@blamejs/pki 0.5.30 → 0.5.32

package/lib/trust.js

@@ -44,7 +44,10 @@ var intrinsic = require("./guard-intrinsic");
 // Own-key membership through an operation taken at load. Written out, the question reads two
 // replaceable properties to answer one thing, and here it decides which trust bits an anchor carries.
 var _hasOwn = intrinsic.hasOwn;
+var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
+var _strSlice = intrinsic.uncurry(String.prototype.slice);
 var x509 = require("./schema-x509");
+var pkix = require("./schema-pkix");
 
 var TrustError = errors.TrustError;
 var LIMITS = constants.LIMITS;
@@ -75,7 +78,104 @@ var CKT_DELEGATOR = "CKT_NSS_TRUSTED_DELEGATOR";
 // An attribute line: `CKA_<NAME> <type> [<value>]`. The value grammar is
 // per-type (a quoted UTF8 string, a single token, or nothing for
 // MULTILINE_OCTAL whose payload follows on its own lines).
-var ATTR_RE = /^(CKA_[A-Z0-9_]+)(?:\s+(\S+)(?:\s+(.*))?)?$/;
+// ---- certdata scanners by character (no regex) ----------------------------------------------------
+function _isNameChar(c) { return (c >= 65 && c <= 90) || (c >= 48 && c <= 57) || c === 95; }   // A-Z 0-9 _
+function _isDigitCode(c) { return c >= 48 && c <= 57; }
+function _isDateSepCode(c) { return c === 46 || c === 47 || c === 45; }   // . / -
+function _isOctalDigit(c) { return c >= 48 && c <= 55; }   // 0-7
+function _isWsCode(c) { return pkix.isJsWhitespace(c); }
+function _containsWs(s) { for (var i = 0; i < s.length; i++) { if (_isWsCode(_charCodeAt(s, i))) return true; } return false; }   // /\s/.test(s)
+
+// An attribute line `CKA_<NAME> [<type> [<value>]]`, matching
+// /^(CKA_[A-Z0-9_]+)(?:\s+(\S+)(?:\s+(.*))?)?$/. Returns [name, type|undefined, value|undefined] or null.
+function _parseAttrLine(s) {
+  var n = s.length;
+  if (_strSlice(s, 0, 4) !== "CKA_") return null;
+  var p = 4;
+  while (p < n && _isNameChar(_charCodeAt(s, p))) p += 1;
+  if (p === 4) return null;
+  var name = _strSlice(s, 0, p);
+  if (p === n) return [name, undefined, undefined];
+  if (!_isWsCode(_charCodeAt(s, p))) return null;
+  while (p < n && _isWsCode(_charCodeAt(s, p))) p += 1;
+  var typeStart = p;
+  while (p < n && !_isWsCode(_charCodeAt(s, p))) p += 1;
+  if (p === typeStart) return null;
+  var type = _strSlice(s, typeStart, p);
+  if (p === n) return [name, type, undefined];
+  if (!_isWsCode(_charCodeAt(s, p))) return null;
+  while (p < n && _isWsCode(_charCodeAt(s, p))) p += 1;
+  return [name, type, _strSlice(s, p)];
+}
+
+// A single double-quoted value with no interior quote (matching /^"([^"]*)"$/): the inner content, or
+// null. Empty content ("\"\"") returns "" (a valid value), distinct from the null no-match.
+function _unquote(s) {
+  var n = s.length;
+  if (n < 2 || _charCodeAt(s, 0) !== 34 || _charCodeAt(s, n - 1) !== 34) return null;   // surrounding "
+  for (var i = 1; i < n - 1; i++) if (_charCodeAt(s, i) === 34) return null;             // no interior "
+  return _strSlice(s, 1, n - 1);
+}
+
+// String.prototype.split(/\s+/): the pieces between whitespace runs (a leading/trailing run yields a
+// "" element; "" -> [""]). Index assignment (not .push) so the scanner adds no live intrinsic read.
+function _splitWhitespace(s) {
+  var out = [], i = 0, n = s.length, pieceStart = 0;
+  while (i < n) {
+    if (_isWsCode(_charCodeAt(s, i))) {
+      out[out.length] = _strSlice(s, pieceStart, i);
+      while (i < n && _isWsCode(_charCodeAt(s, i))) i += 1;
+      pieceStart = i;
+    } else i += 1;
+  }
+  out[out.length] = _strSlice(s, pieceStart);
+  return out;
+}
+
+// Exactly three octal digits (matching /^[0-7]{3}$/).
+function _isOctal3(d) {
+  if (d.length !== 3) return false;
+  for (var i = 0; i < 3; i++) { if (!_isOctalDigit(_charCodeAt(d, i))) return false; }
+  return true;
+}
+
+// String.prototype.split(/\r\n|\n|\r/): split on CRLF, LF, or CR line terminators.
+function _splitLines(text) {
+  var out = [], start = 0, i = 0, n = text.length;
+  while (i < n) {
+    var c = _charCodeAt(text, i);
+    if (c === 13) {                                            // CR (consume a following LF as one)
+      out[out.length] = _strSlice(text, start, i);
+      if (i + 1 < n && _charCodeAt(text, i + 1) === 10) i += 1;
+      i += 1; start = i;
+    } else if (c === 10) {                                     // LF
+      out[out.length] = _strSlice(text, start, i);
+      i += 1; start = i;
+    } else i += 1;
+  }
+  out[out.length] = _strSlice(text, start);
+  return out;
+}
+
+// A Y-M-D date with dotted/dashed/slashed separators, matching /^(\d{4})[./-](\d{1,2})[./-](\d{1,2})$/.
+// Returns [year, month, day] (raw digit strings) or null.
+function _parseYmd(s) {
+  var n = s.length;
+  for (var a = 0; a < 4; a++) if (!_isDigitCode(_charCodeAt(s, a))) return null;
+  var year = _strSlice(s, 0, 4), p = 4;
+  if (!_isDateSepCode(_charCodeAt(s, p))) return null; p += 1;
+  var ms = p;
+  while (p < n && p - ms < 2 && _isDigitCode(_charCodeAt(s, p))) p += 1;
+  if (p === ms) return null;
+  var month = _strSlice(s, ms, p);
+  if (!_isDateSepCode(_charCodeAt(s, p))) return null; p += 1;
+  var ds = p;
+  while (p < n && p - ds < 2 && _isDigitCode(_charCodeAt(s, p))) p += 1;
+  if (p === ds) return null;
+  var day = _strSlice(s, ds, p);
+  if (p !== n) return null;
+  return [year, month, day];
+}
 
