@blamejs/pki 0.5.2 → 0.5.4

package/lib/jose.js

@@ -566,8 +566,47 @@ async function thumbprint(jwk) {
   return b64uEncode(digest);
 }
 
+/**
+ * @primitive  pki.jose.sigAlgs
+ * @signature  pki.jose.sigAlgs() -> Array<{alg,kty,crv,hash,saltLength}>
+ * @since      0.5.3
+ * @status     stable
+ * @spec       RFC 7518 sec. 3, RFC 8037, RFC 9964
+ * @related    pki.jose.verify
+ *
+ * The JWS signature algorithms this toolkit verifies, one row per `alg`, each
+ * naming the JWK key type it requires (`kty`, plus the exact `crv` where the
+ * curve is fixed), the hash, and the RSASSA-PSS salt length where the algorithm
+ * is PSS. Rows describe key material in RFC 7517 / 7518 vocabulary only, so a
+ * caller can decide whether a key it holds can sign or verify a given `alg`
+ * without a table of its own.
+ *
+ * MAC algorithms are deliberately absent: `HS*` is not a signature algorithm and
+ * listing it beside `RS256` is how the HMAC key-confusion class starts. `none`
+ * does not exist here at all.
+ *
+ * Each call returns a fresh array of fresh rows -- the registry that drives
+ * verification is never handed out, so nothing a caller does to the result can
+ * widen what a signature check accepts.
+ *
+ * @example
+ *   var pss = pki.jose.sigAlgs().filter(function (r) { return r.saltLength; });
+ *   pss.map(function (r) { return r.alg; });   // -> ["PS256", "PS384", "PS512"]
+ */
+function sigAlgs() {
+  return Object.keys(SIG_ALGS).map(function (alg) {
+    var row = SIG_ALGS[alg];
+    var out = { alg: alg, kty: row.kty };
+    if (row.crv) out.crv = row.crv;
+    if (row.hash) out.hash = row.hash;
+    if (row.saltLength) out.saltLength = row.saltLength;
+    return out;
+  });
+}
+
 module.exports = {
   base64url: { encode: b64uEncode, decode: b64uDecode },
+  sigAlgs: sigAlgs,
   parseJson: parseJson,
   verify: verify,
   sign: sign,

package/lib/path-validate.js

@@ -1127,13 +1127,35 @@ function validateCriticalExtensionStructure(cert) {
  * The value-carrying options (`time`, `maxPathCerts`, `maxPolicyNodes`, the
  * subtree seeds, `userInitialPolicySet`, `requiredEku`) are validated at the
  * entry point -- a mis-shaped value throws `path/bad-input` rather than
- * silently not applying. Returns `{ valid, path,
- * results, workingPublicKey, workingPublicKeyAlgorithm,
+ * silently not applying. Returns `{ valid, revocationChecked, anchorConstraints,
+ * path, results, workingPublicKey, workingPublicKeyAlgorithm,
  * workingPublicKeyParameters, validPolicyTree }` where `results[i].checks`
  * carries a per-check reason code (`path/*`) for every step. Pure and
  * re-entrant -- no input object is mutated. An empty path or a missing anchor
  * throws a typed `PathError`.
  *
+ * `valid` alone cannot say whether revocation was ever established, so
+ * `revocationChecked` answers separately, taking the WEAKEST outcome on the
+ * path: `false` when no `revocationChecker` was supplied, `"determined"` when
+ * every certificate got an explicit good or revoked answer, `"waived"` when
+ * `softFail` turned an undetermined one into a pass, and `"undetermined"` when
+ * one could not be answered at all and the path fails for it. The
+ * per-certificate `revocation` check carries the `status` it was decided on and
+ * marks a waiver, so "checked, good" is distinguishable from "could not check,
+ * and you waived it" -- which a stored verdict is re-read to settle. A checker
+ * that THROWS is a fault in the checker rather than a status it reported, so it
+ * fails the path as `path/revocation-checker-error` carrying the fault whatever
+ * `softFail` says -- `softFail` opts into an undetermined ANSWER, and the
+ * built-in checkers report one as `{ status: "unknown" }` rather than throwing.
+ *
+ * `anchorConstraints` reports what the anchor's own trust metadata decided:
+ * the `checkedPurpose` it was judged under, and whether the `distrustAfter`
+ * date and the `purposes` delegator map each applied. That metadata is keyed BY
+ * key purpose, so an anchor carrying it while `opts.checkPurpose` is absent is a
+ * configuration fault (`path/bad-input`) rather than a constraint that silently
+ * does nothing -- a root distrusted years ago must not quietly validate a
+ * current leaf.
+ *
  * @example
  *   var pair = await pki.key.generate("Ed25519");
  *   var der = await pki.x509.sign({ subject: "example.com", subjectPublicKey: await pki.key.export(pair.publicKey),
@@ -1204,6 +1226,22 @@ async function validate(path, opts) {
   // then fails the path closed instead of silently skipping the step.
   var requireRevocation = opts.requireRevocation === true;
   var failed = false;
+  // Whether the revocation rule RAN, and whether any certificate's answer had to be waived. The
+  // verdict reports the two separately because they are different claims: a caller re-reading a
+  // stored result needs to tell "every certificate was determined not revoked" from "the step was
+  // skipped" from "the step could not conclude and you had asked for that to pass".
+  var revocationRan = false, revocationWaived = false, revocationUndetermined = false;
+  // Which of the anchor's purpose-scoped constraints actually decided anything, reported so a
+  // verdict can be re-read to tell an anchor that was judged from one that carried nothing to judge.
+  var anchorDistrustApplied = false, anchorPurposeApplied = false;
+  // A trust anchor carrying purpose-scoped metadata, validated with no purpose to select by, is a
+  // configuration fault. The constraint is KEYED by purpose -- there is no way to apply
+  // `distrustAfter.serverAuth` without being told the validation is about serverAuth -- so without
+  // one the caller's stated intent would be discarded silently, and a root distrusted years ago
+  // would validate a current leaf. An anchor carrying no such metadata is unaffected.
+  if (!checkPurpose && opts.trustAnchor && _hasPurposeScopedMetadata(opts.trustAnchor)) {
+    throw E("path/bad-input", "validate: the trust anchor carries purpose-scoped metadata (distrustAfter / purposes), which is keyed by key purpose -- supply opts.checkPurpose to say which purpose this validation is for, or the constraint cannot be applied");
+  }
 
