@blamejs/pki 0.5.3 → 0.5.5

package/lib/crl-sign.js

@@ -30,6 +30,7 @@ var signScheme = require("./sign-scheme");
 var guard = require("./guard-all");
 var frameworkError = require("./framework-error");
 var pkix = require("./schema-pkix");
+var schema = require("./schema-engine");
 var pkiBuild = require("./pki-build");
 var constants = require("./constants");
 require("./path-validate");   // side-effect: path-validate injects its signature engine into crl-verify at load
@@ -183,17 +184,22 @@ function _idpValue(idp) {
 // Validate a pre-encoded IssuingDistributionPoint value against the same RFC 5280 sec. 5.2.5 profile the
 // object form enforces: MUST NOT be empty; at most one of onlyContainsUserCerts [1] / onlyContainsCACerts [2]
 // TRUE; onlyContainsAttributeCerts [5] MUST be FALSE; indirectCRL [4] deferred (crlChecker skips indirect CRLs).
+// Read through the shared sec. 5.2.5 grammar, not a walk over the raw children: each scope flag is
+// an IMPLICIT BOOLEAN whose meaning is fixed by the encoding rules, and a caller-supplied encoding
+// is exactly where a flag that is not one content octet of 0x00 or 0xFF arrives. Deciding TRUE from
+// a content byte would emit a CRL whose scope this toolkit and the relying party read differently.
+var _PRE_ENCODED_IDP_SCHEMA = pkix.issuingDistributionPoint("crl/bad-idp");
 function _validatePreEncodedIdp(inner) {
   if (!inner.children || !inner.children.length) throw _err("crl/bad-idp", "pre-encoded issuingDistributionPoint MUST NOT be empty (RFC 5280 sec. 5.2.5)");
-  var scopeTrue = 0;
-  inner.children.forEach(function (c) {
-    if (c.tagClass !== "context") throw _err("crl/bad-idp", "pre-encoded issuingDistributionPoint members must be context-tagged (RFC 5280 sec. 5.2.5)");
-    var isTrue = c.content != null && c.content.length > 0 && c.content[c.content.length - 1] !== 0x00;   // a present DEFAULT-FALSE boolean is TRUE
-    if (c.tagNumber === 4) throw _err("crl/bad-idp", _INDIRECT_IDP_DEFERRED);   // indirectCRL
-    if (c.tagNumber === 5 && isTrue) throw _err("crl/bad-idp", "onlyContainsAttributeCerts=TRUE is not permitted for a conforming CRL issuer (RFC 5280 sec. 5.2.5)");
-    if ((c.tagNumber === 1 || c.tagNumber === 2) && isTrue) scopeTrue++;
+  var f = schema.walk(_PRE_ENCODED_IDP_SCHEMA, inner, NS).fields;
+  // A present DEFAULT-FALSE flag encodes a default DER omits (X.690 sec. 11.5), so it is rejected
+  // whichever value it carries rather than counted as the FALSE it spells.
+  ["onlyContainsUserCerts", "onlyContainsCACerts", "onlyContainsAttributeCerts"].forEach(function (name) {
+    if (f[name].present && f[name].value !== true) throw _err("crl/bad-idp", "pre-encoded issuingDistributionPoint " + name + " encodes its DEFAULT FALSE, which DER omits (X.690 sec. 11.5)");
   });
-  if (scopeTrue > 1) throw _err("crl/bad-idp", "at most one of onlyContainsUserCerts / onlyContainsCACerts may be TRUE (RFC 5280 sec. 5.2.5)");
+  if (f.indirectCRL.present) throw _err("crl/bad-idp", _INDIRECT_IDP_DEFERRED);
+  if (f.onlyContainsAttributeCerts.present) throw _err("crl/bad-idp", "onlyContainsAttributeCerts=TRUE is not permitted for a conforming CRL issuer (RFC 5280 sec. 5.2.5)");
+  if (f.onlyContainsUserCerts.present && f.onlyContainsCACerts.present) throw _err("crl/bad-idp", "at most one of onlyContainsUserCerts / onlyContainsCACerts may be TRUE (RFC 5280 sec. 5.2.5)");
 }
 
 // freshestCRL / CRLDistributionPoints (sec. 5.2.6): SEQUENCE OF DistributionPoint carrying only
@@ -369,9 +375,10 @@ function _buildRevoked(entryList, isDelta) {
 // ---- the primitives --------------------------------------------------------
 
 function _parseIssuerCert(cert) {
-  var parsed = (Buffer.isBuffer(cert) || typeof cert === "string") ? x509Schema.parse(cert) : cert;
-  if (!parsed || !parsed.tbsBytes || !parsed.subjectPublicKeyInfo) throw _err("crl/bad-input", "issuer.cert must be a certificate DER/PEM or a parsed certificate");
-  return parsed;
+  // The issuer certificate decides who may have signed this CRL: its key verifies the signature and
+  // its keyUsage says whether it may sign CRLs at all. A caller-assembled one could carry a real
+  // CA's name and cRLSign bit beside a substituted key, so it is re-derived like every other.
+  return guard.parsed.acceptDerived(cert, "certificate", x509Schema.parse, _err, "crl/bad-input", "issuer.cert");
 }
 
 // RFC 5280 sec. 4.2.1.3 -- a certificate whose key signs CRLs asserts the cRLSign keyUsage bit. When the
@@ -502,21 +509,59 @@ function _sign(spec, issuer, opts) {
  */
 function sign(spec, issuer, opts) { return Promise.resolve().then(function () { return _sign(spec, issuer, opts); }); }
 
