@blamejs/pki 0.5.14 → 0.5.16

package/lib/attrcert-sign.js

@@ -33,6 +33,9 @@ var x509 = require("./schema-x509");
 var signScheme = require("./sign-scheme");
 var guard = require("./guard-all");
 var pkix = require("./schema-pkix");
+var schema = require("./schema-engine");
+require("./path-validate");   // side-effect: path-validate injects its signature engine into attrcert-verify at load
+var attrcertVerify = require("./attrcert-verify");
 var pkiBuild = require("./pki-build");
 var frameworkError = require("./framework-error");
 
@@ -364,6 +367,21 @@ function _buildAttributes(attrSpec) {
 
 // extensions ::= SEQUENCE OF Extension (RFC 5755 sec. 4.2.9): the recognized object form, or an array
 // of pre-encoded Extension DER. At most one instance of a particular extension OID. Returns a universal
+// RFC 5755 sec. 6 defines two revocation schemes and closes by making them exclusive: "An AC MUST
+// NOT contain both a noRevAvail extension and a 'pointer in AC'." Held over the OIDs an AC ends up
+// carrying, so BOTH extension forms meet it -- the object form and the pre-encoded array form, which
+// is the one that can name a pointer at all. `seen` is the OID-keyed set each branch already builds.
+function _assertRevocationSchemesExclusive(seen) {
+  if (!Object.prototype.hasOwnProperty.call(seen, O("noRevAvail"))) return;
+  var names = Object.keys(REVOCATION_POINTERS);
+  for (var i = 0; i < names.length; i++) {
+    if (Object.prototype.hasOwnProperty.call(seen, names[i])) {
+      throw _err("attrcert/bad-input", "an attribute certificate must not carry both noRevAvail and a " +
+        REVOCATION_POINTERS[names[i]] + " revocation pointer (RFC 5755 sec. 6)");
+    }
+  }
+}
+
 // SEQUENCE OF Extension, or null when none are requested.
 function _buildExtensions(extSpec, aaSpki) {
   if (extSpec == null) return null;
@@ -392,6 +410,7 @@ function _buildExtensions(extSpec, aaSpki) {
       } catch (err) { if (err instanceof AttrCertError) throw err; throw _err("attrcert/bad-input", "pre-encoded " + (oid.name(extnId) || extnId) + " extension value is malformed", err); }
       return b.raw(der);
     });
+    _assertRevocationSchemesExclusive(seenA);
     return b.sequence(exts);
   }
   if (typeof extSpec !== "object") throw _err("attrcert/bad-input", "extensions must be an object or an array of pre-encoded Extension DER");
@@ -406,6 +425,7 @@ function _buildExtensions(extSpec, aaSpki) {
     seen[eOid] = true;
     out.push(_b.ext(eOid, meta.critical, _extensionValue(k, extSpec[k], aaSpki)));
   });
+  _assertRevocationSchemesExclusive(seen);
   if (!out.length) return null;
   return b.sequence(out);
 }
@@ -429,7 +449,10 @@ function _buildExtensions(extSpec, aaSpki) {
  * targetInformation / noRevAvail / aaControls / acProxying / authorityKeyIdentifier, or an array of
  * pre-encoded Extension DER). `issuer` is the signing AA: `{ cert, key }` (the AA certificate DER/PEM
  * and its private key) or `{ name, publicKey, key }` (an explicit issuer DN, AA SPKI DER, and key); an
- * attribute certificate is never self-signed. The signature algorithm is resolved from the AA key (RSA
+ * attribute certificate is never self-signed. RFC 5755 section 6 defines two revocation schemes and
+ * makes them exclusive -- "An AC MUST NOT contain both a noRevAvail extension and a 'pointer in AC'"
+ * -- so `noRevAvail` beside a `crlDistributionPoints` or `authorityInfoAccess` extension is refused,
+ * in the named form and the pre-encoded form alike. The signature algorithm is resolved from the AA key (RSA
  * PKCS#1 v1.5 or PSS, ECDSA, EdDSA, ML-DSA, SLH-DSA, or a composite arm), and the signature is verified
  * under the AA public key before the certificate is returned. Returns DER, or a PEM `ATTRIBUTE
  * CERTIFICATE` with `opts.pem`. Malformed input throws a typed `AttrCertError`; where the spec carries
@@ -517,4 +540,490 @@ function _sign(spec, issuer, opts) {
   });
 }
 
-module.exports = { sign: sign };
+var KNOWN_VERIFY_OPTS = { time: 1, target: 1, revocationStatus: 1 };
+// The two answers a caller can give for RFC 5755 sec. 6, spelled out so a typo is refused instead of
+// read as the safe one. Built without a prototype, so an inherited name cannot answer the lookup.