   for (var idx = 0; idx < n; idx++) {
     var i = idx + 1;
@@ -1274,16 +1312,48 @@ async function validate(path, opts) {
     // 6.1.3(a)(3) revocation.
     if (revocationChecker) {
       var issuerCert = idx > 0 ? certs[idx - 1] : null;   // the anchor issues cert[1]
-      var rv;
+      var rv, rvError = null;
+      // A checker that THROWS -- or whose promise rejects -- is not a checker reporting "unknown".
+      // Laundering the two together made a broken checker indistinguishable from a working one that
+      // could not reach the responder, and under softFail both became a pass. The fault is carried
+      // onto the check so an operator can tell their own bug from a network condition, and it fails
+      // the path whatever softFail says (see the branch below).
       try { rv = await revocationChecker.check(cert, { workingIssuerName: state.workingIssuerName, workingPublicKey: state.workingPublicKey, workingPublicKeyAlgorithm: state.workingPublicKeyAlgorithm, issuerCert: issuerCert }, { time: opts.time, historicalMode: opts.historicalMode === true }); }
-      catch (_e) { rv = { status: "unknown" }; }
+      catch (e) { rv = { status: "error" }; rvError = e; }
       // ONLY an explicit "good" is a determined non-revocation; "revoked" fails;
       // every other value ("unknown", an OCSP tryLater/unauthorized, a typo, a
       // missing status) is undetermined and fails closed unless softFail.
-      if (rv && rv.status === "good") { checks.push({ name: "revocation", ok: true }); }
-      else if (rv && rv.status === "revoked") { checks.push({ name: "revocation", ok: false, code: "path/revoked" }); failed = true; }
-      else if (softFail) { checks.push({ name: "revocation", ok: true }); }
-      else { checks.push({ name: "revocation", ok: false, code: "path/revocation-undetermined" }); failed = true; }
+      //
+      // The two `ok: true` outcomes are NOT the same claim and no longer the same object. "checked,
+      // and it said good" and "could not check, and you waived it" read identically from a bare
+      // boolean, which is the whole reason a stored verdict cannot be re-read to answer whether
+      // revocation was ever established. Each entry now names the status it was decided on, and a
+      // waiver marks itself.
+      var rvStatus = (rv && typeof rv.status === "string") ? rv.status : "unknown";
+      if (rv && rv.status === "good") { checks.push({ name: "revocation", ok: true, status: "good" }); }
+      else if (rv && rv.status === "revoked") { checks.push({ name: "revocation", ok: false, status: "revoked", code: "path/revoked" }); failed = true; }
+      else if (rvError) {
+        // A checker that threw is a FAULT in the checker, not a status it could not reach, and
+        // softFail is the caller opting into an undetermined ANSWER. The built-in CRL and OCSP
+        // checkers return `{status:"unknown"}` for every unreachable or unverifiable condition and
+        // never throw, so a throw here is the caller's own bug -- waiving it would pass the
+        // certificate with no revocation result at all, which is the outcome softFail is asked for
+        // and this is not.
+        checks.push({ name: "revocation", ok: false, status: "error", code: "path/revocation-checker-error", error: rvError });
+        revocationUndetermined = true;
+        failed = true;
+      }
+      else if (softFail) {
+        // No `error` slot here or below: a fault took the branch above, so anything reaching these
+        // two is a status the checker actually reported.
+        checks.push({ name: "revocation", ok: true, status: rvStatus, waived: true });
+        revocationWaived = true;
+      } else {
+        checks.push({ name: "revocation", ok: false, status: rvStatus, code: "path/revocation-undetermined" });
+        revocationUndetermined = true;
+        failed = true;
+      }
+      revocationRan = true;
     } else if (requireRevocation) {
       // No checker was supplied but the caller demands a revocation determination:
       // the step cannot be performed, so fail closed (never silently skip).
@@ -1357,6 +1427,7 @@ async function validate(path, opts) {
       // before the comparison; an absent (undefined/null) date is no restriction.
       var distrustDate = assertAnchorConstraints(ta, checkPurpose);
       if (distrustDate != null) {
+        anchorDistrustApplied = true;
         // STRICTLY > : a leaf whose notBefore == the distrust date stays trusted
         // (Mozilla certverifier isDistrustedCertificateChain: endEntityNotBefore
         // <= distrustAfterTime -> not distrusted; the end-of-day ...235959Z
@@ -1365,8 +1436,11 @@ async function validate(path, opts) {
           checks.push({ name: "distrustAfter", ok: false, code: "path/distrusted-after" }); failed = true;
         }
       }
-      if (checkPurpose && ta.purposes && ta.purposes[checkPurpose] !== true) {
-        checks.push({ name: "purposeTrust", ok: false, code: "path/purpose-not-trusted" }); failed = true;
+      if (checkPurpose && ta.purposes) {
+        anchorPurposeApplied = true;
+        if (ta.purposes[checkPurpose] !== true) {
+          checks.push({ name: "purposeTrust", ok: false, code: "path/purpose-not-trusted" }); failed = true;
+        }
       }
       updateWorkingKey(state, cert);   // 6.1.5(c),(d) -- key AND algorithm AND parameters
     }
@@ -1404,6 +1478,20 @@ async function validate(path, opts) {
 
