@blamejs/pki 0.5.24 → 0.5.26

package/lib/path-validate.js

@@ -1695,38 +1695,23 @@ function decodeIdp(ext) {
 }
 
 // RFC 5280 sec. 6.3.3(b)(2)(i): find the certificate DistributionPoint that
-// CORRESPONDS to a shard CRL's IDP distribution point name -- at least one
-// name in common between the two DistributionPointNames, compared by
-// BYTE-IDENTICAL DER encoding (Buffer.equals on the raw GeneralName / RDN
-// TLVs). sec. 5.2.5 pins the comparison key: "The identical encoding MUST be
-// used in the distributionPoint fields of the certificate and the CRL" -- so
-// a canonicalized or semantic comparison (which would equate two
-// differently-encoded names) is forbidden, and whole-set equality (which
-// would falsely reject a legitimate multi-URI DP sharing one name) is
-// over-strict. Mixed forms -- fullName on one side, nameRelativeToCRLIssuer
-// on the other -- never correspond here: resolving an RDN fragment against
-// the issuer DN is not attempted (fail closed). Per sec. 6.3.3(b)(1), a DP
-// naming a cRLIssuer participates only when that cRLIssuer is the certificate
-// issuer itself: the checker only consults CRLs issued BY the certificate
-// issuer and rejects indirect CRLs, so a DP delegated to another CRL issuer
-// is out of play. Returns the matched DP (its `reasons` feeds the coarse
-// reason-mask rule) or null.
+// CORRESPONDS to a shard CRL's IDP distribution point name. The correspondence
+// rule itself -- at least one name in common, compared by BYTE-IDENTICAL DER,
+// mixed name forms never corresponding -- is guard.name.dpnCorresponds, which
+// is also what a CMP crlUpdate answer is held to, so one definition decides
+// whether a CRL speaks for a point wherever the question is asked. Per sec.
+// 6.3.3(b)(1), a DP naming a cRLIssuer participates only when that cRLIssuer
+// is the certificate issuer itself: the checker only consults CRLs issued BY
+// the certificate issuer and rejects indirect CRLs, so a DP delegated to
+// another CRL issuer is out of play. Returns the matched DP (its `reasons`
+// feeds the coarse reason-mask rule) or null.
 function correspondingCertDp(idpDpn, certDPs, issuerRdns) {
   if (!idpDpn || !certDPs) return null;
   for (var i = 0; i < certDPs.length; i++) {
     var dp = certDPs[i];
     if (!dp.distributionPoint) continue;
     if (dp.cRLIssuer && !crlIssuerNamesIssuer(dp.cRLIssuer, issuerRdns)) continue;
-    var cdpn = dp.distributionPoint;
-    if (idpDpn.kind === "fullName" && cdpn.kind === "fullName") {
-      for (var a = 0; a < idpDpn.names.length; a++) {
-        for (var c = 0; c < cdpn.names.length; c++) {
-          if (idpDpn.names[a].equals(cdpn.names[c])) return dp;
-        }
-      }
-    } else if (idpDpn.kind === "rdn" && cdpn.kind === "rdn") {
-      if (idpDpn.bytes.equals(cdpn.bytes)) return dp;
-    }
+    if (guard.name.dpnCorresponds(idpDpn, dp.distributionPoint, E, "path/bad-idp", "a CRL distribution point")) return dp;
   }
   return null;
 }
@@ -2332,7 +2317,10 @@ var ocspCore = ocspVerify.makeOcspVerify({
 // of it on the public pki.path surface (index.js exports the whole path-validate module).
 cmpVerify.setEngine({ verifyWithSpki: _verifyWithSpki, build: build, validate: validate });
 // pki.cmp.session validates the ISSUED leaf certificate (its signature + chain) through the same engine.
-cmpSession.setEngine({ build: build, validate: validate, toAnchor: toAnchor, coerceCert: coerceCert });
+// `verifyWithSpki` so a root CA key update's rollover signatures are checked by the same signature
+// engine (with its EdDSA low-order-point and algorithm-confusion gates) that verifies a message's
+// protection, rather than a second, weaker check inside the session.
+cmpSession.setEngine({ build: build, validate: validate, toAnchor: toAnchor, coerceCert: coerceCert, verifyWithSpki: _verifyWithSpki });
 // pki.cms.verify chains a SignedData's signer certificate to the anchors the CALLER named, so its
 // `trusted` is decided by this one path engine rather than a second, weaker walk of its own.
 // `toAnchor` so cms.verify can validate the caller's anchors ONCE at entry, before any signer is