 // ---------------------------------------------------------------------------
 // certdata.txt lexer -- line-oriented, C.LIMITS-bounded, fail-closed
@@ -93,7 +193,7 @@ function _readOctalBody(lines, idx) {
     var t = lines[i].trim();
     if (t === "END") return { bytes: Buffer.from(out), next: i + 1 };
     if (t === "") throw E("trust/bad-octal", "MULTILINE_OCTAL body interrupted by a blank line before END");
-    var chunks = t.split(/\s+/);
+    var chunks = _splitWhitespace(t);
     for (var c = 0; c < chunks.length; c++) {
       var chunk = chunks[c];
       for (var k = 0; k < chunk.length; k += 4) {
@@ -101,7 +201,7 @@ function _readOctalBody(lines, idx) {
           throw E("trust/bad-octal", "MULTILINE_OCTAL expects \\ooo escapes, got " + JSON.stringify(chunk.slice(k, k + 4)));
         }
         var d = chunk.slice(k + 1, k + 4);
-        if (!/^[0-7]{3}$/.test(d)) {
+        if (!_isOctal3(d)) {
           throw E("trust/bad-octal", "a MULTILINE_OCTAL escape is a backslash + exactly three octal digits, got " + JSON.stringify("\\" + d));
         }
         if (d.charCodeAt(0) > 51 /* '3' */) {
@@ -120,7 +220,7 @@ function _readOctalBody(lines, idx) {
 // `CKA_* <type> <value>` attribute lines. Returns [{ attrs }] where attrs maps
 // the attribute name to { type, value | bytes }.
 function _lexObjects(text) {
-  var lines = text.split(/\r\n|\n|\r/);
+  var lines = _splitLines(text);
   var n = lines.length;
   var i = 0, sawBegin = false;
   for (; i < n; i++) {
@@ -137,10 +237,10 @@ function _lexObjects(text) {
       i++; continue;
     }
     if (t.charAt(0) === "#") { i++; continue; }
-    var m = ATTR_RE.exec(t);
+    var m = _parseAttrLine(t);
     if (!m) throw E("trust/bad-block", "unexpected line in the certdata object stream: " + JSON.stringify(t.slice(0, 64)));
-    var name = m[1], type = m[2];
-    var rawVal = m[3] !== undefined ? m[3].trim() : undefined;
+    var name = m[0], type = m[1];
+    var rawVal = m[2] !== undefined ? m[2].trim() : undefined;
     if (!type) throw E("trust/bad-block", "attribute line is missing its type token: " + name);
     if (!cur) {
       // Refuse the block bomb before lexing another block's payloads.
@@ -161,15 +261,15 @@ function _lexObjects(text) {
       if (rawVal !== "CK_TRUE" && rawVal !== "CK_FALSE") throw E("trust/bad-block", name + " CK_BBOOL must be CK_TRUE or CK_FALSE");
       entry = { type: type, value: rawVal === "CK_TRUE" };
     } else if (type === "UTF8") {
-      var q = rawVal !== undefined ? /^"([^"]*)"$/.exec(rawVal) : null;
-      if (!q) throw E("trust/bad-block", name + " UTF8 must carry one double-quoted value");
-      entry = { type: type, value: q[1] };
+      var q = rawVal !== undefined ? _unquote(rawVal) : null;
+      if (q === null) throw E("trust/bad-block", name + " UTF8 must carry one double-quoted value");
+      entry = { type: type, value: q };
     } else if (type === "CK_TRUST") {
-      if (rawVal === undefined || /\s/.test(rawVal)) throw E("trust/bad-block", name + " CK_TRUST must carry a single token value");
+      if (rawVal === undefined || _containsWs(rawVal)) throw E("trust/bad-block", name + " CK_TRUST must carry a single token value");
       if (!CKT_RECOGNIZED[rawVal]) throw E("trust/bad-trust-value", "unrecognized CK_TRUST value " + JSON.stringify(rawVal) + " on " + name);
       entry = { type: type, value: rawVal };
     } else if (type === "CK_OBJECT_CLASS" || type === "CK_CERTIFICATE_TYPE") {
-      if (rawVal === undefined || /\s/.test(rawVal)) throw E("trust/bad-block", name + " " + type + " must carry a single token value");
+      if (rawVal === undefined || _containsWs(rawVal)) throw E("trust/bad-block", name + " " + type + " must carry a single token value");
       entry = { type: type, value: rawVal };
     } else {
       // An unknown value type cannot be lexed safely (its value grammar is
@@ -625,10 +725,10 @@ function _trustBits(cell) {
 function _csvDate(cell, label) {
   var s = String(cell).trim();
   if (s === "") return null;
-  var m = /^(\d{4})[./-](\d{1,2})[./-](\d{1,2})$/.exec(s);
+  var m = _parseYmd(s);
   if (!m) throw E("trust/bad-csv", label + " must be a Y-M-D date, got " + JSON.stringify(s));
   var pad = function (x) { return x.length === 1 ? "0" + x : x; };
-  var payload = Buffer.from(m[1] + pad(m[2]) + pad(m[3]) + "235959Z", "latin1");
+  var payload = Buffer.from(m[0] + pad(m[1]) + pad(m[2]) + "235959Z", "latin1");
   // _strictTime tags every rejection (a rolled-over month/day among them) with the code passed here,
   // so the re-throw carries it unchanged; the wrap normalizes any other failure to the same typed code
   // so a bad row is always trust/bad-csv, never an untyped exception escaping parseCcadbCsv.