   return {
     valid: !failed,
+    // What the revocation rule and the anchor's own trust metadata actually decided. `valid` alone
+    // cannot answer either, and both are questions a stored verdict is re-read to settle: was this
+    // certificate ever established as un-revoked, and was the anchor's distrust date consulted.
+    // The WEAKEST outcome on the path, not the fact that a checker ran: a certificate nobody could
+    // answer for leaves revocation unestablished however many others answered, and deriving the word
+    // from "a checker ran" put that run on the same value as one that established every answer.
+    revocationChecked: !revocationRan ? false
+      : revocationUndetermined ? "undetermined"
+        : revocationWaived ? "waived" : "determined",
+    anchorConstraints: {
+      checkedPurpose: checkPurpose || null,
+      distrustAfterApplied: anchorDistrustApplied,
+      purposeTrustApplied: anchorPurposeApplied,
+    },
     path: certs,
     results: state.results,
     workingPublicKey: state.workingPublicKey,
@@ -1446,24 +1534,10 @@ var OID_AUTHORITY_KEY_ID = oid.byName("authorityKeyIdentifier");
 var OID_CRL_NUMBER = oid.byName("cRLNumber");
 var OID_FRESHEST_CRL = oid.byName("freshestCRL");
 
-// IssuingDistributionPoint ::= SEQUENCE { distributionPoint [0] OPTIONAL,
-// onlyContainsUserCerts [1] DEFAULT FALSE, onlyContainsCACerts [2] DEFAULT FALSE,
-// onlySomeReasons [3] ReasonFlags OPTIONAL, indirectCRL [4] DEFAULT FALSE,
-// onlyContainsAttributeCerts [5] DEFAULT FALSE } (RFC 5280 sec. 5.2.5). Declared
-// through the engine so the trailing-field grammar (strictly-ascending tags, each
-// at most once) and the DER BOOLEAN value rules are the shared enforcement, not a
-// hand-walk; a present DEFAULT-FALSE flag encoding FALSE is the omitted default
-// (X.690 sec. 11.5) and rejects at the leaf-value level below.
-var IDP_SCHEMA = schema.seq([
-  schema.trailing([
-    { tag: 0, name: "distributionPoint", schema: schema.any() },
-    { tag: 1, name: "onlyContainsUserCerts", schema: schema.implicitBoolean(1) },
-    { tag: 2, name: "onlyContainsCACerts", schema: schema.implicitBoolean(2) },
-    { tag: 3, name: "onlySomeReasons", schema: schema.implicitBitString(3) },
-    { tag: 4, name: "indirectCRL", schema: schema.implicitBoolean(4) },
-    { tag: 5, name: "onlyContainsAttributeCerts", schema: schema.implicitBoolean(5) },
-  ], { minTag: 0, maxTag: 5, unexpectedCode: "path/bad-idp", orderCode: "path/bad-idp" }),
-], { assert: "sequence", code: "path/bad-idp", what: "IssuingDistributionPoint" });
+// The RFC 5280 sec. 5.2.5 IssuingDistributionPoint grammar, shared with the CRL
+// verbs (pkix.issuingDistributionPoint) so the scope this validator reads and the
+// scope pki.crl.isRevoked refuses to answer past are read by the same rules.
+var IDP_SCHEMA = pkix.issuingDistributionPoint("path/bad-idp");
 