+var REVOCATION_STATUS = Object.create(null);
+REVOCATION_STATUS.notRevoked = 1;
+REVOCATION_STATUS.revoked = 1;
+var _NAME_SCHEMA = pkix.name(NS);
+
+// A Name DER, read through the one Name reader, so every distinguished name this verb compares is
+// in the shape guard.name.dnEqual takes.
+function _readName(der, what) {
+  try { return schema.walk(_NAME_SCHEMA, asn1.decode(der), NS).result; }
+  catch (e) {
+    if (e instanceof AttrCertError) throw e;
+    throw _err("attrcert/bad-input", what + " is not a readable distinguished name", e);
+  }
+}
+
+// The AC issuer's distinguished name. The parser has already established that issuerName holds
+// exactly one non-empty directoryName [4] (RFC 5755 sec. 4.2.3) and surfaces it as a raw node, so
+// the DN itself is one EXPLICIT unwrap away.
+function _acIssuerName(parsed) {
+  var node = asn1.decode(parsed.issuer.v2Form.issuerName.names[0].bytes);
+  if (!node.children || node.children.length !== 1) {
+    throw _err("attrcert/bad-issuer-name", "the AC issuerName directoryName does not wrap exactly one Name");
+  }
+  return _readName(node.children[0].bytes, "the AC issuer name");
+}
+
+function _coerceAc(input) {
+  return guard.parsed.acceptDerived(input, "attributeCertificate", attrcert.parse, _err,
+    "attrcert/bad-input", "the attribute certificate");
+}
+
+// The AC issuer this caller directly trusts as an AC issuer (RFC 5755 sec. 5, item 4). That is a
+// configuration decision the certificate cannot make for itself, so it is an argument, and an
+// argument this verb refuses to infer.
+function _resolveIssuer(issuer) {
+  if (issuer == null || typeof issuer !== "object" || Buffer.isBuffer(issuer)) {
+    throw _err("attrcert/bad-input", "an issuer { name, publicKey } is required -- RFC 5755 sec. 5 item 4 makes trusting an AC issuer the verifier's own configuration");
+  }
+  guard.identifier.assertKnownKeys(issuer, { name: 1, publicKey: 1 }, _err, "attrcert/bad-input",
+    "the issuer has an unknown key ");
+  if (issuer.publicKey == null) throw _err("attrcert/bad-input", "issuer.publicKey (the AC issuer's SubjectPublicKeyInfo DER) is required");
+  if (issuer.name == null) {
+    throw _err("attrcert/bad-input", "issuer.name (the distinguished name this verifier trusts as an AC issuer) is required");
+  }
+  // Every name form pki.attrcert.sign accepts for the issuing AA is a name this verb has to be able
+  // to trust: a string, an array of RDNs, or raw Name DER. The forms come from the one Name encoder
+  // both sides use, so an AC issued under a multi-RDN AA name is verifiable under that same name.
+  //
+  // The trusted name is compared as a distinguished name, never as a string: RFC 5280 sec. 7.1
+  // identity is not string equality, and guard.name owns that comparison. Encoding the caller's
+  // name and reading it back through the SAME Name reader the parser used puts both sides in the
+  // one shape dnEqual takes.
+  var trustedDer;
+  try { trustedDer = _b.encodeName(issuer.name); }
+  catch (e) {
+    if (e instanceof AttrCertError) throw e;
+    throw _err("attrcert/bad-input", "issuer.name is not a distinguished name", e);
+  }
+  var rdns = _readName(trustedDer, "issuer.name").rdns;
+  // Checked on the decoded name, so every input form is held to it. An empty DN names no issuer, and
+  // RFC 5755 sec. 4.2.3 requires the AC's own issuerName to be a non-empty distinguished name, so an
+  // empty trusted name could never match a conformant AC and would only mask the caller's mistake.
+  if (!rdns.length) {
+    throw _err("attrcert/bad-input", "issuer.name is an empty distinguished name, which names no AC issuer (RFC 5755 sec. 4.2.3)");
+  }
+  return {
+    rdns: rdns,
+    // Copied, never viewed. Signature verification suspends this call, and the signature engine
+    // holds this buffer across that suspension -- a composite arm keeps slices of it and imports
+    // them only after its digest settles. A view would leave the trust key writable for that whole
+    // window, so a caller could hand in an unrelated key of the same length, overwrite it with the
+    // real issuer's while the digest ran, and be told the certificate verified under the key they
+    // named. The verdict answers for the key the call was made with.
