("c509/bad-extensions", "an ASIdentifiers value must be null (inherit) or a non-empty CBOR array");
+      }
+      // The deltas are `uint` in the draft's CDDL precisely because RFC 3779 sec. 3.2.3.4 sorts AS
+      // ids by increasing value: a negative delta would walk the chain backwards. That section also
+      // forbids a pair overlapping and requires a contiguous series to be one range -- the same
+      // three rules the encode side applies, tracked here across members through `asPrevHigh`.
+      // A negative delta needs no separate test: on the first entry it drives the absolute below
+      // zero and the range guard refuses it, and on any later entry it lands at or below the
+      // previous high, which the canonical test already refuses. A separate uint check would be a
+      // branch nothing can reach.
+      var asKids = node.children, asDers = [], asPrev = null, asPrevHigh = null;
+      for (var asi2 = 0; asi2 < asKids.length; asi2++) {
+        var it = asKids[asi2];
+        if (it.majorType === 4) {                            // [min, max] -> ASRange
+          if (!it.children || it.children.length !== 2) throw _err("c509/bad-extensions", "an ASIdentifiers range must be exactly [min, max]");
+          var amin = _asDelta(it.children[0], asPrev), amax = _asDelta(it.children[1], amin);
+          if (amax <= amin) throw _err("c509/bad-extensions", "an ASIdentifiers range must be ascending (RFC 3779 sec. 3.2.3.6)");
+          if (asPrevHigh !== null && amin <= asPrevHigh + 1n) throw _err("c509/bad-extensions", "ASIdentifiers must be sorted, non-overlapping and maximally merged (RFC 3779 sec. 3.2.3.4)");
+          asDers.push(b.sequence([b.integer(amin), b.integer(amax)]));
+          asPrev = amax;
+          asPrevHigh = amax;
+        } else {                                             // uint -> ASId
+          var aid = _asDelta(it, asPrev);
+          if (asPrevHigh !== null && aid <= asPrevHigh + 1n) throw _err("c509/bad-extensions", "ASIdentifiers must be sorted, non-overlapping and maximally merged (RFC 3779 sec. 3.2.3.4)");
+          asDers.push(b.integer(aid));
+          asPrev = aid;
+          asPrevHigh = aid;
+        }
+      }
+      return b.sequence([b.explicit(0, b.sequence(asDers))]);
+    }
     case "certificatePolicies": {   // [ pid, [ *(qid, qtext) ], ... ] -> SEQUENCE OF PolicyInformation
       if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a certificatePolicies value must be a CBOR array");
       var cpKids = node.children;
@@ -960,6 +1369,73 @@ function _extValueFromDer(name, der) {
       if (dpResults.length === 1 && dpResults[0].oneUri != null && dpResults[0].noReasons && dpResults[0].noIssuer) return cbor.build.textString(dpResults[0].oneUri);
       return cbor.build.array(dpResults.map(function (r) { return r.triple; }));
     }
+    // IPAddrBlocks -> the flat (AFI, SAFI, choice) array. Any shape the compact form cannot
+    // represent exactly returns null, so the extension rides the ~oid byte-string form intact.
+    case "ipAddrBlocks":
+    case "ipAddrBlocksV2": {
+      if (!_isUniversal(node, asn1.TAGS.SEQUENCE) || !node.children || node.children.length === 0) return null;
+      var ipOut = [], prevFamOct = null;
+      for (var ifi = 0; ifi < node.children.length; ifi++) {
+        var fam = node.children[ifi];
+        if (!_isUniversal(fam, asn1.TAGS.SEQUENCE) || !fam.children || fam.children.length !== 2) return null;
+        var famOct = asn1.read.octetString(fam.children[0]);
+        if (famOct.length !== 2 && famOct.length !== 3) return null;   // OCTET STRING (SIZE (2..3))
+        // Families ordered and unique (RFC 3779 sec. 2.2.3.3) -- the mirror of the decode side.
+        if (prevFamOct !== null && _famOctCmp(prevFamOct, famOct) >= 0) return null;
+        prevFamOct = famOct;
+        var afiVal = (famOct[0] << 8) | famOct[1];
+        ipOut.push(cbor.build.uint(BigInt(afiVal)));
+        ipOut.push(famOct.length === 3 ? cbor.build.uint(BigInt(famOct[2])) : cbor.build.nullValue());
+        var ch = fam.children[1];
+        if (_isUniversal(ch, asn1.TAGS.NULL)) { ipOut.push(cbor.build.nullValue()); continue; }   // inherit
+        var chOut = _ipChoiceFromDer(ch, afiVal);
+        if (!chOut) return null;
+        ipOut.push(chOut);
+      }
+      return cbor.build.array(ipOut);
+    }
+    // ASIdentifiers -> null (inherit) or the flat delta array. Only asnum is representable: a
+    // present rdi has no compact form (sec. 3.3), so such a certificate returns null here.