package/lib/tsp-sign.js

@@ -26,6 +26,7 @@ var smime = require("./schema-smime");
 var schemaTsp = require("./schema-tsp");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var frameworkError = require("./framework-error");
 
 var pkix = require("./schema-pkix");
@@ -34,6 +35,12 @@ var TspError = frameworkError.TspError;
 var _NS = pkix.makeNS("tsp", TspError, oid);
 var b = asn1.build;
 function _err(code, message, cause) { return new TspError(code, message, cause); }
+
+// Any ASCII digit 1-9 present (a non-zero fractional digit), by character scan -- no regex.
+function _hasNonZeroDigit(s) {
+  for (var i = 0; i < s.length; i++) { var c = _charCodeAt(s, i); if (c >= 49 && c <= 57) return true; }
+  return false;
+}
 function O(name) { return oid.byName(name); }
 
 // The shared authoring-side builder, for the same pre-encoded-Extension validation every other
@@ -72,17 +79,20 @@ function _hashAlgId(name) {
 // A policy identifier: an OID name or a dotted-decimal string.
 function _policy(p) {
   if (typeof p !== "string") throw _err("tsp/bad-input", "the timestamp policy must be an OID name or dotted string");
-  return /^\d+(\.\d+)+$/.test(p) ? b.oid(p) : b.oid(O(p));
+  return oid.isDottedDecimal(p) ? b.oid(p) : b.oid(O(p));
 }
-// The signer certificate DER (DER Buffer / PEM string / Uint8Array) -- for the ESSCertIDv2 hash.
+// The signer certificate DER (a DER BufferSource / PEM string) -- for the ESSCertIDv2 hash.
 function _certDer(c) {
   if (c == null) throw _err("tsp/bad-input", "the TSA signer requires a certificate (cert)");
-  if (c instanceof Uint8Array && !Buffer.isBuffer(c)) c = Buffer.from(c);          // a Uint8Array -> Buffer
-  if (Buffer.isBuffer(c)) { if (c[0] === 0x30) return c; c = c.toString("latin1"); }   // DER as-is, else decode as PEM
-  if (typeof c !== "string") throw _err("tsp/bad-input", "the TSA certificate must be a DER Buffer or a PEM string");
-  var m = c.match(/-----BEGIN CERTIFICATE-----([\s\S]*?)-----END CERTIFICATE-----/);
-  if (!m) throw _err("tsp/bad-input", "the TSA certificate PEM is not a CERTIFICATE block");
-  return Buffer.from(m[1].replace(/[^A-Za-z0-9+/=]/g, ""), "base64");
+  if (guard.bytes.isByteSource(c)) {                                                // any BufferSource -> a byte view
+    var buf = guard.bytes.source(c, TspError, "tsp/bad-input", "the TSA certificate");
+    if (buf[0] === 0x30) return buf;                                                // DER as-is
+    c = buf.toString("latin1");                                                     // else decode as PEM
+  }
+  if (typeof c !== "string") throw _err("tsp/bad-input", "the TSA certificate must be a DER BufferSource or a PEM string");
+  var der = pkix.pemDecodeLenient(c, "CERTIFICATE");
+  if (der === null) throw _err("tsp/bad-input", "the TSA certificate PEM is not a CERTIFICATE block");
+  return der;
 }
 