+// A CRL these verbs answer from is re-derived from the bytes its parser read. Completeness -- every
+// field present with the right type -- is not enough for a verdict: the signature covers a byte
+// range, while the revocation list and the scope extensions are separate properties of the parsed
+// object. Keep a correctly signed CRL's `tbsBytes` and signature and empty `revokedCertificates`,
+// and the signature still verifies while `isRevoked` answers from the edited list. An emptied
+// `crlExtensions` does the same to scope: a shard that may only speak for some reasons, or a delta
+// that may not answer alone, becomes one that answers for everything.
 function _coerceCrl(crl) {
-  if (Buffer.isBuffer(crl) || typeof crl === "string") return crlSchema.parse(crl);
-  if (crl && typeof crl === "object" && crl.tbsBytes && crl.signatureValue && crl.signatureAlgorithm) return crl;
-  throw _err("crl/bad-input", "crl must be a CRL DER Buffer, a PEM string, or a parsed CRL (from pki.schema.crl.parse)");
+  return guard.parsed.acceptDerived(crl, "crl", crlSchema.parse, _err, "crl/bad-input", "the CRL");
 }
 
-function _resolveIssuerSpki(issuer) {
+// The issuer's key AND, when the caller supplied a certificate rather than a bare key, the
+// certificate itself -- because a CRL signature that verifies says only that SOME key signed these
+// bytes. Whether that key was allowed to sign a CRL, and whether it belongs to the issuer this CRL
+// names, are separate questions that only a certificate can answer.
+function _resolveIssuer(issuer) {
   if (issuer == null) throw _err("crl/bad-input", "an issuer is required to verify a CRL");
-  if (Buffer.isBuffer(issuer)) { _assertValidSpki(issuer, "issuer SPKI"); return issuer; }
-  if (issuer.cert != null) return _parseIssuerCert(issuer.cert).subjectPublicKeyInfo.bytes;
-  if (issuer.publicKey != null) { var spki = _reqDer(issuer.publicKey, "issuer.publicKey"); _assertValidSpki(spki, "issuer.publicKey"); return spki; }
-  if (issuer.subjectPublicKeyInfo && issuer.subjectPublicKeyInfo.bytes) return issuer.subjectPublicKeyInfo.bytes;   // a parsed certificate
+  if (Buffer.isBuffer(issuer)) { _assertValidSpki(issuer, "issuer SPKI"); return { spki: issuer, cert: null }; }
+  if (issuer.cert != null) { var ic = _parseIssuerCert(issuer.cert); return { spki: ic.subjectPublicKeyInfo.bytes, cert: ic }; }
+  if (issuer.publicKey != null) { var spki = _reqDer(issuer.publicKey, "issuer.publicKey"); _assertValidSpki(spki, "issuer.publicKey"); return { spki: spki, cert: null }; }
+  // A parsed certificate passed directly. It reaches the same identity and cRLSign checks the
+  // { cert } form does, so it goes through the same door: an object carrying an SPKI but missing
+  // the subject those checks compare would decide them on undefined.
+  if (issuer.subjectPublicKeyInfo && issuer.subjectPublicKeyInfo.bytes) {
+    var pc = _parseIssuerCert(issuer);
+    return { spki: pc.subjectPublicKeyInfo.bytes, cert: pc };
+  }
   throw _err("crl/bad-input", "issuer must be { cert }, { publicKey } (SPKI DER), or a raw SPKI Buffer");
 }
 