+    spki: guard.bytes.snapshot(issuer.publicKey, AttrCertError, "attrcert/bad-input", "issuer.publicKey"),
+  };
+}
+
+// RFC 5755 sec. 4.3.2: a targeted AC is valid only at the servers it names, and "servers not named
+// MUST reject the AC". An absent extension means untargeted, so there is nothing to check.
+//
+// Only the decoded targetName and targetGroup alternatives are compared. Searching the extension's
+// raw bytes for the caller's encoded GeneralName would also match a name nested inside a targetCert,
+// where it identifies the TARGET CERTIFICATE'S ISSUER rather than a target, and would then accept an
+// AC at a server it never named. A match against a targetGroup does count: sec. 4.3.2 targets "named
+// targets or groups", so a verifier presenting its group name is naming itself among them.
+//
+// The caller's GeneralName goes through the shared builder, then back through the SAME GeneralName
+// reader the parser used, so both sides of every comparison are the one decoded shape. Reading it
+// back rather than dereferencing a context node's `content` also keeps this off a field that is
+// null whenever the node is constructed.
+function _callerTarget(target) {
+  return attrcert.readGeneralName(_b.encodeGeneralName(target), "attrcert/bad-input");
+}
+
+// RFC 5280 sec. 7.5: two mailboxes match when the local-part is an exact match AND the host-part
+// matches case-insensitively. The split is on the LAST "@", since a quoted local-part may contain
+// one; a value with no "@" has no host-part to fold and compares exactly.
+function _mailboxEqual(a, bx) {
+  var i = a.lastIndexOf("@"), j = bx.lastIndexOf("@");
+  if (i < 0 || j < 0) return a === bx;
+  return a.slice(0, i) === bx.slice(0, j) &&
+    a.slice(i + 1).toLowerCase() === bx.slice(j + 1).toLowerCase();
+}
+
+// Whether a target the AC names is this verifier, under the matching rule each GeneralName form
+// defines. A form whose rule this build does not implement compares exactly, which can refuse a
+// name a fuller comparison would accept and can never accept one it would refuse.
+function _generalNameMatches(entry, want) {
+  if (!entry || entry.tagNumber !== want.tagNumber) return false;
+  switch (entry.tagNumber) {
+    // RFC 5280 sec. 7.2: "When comparing DNS names for equality, conforming implementations MUST
+    // perform a case-insensitive exact match on the entire DNS name."
+    case 2: return String(entry.value).toLowerCase() === String(want.value).toLowerCase();
+    // sec. 7.5, as above.
+    case 1: return _mailboxEqual(String(entry.value), String(want.value));
+    // A directoryName is a distinguished name, and sec. 7.1 identity is not string equality, so it
+    // goes through the one DN comparator rather than comparing the printed form.
+    case 4:
+      return !!(entry.value && want.value) &&
+        guard.name.dnEqual(entry.value.rdns, want.value.rdns, _err, "attrcert/bad-input", "the target name");
+    // sec. 7.4 makes a URI comparison a full RFC 3987 normalization: percent-encoding, path
+    // segments and scheme-based rules, not merely lowercasing the scheme and host. A partial
+    // normalization would be a guess that could match a URI it should not, so the encoded value is
+    // compared as it stands. Re-open condition: an RFC 3987 normalizer in the toolkit.
+    default:
+      if (Buffer.isBuffer(entry.value) && Buffer.isBuffer(want.value)) return entry.value.equals(want.value);
+      if (typeof entry.value === "string" && typeof want.value === "string") return entry.value === want.value;
+      // A form whose decoded value is neither (otherName, ediPartyName, x400Address) has no
+      // comparison here; the caller is told so rather than given a silent mismatch.
+      return null;
+  }
+}
+
+// `want` is the caller's target already decoded, so this runs against the target the call was made
+// with. See _fixVerifyOptions.
