@blamejs/pki 0.5.29 → 0.5.30

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.5.30 — 2026-08-24
+
+A CMP certReqTemplate keySpec that names an ISO/IEC 9796-2 RSA signature scheme is now refused, instead of being surfaced to the caller as a non-RSA algorithm requirement.
+
+### Security
+
+- `pki.cmp.session` refuses a certReqTemplate keySpec whose `id-regCtrl-algId` names an ISO/IEC 9796-2 RSA signature-with-message-recovery scheme, with `cmp/bad-info-value`, rather than surfacing it to the caller as a non-RSA algorithm requirement. RFC 9483 sec. 4.3.3 reserves an RSA key requirement for `id-regCtrl-rsaKeyLen`; the 9796-2 schemes are RSA, so a keySpec naming one is now rejected the same way an rsaEncryption or RSASSA-PSS algId already was. The classifier recognizes the deterministic (1.3.36.3.4.2) and randomized (1.3.36.3.4.3) sub-arcs by prefix -- so a hash variant registered later is caught without being listed -- and ISO/IEC 9796-1 (1.3.36.3.4.1) on the same registrant arc. The generic signatureScheme parent (1.3.36.3.4) and the sibling authentication arc (1.3.36.3.5, whose children include ECC) are not treated as RSA, so a non-RSA algorithm under either is still surfaced. Recognizing these OIDs classifies a keySpec requirement; it is not a claim that the toolkit produces or verifies a 9796-2 signature.
+
 ## v0.5.29 — 2026-08-24
 
 pki.path.validate refuses a mis-shaped trust anchor instead of returning a verdict against it, and accepts a parsed certificate directly.

package/lib/cmp-session.js

@@ -135,10 +135,15 @@ var KNOWN_REVOKE_KEYS = { certificate: 1, certDetails: 1, reason: 1 };
 // "RSA" is decided by OID FAMILY, not a hand-list. An RSA-DEDICATED arc -- one whose members are RSA --
 // is matched by its prefix, so a standardized member this registry has not named is caught with the ones
 // it has: PKCS#1 (rsaEncryption, PSS, OAEP, every sha*/md*WithRSAEncryption), the TeleTrusT rsaSignature
-// arc (RSA with SHA-1 and the RIPEMD family), and the BSI TR-03110 id-TA-RSA arc (EAC Terminal
-// Authentication, RSA v1.5/PSS over SHA-1/256/512). Each prefix is the arc a registered member sits
-// directly under, read from the registry, so no dotted-decimal literal appears here and pki.oid.register
-// cannot move it. The PKCS#1 arc also carries two auxiliary identifiers that are NOT RSA algorithms --
+// arc (RSA with SHA-1 and the RIPEMD family), the TeleTrusT signatureScheme arc (the ISO/IEC 9796-2 RSA
+// signature-with-message-recovery schemes -- deterministic 1.3.36.3.4.2 and randomized .4.3 -- plus ISO/IEC
+// 9796-1 on .4.1), and the BSI TR-03110 id-TA-RSA arc (EAC Terminal Authentication, RSA v1.5/PSS over
+// SHA-1/256/512). Each prefix is the arc a registered member sits directly under, read from the registry,
+// so no dotted-decimal literal appears here and pki.oid.register cannot move it. The strict-descendant
+// match skips an arc NODE itself, so a scheme's bare arc node (the 9796 1.3.36.3.4.1/.2/.3 nodes) is named
+// off-arc below; the generic signatureScheme PARENT (1.3.36.3.4) and the sibling authentication arc
+// (1.3.36.3.5, whose .5.3 children are ECC) are NOT RSA-dedicated, so neither is prefix-matched. The PKCS#1
+// arc also carries two auxiliary identifiers that are NOT RSA algorithms --
 // mgf1 and pSpecified, the mask-generation and OAEP-label parameters -- so those are excluded from the
 // match by name (RSA_ARC_EXCLUDE) and surfaced. RSA also sits off those arcs on ones it SHARES with non-RSA
 // algorithms, where no prefix can isolate it, so those are listed by name: id-rsa-kem (S/MIME) and
@@ -151,7 +156,8 @@ var KNOWN_REVOKE_KEYS = { certificate: 1, certDetails: 1, reason: 1 };
 // Chinese GM/T sm3WithRSAEncryption (1.2.156.10197.1.504), an RSA-over-SM3 signature on the SM arc it
 // shares with SM2 and SM3. A composite signature naming RSA as one half is a composite key, not an RSA
 // one, and lives on the PKIX arc, so it is outside all of these.
-var RSA_ARCS = ["rsaEncryption", "rsaSignatureWithripemd160", "id-TA-RSA-v1-5-SHA-256"].map(function (n) {
+var RSA_ARCS = ["rsaEncryption", "rsaSignatureWithripemd160", "id-TA-RSA-v1-5-SHA-256",
+  "sigS-ISO9796-1-DFUE", "sigS-ISO9796-2Withrsa", "sigS-ISO9796-2rndWithrsa"].map(function (n) {
   return oid.toArcs(oid.byName(n)).slice(0, -1);   // the RSA-dedicated arc a registered member sits directly under
 });
 var RSA_OFF_ARC = Object.create(null);
@@ -165,6 +171,9 @@ var RSA_OFF_ARC = Object.create(null);
   "rsa",   // the X.509 directory rsa public-key OID (2.5.8.1.1), distinct from PKCS#1 rsaEncryption
   "sqMod-nWithRSA", "mdc2WithRSA",   // the X.500 directory signatureAlgorithm RSA OIDs (2.5.8.3.1, 2.5.8.3.100)
   "sm3WithRSAEncryption",   // the Chinese GM/T RSA-with-SM3 signature (1.2.156.10197.1.504)
+  // The TeleTrusT signatureScheme (ISO/IEC 9796-2) sub-arcs are prefix-matched in RSA_ARCS, but the strict-
+  // descendant match skips each arc NODE itself, so the three bare nodes are named here (1.3.36.3.4.1/.2/.3).
+  "sigS-ISO9796-1", "sigS-ISO9796-2", "sigS-ISO9796-2rnd",
 ].forEach(function (n) { var d = oid.byName(n); if (d) RSA_OFF_ARC[d] = 1; });
 // The PKCS#1 arc carries two identifiers that are NOT RSA algorithms: mgf1 (the mask-generation function
 // RSA-PSS and RSA-OAEP parametrize) and pSpecified (the OAEP label source). The prefix match would sweep