 // The RFC 5035 SigningCertificateV2 signed-attribute value binding the token to the TSA cert:
@@ -177,8 +187,9 @@ function _sign(messageImprint, tsa, opts) {
   }
   var mi = messageImprint || {};
   if (!mi.hashAlgorithm || !NODE_DIGEST[mi.hashAlgorithm]) throw _err("tsp/unsupported-algorithm", "messageImprint.hashAlgorithm must be a supported hash name");
-  if (!Buffer.isBuffer(mi.hashedMessage) && !(mi.hashedMessage instanceof Uint8Array)) throw _err("tsp/bad-input", "messageImprint.hashedMessage must be a Buffer");
-  if (mi.hashedMessage.length !== HASH_LEN[mi.hashAlgorithm]) throw _err("tsp/bad-input", "messageImprint.hashedMessage length (" + mi.hashedMessage.length + ") does not match the " + mi.hashAlgorithm + " digest length (" + HASH_LEN[mi.hashAlgorithm] + ")");
+  if (!guard.bytes.isByteSource(mi.hashedMessage)) throw _err("tsp/bad-input", "messageImprint.hashedMessage must be a BufferSource");
+  var _signHmLen = guard.bytes.source(mi.hashedMessage, TspError, "tsp/bad-input", "messageImprint.hashedMessage").length;
+  if (_signHmLen !== HASH_LEN[mi.hashAlgorithm]) throw _err("tsp/bad-input", "messageImprint.hashedMessage length (" + _signHmLen + ") does not match the " + mi.hashAlgorithm + " digest length (" + HASH_LEN[mi.hashAlgorithm] + ")");
   if (!opts.policy) throw _err("tsp/bad-input", "a timestamp token requires a policy identifier (opts.policy)");
   if (opts.serialNumber == null) throw _err("tsp/bad-input", "a timestamp token requires a serialNumber (opts.serialNumber)");
 
@@ -188,7 +199,7 @@ function _sign(messageImprint, tsa, opts) {
 
   // TSTInfo (RFC 3161 sec. 2.4.2): version(1), policy, messageImprint, serialNumber, genTime,
   // then the OPTIONAL accuracy / ordering / nonce in ascending order.
-  var imprint = b.sequence([_hashAlgId(mi.hashAlgorithm), b.octetString(Buffer.from(mi.hashedMessage))]);
+  var imprint = b.sequence([_hashAlgId(mi.hashAlgorithm), b.octetString(guard.bytes.source(mi.hashedMessage, TspError, "tsp/bad-input", "messageImprint.hashedMessage"))]);
   // genTime defaults to now; a supplied value MUST be a valid Date (never a silently-ignored
   // non-Date or an Invalid Date that would encode a garbage GeneralizedTime).
   if (opts.genTime != null) guard.time.assertValid(opts.genTime, _err, "tsp/bad-input", "genTime");
@@ -270,16 +281,16 @@ function _failInfoBits(names) {
 // Coerce a timeStampToken (a CMS ContentInfo the token producer emits) to DER for embedding in a
 // TimeStampResp -- a DER Buffer as-is, a Uint8Array copied, or a PEM string de-armored.
 function _tokenDer(t) {
-  if (Buffer.isBuffer(t) && t[0] === 0x30) return t;
-  if (t instanceof Uint8Array && !Buffer.isBuffer(t)) { var u = Buffer.from(t); if (u[0] === 0x30) return u; }
+  if (guard.bytes.isByteSource(t)) { var u = guard.bytes.source(t, TspError, "tsp/bad-input", "the timeStampToken"); if (u[0] === 0x30) return u; }
   if (typeof t === "string") return schemaTsp.pemDecode(t);
-  throw _err("tsp/bad-input", "the timeStampToken must be a DER Buffer or a PEM string");
+  throw _err("tsp/bad-input", "the timeStampToken must be a DER BufferSource or a PEM string");
 }
 
 function _assertImprint(mi) {
   if (!mi.hashAlgorithm || !NODE_DIGEST[mi.hashAlgorithm]) throw _err("tsp/unsupported-algorithm", "messageImprint.hashAlgorithm must be a supported hash name");
-  if (!Buffer.isBuffer(mi.hashedMessage) && !(mi.hashedMessage instanceof Uint8Array)) throw _err("tsp/bad-input", "messageImprint.hashedMessage must be a Buffer");
-  if (mi.hashedMessage.length !== HASH_LEN[mi.hashAlgorithm]) throw _err("tsp/bad-input", "messageImprint.hashedMessage length (" + mi.hashedMessage.length + ") does not match the " + mi.hashAlgorithm + " digest length (" + HASH_LEN[mi.hashAlgorithm] + ")");
+  if (!guard.bytes.isByteSource(mi.hashedMessage)) throw _err("tsp/bad-input", "messageImprint.hashedMessage must be a BufferSource");
+  var hmLen = guard.bytes.source(mi.hashedMessage, TspError, "tsp/bad-input", "messageImprint.hashedMessage").length;
+  if (hmLen !== HASH_LEN[mi.hashAlgorithm]) throw _err("tsp/bad-input", "messageImprint.hashedMessage length (" + hmLen + ") does not match the " + mi.hashAlgorithm + " digest length (" + HASH_LEN[mi.hashAlgorithm] + ")");
 }
 