+function _checkTargeting(ac, want) {
+  var ext = null;
+  for (var i = 0; i < ac.extensions.length; i++) {
+    if (ac.extensions[i].name === "targetInformation") ext = ac.extensions[i];
+  }
+  if (!ext) return { checked: true, ok: true };
+  if (want === undefined) {
+    return { checked: false, ok: false,
+      reason: "this attribute certificate is targeted, and no opts.target names this verifier (RFC 5755 sec. 4.3.2)" };
+  }
+  // The extension's syntax is a SEQUENCE OF Targets, and its groups are FLATTENED rather than
+  // required one by one. RFC 5755 sec. 4.3.2: "If more than one Targets element is found in an AC,
+  // the extension MUST be treated as if all Target elements had been found within one Targets
+  // element." An issuer conforming to the same paragraph produces only one group anyway, so the
+  // nesting carries no meaning to honor; requiring a match in every group would refuse ACs the
+  // paragraph says to accept.
+  var groups = ext.decoded || [];
+  // sec. 4.3.2 defines the check exactly: it "passes if the current server (recipient) is one of the
+  // targetName fields in the Targets SEQUENCE, or if the current server is a member of one of the
+  // targetGroup fields". The third arm is excluded by the same section -- "The targetCert CHOICE
+  // within the Target structure is only present to allow future compatibility with [X.509-2000] and
+  // MUST NOT be used" -- and the names inside it identify a certificate, not a target.
+  //
+  // An AC using it is refused before any match is considered, the same way sec. 6's "An AC MUST NOT
+  // contain both a noRevAvail extension and a 'pointer in AC'" is enforced here. Both are MUST NOTs
+  // the issuer broke, and a certificate that breaks its own profile is refused rather than partly
+  // honored: passing it because some OTHER entry happened to match would resolve the violation in
+  // the accepting direction, and would leave the verdict depending on which entries an attacker
+  // chose to include alongside the forbidden one. The targets check itself never runs, so its slot
+  // says so.
+  for (var g0 = 0; g0 < groups.length; g0++) {
+    for (var t0 = 0; t0 < groups[g0].length; t0++) {
+      if (groups[g0][t0].kind !== "targetCert") continue;
+      return { checked: false, ok: false,
+        reason: "this attribute certificate carries a targetCert target, which RFC 5755 sec. 4.3.2 says MUST NOT be used, so the targeting check did not run" };
+    }
+  }
+
+  var uncomparable = null;
+  for (var g = 0; g < groups.length; g++) {
+    for (var t = 0; t < groups[g].length; t++) {
+      var entry = groups[g][t];
+      if (entry.kind !== "targetName" && entry.kind !== "targetGroup") continue;
+      var m = _generalNameMatches(entry.name, want);
+      if (m === true) return { checked: true, ok: true };
+      if (m === null) uncomparable = entry.name && entry.name.tagNumber;
+    }
+  }
+  // A target this build cannot compare leaves the check unperformed, which cannot read as a pass.
+  if (uncomparable !== null) {
+    return { checked: false, ok: false,
+      reason: "this attribute certificate names a target in a GeneralName form ([" + uncomparable +
+        "]) this verifier does not compare, so the RFC 5755 sec. 4.3.2 check did not run" };
+  }
+  return { checked: true, ok: false,
+    reason: "this attribute certificate does not name this verifier among its targets (RFC 5755 sec. 4.3.2)" };
+}
+
+// The critical extensions this verb SUPPORTS, by OID. RFC 5755 sec. 5 defines support in two parts:
+// the verifier must be able to parse the value, AND "where the extension value causes the AC to be
+// rejected, the AC verifier MUST reject the AC". Parsing alone satisfies only the first, so an
+// extension whose constraints this verb never evaluates cannot be called supported however cleanly
+// it decodes.
+//
+//   targetInformation -- evaluated, by the sec. 4.3.2 check below.
+//   acAuditIdentity   -- sec. 4.3.1 is an audit/logging identity and states no rule that rejects an
+//                        AC, so there is no second part to satisfy. It rides out on the verdict's
+//                        `extensions` for the logging the section asks for.
+//
+// Everything else critical is refused, including extensions this build parses but does not act on:
+// aaControls (sec. 7.4) constrains what an AA may delegate and acProxying (sec. 7.2) constrains
+// proxy use, and an unevaluated constraint is exactly what item 7 exists to stop. A critical
+// extension defined in future defaults to refused, which is the safe direction.
+var SUPPORTED_CRITICAL = {};
+SUPPORTED_CRITICAL[O("targetInformation")] = 1;
+SUPPORTED_CRITICAL[O("acAuditIdentity")] = 1;
+
+function _unsupportedCritical(ac) {
+  for (var i = 0; i < ac.extensions.length; i++) {
+    var e = ac.extensions[i];
+    if (e.critical !== true) continue;
+    // Own-property membership, so an extension OID that happens to name something on Object.prototype
+    // cannot read as supported.