 // RFC 5280 sec. 6.3.2(a): the legal members of reasons_mask are exactly the eight
 // named ReasonFlags bits, 1..8 (`unused` bit 0 is not a reason, and `unspecified`
@@ -2437,6 +2511,17 @@ function coerceCert(input) {
 // exposed for the same reason: a caller that may never reach the walk -- pki.cms.verify when no
 // signer verified -- has to be able to reject a malformed anchor at ITS entry point, through this
 // same definition, so configuration validity never depends on the message.
+// Does this anchor carry trust metadata that only a named key purpose can unlock? A non-empty
+// `distrustAfter` or `purposes` map is such metadata -- both are indexed BY purpose, so both are
+// inert without one. An EMPTY map states no constraint and is not a reason to refuse.
+function _hasPurposeScopedMetadata(ta) {
+  if (!ta || typeof ta !== "object") return false;
+  return ["distrustAfter", "purposes"].some(function (k) {
+    var m = ta[k];
+    return !!m && typeof m === "object" && Object.keys(m).length > 0;
+  });
+}
+
 function assertAnchorConstraints(ta, checkPurpose) {
   var d = (checkPurpose && ta && ta.distrustAfter) ? ta.distrustAfter[checkPurpose] : null;
   if (d == null) return null;

package/lib/schema-pkix.js

@@ -669,6 +669,66 @@ function distributionPointName(ns, node, code) {
   throw ns.E(code, "DistributionPointName must be fullName [0] or nameRelativeToCRLIssuer [1] (RFC 5280 sec. 4.2.1.13)");
 }
 
+// A certificate's keyUsage as the named booleans the shared sec. 4.2.1 decoder produces, or null
+// when the certificate carries no keyUsage extension -- which places no restriction (sec. 4.2.1.3),
+// a distinct answer from "carries one that permits nothing".
+//
+// Declared here because "may this certificate do X" is asked at five boundaries and the answer has
+// to be the same at all of them. keyUsage is a NamedBitList: DER drops its trailing zero bits
+// (X.690 sec. 11.2.2) and sec. 4.2.1.3 requires at least one bit set. A boundary that reads the
+// bits with a plain BIT STRING read applies neither, so the same certificate is authorized there
+// and rejected as malformed by the issuing side and the path validator -- one extension with two
+// readings, and the permissive one deciding.
+//
+// `E(code, message, cause)` is the caller's typed error factory, so each boundary keeps its own
+// domain while the RULE stays single-homed.
+var _KU_DECODER = new WeakMap();       // one decoder table per namespace, built on first use
+function keyUsageOf(ns, cert, E, code, label) {
+  var exts = (cert && cert.extensions) || [];
+  var want = ns.oid.byName("keyUsage");
+  for (var i = 0; i < exts.length; i++) {
+    if (exts[i].oid !== want || exts[i].value == null) continue;
+    var dec = _KU_DECODER.get(ns);
+    if (!dec) { dec = certExtensionDecoders(ns).byOid[want]; _KU_DECODER.set(ns, dec); }
+    try { return dec(exts[i].value); }
+    catch (e) { throw E(code, "the " + label + " keyUsage extension is malformed", e); }
+  }
+  return null;
+}
+
+// IssuingDistributionPoint ::= SEQUENCE { distributionPoint [0] OPTIONAL,
+// onlyContainsUserCerts [1] DEFAULT FALSE, onlyContainsCACerts [2] DEFAULT FALSE,
+// onlySomeReasons [3] ReasonFlags OPTIONAL, indirectCRL [4] DEFAULT FALSE,
+// onlyContainsAttributeCerts [5] DEFAULT FALSE } (RFC 5280 sec. 5.2.5).
+//
+// Declared here rather than in a consumer because the extension answers a
+// question -- which certificates does this CRL speak for -- that both the path
+// validator and the standalone CRL verbs act on, and a scope flag read by a hand
+// walk over the raw children is read by the reader's own rules instead of the
+// encoding's. Each flag is an IMPLICIT BOOLEAN, so `implicitBoolean` is what
+// holds it to one content octet of 0x00 or 0xFF (X.690 sec. 11.1); a hand walk
+// testing a content byte reads an EMPTY [4] as absent and a multi-octet one by
+// whichever byte it happens to index, and "absent" is the reading that grants
+// permission to answer. `trailing` supplies the rest of the grammar: strictly
+// ascending tags, each field at most once, nothing outside 0..5.
+//
+// A present DEFAULT-FALSE flag encoding FALSE is well-formed at the leaf but is
+// still an encoding DER forbids (X.690 sec. 11.5 omits the default), so the
+// caller decides what that means for it -- reported as a value of `false`
+// against a `present` of true, never silently normalized away.
+function issuingDistributionPoint(code) {
+  return schema.seq([
+    schema.trailing([
+      { tag: 0, name: "distributionPoint", schema: schema.any() },
+      { tag: 1, name: "onlyContainsUserCerts", schema: schema.implicitBoolean(1) },
+      { tag: 2, name: "onlyContainsCACerts", schema: schema.implicitBoolean(2) },
+      { tag: 3, name: "onlySomeReasons", schema: schema.implicitBitString(3) },
+      { tag: 4, name: "indirectCRL", schema: schema.implicitBoolean(4) },
+      { tag: 5, name: "onlyContainsAttributeCerts", schema: schema.implicitBoolean(5) },
+    ], { minTag: 0, maxTag: 5, unexpectedCode: code, orderCode: code }),
+  ], { assert: "sequence", code: code, what: "IssuingDistributionPoint" });
+}
+
 // certExtensionDecoders(ns) -- the ns-parameterized RFC 5280 sec. 4.2.1 extension
 // VALUE decoders. `x509.parse` surfaces each extension as { oid, name, critical,
 // value } with `value` the raw inner OCTET-STRING content (a Buffer); the path
@@ -1587,6 +1647,8 @@ module.exports = {
   generalName: generalName,
   generalNames: generalNames,
   distributionPointName: distributionPointName,
+  issuingDistributionPoint: issuingDistributionPoint,
+  keyUsageOf: keyUsageOf,
   generalizedTime: generalizedTime,
   utf8Text: utf8Text,
   rawNonEmptySequence: rawNonEmptySequence,