+    case "autonomousSysIds":
+    case "autonomousSysIdsV2": {
+      if (!_isUniversal(node, asn1.TAGS.SEQUENCE) || !node.children || node.children.length !== 1) return null;
+      var asnum = node.children[0];
+      if (asnum.tagClass !== "context" || asnum.tagNumber !== 0 || !asnum.children || asnum.children.length !== 1) return null;
+      var inner = asnum.children[0];
+      if (_isUniversal(inner, asn1.TAGS.NULL)) return cbor.build.nullValue();          // asnum inherit
+      if (!_isUniversal(inner, asn1.TAGS.SEQUENCE) || !inner.children || inner.children.length === 0) return null;
+      // RFC 3779 sec. 3.2.3.4 fixes the canonical form the same way sec. 2.2.3.6 does for addresses:
+      // sorted by increasing value, no pair overlapping, and any contiguous series already merged
+      // into one range. `asPrevHigh` carries the previous entry's upper bound so all three hold
+      // ACROSS members -- checking only within a range would let a descending or adjacent pair
+      // through. A list that is not canonical is left uncompacted with its bytes intact.
+      var asOut = [], asPrevOut = null, asPrevHigh = null;
+      for (var aoi = 0; aoi < inner.children.length; aoi++) {
+        var el = inner.children[aoi], elLo, elHi;
+        if (_isUniversal(el, asn1.TAGS.INTEGER)) {
+          elLo = asn1.read.integer(el);
+          elHi = elLo;
+          if (elLo < 0n || elLo > 4294967295n) return null;
+        } else if (_isUniversal(el, asn1.TAGS.SEQUENCE) && el.children && el.children.length === 2) {
+          elLo = asn1.read.integer(el.children[0]);
+          elHi = asn1.read.integer(el.children[1]);
+          if (elLo < 0n || elHi > 4294967295n || elHi <= elLo) return null;
+        } else return null;
+        if (asPrevHigh !== null && elLo <= asPrevHigh + 1n) return null;   // descending, overlapping, or contiguous
+        if (el.tagNumber === asn1.TAGS.INTEGER) {
+          asOut.push(cbor.build.int(asPrevOut === null ? elLo : elLo - asPrevOut));
+          asPrevOut = elLo;
+        } else {
+          asOut.push(cbor.build.array([
+            cbor.build.int(asPrevOut === null ? elLo : elLo - asPrevOut),
+            cbor.build.int(elHi - elLo),
+          ]));
+          asPrevOut = elHi;
+        }
+        asPrevHigh = elHi;
+      }
+      return cbor.build.array(asOut);
+    }
     case "certificatePolicies": {                                  // SEQUENCE OF PolicyInformation -> [ pid, [ *(qid, qtext) ], ... ]
       if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length < 1) return null;
       var cpOut = [];
@@ -1879,6 +2355,14 @@ function _compressEcPoint(point, coordLen) {
 _derToType3 = function (input, opts) {
   var c;
   try { c = x509.parse(input); } catch (e) { throw _err("c509/bad-input", "the input is not a valid X.509 certificate", e); }
+  // Both C509 certificate types are defined over X.509 v3 (draft-ietf-cose-cbor-encoded-cert
+  // sec. 1), and the encoding carries no version field -- reconstruction always emits v3. So a v1
+  // or v2 certificate is outside the format, not a codec limitation, and saying so here keeps it
+  // from falling through to the byte-compare below, whose "does not reconstruct byte-for-byte"
+  // reads as a defect in this encoder rather than a certificate the format does not cover.
+  // (A v3 certificate with the extensions field OMITTED is fully supported: sec. 3.1.10 encodes
+  // an omitted 'extensions' field as an empty CBOR array.)
+  if (c.version !== 3) throw _err("c509/non-invertible", "C509 covers X.509 v3 certificates; got v" + c.version);
   if (!/^ecdsa/i.test(c.signatureAlgorithm.name || "")) throw _err("c509/non-invertible", "type-3 C509 encoding covers only ECDSA-signed certificates; got " + (c.signatureAlgorithm.name || "an unregistered algorithm"));
   if (c.subjectPublicKeyInfo.algorithm.name !== "ecPublicKey") throw _err("c509/non-invertible", "type-3 C509 encoding covers only EC (ecPublicKey) certificates in v1; got " + (c.subjectPublicKeyInfo.algorithm.name || "an unregistered algorithm"));
   var curveOid = asn1.read.oid(asn1.decode(c.subjectPublicKeyInfo.algorithm.parameters));