 /**
@@ -328,7 +339,7 @@ function request(messageImprint, opts) {
     });
   }
   _assertImprint(mi);
-  var imprint = b.sequence([_hashAlgId(mi.hashAlgorithm), b.octetString(Buffer.from(mi.hashedMessage))]);
+  var imprint = b.sequence([_hashAlgId(mi.hashAlgorithm), b.octetString(guard.bytes.source(mi.hashedMessage, TspError, "tsp/bad-input", "messageImprint.hashedMessage"))]);
   // TimeStampReq: version(1), messageImprint, then OPTIONAL reqPolicy / nonce / certReq /
   // extensions in schema order. certReq DEFAULT FALSE -> only an explicit TRUE is encoded (DER).
   var fields = [b.integer(1n), imprint];
@@ -337,7 +348,7 @@ function request(messageImprint, opts) {
   if (opts.certReq != null && typeof opts.certReq !== "boolean") throw _err("tsp/bad-input", "certReq must be a boolean");
   if (opts.certReq === true) fields.push(b.boolean(true));
   if (opts.extensions != null) {
-    if (!Array.isArray(opts.extensions) || !guard.list.allMatch(opts.extensions, function (e) { return Buffer.isBuffer(e) || e instanceof Uint8Array; })) throw _err("tsp/bad-input", "extensions must be an array of encoded Extension DER buffers");
+    if (!Array.isArray(opts.extensions) || !guard.list.allMatch(opts.extensions, function (e) { return guard.bytes.isByteSource(e); })) throw _err("tsp/bad-input", "extensions must be an array of encoded Extension DER buffers");
     // Each pre-encoded Extension is validated as one, and its extnID must not repeat -- the same
     // gate every other request builder applies. Spliced in unchecked, a caller relaying a blob it
     // did not author put fully chosen bytes inside [0] and this encoder emitted DER its own
@@ -345,7 +356,7 @@ function request(messageImprint, opts) {
     // the DER DEFAULT rule forbids.
     var seenExt = {};
     var encoded = opts.extensions.map(function (e, i) {
-      var der = Buffer.from(e);
+      var der = guard.bytes.source(e, TspError, "tsp/bad-input", "an extension");
       _b.assertValidExtension(der, i);
       var extnId = asn1.read.oid(asn1.decode(der).children[0]);
       if (seenExt[extnId]) throw _err("tsp/bad-input", "duplicate request extension " + extnId + " (RFC 5280 sec. 4.2)");
@@ -516,14 +527,15 @@ function _imprintMatches(mi, data) {
   // matching short precomputed imprint must never make it verify (RFC 3161 sec. 2.4.1).
   if (mi.hashedMessage.length !== wantLen) return "tsp/imprint-mismatch";
   var actual;
-  if (Buffer.isBuffer(data) || data instanceof Uint8Array) {
-    actual = nodeCrypto.createHash(nodeAlg).update(Buffer.from(data)).digest();
-  } else if (data && typeof data === "object" && (Buffer.isBuffer(data.hashedMessage) || data.hashedMessage instanceof Uint8Array)) {
+  if (guard.bytes.isByteSource(data)) {
+    actual = nodeCrypto.createHash(nodeAlg).update(guard.bytes.source(data, TspError, "tsp/bad-input", "data")).digest();
+  } else if (data && typeof data === "object" && guard.bytes.isByteSource(data.hashedMessage)) {
     if (data.hashAlgorithm !== name) return "tsp/imprint-mismatch";   // a precomputed imprint under a different algorithm
     // a caller-supplied precomputed imprint of the wrong length is a config error (the sign path
     // rejects it identically) -- throw rather than silently mismatch (three-tier: caller input).
-    if (data.hashedMessage.length !== wantLen) throw _err("tsp/bad-input", "precomputed imprint hashedMessage length (" + data.hashedMessage.length + ") does not match the " + name + " digest length (" + wantLen + ")");
-    actual = Buffer.from(data.hashedMessage);
+    var dhmLen = guard.bytes.source(data.hashedMessage, TspError, "tsp/bad-input", "precomputed imprint hashedMessage").length;
+    if (dhmLen !== wantLen) throw _err("tsp/bad-input", "precomputed imprint hashedMessage length (" + dhmLen + ") does not match the " + name + " digest length (" + wantLen + ")");
+    actual = guard.bytes.source(data.hashedMessage, TspError, "tsp/bad-input", "precomputed imprint hashedMessage");
   } else {
     throw _err("tsp/bad-input", "pki.tsp.verify data must be a Buffer or a { hashAlgorithm, hashedMessage } imprint");
   }
@@ -749,7 +761,7 @@ async function verify(token, data, opts) {
   // nothing to notice it by. Naming the difference at the boundary is the only place it is cheap.
   guard.identifier.assertKnownKeys(opts, _VERIFY_OPTS, _err, "tsp/bad-input",
     "pki.tsp.verify has an unknown option (note the anchor option here is `trustAnchor`, singular, an anchor tuple -- not the `trustAnchors` certificate list pki.cms.verify takes) ");
-  if (opts.certs != null && (!Array.isArray(opts.certs) || !guard.list.allMatch(opts.certs, function (c) { return Buffer.isBuffer(c) || c instanceof Uint8Array; }))) {
+  if (opts.certs != null && (!Array.isArray(opts.certs) || !guard.list.allMatch(opts.certs, function (c) { return guard.bytes.isByteSource(c); }))) {
     throw _err("tsp/bad-input", "pki.tsp.verify opts.certs must be an array of DER certificate Buffers");   // a bad element is a caller error, never silently dropped
   }
   var tokenDer = _tokenDer(token);   // DER Buffer / PEM -> DER; a non-token input throws tsp/bad-input
@@ -790,7 +802,7 @@ async function verify(token, data, opts) {
   }
   // M15 -- if the requested policy is supplied, the token's policy MUST equal it.
   if (opts.reqPolicy != null) {
-    var wantPolicy = /^\d+(\.\d+)+$/.test(opts.reqPolicy) ? opts.reqPolicy : O(opts.reqPolicy);
+    var wantPolicy = oid.isDottedDecimal(opts.reqPolicy) ? opts.reqPolicy : O(opts.reqPolicy);
     if (tst.policy !== wantPolicy) return fail("tsp/policy-mismatch");
   }
   // A TSTInfo carrying a CRITICAL extension the verifier cannot process is unusable: RFC 3161 sec.
@@ -835,7 +847,7 @@ async function verify(token, data, opts) {
     // notBefore is rejected at the floor (ceil >= notBefore but floor < notBefore). Certificate
     // validity is seconds-precise (RFC 5280 sec. 4.1.2.5), so this never over-rejects a valid token.
     var floorT = tst.genTime;
-    var ceilT = (tst.genTimeFraction != null && /[1-9]/.test(tst.genTimeFraction.slice(3))) ? new Date(guard.time.instantOf(floorT) + 1) : floorT;
+    var ceilT = (tst.genTimeFraction != null && _hasNonZeroDigit(tst.genTimeFraction.slice(3))) ? new Date(guard.time.instantOf(floorT) + 1) : floorT;
     try {
       // parseToken surfaces each embedded cert as { bytes, tagClass, ... }; take the X.509 certs
       // (universal SEQUENCE), skipping any attribute-certificate choices, and parse their raw bytes.