package/lib/pki-build.js

@@ -18,9 +18,16 @@ var intrinsic = require("./guard-intrinsic");
 // Each of these doors refuses a caller argument that is not a list. Read live, a replacement
 // answering true lets a non-list through the check written to stop it.
 var _isArray = intrinsic.isArray;
+// Taken at load for the reason every capture here is: the question "do these two encodings name the
+// same key" decides whether a proof of possession is accepted, and a caller who replaces the copy or
+// the comparison afterwards decides it instead.
+var _bufferFrom = intrinsic.bufferFrom;
+var _bufferEquals = intrinsic.bufferEquals;
 var oid = require("./oid");
 var ipUtils = require("./ip-utils");
 var nodeCrypto = require("crypto");
+// The key-material comparison, taken at load like every other operation a decision here rests on.
+var _keyEquals = intrinsic.uncurry(nodeCrypto.KeyObject.prototype.equals);
 
 var b = asn1.build;
 
@@ -402,6 +409,27 @@ function makeBuilder(ctx) {
     if (!ok) throw E("bad-input", "the signing key does not correspond to the public key -- the signature would not verify");
   }
 
+  // Do two SubjectPublicKeyInfo encodings name the same key? Bytes first, because that is the answer
+  // almost always and it costs nothing. When they differ the question is still open, since one key has
+  // more than one legal SPKI: an EC point may be carried compressed or uncompressed, so a P-256 key
+  // written the compressed way is byte-unequal to the same key written the other. Comparing the DER
+  // alone would refuse a proof of possession over a key the requester genuinely holds, while the
+  // sibling arms of the same verb accept that template. The fallback asks the key layer, which
+  // compares key material and still answers false for a different key, a different curve, or a
+  // different algorithm. A key neither side can import is equal to nothing, so the refusal stands.
+  function samePublicKey(spkiA, spkiB) {
+    var a = _bufferFrom(spkiA), bb = _bufferFrom(spkiB);
+    if (_bufferEquals(a, bb)) return true;
+    var ka, kb;
+    // allow:swallow-unverified an SPKI the key layer cannot import matches nothing, which is the
+    // refusal the caller wants; the caller raises its own typed error on the false.
+    try {
+      ka = nodeCrypto.createPublicKey({ key: a, format: "der", type: "spki" });
+      kb = nodeCrypto.createPublicKey({ key: bb, format: "der", type: "spki" });
+    } catch (_e) { return false; }
+    return _keyEquals(ka, kb) === true;
+  }
+
   return {
     E: E, code: code, KU_BIT: KU_BIT,
     encodeName: encodeName, isEmptyName: isEmptyName, encodeGeneralName: encodeGeneralName,
@@ -413,6 +441,7 @@ function makeBuilder(ctx) {
     spkiKeyId: spkiKeyId, skiKeyId: skiKeyId,
     reqDer: reqDer, assertValidSpki: assertValidSpki, assertValidExtension: assertValidExtension,
     certLikeFromSpki: certLikeFromSpki, assertSignatureVerifies: assertSignatureVerifies,
+    samePublicKey: samePublicKey,
   };
 }
 

package/lib/schema-cmp.js

@@ -836,6 +836,99 @@ var PKI_MESSAGE = schema.seq([
   },
 });
 