+    if (!Object.prototype.hasOwnProperty.call(SUPPORTED_CRITICAL, e.oid)) return e.oid;
+    // A supported OID whose value this build could not interpret is still unusable.
+    if (e.decoded === null || e.decoded === undefined || e.decoded.opaque === true) return e.oid;
+  }
+  return null;
+}
+
+/**
+ * @primitive pki.attrcert.verify
+ * @signature pki.attrcert.verify(ac, issuer, opts) -> Promise<{ verified, signatureValid, validityChecked, targetingChecked, revocationChecked, noRevAvail, holderBindingChecked, issuerPathChecked, holder, issuer, attributes, extensions, notBefore, notAfter, serialNumberHex, reason }>
+ * @since 0.5.15
+ * @status stable
+ * @spec RFC 5755 sec. 5
+ * @defends attribute-certificate-forgery (CWE-347)
+ * @related pki.attrcert.sign, pki.path.validate, pki.schema.attrcert.parse
+ *
+ * Verify an RFC 5755 attribute certificate. An AC carries privilege attributes -- a role, a group, a
+ * clearance -- so a consumer that reads them without this grants privileges on unauthenticated
+ * input. `ac` is a DER `Buffer`, a PEM string, or a parsed attribute certificate; `issuer` is
+ * `{ name, publicKey }`, the AC issuer this verifier trusts as an AC issuer, which section 5 item 4
+ * makes the verifier's own configuration and this verb therefore refuses to infer from the AC.
+ * `issuer.name` takes every form `pki.attrcert.sign` accepts for the issuing AA -- a string, an
+ * array of RDNs, or raw `Name` DER -- and is compared as a distinguished name (RFC 5280 section
+ * 7.1), so an AC issued under a multi-RDN authority name is verifiable under that same name.
+ *
+ * Both options are read at the call, before signature verification suspends it, so a caller that
+ * reuses or rewrites its options object -- including calling `setTime` on the `Date` it passed in --
+ * cannot change the verdict that call returns.
+ *
+ * The checks it performs are section 5's items 2, 4, 5, 6 and 7: the signature over the exact
+ * `AttributeCertificateInfo` bytes through the one path-validation signature engine; the issuer
+ * being the one named; the evaluation instant lying within the validity, where equality with either
+ * bound succeeds as the section states; the targeting rule of section 4.3.2, where an AC naming
+ * targets is refused at a verifier it does not name; and rejection of any critical extension this
+ * verb does not process. Section 5 defines support as parsing the value AND rejecting where the
+ * value would reject, so an extension parsed but never evaluated is not supported: targeting is
+ * processed and an audit identity states no rule that rejects, while `aaControls` and `acProxying`
+ * carry constraints this verb does not evaluate, so a critical one is refused. A critical extension
+ * defined in future defaults to refused. The verdict carries `extensions` so an audit identity
+ * reaches the caller for the logging section 4.3.1 asks for.
+ *
+ * Targeting compares `opts.target` against the `targetName` and `targetGroup` alternatives only,
+ * under each GeneralName form's own matching rule: a dNSName folds case across the whole name
+ * (RFC 5280 sec. 7.2), a mailbox matches its local-part exactly and its host-part case-insensitively
+ * (sec. 7.5), and a directoryName goes through the same distinguished-name comparison the rest of
+ * the toolkit uses (sec. 7.1). A URI compares as encoded, because sec. 7.4 makes URI equality a full
+ * RFC 3987 normalization -- percent-encoding, path segments and scheme-based rules -- and a partial
+ * one could match a URI it should not. A form with no comparison here (otherName, ediPartyName,
+ * x400Address) leaves `targetingChecked: false` and never a pass. Every one of those limits can
+ * refuse a target a fuller comparison would accept, and none can accept one it would refuse.
+ * Re-open condition: an RFC 3987 normalizer, at which point URIs compare under sec. 7.4.
+ *
+ * The third `Target` alternative, `targetCert`, is one section 4.3.2 says "MUST NOT be used", so an
+ * attribute certificate carrying one is refused before any match is considered, with
+ * `targetingChecked: false`. A match on some other entry does not rescue it: the issuer broke a MUST
+ * NOT of its own profile, and letting the verdict turn on which entries rode alongside the forbidden
+ * one would leave the outcome to whoever assembled the certificate.