+// RFC 5280 sec. 5.1.1.2 / 6.3.3: the certificate that signed a CRL must BE the CRL's issuer, and if
+// it carries a keyUsage extension that extension must assert cRLSign. Neither is implied by the
+// signature verifying: any key can sign any bytes, and a certificate restricted to digitalSignature
+// chains to its root perfectly well while having no authority to revoke anything. The producing
+// side of this same file already refuses to SIGN a CRL with a certificate lacking cRLSign; the
+// verifying side asked neither question, so a CRL minted under an end-entity certificate of the
+// same CA verified as that CA's CRL.
+// Returns false rather than throwing, because both answers are statements about the CRL, not about
+// the caller's input: "this CRL was not validly issued by the certificate you named". That keeps
+// the verb's boolean contract, and keeps working the ordinary pattern of trying each candidate
+// issuer to find which one issued a CRL. A MALFORMED keyUsage is different -- it is a defect in the
+// caller's own certificate rather than a verdict about the CRL -- and throws.
+function _issuerMaySign(parsed, cert) {
+  if (!guard.name.dnEqual(parsed.issuer.rdns, cert.subject.rdns, _err, "crl/bad-issuer", "the CRL issuer")) return false;
+  // Through the shared reader, not a local BIT STRING read: keyUsage is a NamedBitList, so DER drops
+  // its trailing zero bits and sec. 4.2.1.3 requires at least one bit set, and a boundary reading
+  // the bits itself applies neither -- authorizing here a certificate the signing side and the path
+  // validator both refuse as malformed.
+  var ku = pkix.keyUsageOf(NS, cert, _err, "crl/bad-issuer", "issuer certificate");
+  if (!ku) return true;                              // absent keyUsage places no restriction (sec. 4.2.1.3)
+  return ku.cRLSign === true;
+}
+
 /**
  * @primitive pki.crl.verify
  * @signature pki.crl.verify(crl, issuer) -> Promise<boolean>
@@ -531,8 +576,16 @@ function _resolveIssuerSpki(issuer) {
  * (SPKI DER), or a raw SPKI `Buffer`. Verification composes the one path-validation signature engine
  * `pki.path.crlChecker` uses -- the same algorithm-confusion (RFC 9814 sec. 4 key-OID == sig-OID) and
  * EdDSA low-order-point gates -- so there is no second, weaker CRL verifier. It fails closed to `false` on
- * any resolution, import, or verification fault; malformed input throws a typed `CrlError`. This checks the
- * signature only -- issuer authorization, currency, and distribution-point scope are `pki.path.crlChecker`.
+ * any resolution, import, or verification fault; malformed input throws a typed `CrlError`.
+ *
+ * Given a CERTIFICATE rather than a bare key, it also asks what only a certificate can answer: that
+ * the certificate is the issuer this CRL names, and that its keyUsage -- when it carries one -- asserts
+ * `cRLSign` (RFC 5280 sec. 4.2.1.3, the same rule this module's signing side already enforces). Either
+ * failing is `false`: a statement about the CRL, not about the caller's input, so trying each candidate
+ * issuer in turn still works. A signature verifying says only that SOME key signed these bytes; without
+ * those two questions a CRL minted under an end-entity certificate of the same CA verified as that CA's.
+ * Handed a bare SPKI there is no certificate to carry either restriction, and the signature is all that
+ * is checked. Currency and distribution-point scope remain `pki.path.crlChecker`.
  *
  * @example
  *   var pair = await pki.key.generate("Ed25519");
@@ -548,8 +601,12 @@ function _resolveIssuerSpki(issuer) {
 function verify(crl, issuer) { return Promise.resolve().then(function () { return _verify(crl, issuer); }); }
 function _verify(crl, issuer) {
   var parsed = _coerceCrl(crl);
-  var spki = _resolveIssuerSpki(issuer);
-  return crlVerify.verifyCrlSignature(parsed, spki);
+  var resolved = _resolveIssuer(issuer);
+  // Asked BEFORE the signature: a certificate that may not sign CRLs, or that is not this CRL's
+  // issuer, is a caller-configuration answer that does not depend on the math, and spending a
+  // verification on it would let the cheaper question be answered by the more expensive one.
+  if (resolved.cert && !_issuerMaySign(parsed, resolved.cert)) return false;
+  return crlVerify.verifyCrlSignature(parsed, resolved.spki);
 }
 
 function _serialHexOf(serial) {
@@ -578,6 +635,22 @@ function _serialHexOf(serial) {
  * revocationDate, crlEntryExtensions }`) or `null` when the serial is not listed. A structural lookup only --
  * it does NOT verify the CRL signature or its currency; call `pki.crl.verify` / `pki.path.crlChecker` for that.
  *
+ * It does check SCOPE first, because a serial number means something only within the set of
+ * certificates a CRL speaks for, and this verb is given a serial and nothing else -- so a CRL that
+ * speaks for part of its issuer's certificates is refused rather than answered from:
+ *
+ * - A DELTA CRL lists changes since a base, so a serial in it may be there to say the certificate
+ *   was RELEASED; read alone, the entry meaning "no longer revoked" reads as "revoked"
+ *   (`crl/delta-not-authoritative`). Merge it with its base through `pki.path.crlChecker`.
+ * - An INDIRECT CRL carries entries for other issuers, whose serials are unrelated to yours
+ *   (`crl/indirect-not-supported`) -- as does any CRL carrying `certificateIssuer` on an entry
+ *   while not declaring itself indirect, a contradiction about whose certificates it lists.
+ * - Any other `issuingDistributionPoint` narrows the CRL to one distribution point, one kind of
+ *   certificate, or a subset of revocation reasons (`crl/scope-not-authoritative`). Which part
+ *   applies is decided against fields of the CERTIFICATE, which this verb never sees, so an absent
+ *   serial is not an unrevoked certificate. `pki.path.crlChecker` is handed the certificate and
+ *   performs the RFC 5280 sec. 6.3.3 correspondence.
+ *
  * @example
  *   var pair = await pki.key.generate("Ed25519");
  *   var signerKeyPkcs8 = await pki.key.export(pair.privateKey);
@@ -592,10 +665,83 @@ function _serialHexOf(serial) {
 function isRevoked(crl, serialNumber) {
   var parsed = _coerceCrl(crl);
   var hex = _serialHexOf(serialNumber);
+  // SCOPE, before the serial is looked for at all. A serial number is only meaningful within the
+  // set of certificates a CRL actually speaks for, and two shapes of CRL speak for a different set
+  // than a caller matching on serial alone assumes. pki.path.crlChecker already refuses both; this
+  // verb answered from any CRL it was handed, so the toolkit knew the rule and applied it in one
+  // consumer -- which is how the standalone verb came to give the opposite answer.
+  //
+  // A DELTA CRL lists CHANGES since its base, so a serial present in it may be there to say the
+  // certificate was RELEASED (removeFromCRL); read alone, the extension that means "no longer
+  // revoked" reads as "revoked". The answer is only derivable from the delta MERGED with its base,
+  // which pki.path.crlChecker does.
+  if (_findExtOid(parsed.crlExtensions, "deltaCRLIndicator")) {
+    throw _err("crl/delta-not-authoritative", "this is a delta CRL: it lists changes since a base CRL, so a serial appearing in it may be RELEASED rather than revoked. Merge it with its base -- pki.path.crlChecker does -- rather than reading a revocation status out of the delta alone");
+  }
+  // An INDIRECT CRL carries entries for OTHER issuers' certificates, identified by a per-entry
+  // certificateIssuer attribute. Matching on serial alone attributes another issuer's revocation to
+  // this one's certificate of the same serial number -- serials are unique per issuer, not globally.
+  var idp = _findExtOid(parsed.crlExtensions, "issuingDistributionPoint");
+  if (idp) _assertAuthoritativeScope(idp);
+  // certificateIssuer (sec. 5.3.3) names the issuer an entry belongs to, and is meaningful ONLY on
+  // an indirect CRL -- which was refused above. One here means the CRL declares itself direct while
+  // carrying an entry that says otherwise, and the two readings disagree about whose certificates
+  // this list covers. That is a property of the CRL, so it is settled BEFORE the lookup and over
+  // EVERY entry: checking only the entry that matches would leave the not-listed answer -- the one
+  // that says the certificate is fine -- coming from a list whose own entries dispute what it lists.
   for (var i = 0; i < parsed.revokedCertificates.length; i++) {
-    if (parsed.revokedCertificates[i].serialNumberHex === hex) return parsed.revokedCertificates[i];
+    if (_findExtOid(parsed.revokedCertificates[i].crlEntryExtensions, "certificateIssuer")) {
+      throw _err("crl/indirect-not-supported", "a revoked-certificate entry carries certificateIssuer, which names another issuer, on a CRL that does not declare itself indirect -- the entry and the CRL disagree about whose certificates this list covers, so no revocation status follows from it");
+    }
+  }
+  for (var j = 0; j < parsed.revokedCertificates.length; j++) {
+    if (parsed.revokedCertificates[j].serialNumberHex === hex) return parsed.revokedCertificates[j];
   }
   return null;
 }
 