+// ---- support-message infoValue structures (RFC 9480 sec. 2.14-2.17) -----
+//
+// A genm / genp carries its payload as an ANY, so the InfoTypeAndValue leaf above
+// surfaces it as raw bytes. These are the strict decoders for the four values RFC 9483
+// sec. 4.3 defines, each a standalone parser so a malformed payload is refused with the
+// same caps, minimal-encoding and trailing-byte rules the message itself is held to.
+// The CMP module is EXPLICIT TAGS, so every context tag here wraps its value.
+
+// CACertsValue ::= SEQUENCE SIZE (1..MAX) OF CMPCertificate. An absent infoValue is how
+// "no CA certificate is available" is said (sec. 4.3.1), so an EMPTY sequence is malformed
+// rather than a second spelling of the same answer.
+var CA_CERTS_VALUE = schema.seqOf(rawSequence("cmp/bad-info-value"), {
+  min: 1, code: "cmp/bad-info-value", what: "CACertsValue",
+  build: function (m) { return m.items.map(function (it) { return it.value; }); },
+});
+
+// RootCaKeyUpdateContent ::= SEQUENCE { newWithNew CMPCertificate,
+//   newWithOld [0] CMPCertificate OPTIONAL, oldWithNew [1] CMPCertificate OPTIONAL }
+// (RFC 9480 sec. 2.15). Both optionals are OPTIONAL in the syntax; RFC 9483 sec. 4.3.2
+// requires newWithOld of a response, which the caller of this decoder enforces.
+var ROOT_CA_KEY_UPDATE = schema.seq([
+  schema.field("newWithNew", rawSequence("cmp/bad-info-value")),
+  schema.trailing([
+    { tag: 0, name: "newWithOld", schema: rawSequence("cmp/bad-info-value"), explicit: true, emptyCode: "cmp/bad-info-value" },
+    { tag: 1, name: "oldWithNew", schema: rawSequence("cmp/bad-info-value"), explicit: true, emptyCode: "cmp/bad-info-value" },
+  ], { minTag: 0, maxTag: 1, unexpectedCode: "cmp/bad-info-value", orderCode: "cmp/bad-info-value" }),
+], {
+  assert: "sequence", code: "cmp/bad-info-value", what: "RootCaKeyUpdateContent",
+  build: function (m) {
+    return {
+      newWithNew: m.fields.newWithNew.value,
+      newWithOld: m.fields.newWithOld.present ? m.fields.newWithOld.value : null,
+      oldWithNew: m.fields.oldWithNew.present ? m.fields.oldWithNew.value : null,
+    };
+  },
+});
+
+// AttributeTypeAndValue ::= SEQUENCE { type OBJECT IDENTIFIER, value ANY }, the element of
+// the Controls that carries a CertReqTemplate keySpec (RFC 9480 sec. 2.16). The value stays
+// raw here: which syntax it must have depends on the type, which sec. 4.3.3 constrains.
+var ATTR_TYPE_AND_VALUE = schema.seq([
+  schema.field("type", schema.oidLeaf()),
+  schema.field("value", schema.any()),
+], {
+  assert: "sequence", code: "cmp/bad-info-value", what: "AttributeTypeAndValue",
+  build: function (m, ctx) {
+    var t = m.fields.type.value;
+    return { type: t, name: ctx.oid.name(t) || null, value: m.fields.value.value.bytes };
+  },
+});
+
+// CertReqTemplateContent ::= SEQUENCE { certTemplate CertTemplate, keySpec Controls OPTIONAL }
+// (RFC 9480 sec. 2.16). keySpec is untagged, so it is recognized by its universal SEQUENCE tag
+// following the CertTemplate, which is itself IMPLICIT [tagged] by the CRMF module.
+var CERT_REQ_TEMPLATE_VALUE = schema.seq([
+  schema.field("certTemplate", CERT_TEMPLATE_LEAF),
+  schema.optional("keySpec", schema.seqOf(ATTR_TYPE_AND_VALUE, {
+    min: 1, code: "cmp/bad-info-value", what: "CertReqTemplate keySpec",