package/lib/validator-tpm.js

@@ -226,10 +226,10 @@ function normalizeObjectAttributePolicy(policy, E, code) {
       // and now live in one place. It also decodes, so the hex path cannot validate one string
       // and decode another.
       allow = ap.allow.map(function (entry, i) {
-        if (Buffer.isBuffer(entry)) return guard.bytes.snapshot(entry, E, code, "opts.tpmPolicy.authPolicy.allow[" + i + "]");
+        if (guard.bytes.isByteSource(entry)) return guard.bytes.snapshotSource(entry, E, code, "opts.tpmPolicy.authPolicy.allow[" + i + "]");
         var label = "opts.tpmPolicy.authPolicy.allow[" + i + "]";
         if (typeof entry !== "string" || entry.length === 0) {
-          throw new E(code, label + " must be a Buffer or an even-length hex string");
+          throw new E(code, label + " must be a BufferSource or an even-length hex string");
         }
         return guard.encoding.hex(entry, null, function (c, m) { return new E(c, m); }, code,
           label + " must be a Buffer or an even-length hex string --");

package/lib/webauthn-mds.js

@@ -26,6 +26,7 @@ var intrinsic = require("./guard-intrinsic");
 // Own-key membership through an operation taken at load. Written out, the question reads two
 // replaceable properties to answer one thing, and here it decides which status rows an entry carries.
 var _hasOwn = intrinsic.hasOwn;
+var _charAt = intrinsic.uncurry(String.prototype.charAt);
 var jose = require("./jose");
 var rfc3339 = require("./rfc3339");
 var constants = require("./constants");
@@ -40,6 +41,10 @@ var pkix = require("./schema-pkix");
 var WebauthnError = frameworkError.WebauthnError;
 var _KU_NS = pkix.makeNS("webauthn", WebauthnError, oid);
 function _err(code, message, cause) { return new WebauthnError(code, message, cause); }
+// A 40-character certificate-key-identifier: SHA-1 hex. One accepts either case (/^[0-9a-fA-F]{40}$/), the
+// lookup form is lower-case only (/^[0-9a-f]{40}$/).
+var _KEYID_HEX_CI = pkix.charTable("0123456789abcdefABCDEF");
+var _KEYID_HEX_LOWER = pkix.charTable("0123456789abcdef");
 var C = constants.LIMITS;
 
