@blamejs/pki 0.5.17 → 0.5.19

package/lib/tsp-sign.js

@@ -142,9 +142,38 @@ function sign(messageImprint, tsa, opts) {
   ], _sign);
 }
 
+// The three caller-owned objects pki.tsp.sign reads. A dropped option here is a token that quietly
+// lacks what was asked for -- `odering` for `ordering` emitted a token with the ordering flag unset,
+// which is a claim about the timestamp's orderability that the caller believes they made.
+// The TSA is gated too, and the reason it needs to be is not the one it looks like. Both fields it
+// carries are REQUIRED, so a MISSPELLING of either is already refused for what it leaves missing --
+// but that is only half the class. A name belonging on the OPTIONS, written on the TSA instead, is
+// read by nothing here: `ordering` placed on the TSA emits a token the same size as one that never
+// asked for it, with the flag unset, while the caller believes they set it. Requiring the argument
+// to carry only what it reads is what closes that, so all three caller-owned arguments answer the
+// same question -- is this a name I read? -- rather than two of them answering it.
+var _TSA_KEYS = { cert: 1, key: 1 };
+var _IMPRINT_KEYS = { hashAlgorithm: 1, hashedMessage: 1 };
+var _SIGN_OPTS = {
+  policy: 1, serialNumber: 1, genTime: 1, nonce: 1, accuracy: 1, ordering: 1, sid: 1,
+  digestAlgorithm: 1, certHashAlgorithm: 1, additionalSignedAttributes: 1, pss: 1, pem: 1,
+};
+
 function _sign(messageImprint, tsa, opts) {
   opts = opts || {};
+  if (messageImprint && typeof messageImprint === "object" && !Buffer.isBuffer(messageImprint)) {
+    guard.identifier.assertKnownKeys(messageImprint, _IMPRINT_KEYS, _err, "tsp/bad-input", function (k) {
+      return "unknown messageImprint field " + JSON.stringify(k) + " (the imprint is { hashAlgorithm, hashedMessage })";
+    });
+  }
+  guard.identifier.assertKnownKeys(opts, _SIGN_OPTS, _err, "tsp/bad-input", "pki.tsp.sign has an unknown option ");
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("tsp/bad-input", "pki.tsp.sign options must be an object");
+  if (tsa && typeof tsa === "object" && !Buffer.isBuffer(tsa)) {
+    guard.identifier.assertKnownKeys(tsa, _TSA_KEYS, _err, "tsp/bad-input", function (k) {
+      return "unknown TSA field " + JSON.stringify(k) +
+        " (the TSA is { cert, key }; a signing option belongs in the third argument)";
+    });
+  }
   var mi = messageImprint || {};
   if (!mi.hashAlgorithm || !NODE_DIGEST[mi.hashAlgorithm]) throw _err("tsp/unsupported-algorithm", "messageImprint.hashAlgorithm must be a supported hash name");
   if (!Buffer.isBuffer(mi.hashedMessage) && !(mi.hashedMessage instanceof Uint8Array)) throw _err("tsp/bad-input", "messageImprint.hashedMessage must be a Buffer");
@@ -187,7 +216,17 @@ function _sign(messageImprint, tsa, opts) {
 // Accuracy ::= SEQUENCE { seconds INTEGER OPTIONAL, millis [0] INTEGER (1..999) OPTIONAL,
 // micros [1] INTEGER (1..999) OPTIONAL } (RFC 3161 sec. 2.4.2). seconds is a non-negative
 // integer; millis and micros MUST each be in 1..999 -- enforced before encoding.
+// Accuracy ::= SEQUENCE { seconds INTEGER OPTIONAL, millis [0] OPTIONAL, micros [1] OPTIONAL }
+// (RFC 3161 sec. 2.4.2). All three are OPTIONAL and encoded only when present, so a misspelling is
+// missed by nothing: `milis` emitted an EMPTY Accuracy that parses back as zero seconds, millis and
+// micros, and the token then understates its own precision -- a claim about the timestamp that the
+// caller believed they had made.
+var _ACCURACY_KEYS = { seconds: 1, millis: 1, micros: 1 };
+
 function _accuracy(a) {
+  guard.identifier.assertKnownKeys(a, _ACCURACY_KEYS, _err, "tsp/bad-input", function (k) {