package/lib/sign-scheme.js

@@ -67,23 +67,61 @@ function _pssAlgId(digestName) {
   var params = b.sequence([b.explicit(0, hashAlg), b.explicit(1, mgf), b.explicit(2, b.integer(BigInt(PSS_SALT[HASH[digestName]])))]);
   return b.sequence([b.oid(O("rsassaPss")), params]);
 }
-// An id-RSASSA-PSS SPKI MAY pin its permitted hash in the params (RFC 4055 sec. 1.2 / 3.1). Read
-// it so signing honors the restriction; absent params or an unrecognized hash returns null.
+// The hash an id-RSASSA-PSS SPKI restricts its key to, or null when it restricts none.
+//
+// RFC 4055 sec. 3.1 draws the line at whether the parameters are THERE: "if present, the parameters
+// field MUST contain RSASSA-PSS-params", and "if RSASSA-PSS-params is present, the certificate user
+// MUST perform those operations using the one-way hash function ... identified in the ...
+// parameters". Absent parameters therefore restrict nothing, and null says so.
+//
+// PRESENT parameters are a restriction even where they look empty. `hashAlgorithm` is
+// `[0] HashAlgorithm DEFAULT sha1Identifier`, so a params SEQUENCE that omits it names SHA-1 --
+// it does not decline to name anything. Reading the omission as "no restriction" is the fail-open
+// that matters here: it turns a key its own certificate confines to SHA-1 into one that will verify
+// a SHA-512 signature. And parameters that are present but unreadable are a restriction this code
+// cannot honor, which is not the same as no restriction either, so they are refused.
 function _pssHashFromSpki(cert, E) {
   var params = cert.subjectPublicKeyInfo.algorithm.parameters;
   if (params == null) return null;
-  var node = asn1.decode(params);
-  if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children) return null;
+  var node;
+  try { node = asn1.decode(params); }
+  catch (e) { throw E("unsupported-algorithm", "the id-RSASSA-PSS key parameters are not decodable, so the restriction they carry cannot be honored", e); }
+  if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children) {
+    throw E("unsupported-algorithm", "the id-RSASSA-PSS key parameters are not an RSASSA-PSS-params SEQUENCE (RFC 4055 sec. 3.1)");
+  }
   var hashField = node.children.filter(function (c) { return c.tagClass === "context" && c.tagNumber === 0; })[0];
-  if (!hashField || !hashField.children || !hashField.children[0] || !hashField.children[0].children) return null;
+  // DEFAULT sha1Identifier -- an omitted hashAlgorithm names SHA-1, which this toolkit does not
+  // sign or verify with, so it is reported as the pin it is and refused by the caller's own table.
+  if (!hashField) return "sha1";
+  if (!hashField.children || !hashField.children[0] || !hashField.children[0].children) {
+    throw E("unsupported-algorithm", "the id-RSASSA-PSS key parameters carry a malformed hashAlgorithm");
+  }
   var oidNode = hashField.children[0].children[0];
-  if (!oidNode || oidNode.tagClass !== "universal" || oidNode.tagNumber !== asn1.TAGS.OBJECT_IDENTIFIER) return null;
+  if (!oidNode || oidNode.tagClass !== "universal" || oidNode.tagNumber !== asn1.TAGS.OBJECT_IDENTIFIER) {
+    throw E("unsupported-algorithm", "the id-RSASSA-PSS key parameters hashAlgorithm is not an OBJECT IDENTIFIER");
+  }
   var pinnedOid = asn1.read.oid(oidNode);
   var name = HASH_NAME_BY_OID[pinnedOid];
   if (!name) throw E("unsupported-algorithm", "the id-RSASSA-PSS signer key pins an unsupported hash algorithm (" + pinnedOid + ")");
   return name;
 }
 