 // Which signature schemes each certificate key type may perform, keyed by the SPKI algorithm the
@@ -176,7 +181,20 @@ function _deepFreeze(v, depth) {
   Object.keys(v).forEach(function (k) { _deepFreeze(v[k], depth + 1); });
   return v;
 }
-var AAGUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+// The AAGUID canonical form (lowercase hex 8-4-4-4-12 with dashes), matching
+// /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/, decided by character (no regex).
+function _isAaguid(s) {
+  if (s.length !== 36) return false;
+  for (var i = 0; i < 36; i++) {
+    if (i === 8 || i === 13 || i === 18 || i === 23) {
+      if (_charAt(s, i) !== "-") return false;
+    } else {
+      var c = _charAt(s, i);
+      if (!((c >= "0" && c <= "9") || (c >= "a" && c <= "f"))) return false;
+    }
+  }
+  return true;
+}
 // "This authenticator declares no model identity": the AAGUID a U2F authenticator carries, since
 // U2F has no such concept. It is a sentinel, never a lookup key, and lives in one place so the
 // lookup and the dispatch that decides which key space applies cannot disagree about it.
@@ -281,7 +299,7 @@ function _verifyMetadataBlob(blob, opts) {
   // network, and the ordinary way to hold a fetched body is an ArrayBuffer, so the form an
   // operator most naturally arrives with was the one form this refused. `byteLength` is declared by
   // an ArrayBuffer and by every view over one, so the ceiling below still bites before any copy.
-  var raw = (ArrayBuffer.isView(blob) || blob instanceof ArrayBuffer)
+  var raw = guard.bytes.isByteSource(blob)
     ? guard.bytes.source(blob, WebauthnError, "webauthn/bad-input", "the metadata BLOB") : null;
   // A string's `.length` counts UTF-16 code units, not the UTF-8 bytes the conversion produces, so
   // measuring it would let a string of multi-byte characters sit under the ceiling and then expand
@@ -600,7 +618,7 @@ function _parsePayload(seg, at, opts) {
     });
     var aaguid = null;
     if (e.aaguid !== undefined) {
-      if (typeof e.aaguid !== "string" || !AAGUID_RE.test(e.aaguid.toLowerCase())) {
+      if (typeof e.aaguid !== "string" || !_isAaguid(e.aaguid.toLowerCase())) {
         throw _err("webauthn/bad-metadata-blob", "metadata entry " + i + " has a malformed aaguid");
       }
       aaguid = e.aaguid.toLowerCase();
@@ -634,7 +652,7 @@ function _parsePayload(seg, at, opts) {
           // matches -- an entry that silently cannot be found. sec. 3.1.1 requires lower case; the
           // value is canonicalized, not refused, so a catalogue that differs only in letter
           // case still resolves instead of denying service for every authenticator it lists.
-          if (typeof k !== "string" || !/^[0-9a-fA-F]{40}$/.test(k)) {
+          if (typeof k !== "string" || k.length !== 40 || !pkix.allCharsIn(k, _KEYID_HEX_CI)) {
             throw _err("webauthn/bad-metadata-blob", "metadata entry " + i + " has a malformed attestation certificate key identifier");
           }
           var lower = k.toLowerCase();
@@ -692,11 +710,11 @@ function metadataFor(metadata, identifier) {
   if (!isVerifiedResult(metadata)) throw _err("webauthn/bad-input", "metadataFor expects a verifyMetadataBlob result -- an object that merely resembles one, such as a catalogue restored from a cache, has not been through the signature and chain checks");
   if (typeof identifier !== "string") return null;
   var key = identifier.toLowerCase();
-  if (AAGUID_RE.test(key)) {
+  if (_isAaguid(key)) {
     if (key === ZERO_AAGUID) return null;
     return metadata.byAaguid[key] || null;
   }
-  if (/^[0-9a-f]{40}$/.test(key)) return metadataForKeyIdentifier(metadata, key);
+  if (key.length === 40 && pkix.allCharsIn(key, _KEYID_HEX_LOWER)) return metadataForKeyIdentifier(metadata, key);
   return null;
 }
 

package/lib/webauthn.js

@@ -536,7 +536,7 @@ var _FORMAT_SCOPED_BOOLEAN_OPTS = ["verifySafetyNetJws", "requireCtsProfileMatch
 // object cannot recurse without end.
 function _cloneParsed(v, depth) {
   if (depth > 64) throw _err("webauthn/bad-input", "opts.rootCertificates[] is nested too deeply to be a parsed certificate");
-  if (Buffer.isBuffer(v) || v instanceof Uint8Array) return guard.bytes.snapshot(v, _err, "webauthn/bad-input", "a byte field of opts.rootCertificates[]");
+  if (guard.bytes.isByteSource(v)) return guard.bytes.snapshotSource(v, _err, "webauthn/bad-input", "a byte field of opts.rootCertificates[]");
   if (Array.isArray(v)) return v.map(function (x) { return _cloneParsed(x, depth + 1); });
   if (guard.time.isDate(v)) return new Date(guard.time.instantOf(v));
   if (v && typeof v === "object") {
@@ -559,7 +559,7 @@ function _cloneParsed(v, depth) {
 //
 // Anything that is not a BufferSource is refused BY NAME, rather than passed down to be described
 // by whichever parser reaches it first.
-function _isBufferSource(v) { return ArrayBuffer.isView(v) || v instanceof ArrayBuffer; }
+function _isBufferSource(v) { return guard.bytes.isByteSource(v); }
 function _bytesArg(v, label) {
   if (_isBufferSource(v)) {
     return guard.bytes.snapshotSource(v, WebauthnError, "webauthn/bad-input", label);
@@ -2313,7 +2313,7 @@ function verifyAssertion(input) {
     // store already holds the COSE bytes. Accepting only the object made a caller fabricate an
     // authenticatorData that never existed just to reach their own key.
     var coseKey = input.credentialPublicKey;
-    if (Buffer.isBuffer(coseKey) || ArrayBuffer.isView(coseKey) || coseKey instanceof ArrayBuffer) {
+    if (guard.bytes.isByteSource(coseKey)) {
       coseKey = parseCoseKey(coseKey);
     } else if (_isPlainObject(coseKey)) {
       // The OBJECT form is held to the same rules about the KEY as the bytes form. The bytes went