+    return "unknown accuracy field " + JSON.stringify(k) + "; Accuracy is { seconds?, millis?, micros? }";
+  });
   var f = [];
   if (a.seconds != null) {
     var s = Number(a.seconds);
@@ -264,10 +303,29 @@ function _assertImprint(mi) {
  *   var sha256Digest = Buffer.from(await pki.webcrypto.subtle.digest("SHA-256", Buffer.from("hello")));
  *   var req = pki.tsp.request({ hashAlgorithm: "sha256", hashedMessage: sha256Digest }, { nonce: 0x0102030405060708n, certReq: true });
  */
+// The options pki.tsp.request encodes into the TimeStampReq. Every one is OPTIONAL in the
+// structure, so a misspelled name is missed by nothing and the request goes out claiming less than
+// was asked for. `nonce` is the one that costs most: misspelled, the request carries no nonce at
+// all, and the caller matches a reply against a replay defense that was never asked for.
+var _REQUEST_OPTS = { reqPolicy: 1, nonce: 1, certReq: 1, extensions: 1, pem: 1 };
+
 function request(messageImprint, opts) {
   opts = opts || {};
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("tsp/bad-input", "pki.tsp.request options must be an object");
+  guard.identifier.assertKnownKeys(opts, _REQUEST_OPTS, _err, "tsp/bad-input", "pki.tsp.request has an unknown option ");
   var mi = messageImprint || {};
+  // The same table pki.tsp.sign holds its imprint to. The request's own options live in the second
+  // argument, so `nonce` written on the imprint reaches nothing and the request goes out without
+  // the replay defense the caller believes they asked for.
+  // The same table pki.tsp.sign holds its imprint to. The request's own options live in the second
+  // argument, so `nonce` written on the imprint reaches nothing and the request goes out without
+  // the replay defense the caller believes they asked for.
+  if (mi && typeof mi === "object" && !Buffer.isBuffer(mi)) {
+    guard.identifier.assertKnownKeys(mi, _IMPRINT_KEYS, _err, "tsp/bad-input", function (k) {
+      return "unknown messageImprint field " + JSON.stringify(k) +
+        " (the imprint is { hashAlgorithm, hashedMessage }; a request option belongs in the second argument)";
+    });
+  }
   _assertImprint(mi);
   var imprint = b.sequence([_hashAlgId(mi.hashAlgorithm), b.octetString(Buffer.from(mi.hashedMessage))]);
   // TimeStampReq: version(1), messageImprint, then OPTIONAL reqPolicy / nonce / certReq /
@@ -349,9 +407,15 @@ function parseRequest(input) { return schemaTsp.parseRequest(input); }
  *   var resp = pki.tsp.response(token, {});                                  // granted
  *   var rej  = pki.tsp.response(null, { status: 2, failInfo: ["badAlg"] });  // rejection
  */
+// The options pki.tsp.response encodes into the TimeStampResp. `status` carries the verdict and
+// defaults to granted(0), so a misspelled name does not lose a detail -- it INVERTS the answer: a
+// TSA refusing a request emits a granted response instead, over a token it did mean to withhold.
+var _RESPONSE_OPTS = { status: 1, statusString: 1, failInfo: 1, pem: 1 };
+
 function response(token, opts) {
   opts = opts || {};
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("tsp/bad-input", "pki.tsp.response options must be an object");
+  guard.identifier.assertKnownKeys(opts, _RESPONSE_OPTS, _err, "tsp/bad-input", "pki.tsp.response has an unknown option ");
   var status = opts.status == null ? 0 : Number(opts.status);
   if (!Number.isInteger(status) || status < 0 || status > 5) throw _err("tsp/bad-input", "PKIStatus must be an integer in 0..5 (RFC 3161 sec. 2.4.2)");
   var granted = status === 0 || status === 1;