+// @internal -- the WebCrypto hash name an id-RSASSA-PSS SPKI pins, or null when it pins none.
+// Verifiers need the same restriction the signer above honors: a key whose certificate says
+// SHA-256 must not be handed a SHA-512 signature to check, and reading the pin in two places is
+// how the two directions come to disagree. Throws through the caller's E on a hash this toolkit
+// does not implement, so an unreadable restriction is never treated as no restriction.
+function pssSpkiPinnedHash(cert, E) {
+  var d = _pssHashFromSpki(cert, E);
+  if (!d) return null;
+  // A pin this toolkit has no WebCrypto hash for -- SHA-1, which RSASSA-PSS-params names by DEFAULT
+  // -- is still a pin. Returning undefined here would hand the caller a falsy value it reads as
+  // "unrestricted", which is the same fail-open the DEFAULT reading above exists to close, one
+  // layer up.
+  if (!HASH[d]) throw E("unsupported-algorithm", "the id-RSASSA-PSS key is restricted to " + d + ", which this toolkit does not verify with");
+  return HASH[d];
+}
+
 // resolveSignScheme(cert, so, noSignedAttrs, E) -> the signature scheme from the signer cert's
 // public-key algorithm + per-signer opts (so.digestAlgorithm / so.pss / so.combinedRsaSig -- the
 // last folds the digest into a combined RSA signature OID for a caller with no digestAlgorithm
@@ -205,6 +243,7 @@ function signOverTbs(scheme, key, signedBytes, E) {
 // no drift between the two.
 module.exports = {
   resolveSignScheme: resolveSignScheme,
+  pssSpkiPinnedHash: pssSpkiPinnedHash,
   signOverTbs: signOverTbs,
   MLDSA_SUITABLE_DIGEST: MLDSA_SUITABLE_DIGEST,
   SLHDSA_BY_OID: SLHDSA_BY_OID,

package/lib/tsp-sign.js

@@ -23,11 +23,12 @@ var pathValidate = require("./path-validate");
 var pkiX509 = require("./schema-x509");
 var smime = require("./schema-smime");
 var schemaTsp = require("./schema-tsp");
-var schema = require("./schema-engine");
 var guard = require("./guard-all");
 var frameworkError = require("./framework-error");
 
+var pkix = require("./schema-pkix");
 var TspError = frameworkError.TspError;
+var _NS = pkix.makeNS("tsp", TspError, oid);
 var b = asn1.build;
 function _err(code, message, cause) { return new TspError(code, message, cause); }
 function O(name) { return oid.byName(name); }
@@ -484,19 +485,12 @@ function _checkTsaCertUsage(tsaCertDer) {
   // A keyUsage that forbids signing cannot mint a token (RFC 5280 sec. 4.2.1.3); an absent keyUsage
   // is unrestricted. Require digitalSignature (bit 0) or nonRepudiation/contentCommitment (bit 1) --
   // the signing bits, the TSA analogue of the OCSP-responder keyUsage gate.
-  var kuExts = (cert.extensions || []).filter(function (e) { return e.oid === O("keyUsage"); });
-  if (kuExts.length) {
-    var ku;
-    try {
-      ku = asn1.read.bitString(asn1.decode(kuExts[0].value));
-      // KeyUsage is a NamedBitList: enforce the X.690 sec. 11.2.2 minimal-DER rule (no trailing zero
-      // bits) that the shared certExtensionDecoders keyUsage decoder applies, so a non-minimal
-      // encoding other paths reject cannot slip a "permits signing" verdict through here.
-      schema.assertMinimalNamedBits(ku.unusedBits, ku.bytes, function (m) { throw _err("tsp/bad-key-usage", m); });
-    } catch (_e) { return "tsp/bad-key-usage"; }
-    var byte0 = ku.bytes.length ? ku.bytes[0] : 0;
-    if (!((byte0 >> 7) & 1) && !((byte0 >> 6) & 1)) return "tsp/bad-key-usage";   // no digitalSignature / nonRepudiation
-  }
+  // Through the shared reader, which applies the NamedBitList rules (X.690 sec. 11.2.2 minimal
+  // encoding, sec. 4.2.1.3 at least one bit set) this boundary was applying only half of.
+  var ku;
+  try { ku = pkix.keyUsageOf(_NS, cert, _err, "tsp/bad-key-usage", "TSA certificate"); }
+  catch (_e) { return "tsp/bad-key-usage"; }
+  if (ku && !ku.digitalSignature && !ku.nonRepudiation) return "tsp/bad-key-usage";
   return true;
 }
 