+ *
+ * Revocation is section 6, outside the seven. This verb implements that section's "never revoke"
+ * scheme, which AC users MUST support: it holds no revocation evidence and follows no pointer out
+ * of the certificate. The section states the consequence -- "If only the 'never revoke' scheme is
+ * supported, then all ACs that do not contain a noRevAvail extension, MUST be rejected" -- because
+ * an issuer that omits noRevAvail is stating that revocation status checks are supported, and a
+ * verdict that skipped one would grant privileges the issuer expected to be able to withdraw. So an
+ * AC carrying `noRevAvail` verifies with `revocationChecked: true` and `noRevAvail: true`, and one
+ * without it is refused unless the caller supplies `opts.revocationStatus`. A caller running the
+ * section's "pointer in AC" scheme reads the certificate's own `crlDistributionPoints` /
+ * `authorityInfoAccess` from the verdict's `extensions`, establishes the status, and passes it back.
+ *
+ * Items 1 and 3, and the issuer path in item 2, need certificates this verb is not given: the
+ * holder's own public-key certificate and its chain, the AC issuer's chain, and the section 4.5
+ * profile of the issuer's certificate. Run those through `pki.path.validate` with the certificates
+ * you hold. The verdict reports them as `holderBindingChecked: false` and `issuerPathChecked:
+ * false` rather than leaving their absence to read as a pass, and `verified` never means more than
+ * the checks whose slots are true. Re-open condition: when a caller can pass the holder and issuer
+ * certificates, both become checks this verb performs and both slots follow the arguments.
+ *
+ * @opts
+ *   time    the instant to evaluate the AC at. Omitting it leaves section 5 item 5 unasked, which
+ *           reports `validityChecked: false` and never `verified: true`.
+ *   target  a GeneralName naming this verifier, for the section 4.3.2 targeting check.
+ *   revocationStatus
+ *           `"notRevoked"` or `"revoked"`, the status the caller established for this AC through
+ *           the section 6 "pointer in AC" scheme. Supplying it answers section 6 for an AC that
+ *           carries no `noRevAvail`; omitting it leaves such an AC refused.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var aaSpki = await pki.key.export(pair.publicKey);
+ *   var aaKey = await pki.key.export(pair.privateKey);
+ *   var acDer = await pki.attrcert.sign({
+ *     holder: { entityName: { directoryName: "CN=Alice" } },
+ *     notBeforeTime: new Date("2026-01-01T00:00:00Z"),
+ *     notAfterTime: new Date("2027-01-01T00:00:00Z"),
+ *     attributes: { role: { roleName: { uniformResourceIdentifier: "urn:role:admin" } } },
+ *     // RFC 5755 sec. 6: the issuer states no revocation information will exist for this AC.
+ *     extensions: { noRevAvail: true },
+ *   }, { name: "CN=Example AA", publicKey: aaSpki, key: aaKey });
+ *   var r = await pki.attrcert.verify(acDer, { name: "CN=Example AA", publicKey: aaSpki },
+ *     { time: new Date("2026-06-01T00:00:00Z") });
+ *   r.verified;      // true when every check whose slot is true passed
+ *   r.attributes;    // the privileges, re-derived from the signed bytes
+ */
+function verify(ac, issuer, opts) {
+  return guard.async.deferred(function () { return _verify(ac, issuer, opts); });
+}
+// Every caller-owned value the verdict depends on, read HERE and reduced to a value the caller no
+// longer reaches: the instant rather than the Date (a Date is mutable through setTime even when the
+// property is never reassigned), and the target already encoded and decoded rather than the object.
+// Signature verification suspends this call for at least a turn, and an option re-read after it
+// resumes answers for whatever the caller last wrote, so a caller could hand in an expired instant,
+// replace it while WebCrypto works, and receive `verified: true`. The reduction is returned rather
+// than performed at each use, so reading an option late is not an available mistake.
+function _fixVerifyOptions(opts) {
+  var o = guard.identifier.optionsObject(opts, _err, "attrcert/bad-input", "pki.attrcert.verify options");
+  guard.identifier.assertKnownKeys(o, KNOWN_VERIFY_OPTS, _err, "attrcert/bad-input",
+    "pki.attrcert.verify has an unknown option ");
+  var at = null;
+  if (o.time !== undefined) {
+    guard.time.assertValid(o.time, _err, "attrcert/bad-input", "pki.attrcert.verify opts.time");
+    at = guard.time.instantOf(o.time);
+  }
+  var revocationStatus = null;
+  if (o.revocationStatus !== undefined) {
+    if (typeof o.revocationStatus !== "string" ||
+      !Object.prototype.hasOwnProperty.call(REVOCATION_STATUS, o.revocationStatus)) {
+      throw _err("attrcert/bad-input", 'pki.attrcert.verify opts.revocationStatus must be "notRevoked" or "revoked"');
+    }
+    revocationStatus = o.revocationStatus;
+  }
+  // A supplied target is encoded and read back whether or not the AC turns out to be targeted, so a
+  // malformed one is refused at the call that supplied it.