+// One extension out of a parsed list, by registered OID name. Null-safe: an absent list is no
+// extension rather than a fault, which is what every caller here means by it.
+function _findExtOid(list, name) {
+  var want = O(name);
+  return (list || []).filter(function (e) { return e.oid === want; })[0] || null;
+}
+
+// The issuingDistributionPoint states which certificates a CRL speaks for (sec. 5.2.5), and every
+// form of it narrows that set below what a bare serial lookup assumes. `isRevoked` is handed a
+// serial and nothing else, so it cannot tell whether the certificate behind that serial falls in
+// the scope -- that decision needs the certificate, which is what pki.path.crlChecker has and this
+// verb does not. So the presence of the extension is the refusal, whichever field carries it:
+//
+//   indirectCRL       entries name their own issuers, and serials are unique per issuer: a match
+//                     would attribute another issuer's revocation to your certificate.
+//   distributionPoint the CRL covers the certificates whose own distribution point corresponds to
+//                     this one (sec. 6.3.3(b)(2)(i)) -- a byte-exact comparison against a field of
+//                     the certificate.
+//   onlyContainsUserCerts / onlyContainsCACerts / onlyContainsAttributeCerts
+//                     the CRL covers one KIND of certificate; a serial does not say which kind it
+//                     names, so an absent entry says nothing about a certificate of another kind.
+//   onlySomeReasons   the CRL covers some revocation REASONS; a certificate revoked for a reason
+//                     outside the set is absent from it while being revoked.
+//
+// Written as a throwing assertion rather than a predicate so the malformed case cannot be mistaken
+// for a verdict about the certificate. The extension is read through the shared sec. 5.2.5 grammar
+// rather than by walking its children, because the flags are IMPLICIT BOOLEANs and only the encoding
+// rules say what their bytes mean: a walk that tests a content byte reads an EMPTY [4] as an absent
+// flag and a multi-octet one by whichever byte it indexes, and "absent, so unscoped" is precisely
+// the reading that lets an unreadable scope license an answer.
+var _IDP_SCHEMA = pkix.issuingDistributionPoint("crl/scope-not-authoritative");
+var _INDIRECT_REFUSAL = "this CRL is marked indirect (issuingDistributionPoint indirectCRL): its entries name their own issuers, so a serial alone does not identify a certificate. Reading a revocation status from it by serial would attribute another issuer's revocation to yours";
+var _SCOPED_REFUSAL = "this CRL carries an issuingDistributionPoint, so it speaks for part of its issuer's certificates rather than all of them, and which part is decided against fields of the certificate -- which this verb is not given. A serial absent from it is not a certificate that is unrevoked. Use pki.path.crlChecker, which is handed the certificate and performs the RFC 5280 sec. 6.3.3 scope correspondence";
+function _assertAuthoritativeScope(ext) {
+  var m;
+  try { m = schema.walk(_IDP_SCHEMA, asn1.decode(ext.value), NS); }
+  catch (e) { throw _err("crl/scope-not-authoritative", "the issuingDistributionPoint cannot be read, so this CRL's scope cannot be established", e); }
+  var f = m.fields;
+  // Named first so the sharper reason wins: indirect is not merely a narrower scope, it is a list
+  // whose serials belong to other issuers.
+  if (f.indirectCRL.present && f.indirectCRL.value === true) throw _err("crl/indirect-not-supported", _INDIRECT_REFUSAL);
+  throw _err("crl/scope-not-authoritative", _SCOPED_REFUSAL);
+}
+
 module.exports = { sign: sign, verify: verify, isRevoked: isRevoked };

package/lib/est.js

@@ -86,6 +86,59 @@ var OID_TEMPLATE = oid.byName("certificationRequestInfoTemplate");
 
 var OPERATIONS = ["cacerts", "simpleenroll", "simplereenroll", "fullcmc", "serverkeygen", "csrattrs"];
 