package/lib/webcrypto.js

@@ -760,7 +760,7 @@ async function _deriveBitsRaw(alg, key, length) {
     // caveat covers, so it is wiped once the derivation has consumed it.
     return _withSecretBytes(key, function (ikm) {
       var derived = nodeCrypto.hkdfSync(_hashNode(alg.hash, "HKDF"), ikm, _toBuf(alg.salt, "HKDF salt"), _toBuf(alg.info || _bufferAlloc(0), "HKDF info"), length / 8);
-      return derived instanceof ArrayBuffer ? derived : _toArrayBuffer(_bufferFrom(derived));
+      return _types.isArrayBuffer(derived) ? derived : _toArrayBuffer(_bufferFrom(derived));
     });
   }
   if (name === "PBKDF2") {

package/lib/x509-sign.js

@@ -105,7 +105,7 @@ function _skiValueOf(caCert) {
   return null;
 }
 function _akiKeyId(val, ctx) {
-  if (Buffer.isBuffer(val)) return guard.bytes.snapshot(val, CertificateError, "x509/bad-input", "the authorityKeyIdentifier keyIdentifier");
+  if (guard.bytes.isByteSource(val)) return guard.bytes.snapshotSource(val, CertificateError, "x509/bad-input", "the authorityKeyIdentifier keyIdentifier");
   if (val === true) {
     if (ctx.issuerCert) { var ski = _skiValueOf(ctx.issuerCert); if (ski) return ski; }
     return _spkiKeyId(ctx.issuerSpki);
@@ -264,7 +264,12 @@ function _hasCriticalSan(extSpec) {
  * key being certified), `notBefore` / `notAfter` (`Date`s), an optional `serialNumber`, and an optional
  * `extensions` object. `issuer` is the signing side: `{ key }` alone issues a self-signed certificate
  * (issuer = subject, signed with the subject's own key); `{ name, publicKey, key }` or `{ cert, key }`
- * issues a CA-signed one. The signature algorithm is resolved from the signing key: RSA (PKCS#1 v1.5
+ * issues a CA-signed one. The signing key `key` is a WebCrypto `CryptoKey` -- a `pki.key.generate`
+ * private key passed directly, without exporting -- or a PKCS#8 private key as DER (`Buffer`) or PEM
+ * (`string`); a public or secret CryptoKey, or a `node:crypto` KeyObject, is refused. A `subjectAltName`
+ * (or any `GeneralName`) entry may be a form object (`{ dNSName: "..." }`) or a bare string classified
+ * fail-closed into its form (`"host.example"`, `"a@b.example"`, `"10.0.0.1"`, `"https://host.example/"`).
+ * The signature algorithm is resolved from the signing key: RSA (PKCS#1 v1.5
  * or PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, or a composite arm, so every algorithm the
  * toolkit signs with is available here without a per-algorithm branch.
  *
@@ -283,12 +288,11 @@ function _hasCriticalSan(extSpec) {
  * @example
  *   var pair = await pki.key.generate("Ed25519");
  *   var signerSpki = await pki.key.export(pair.publicKey);
- *   var signerKeyPkcs8 = await pki.key.export(pair.privateKey);
  *   var root = await pki.x509.sign(
  *     { subject: "Example Root CA", subjectPublicKey: signerSpki,
  *       notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z"),
  *       extensions: { basicConstraints: { cA: true }, keyUsage: ["keyCertSign", "cRLSign"], subjectKeyIdentifier: true } },
- *     { key: signerKeyPkcs8 });
+ *     { key: pair.privateKey });   // a WebCrypto CryptoKey signs directly (or pass a PKCS#8 DER Buffer / PEM string)
  *   pki.schema.x509.parse(root).subject.dn;   // "CN=Example Root CA"
  */
 function sign(spec, issuer, opts) {
@@ -324,7 +328,7 @@ function _sign(spec, issuer, opts) {
         : "explicit form; the issuer takes { key, name, publicKey }, or { key, cert } to take both from a certificate");
     });
   guard.identifier.assertKnownKeys(opts, KNOWN_SIGN_OPTS, _err, "x509/bad-input", "pki.x509.sign has an unknown option ");
-  if (issuer.key == null) throw _err("x509/bad-input", "a signing key (issuer.key, a PKCS#8 private key) is required");
+  if (issuer.key == null) throw _err("x509/bad-input", "a signing key (issuer.key, a WebCrypto CryptoKey or a PKCS#8 private key DER/PEM) is required");
 
   var spki = _reqDer(spec.subjectPublicKey, "spec.subjectPublicKey (the SPKI DER of the certified key)");
   _assertValidSpki(spki, "spec.subjectPublicKey");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.30",
+  "version": "0.5.32",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:a82d39df-dc02-419e-86bb-787363fa4d07",
+  "serialNumber": "urn:uuid:e0315ce7-f8af-453b-be94-cae61e3f47ea",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-24T19:49:42.857Z",
+    "timestamp": "2026-08-28T18:08:22.906Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.30",
+      "bom-ref": "@blamejs/pki@0.5.32",
       "type": "application",
       "name": "pki",
-      "version": "0.5.30",
+      "version": "0.5.32",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.30",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.32",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.30",
+      "ref": "@blamejs/pki@0.5.32",
       "dependsOn": []
     }
   ]