+  return {
+    at: at, revocationStatus: revocationStatus,
+    target: o.target === undefined ? undefined : _callerTarget(o.target),
+  };
+}
+
+// RFC 5755 sec. 6 "pointer in AC": "ACs may 'point' to sources of revocation status information,
+// using either an authorityInfoAccess extension or a crlDistributionPoints extension within the AC."
+// Named by OID, since the OID is what an issuer signs and a display name is not.
+var REVOCATION_POINTERS = Object.create(null);
+REVOCATION_POINTERS[O("cRLDistributionPoints")] = "crlDistributionPoints";
+REVOCATION_POINTERS[O("authorityInfoAccess")] = "authorityInfoAccess";
+
+// The two revocation schemes an AC declares, read from its extensions. RFC 5755 sec. 4.3.6 / sec. 6:
+// noRevAvail is the issuer stating that no revocation information will ever be made available for
+// this AC, and it is a bare NULL, so its presence is the whole content.
+function _revocationScheme(ac) {
+  var out = { noRevAvail: false, pointer: null };
+  for (var i = 0; i < ac.extensions.length; i++) {
+    var e = ac.extensions[i];
+    if (e.name === "noRevAvail") out.noRevAvail = true;
+    var p = REVOCATION_POINTERS[e.oid];
+    if (p !== undefined && Object.prototype.hasOwnProperty.call(REVOCATION_POINTERS, e.oid)) out.pointer = p;
+  }
+  return out;
+}
+
+function _verify(ac, issuer, opts) {
+  var fixed = _fixVerifyOptions(opts);
+  var parsed = _coerceAc(ac);
+  var trust = _resolveIssuer(issuer);
+
+  var acIssuer = _acIssuerName(parsed);
+  var result = {
+    holder: parsed.holder,
+    issuer: acIssuer,
+    attributes: parsed.attributes,
+    // Carried so a caller can act on what rode along: sec. 4.3.1 asks that an audit identity be
+    // used for audit and logging, which it cannot be if the verdict drops it.
+    extensions: parsed.extensions,
+    notBefore: parsed.validity.notBeforeTime,
+    notAfter: parsed.validity.notAfterTime,
+    serialNumberHex: parsed.serialNumberHex,
+    signatureValid: false,
+    validityChecked: false,
+    targetingChecked: false,
+    revocationChecked: false,
+    noRevAvail: false,
+    holderBindingChecked: false,   // item 1 needs the holder's certificate, which this verb is not given
+    issuerPathChecked: false,      // items 2 and 3 need the issuer's chain, likewise
+    verified: false,
+    reason: undefined,
+  };
+
+  // The signature runs first so `signatureValid` is answered even when a later gate refuses: an
+  // operator reading an out-of-window verdict still learns whether the bytes were authentic.
+  return Promise.resolve(attrcertVerify.verifyAcSignature(parsed, trust.spki)).then(function (sigOk) {
+    result.signatureValid = sigOk === true;
+    var fail = function (reason) { result.reason = reason; return result; };
+    if (!result.signatureValid) return fail("the signature does not verify under the issuer public key");
+
+    // Item 4: the caller trusts a named AC issuer, and this AC must be the one they named.
+    if (!guard.name.dnEqual(acIssuer.rdns, trust.rdns, _err,
+      "attrcert/bad-input", "the AC issuer")) {
+      return fail("this attribute certificate names issuer " + JSON.stringify(acIssuer.dn) +
+        ", which is not the AC issuer this verifier trusts");
+    }
+
+    // Item 7, before the fields are read: an unsupported critical extension makes the whole AC
+    // unusable, so a caller must not act on attributes carried beside one.
+    var badExt = _unsupportedCritical(parsed);
+    if (badExt) return fail("this attribute certificate carries an unsupported critical extension (" + badExt + "), which RFC 5755 sec. 5 item 7 requires be rejected");
+
+    // Item 6.
+    var targeting = _checkTargeting(parsed, fixed.target);
+    result.targetingChecked = targeting.checked;
+    if (!targeting.ok) return fail(targeting.reason);
+
+    // Item 5. An absent instant asks nothing, which cannot read as a pass.