+    build: function (m) { return m.items.map(function (it) { return it.value.result; }); },
+  }), { whenUniversal: [TAGS.SEQUENCE] }),
+], {
+  assert: "sequence", code: "cmp/bad-info-value", what: "CertReqTemplateValue",
+  build: function (m) {
+    return {
+      certTemplate: m.fields.certTemplate.value,
+      keySpec: m.fields.keySpec.present ? m.fields.keySpec.value.result : null,
+    };
+  },
+});
+
+// CRLsValue ::= SEQUENCE SIZE (1..MAX) OF CertificateList (RFC 9480 sec. 2.17).
+var CRLS_VALUE = schema.seqOf(rawSequence("cmp/bad-info-value"), {
+  min: 1, code: "cmp/bad-info-value", what: "CRLsValue",
+  build: function (m) { return m.items.map(function (it) { return it.value; }); },
+});
+
+function _valueParser(what, topSchema) {
+  return pkix.makeParser({ pemLabel: "CMP", PemError: PemError, ErrorClass: CmpError, prefix: "cmp", what: what, topSchema: topSchema, ns: NS });
+}
+// @internal -- pki.cmp.session reads a support-message response through these.
+var readCaCerts = _valueParser("CACertsValue", CA_CERTS_VALUE);
+var readRootCaKeyUpdate = _valueParser("RootCaKeyUpdateContent", ROOT_CA_KEY_UPDATE);
+var readCertReqTemplate = _valueParser("CertReqTemplateValue", CERT_REQ_TEMPLATE_VALUE);
+var readCrls = _valueParser("CRLsValue", CRLS_VALUE);
+// A CertReqTemplate keySpec states a key requirement as an AlgorithmIdentifier (RFC 9480 sec. 2.16),
+// which is the shared sub-schema every format already reads one with: `SEQUENCE { algorithm OID,
+// parameters ANY OPTIONAL }` and nothing after it. Reading it through the same definition is what
+// keeps a third field from passing as a well-formed one.
+var readAlgorithmIdentifier = _valueParser("AlgorithmIdentifier", ALG_ID);
+// A bare Name, so a caller-encoded issuer can be read back into the RDN sequence that guard-name's
+// canonical comparison takes. pki.cmp.session binds a returned CRL to the issuer it asked for.
+var readName = _valueParser("Name", pkix.name(NS));
+
 /**
  * @primitive  pki.schema.cmp.parse
  * @signature  pki.schema.cmp.parse(input) -> pkiMessage
@@ -970,4 +1063,11 @@ module.exports = {
   pemDecode: pemDecode,
   pemEncode: pemEncode,
   matches: matches,
+  // @internal -- the RFC 9483 sec. 4.3 support-message values, read strictly from a genp.
+  readCaCerts: readCaCerts,
+  readRootCaKeyUpdate: readRootCaKeyUpdate,
+  readCertReqTemplate: readCertReqTemplate,
+  readCrls: readCrls,
+  readAlgorithmIdentifier: readAlgorithmIdentifier,
+  readName: readName,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.24",
+  "version": "0.5.26",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:1d864685-81db-45d8-92b0-ef5b74906999",
+  "serialNumber": "urn:uuid:af65ad7a-ef35-4bc4-8aef-24a43cb8ece0",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-21T11:03:39.559Z",
+    "timestamp": "2026-08-23T00:05:35.940Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.24",
+      "bom-ref": "@blamejs/pki@0.5.26",
       "type": "application",
       "name": "pki",
-      "version": "0.5.24",
+      "version": "0.5.26",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.24",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.26",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.24",
+      "ref": "@blamejs/pki@0.5.26",
       "dependsOn": []
     }
   ]