@@ -570,7 +564,7 @@ function _buildTsaChains(leaf, pool) {
  * PEM (never a parsed object -- every checked field is read from the CMS-verified eContent, so a
  * mutated parsed structure cannot desynchronize the checks from the signed bytes). `data` is the
  * original bytes (hashed under the token's messageImprint algorithm) or a precomputed
- * `{ hashAlgorithm, hashedMessage }`. Returns `{ valid, genTime, accuracy, serialNumber,
+ * `{ hashAlgorithm, hashedMessage }`. Returns `{ valid, trusted, genTime, accuracy, serialNumber,
  * serialNumberHex, policy, nonce, tsa, tstInfo, signer, code?, reason? }`. `valid` is true only
  * when the CMS signature, the imprint match, the eContentType, the ESSCertID(V2) binding, the
  * RFC 3161 sec. 2.3 critical single-`timeStamping` extendedKeyUsage rule, the requested nonce (when
@@ -578,6 +572,13 @@ function _buildTsaChains(leaf, pool) {
  * validation all pass. A conformance / trust failure of a well-formed token is a
  * `{ valid:false, code }` verdict; malformed or config input throws a typed `TspError`.
  *
+ * `trusted` is the second claim and is kept apart from the first. `valid` says the token's
+ * signature and structural bindings hold; `trusted` says the timestamp authority chained to an
+ * anchor this caller named. Without `trustAnchor` there is nothing to chain to and `trusted` is
+ * `false` -- a definite answer rather than a missing one, on the refusal branch as well as the
+ * accepting one. A timestamp is archived precisely to be re-read years later, and one boolean
+ * cannot answer both questions then.
+ *
  * @opts  trustAnchor   Anchor `{ name, publicKey, algorithm }` -- runs `pki.path.validate` on the
  *                       TSA certificate chain ordered from the token's embedded certificates
  *                       (validity at genTime, requiredEku timeStamping, revocation), so a TSA under
@@ -625,8 +626,12 @@ async function verify(token, data, opts) {
   // structure and decodes the TSTInfo FROM the raw eContent; a structural defect throws.
   var parsed = schemaTsp.parseToken(tokenDer);
   var tst = parsed.tstInfo;
+  // `trusted: false` on every refusal too, not only on the accepting return. A caller reading
+  // `res.trusted` must get an answer on both branches -- an undefined on the failure path is the
+  // same "cannot tell what was checked" the field was added to remove, and `!res.trusted` reading
+  // true by accident is not the same as its reading true because nothing anchored the TSA.
   function fail(code, reason) {
-    return { valid: false, code: code, reason: reason || null, genTime: tst.genTime, accuracy: tst.accuracy, serialNumber: tst.serialNumber, serialNumberHex: tst.serialNumberHex, policy: tst.policy, nonce: tst.nonce, tsa: tst.tsa, tstInfo: tst, signer: null };
+    return { valid: false, trusted: false, code: code, reason: reason || null, genTime: tst.genTime, accuracy: tst.accuracy, serialNumber: tst.serialNumber, serialNumberHex: tst.serialNumberHex, policy: tst.policy, nonce: tst.nonce, tsa: tst.tsa, tstInfo: tst, signer: null };
   }
   // M12 -- the CMS signature over the exact RFC 5652 sec. 5.4 preimage (message-digest bound to the
   // authenticated eContent). cms.verify re-parses the same bytes; a failure is a fail-closed verdict.
@@ -673,6 +678,14 @@ async function verify(token, data, opts) {
   // key-param inheritance, requiredEku, optional revocation), only when a trustAnchor is supplied.
   // The path is ordered from the token's embedded certificates (leaf + any intermediates), so a TSA
   // issued under an intermediate CA -- not just directly under the anchor -- validates.
+  // `trusted` is the SECOND claim, kept apart from `valid`. `valid` says the token's signature and
+  // its structural bindings hold; whether the timestamp authority is one this caller accepts is
+  // answered only by the chain below, and only when an anchor was supplied. Collapsing the two into
+  // one boolean meant an archived verdict could not be re-read to tell whether the TSA was ever
+  // trusted -- which is exactly what a timestamp is archived to answer. Without an anchor there is
+  // nothing to chain to and `trusted` is false: a definite answer rather than a missing one, the
+  // same shape pki.cms.verify and pki.cmp.verify return.
+  var trusted = false;
   if (opts.trustAnchor) {
     var pathRes = null;
     // tst.genTime floors to millisecond precision. When genTime carries sub-millisecond digits the true
@@ -693,22 +706,30 @@ async function verify(token, data, opts) {
       // path.validate validates a FIXED path, so backtracking over same-subject issuer candidates
       // happens here -- accept the TSA certificate if ANY enumerated chain validates to the anchor at
       // both window endpoints.
+      //
+      // checkPurpose names timeStamping alongside requiredEku, and the pairing is the point. The EKU
+      // constrains the TSA CERTIFICATE; checkPurpose selects the ANCHOR's own trust metadata, which
+      // pki.path consults only when a purpose is named -- so asking one without the other checks one
+      // end of the chain and not the other, and a root explicitly distrusted for timestamping would
+      // still answer trusted. The purpose is not a caller choice here: this verb validates timestamp
+      // tokens and nothing else, so there is exactly one purpose its anchors can be judged under.
       var chains = _buildTsaChains(pkiX509.parse(tsaCertDer), pool);
       for (var ci = 0; ci < chains.length && !(pathRes && pathRes.valid); ci++) {
         pathRes = await pathValidate.validate(chains[ci], {
-          time: floorT, trustAnchor: opts.trustAnchor, requiredEku: ["timeStamping"], revocationChecker: opts.revocationChecker,
+          time: floorT, trustAnchor: opts.trustAnchor, requiredEku: ["timeStamping"], checkPurpose: "timeStamping", revocationChecker: opts.revocationChecker,
         });
         if (pathRes.valid && ceilT !== floorT) {
           pathRes = await pathValidate.validate(chains[ci], {
-            time: ceilT, trustAnchor: opts.trustAnchor, requiredEku: ["timeStamping"], revocationChecker: opts.revocationChecker,
+            time: ceilT, trustAnchor: opts.trustAnchor, requiredEku: ["timeStamping"], checkPurpose: "timeStamping", revocationChecker: opts.revocationChecker,
           });
         }
       }
     } catch (e) { return fail("tsp/untrusted-tsa", (e && e.message) || String(e)); }
     if (!pathRes || !pathRes.valid) return fail("tsp/untrusted-tsa", "the TSA certificate did not validate to the trust anchor at genTime");
+    trusted = true;
   }
   return {
-    valid: true, genTime: tst.genTime, accuracy: tst.accuracy,
+    valid: true, trusted: trusted, genTime: tst.genTime, accuracy: tst.accuracy,
     serialNumber: tst.serialNumber, serialNumberHex: tst.serialNumberHex,
     policy: tst.policy, policyName: tst.policyName, nonce: tst.nonce, tsa: tst.tsa,
     tstInfo: tst, signer: { cert: tsaCertDer, sid: signer.sid },