package/lib/oid.js

@@ -456,6 +456,30 @@ var FAMILIES = {
   // registered here so that prefix can be derived from the registry rather than a dotted-decimal literal.
   teletrustRsaSig: { base: [1, 3, 36, 3, 3, 1], of: { "rsaSignatureWithripemd160": 2 } },
 
+  // TeleTrusT (BSI) signatureScheme arc (1.3.36.3.4) -- the ISO/IEC 9796-2 RSA signatures giving message
+  // recovery (schemes 1/2/3: two deterministic, one randomized). ISO/IEC 9796-2 is titled "integer
+  // factorization based mechanisms", so EVERY scheme it defines is RSA and the standard has no non-RSA
+  // member; each node is registered so a consumer can name it -- e.g. the CMP keySpec RSA exclusion, which
+  // must recognize RSA wherever it is standardized. ISO/IEC 9796-2 assigns no algorithm OIDs of its own;
+  // this registrant tree is the de-facto registry. The .2 (deterministic) and .3 (randomized) sub-arcs are
+  // RSA-dedicated in full -- every descendant is RSA -- so a consumer prefix-matches each to catch a hash
+  // variant added later; the per-hash leaves are registered for readability. The `...Withrsa-even-exp`
+  // nodes (.2.1 / .3.1) are the even-public-exponent RSA variants the registrant marks "not used"; they are
+  // RSA (the registrant names them `sigS_ISO9796-2Withrsa_even-exp`), so the sub-arc prefix classifies them
+  // correctly, not wrongly. .1 is ISO/IEC 9796-1, also RSA, on the same arc. The PARENT node (.4) is generic
+  // "signatureScheme" and the sibling authentication arc (.5) is mixed (its .5.3 children are ECC), so
+  // neither is RSA-dedicated -- a consumer must not prefix-match the parent or .5.
+  teletrustSigScheme: { base: [1, 3, 36, 3, 4], of: {
+    "sigS-ISO9796-1": 1, "sigS-ISO9796-1-DFUE": [1, 1],
+    "sigS-ISO9796-2": 2, "sigS-ISO9796-2Withrsa-even-exp": [2, 1], "sigS-ISO9796-2Withrsa": [2, 2],
+    "sigS-ISO9796-2Withrsa-sha1": [2, 2, 1], "sigS-ISO9796-2Withrsa-ripemd160": [2, 2, 2],
+    "sigS-ISO9796-2Withrsa-sha224": [2, 2, 3], "sigS-ISO9796-2Withrsa-sha256": [2, 2, 4],
+    "sigS-ISO9796-2Withrsa-sha384": [2, 2, 5], "sigS-ISO9796-2Withrsa-sha512": [2, 2, 6],
+    "sigS-ISO9796-2rnd": 3, "sigS-ISO9796-2rndWithrsa-even-exp": [3, 1], "sigS-ISO9796-2rndWithrsa": [3, 2],
+    "sigS-ISO9796-2rndWithrsa-sha1": [3, 2, 1], "sigS-ISO9796-2rndWithrsa-ripemd160": [3, 2, 2],
+    "sigS-ISO9796-2rndWithrsa-sha224": [3, 2, 3], "sigS-ISO9796-2rndWithrsa-sha256": [3, 2, 4],
+    "sigS-ISO9796-2rndWithrsa-sha384": [3, 2, 5], "sigS-ISO9796-2rndWithrsa-sha512": [3, 2, 6] } },
+
   // X.509 directory encryptionAlgorithm arc (2.5.8.1). id-ea-rsa (.1) is the X.509 `rsa` public-key
   // identifier, distinct from PKCS#1 rsaEncryption. Registered so a consumer can name it -- e.g. the
   // CMP keySpec RSA exclusion, which must recognize RSA wherever it is standardized.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.29",
+  "version": "0.5.30",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:6fc4808e-4377-42ae-a5a4-080dbff3e1df",
+  "serialNumber": "urn:uuid:a82d39df-dc02-419e-86bb-787363fa4d07",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-24T18:48:42.954Z",
+    "timestamp": "2026-08-24T19:49:42.857Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.29",
+      "bom-ref": "@blamejs/pki@0.5.30",
       "type": "application",
       "name": "pki",
-      "version": "0.5.29",
+      "version": "0.5.30",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.29",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.30",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.29",
+      "ref": "@blamejs/pki@0.5.30",
       "dependsOn": []
     }
   ]