+    if (fixed.at === null) {
+      return fail("no opts.time was supplied, so RFC 5755 sec. 5 item 5 (the evaluation instant lies within the validity) went unasked");
+    }
+    result.validityChecked = true;
+    // "If the evaluation time is equal to either notBeforeTime or notAfterTime, then the AC is
+    // timely and this check succeeds" -- both bounds are inclusive.
+    if (fixed.at < guard.time.instantOf(result.notBefore) || fixed.at > guard.time.instantOf(result.notAfter)) {
+      return fail("the evaluation instant lies outside this attribute certificate's validity");
+    }
+
+    // RFC 5755 sec. 6. This verb implements the "never revoke" scheme: it holds no revocation
+    // evidence of its own and follows no pointer out of the certificate. The section says exactly
+    // what that obliges -- "If only the 'never revoke' scheme is supported, then all ACs that do not
+    // contain a noRevAvail extension, MUST be rejected" -- because where noRevAvail is absent "the
+    // AC issuer is implicitly stating that revocation status checks are supported", so a verdict
+    // that skipped one would grant privileges the issuer expected to be able to withdraw. A caller
+    // who has established the status passes it as opts.revocationStatus; the AC's own
+    // crlDistributionPoints / authorityInfoAccess pointers ride out on the verdict's `extensions`
+    // for them to follow.
+    //
+    // That status is accepted whether or not the AC carries a pointer, because the section closes by
+    // saying where it may come from: "An AC verifier MAY use any source for AC revocation status
+    // information." Requiring a pointer in the certificate would refuse a verifier who obtained the
+    // status from a directory, an out-of-band CRL, or a local record, all of which that sentence
+    // permits. The verdict keeps the two apart: `noRevAvail` says the issuer declared none would
+    // exist, and its absence beside `revocationChecked: true` says the caller supplied one.
+    var scheme = _revocationScheme(parsed);
+    result.noRevAvail = scheme.noRevAvail;
+    // The two schemes are alternatives, and the section closes by saying so: "An AC MUST NOT contain
+    // both a noRevAvail extension and a 'pointer in AC'." An AC carrying both tells the verifier two
+    // different things about its own revocation, and reading the never-revoke claim as settling the
+    // question would resolve that contradiction in the accepting direction. It is refused whichever
+    // way the caller answers, since the certificate itself is the thing that is wrong.
+    if (scheme.noRevAvail && scheme.pointer) {
+      return fail("this attribute certificate carries both noRevAvail and a " + scheme.pointer +
+        " revocation pointer, which RFC 5755 sec. 6 says an AC MUST NOT do");
+    }
+    if (fixed.revocationStatus !== null) {
+      result.revocationChecked = true;
+      if (fixed.revocationStatus === "revoked") {
+        return fail("this attribute certificate is revoked, as opts.revocationStatus reports");
+      }
+    } else if (result.noRevAvail) {
+      // The issuer has stated no revocation information will exist, so there is no status to obtain.
+      result.revocationChecked = true;
+    } else {
+      return fail("this attribute certificate carries no noRevAvail extension, so its issuer supports revocation status checks and RFC 5755 sec. 6 requires one; establish the status from the certificate's own pointers and pass it as opts.revocationStatus");
+    }
+
+    result.verified = true;
+    return result;
+  });
+}
+
+module.exports = { sign: sign, verify: verify };

package/lib/attrcert-verify.js

@@ -0,0 +1,21 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- the RFC 5755 attribute-certificate signature seam, shared by pki.attrcert.verify and
+// by any path that accepts an inbound AC. The slot, the wiring assertion and the octet-alignment
+// refusal are the shared seam (lib/verify-seam.js); what is domain-specific is the error class and
+// the byte range the signature covers. It is not wired into index.js and is reached only by require.
+
+var frameworkError = require("./framework-error");
+var seam = require("./verify-seam");
+
+var _seam = seam.makeSeam("attrcert-verify", frameworkError.AttrCertError, "attrcert/bad-input");
+
+// Verify a parsed attribute certificate's signature over its exact AttributeCertificateInfo bytes
+// under the AC issuer's SubjectPublicKeyInfo DER (RFC 5755 sec. 5, item 2).
+function verifyAcSignature(ac, spkiBytes) {
+  return _seam.verify(ac.signatureAlgorithm, ac.signatureValue, spkiBytes, ac.tbsBytes);
+}
+
+module.exports = { setEngine: _seam.setEngine, verifyAcSignature: verifyAcSignature };