package/lib/validator-cose.js

@@ -57,6 +57,17 @@ var OKP_CRV = { 6: { oid: "Ed25519", len: 32 }, 7: { oid: "Ed448", len: 57 } };
 // -8 (EdDSA) is Ed25519 ONLY, and the RFC 9864 fully-specified ids (-9 ESP256, -51 ESP384,
 // -52 ESP512, -19 Ed25519, -53 Ed448) each pin key type + curve. A verifier accepts the
 // fully-specified ids even though WebAuthn recommends against them for credential creation.
+// The RSA credential-key bounds. 2048 bits is the floor every current FIDO authenticator and
+// NIST SP 800-57 agree on; nothing in the field emits less, so the floor refuses forgeable keys
+// without refusing real ones. The exponent bound is a work bound, not a security one.
+var RSA_MIN_MODULUS_BITS = 2048;
+var RSA_MAX_EXPONENT_BYTES = 8;
+// The modulus BIT length. A byte count is not one: minimally encoded, a 256-byte modulus whose
+// leading byte is 0x01 is 2041 bits, and would clear a floor expressed in bytes while sitting below
+// the floor that floor exists to state. The leading byte is non-zero by the minimal-encoding check
+// above, so its position fixes the total.
+function _modulusBits(n) { return (n.length - 1) * 8 + (32 - Math.clz32(n[0])); }
+
 var ALG_PROFILE = {
   "-7": { kty: 2, crv: 1 }, "-35": { kty: 2, crv: 2 }, "-36": { kty: 2, crv: 3 },
   "-9": { kty: 2, crv: 1 }, "-51": { kty: 2, crv: 2 }, "-52": { kty: 2, crv: 3 },
@@ -111,6 +122,34 @@ function credentialKey(node, E, code, unsupportedCode) {
   } else if (kty === 3n) {
     key.n = ib(-1); key.e = ib(-2);
     if (!key.n || !key.n.length || !key.e || !key.e.length) throw bad("an RSA COSE_Key must carry n (-1) and e (-2)");
+    // The MATERIAL, not merely its presence -- the same standard the other two key types are held
+    // to, where EC2 pins x/y to the curve's field size and has the point validated on the curve,
+    // and OKP pins x to an exact length. Checking only presence let a 1-byte modulus and an
+    // exponent of 1 through as conformant credential public keys, and both reach the WebCrypto
+    // import, so they reach real signature verification. e = 1 makes RSA the identity function:
+    // the "signature" is the message, and it verifies under any modulus.
+    // BOTH values first, before either is judged. RFC 8230 sec. 4 encodes n and e as unsigned
+    // big-endian integers with no leading zero, and every check below reads a byte LENGTH as though
+    // it were a magnitude: the modulus floor, the exponent bound, and the exponent's value. A
+    // padded encoding decouples the two, so `00 01` would be read as a two-byte exponent and skip
+    // the value check that refuses 1 -- the degenerate key the whole check exists to catch. (An EC2
+    // coordinate is the opposite case, fixed-width and zero-padded by definition, which is why this
+    // rule is stated for the RSA parameters and not for x/y.)
+    if (key.n[0] === 0) throw bad("an RSA COSE_Key modulus (-1) must be minimally encoded, with no leading zero byte (RFC 8230 sec. 4)");
+    if (key.e[0] === 0) throw bad("an RSA COSE_Key exponent (-2) must be minimally encoded, with no leading zero byte (RFC 8230 sec. 4)");
+    var modulusBits = _modulusBits(key.n);
+    if (modulusBits < RSA_MIN_MODULUS_BITS) {
+      throw bad("an RSA COSE_Key modulus (-1) is " + modulusBits + " bits, below the " +
+        RSA_MIN_MODULUS_BITS + "-bit minimum");
+    }
+    // e must be odd and greater than 1: RSA needs gcd(e, phi(n)) = 1, so an even exponent is not a
+    // valid RSA public exponent at all, and 1 is the degenerate case above. Bounded on the way in
+    // so a caller cannot hand over a megabyte of exponent for the modular exponentiation to chew.
+    if (key.e.length > RSA_MAX_EXPONENT_BYTES) throw bad("an RSA COSE_Key exponent (-2) is longer than " + RSA_MAX_EXPONENT_BYTES + " bytes");
+    if ((key.e[key.e.length - 1] & 1) === 0) throw bad("an RSA COSE_Key exponent (-2) must be odd");
+    // Minimal encoding above makes a one-byte e the ONLY way to express a value this small, so the
+    // comparison is on the value and not on where it happens to sit.
+    if (key.e.length === 1 && key.e[0] <= 1) throw bad("an RSA COSE_Key exponent (-2) must be greater than 1 -- e = 1 makes RSA the identity function");
   } else {
     throw bad("unsupported COSE_Key kty " + Number(kty));
   }