+// ---- the option surface each verb accepts -----------------------------------
+//
+// A misspelled option reads as an omission rather than as a value: nothing is out of range and
+// nothing fails to parse, so the caller who asked for something stricter gets the looser default
+// and is told nothing. That is worst here, where the options carry the security posture of a
+// network exchange -- a misspelled `tls` leaves the anchors unset (the no-anchors refusal names
+// the missing pin, so this one is caught), a misspelled `strict` accepts the extra certificates it
+// was set to reject, a misspelled `expectedRecipientKeyId` drops a recipient pin on a
+// server-generated private key, and a misspelled `oldCert` fails the re-enrollment outright.
+//
+// Every network verb shares the client surface, because every one of them goes through _client and
+// the redirect / authentication plumbing it drives. The per-verb tables extend it rather than
+// restating it, so a key added to the client reaches every verb at once and none of them drifts.
+var CLIENT_OPTS = {
+  transport: 1, tls: 1, label: 1, timeout: 1, maxResponseBytes: 1, maxRedirects: 1, now: 1,
+  auth: 1, username: 1, password: 1, allowCrossOriginRedirect: 1,
+};
+function _withClient(extra) {
+  var out = {};
+  Object.keys(CLIENT_OPTS).forEach(function (k) { out[k] = 1; });
+  Object.keys(extra || {}).forEach(function (k) { out[k] = 1; });
+  return out;
+}
+// `strict` is enroll-only: _certsResult reads it after the /cacerts branch has already returned, so
+// accepting it on cacerts would advertise a check that cannot run there.
+var CACERTS_OPTS = _withClient(null);
+var SIMPLEENROLL_OPTS = _withClient({ strict: 1 });
+var SIMPLEREENROLL_OPTS = _withClient({ strict: 1, oldCert: 1 });
+// expectedRecipientKind is NOT here: it is derived from the CSR's own advertised attribute, never
+// taken from the caller, so listing it would offer a pin that nothing reads.
+var SERVERKEYGEN_OPTS = _withClient({
+  requestedEncryption: 1, expectedRecipientKeyId: 1, expectedRecipientIssuerSerial: 1,
+});
+var CSRATTRS_OPTS = _withClient(null);
+var FULLCMC_OPTS = _withClient({
+  transactionId: 1, senderNonce: 1, dataReturn: 1,
+  responderCerts: 1, responseRecipient: 1, allowUnverifiedResponse: 1,
+});
+// The two verbs that take options without going near the network.
+var CLASSIFY_OPTS = { op: 1, now: 1 };
+var PATHS_OPTS = { label: 1 };
+var PARSE_SERVERKEYGEN_OPTS = {
+  requestedEncryption: 1, expectedRecipientKeyId: 1, expectedRecipientKind: 1,
+  expectedRecipientIssuerSerial: 1,
+};
+
+function _knownOpts(opts, known, verb) {
+  guard.identifier.assertKnownKeys(opts, known, E, "est/bad-input", function (k) {
+    return "unknown option " + JSON.stringify(k) + " for pki.est." + verb + " -- accepted: " +
+      Object.keys(known).sort().join(", ");
+  });
+}
+
 // ---- the RFC 8951 sec. 3/3.1 transfer codec (CTE-header-blind) -----------
 
 /**
@@ -397,6 +450,7 @@ function _partMediaType(contentType) {
 
 function parseServerKeygenResponse(body, contentType, opts) {
   opts = opts || {};
+  _knownOpts(opts, PARSE_SERVERKEYGEN_OPTS, "parseServerKeygenResponse");
   var parts = splitMultipartMixed(body, contentType);
   if (parts.length !== 2) throw E("est/bad-multipart", "a serverkeygen response must have exactly two parts (RFC 7030 sec. 4.4.2)");
   var keyPart = null, certPart = null, encrypted = false;
@@ -524,6 +578,7 @@ var NOT_IMPLEMENTED_OPS = { fullcmc: 1 };
  */
 function classifyResponse(status, headers, body, opts) {
   opts = opts || {};
+  _knownOpts(opts, CLASSIFY_OPTS, "classifyResponse");
   var op = opts.op;
   // Fail closed on an operation whose response this client cannot validate:
   // A named op this client cannot validate is a typo, not a pass. An
@@ -618,6 +673,7 @@ function classifyResponse(status, headers, body, opts) {
  */
 function paths(baseUrl, opts) {
   opts = opts || {};
+  _knownOpts(opts, PATHS_OPTS, "paths");
   var prefix = String(baseUrl).replace(/\/+$/, "") + "/.well-known/est";
   if (opts.label != null) {
     var label = String(opts.label);
@@ -1152,6 +1208,11 @@ function fullcmc(baseUrl, request, opts) {
   var der, wanted, sent;
   try {
     if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw E("est/bad-input", "pki.est.fullcmc options must be an object");
+    // Inside the try, so the refusal is a REJECTION like every other failure of this verb: it is
+    // documented as Promise-returning, and a synchronous throw escapes the `.catch(...)` a caller
+    // has already written. It stays in the synchronous capture rather than moving into a later turn,
+    // because that is what closes the race described above.
+    _knownOpts(opts, FULLCMC_OPTS, "fullcmc");
     der = _cmcRequestDer(request);
     // Confirm this IS a Full PKI Request before any of it goes over the wire. The
     // bytes are about to be labelled `smime-type=CMC-request`, so a PKIResponse or
@@ -1750,6 +1811,10 @@ function _enroll(op, baseUrl, csrInput, opts) {
  *   - `tls` -- { anchors, useSystemStore, cert, key, minVersion, servername, checkServerIdentity }.
  *   - `label` -- an OPTIONAL CA label path segment; `timeout` / `maxResponseBytes` / `maxRedirects` -- budgets.
  *   - `now` -- receipt time (epoch ms) to render a 202 Retry-After HTTP-date as seconds.
+ *   - `auth` -- HTTP authentication: `{ scheme: "basic" | "digest", username, password, allowMD5, allowLegacyQop, maxStaleRetries }`.
+ *     There is no `"auto"`: the scheme is chosen here, not by whatever a server offers. `username` / `password`
+ *     at the top level are the older form and mean Basic. Answered only after the transport authenticated the server.
+ *   - `allowCrossOriginRedirect` -- opt in to following a cross-origin redirect on an unsafe method.
  * @example
  *   // a live CA uses the default pki.transport.https; here an injected transport returns a canned bag
  *   var r = await pki.est.cacerts("https://ca.example",
@@ -1759,6 +1824,11 @@ function _enroll(op, baseUrl, csrInput, opts) {
 function cacerts(baseUrl, opts) {
   opts = opts || {};
   return Promise.resolve().then(function () {
+    // Inside the promise, like every other refusal these verbs make. They are documented as
+    // Promise-returning, so a caller writes `.catch(...)` -- and a check that throws synchronously
+    // escapes that catch entirely, turning a misspelled option into an uncaught exception rather
+    // than the rejection the caller is already handling.
+    _knownOpts(opts, CACERTS_OPTS, "cacerts");
     return _client("cacerts", "GET", baseUrl, null, { accept: "application/pkcs7-mime" }, opts);
   }).then(function (res) { return _certsResult("cacerts", res, opts, null); });
 }
@@ -1795,7 +1865,10 @@ function cacerts(baseUrl, opts) {
  */
 function simpleenroll(baseUrl, csrInput, opts) {
   opts = opts || {};
-  return Promise.resolve().then(function () { return _enroll("simpleenroll", baseUrl, csrInput, opts); });
+  return Promise.resolve().then(function () {
+    _knownOpts(opts, SIMPLEENROLL_OPTS, "simpleenroll");
+    return _enroll("simpleenroll", baseUrl, csrInput, opts);
+  });
 }
 
 /**
@@ -1826,6 +1899,7 @@ function simpleenroll(baseUrl, csrInput, opts) {
 function simplereenroll(baseUrl, csrInput, opts) {
   opts = opts || {};
   return Promise.resolve().then(function () {
+    _knownOpts(opts, SIMPLEREENROLL_OPTS, "simplereenroll");
     if (!opts.oldCert) throw E("est/bad-input", "simplereenroll requires opts.oldCert (the certificate being renewed, RFC 7030 sec. 4.2.2)");
     reenrollGuard(opts.oldCert, _csrDer(csrInput));   // est/reenroll-* on mismatch, BEFORE the POST
     return _enroll("simplereenroll", baseUrl, csrInput, opts);
@@ -1989,6 +2063,7 @@ async function _serverkeygenResult(res, opts, derived) {
 function serverkeygen(baseUrl, csrInput, opts) {
   opts = opts || {};
   return Promise.resolve().then(function () {
+    _knownOpts(opts, SERVERKEYGEN_OPTS, "serverkeygen");
     var csrDer = _csrDer(csrInput);
     var derived = _serverkeygenEncryptionFromCsr(csrDer);
     if (opts.requestedEncryption !== undefined && !!opts.requestedEncryption !== derived.requestedEncryption) throw E("est/bad-input", "opts.requestedEncryption (" + !!opts.requestedEncryption + ") contradicts the CSR's advertised key-encryption attribute (" + derived.requestedEncryption + ") (RFC 7030 sec. 4.4.1)");
@@ -2056,6 +2131,7 @@ function _csrattrsResult(res, opts) {
 function csrattrs(baseUrl, opts) {
   opts = opts || {};
   return Promise.resolve().then(function () {
+    _knownOpts(opts, CSRATTRS_OPTS, "csrattrs");
     return _client("csrattrs", "GET", baseUrl, null, { accept: "application/csrattrs" }, opts);
   }).then(function (res) { return _csrattrsResult(res, opts); });
 }

package/lib/guard-all.js

@@ -40,6 +40,10 @@
 //   guard.header.assertField          -- emitted MIME/RFC 5322 header field name +
 //                                        value integrity (CR/LF/NUL header-injection
 //                                        defence, CWE-93)
+//   guard.parsed.accept               -- a CLAIMED-parsed structure carries every
+//                                        field the consuming code dereferences
+//                                        (type confusion / unverified provenance,
+//                                        CWE-843 / CWE-345)
 //
 // Each shape is enforced by a codebase-patterns detector: the characteristic
 // token of a guard (the Buffer.from(x.buffer, byteOffset) re-view, the
@@ -60,6 +64,7 @@ var identifier = require("./guard-identifier");
 var header = require("./guard-header");
 var compress = require("./guard-compress");
 var secret = require("./guard-secret");
+var parsed = require("./guard-parsed");
 
 module.exports = {
   bytes:  bytes,
@@ -75,4 +80,5 @@ module.exports = {
   header: header,
   compress: compress,
   secret: secret,
+  parsed: parsed,
 };

package/lib/guard-encoding.js

@@ -25,9 +25,33 @@
 // domain/reason; `label` the field phrase; `maxBytes` an optional decoded-size
 // cap (null/undefined = uncapped, for a PEM cert body already bounded upstream).
 
-var B64URL_ALPHABET = /^[A-Za-z0-9_-]*$/;
-var B64_ALPHABET = /^[A-Za-z0-9+/]*={0,2}$/;
-var HEX_ALPHABET = /^[0-9A-Fa-f]*$/;
+// The alphabets are TABLES, walked one character at a time, rather than regular
+// expressions. A guard runs on the most hostile input the toolkit sees, and a
+// pattern engine's cost on a non-matching string is a property of the pattern
+// rather than of the length -- the one thing a bound cannot be placed on from the
+// outside. A table lookup is one array index per character and its cost is the
+// length, which the caller already caps. It is also the more honest statement of
+// the rule: the set of permitted characters IS the rule, written out.
+function _alphabet(chars) {
+  var t = new Uint8Array(128);
+  for (var i = 0; i < chars.length; i++) t[chars.charCodeAt(i)] = 1;
+  return t;
+}
+var UPPER = "ABCDEFGHIJKLMNOPQRSTUVWXYZ", LOWER = "abcdefghijklmnopqrstuvwxyz", DIGITS = "0123456789";
+var B64URL_ALPHABET = _alphabet(UPPER + LOWER + DIGITS + "-_");
+var B64_ALPHABET = _alphabet(UPPER + LOWER + DIGITS + "+/");
+var HEX_ALPHABET = _alphabet(DIGITS + "abcdef" + "ABCDEF");
+
+// Every character of `text` is in `table`. A code point outside Latin-1's low half
+// (including every astral half) is outside all three alphabets, so the table bound
+// is the reject rather than an index that reads undefined.
+function _inAlphabet(text, table) {
+  for (var i = 0; i < text.length; i++) {
+    var c = text.charCodeAt(i);
+    if (c > 127 || table[c] !== 1) return false;
+  }
+  return true;
+}
 
 // Reject before Buffer.from allocates: a base64 text of N chars decodes to at
 // most floor(N*3/4) bytes, a hex text to N/2.
@@ -49,7 +73,7 @@ function _capBefore(nChars, perByteChars, maxBytes, E, code, label) {
 // @enforced-by base64-decode-not-via-guard
 function base64url(text, maxBytes, E, code, label) {
   if (typeof text !== "string") throw E(code, label + " must be a string");
-  if (!B64URL_ALPHABET.test(text)) throw E(code, label + " is not base64url (padding or a non-alphabet character)");
+  if (!_inAlphabet(text, B64URL_ALPHABET)) throw E(code, label + " is not base64url (padding or a non-alphabet character)");
   if (text.length % 4 === 1) throw E(code, label + " has an impossible base64url length");
   _capBefore(text.length * 3, 4, maxBytes, E, code, label);
   var buf = Buffer.from(text, "base64url");
@@ -62,7 +86,12 @@ function base64url(text, maxBytes, E, code, label) {
 // @enforced-by base64-decode-not-via-guard
 function base64(text, maxBytes, E, code, label) {
   if (typeof text !== "string") throw E(code, label + " must be a string");
-  if (!B64_ALPHABET.test(text)) throw E(code, label + " is not base64 (a non-alphabet character)");
+  // Padding is positional, not alphabetic: at most two "=" and only at the end, so
+  // the body is measured first and the alphabet applies to what remains. An "="
+  // anywhere else leaves a non-alphabet character in the body and rejects there.
+  var pad = 0;
+  while (pad < 2 && text.length > pad && text.charCodeAt(text.length - 1 - pad) === 0x3d) pad++;
+  if (!_inAlphabet(text.slice(0, text.length - pad), B64_ALPHABET)) throw E(code, label + " is not base64 (a non-alphabet character)");
   if (text.length % 4 !== 0) throw E(code, label + " must be whole 4-character base64 groups (RFC 4648 sec. 3.5)");
   _capBefore(text.length * 3, 4, maxBytes, E, code, label);
   var buf = Buffer.from(text, "base64");
@@ -79,7 +108,7 @@ function base64(text, maxBytes, E, code, label) {
 //   (a non-canonical / odd-length / non-hex #hex attribute value rejects) guard it.
 function hex(text, maxBytes, E, code, label) {
   if (typeof text !== "string") throw E(code, label + " must be a string");
-  if (!HEX_ALPHABET.test(text)) throw E(code, label + " is not hexadecimal");
+  if (!_inAlphabet(text, HEX_ALPHABET)) throw E(code, label + " is not hexadecimal");
   if (text.length % 2 !== 0) throw E(code, label + " must have an even number of hex digits");
   _capBefore(text.length, 2, maxBytes, E, code, label);
   var buf = Buffer.from(text, "hex");

package/lib/guard-identifier.js

@@ -21,6 +21,32 @@
 // silent false-reject). Every string-form identifier check routes through here so
 // the string and DER forms cannot diverge.
 
+// The dotted-decimal grammar, walked rather than matched. `(0|[1-9]\d*)(\.(0|[1-9]\d*))+`
+// nests a quantified group inside a quantified group with an alternation in each,
+// which is the shape whose cost on a REJECTING string is a property of the pattern
+// rather than of the length -- and this guard's whole job is to be handed strings
+// that reject. Walking the string is one pass, one comparison per character, and it
+// states the two rules plainly: an arc is one or more digits, and an arc longer than
+// one digit does not start with zero (the leading-zero form round-trips to a
+// DIFFERENT OID, which is the divergence this guard exists to stop).
+function _isDottedDecimal(str) {
+  if (str.length === 0) return false;
+  var arcs = 0, digits = 0, leadingZero = false;
+  for (var i = 0; i < str.length; i++) {
+    var c = str.charCodeAt(i);
+    if (c === 0x2e) {                                   // "."
+      if (digits === 0 || leadingZero) return false;    // empty arc, or "01"
+      arcs++; digits = 0; leadingZero = false;
+      continue;
+    }
+    if (c < 0x30 || c > 0x39) return false;             // not a digit
+    if (digits === 1 && str.charCodeAt(i - 1) === 0x30) leadingZero = true;
+    digits++;
+  }
+  if (digits === 0 || leadingZero) return false;        // trailing "." or a final "01"
+  return arcs >= 1;                                     // two or more arcs
+}
+
 // assertCanonicalOid(str, E, code, label, boundsCode) -> str | throws
 // A canonical dotted-decimal object identifier string: two or more arcs, each a
 // non-negative decimal integer with no leading zero (the SYNTAX), and -- unless
@@ -40,7 +66,7 @@
 //   reject a non-canonical OID) driving the composing consumers are the guard.
 function assertCanonicalOid(str, E, code, label, boundsCode) {
   var who = label || "OID";
-  if (typeof str !== "string" || !/^(0|[1-9]\d*)(\.(0|[1-9]\d*))+$/.test(str)) {
+  if (typeof str !== "string" || !_isDottedDecimal(str)) {
     throw E(code, who + " must be a canonical dotted-decimal OID string of two or more arcs with no leading-zero component");
   }
   if (boundsCode === null) return str;

package/lib/guard-json.js

@@ -25,6 +25,14 @@
 var text = require("./guard-text");
 var limits = require("./guard-limits");
 
+// One hex digit's value, or -1. Written out because the three ranges ARE the rule.
+function _hexVal(c) {
+  if (c >= 0x30 && c <= 0x39) return c - 0x30;          // 0-9
+  if (c >= 0x61 && c <= 0x66) return c - 0x61 + 10;     // a-f
+  if (c >= 0x41 && c <= 0x46) return c - 0x41 + 10;     // A-F
+  return -1;
+}
+
 // parse(input, ErrorClass, spec) -> value. `input` is a Buffer or a string.
 // spec = { maxBytes, maxDepth, badJson, tooDeep, duplicateMember, tooLarge,
 //   badInput, label } -- the caller's caps + frozen domain/reason codes.
@@ -118,9 +126,17 @@ function parse(input, ErrorClass, spec) {
         else if (e === "r") s += "\r";
         else if (e === "t") s += "\t";
         else if (e === "u") {
-          var hex = str.substr(i, 4);
-          if (!/^[0-9a-fA-F]{4}$/.test(hex)) fail("bad \\u escape");
-          s += String.fromCharCode(parseInt(hex, 16));
+          // Four hex digits, read as digits rather than matched as a pattern: the
+          // scanner is already walking this string one character at a time, and a
+          // parser handed hostile input should not hand any of it to a second engine.
+          var cp = 0;
+          if (i + 4 > n) fail("bad \\u escape");
+          for (var h = 0; h < 4; h++) {
+            var d = _hexVal(str.charCodeAt(i + h));
+            if (d < 0) fail("bad \\u escape");
+            cp = (cp << 4) | d;
+          }
+          s += String.fromCharCode(cp);
           i += 4;
         } else fail("bad escape");
       } else if (c.charCodeAt(0) < 0x20) {
@@ -128,15 +144,35 @@ function parse(input, ErrorClass, spec) {
       } else s += c;
     }
   }
+  // RFC 8259 sec. 6, enforced BY the walk rather than by re-matching the token
+  // afterwards. The scan already knows where each part starts and ends, so the
+  // grammar's three rules -- an integer part that is "0" or has no leading zero, a
+  // fraction with at least one digit, an exponent with at least one digit -- are
+  // checked as it goes. Re-matching what the scanner just read meant maintaining
+  // the same grammar twice, in two notations, and the pattern was the copy whose
+  // cost on a rejecting token could not be bounded from outside.
   function number() {
     var start = i;
     if (str[i] === "-") i++;
+    var intStart = i;
     while (i < n && str[i] >= "0" && str[i] <= "9") i++;
-    if (str[i] === ".") { i++; while (i < n && str[i] >= "0" && str[i] <= "9") i++; }
-    if (str[i] === "e" || str[i] === "E") { i++; if (str[i] === "+" || str[i] === "-") i++; while (i < n && str[i] >= "0" && str[i] <= "9") i++; }
-    var tok = str.slice(start, i);
-    if (!/^-?(0|[1-9][0-9]*)(\.[0-9]+)?([eE][+-]?[0-9]+)?$/.test(tok)) fail("malformed number");
-    var v = Number(tok);
+    var intLen = i - intStart;
+    if (intLen === 0) fail("malformed number");
+    if (intLen > 1 && str[intStart] === "0") fail("malformed number");   // no leading zero
+    if (str[i] === ".") {
+      i++;
+      var fracStart = i;
+      while (i < n && str[i] >= "0" && str[i] <= "9") i++;
+      if (i === fracStart) fail("malformed number");                     // "1." has no fraction
+    }
+    if (str[i] === "e" || str[i] === "E") {
+      i++;
+      if (str[i] === "+" || str[i] === "-") i++;
+      var expStart = i;
+      while (i < n && str[i] >= "0" && str[i] <= "9") i++;
+      if (i === expStart) fail("malformed number");                      // "1e" has no exponent
+    }
+    var v = Number(str.slice(start, i));
     if (!isFinite(v)) fail("bad number");
     return v;
   }