@blamejs/pki 0.5.38 → 0.6.0

package/lib/cmp-build.js

@@ -60,6 +60,8 @@ var _bigInt = intrinsic.BigInt;
 // go through a Date a caller could have replaced after this module was read.
 var _Date = intrinsic.Date;
 var csr = require("./schema-csr");
+require("./path-validate");   // side-effect: path-validate injects its signature engine into csr-verify at load
+var csrVerify = require("./csr-verify");   // verify an embedded p10cr request's proof-of-possession before sending it
 var crl = require("./schema-crl");
 var x509 = require("./schema-x509");
 var signScheme = require("./sign-scheme");
@@ -681,10 +683,17 @@ function _encodeBody(bodySpec, key, opts) {
   var inner;
   if (arm === "p10cr") {
     var csrDer = _b.reqDerSequence(bodySpec.p10cr, "p10cr (a CertificationRequest DER)");
-    try { csr.parse(csrDer); }   // validate the embedded PKCS#10 via the real parser (fail-closed on a non-CSR)
+    var parsedCsr;
+    try { parsedCsr = csr.parse(csrDer); }   // validate structure via the real parser AND capture the parse for the PoP check
     catch (e) { if (e instanceof CmpError) throw e; throw _err("cmp/bad-input", "p10cr is not a valid PKCS#10 CertificationRequest", e); }
-    inner = b.raw(csrDer);
-  } else if (arm === "certConf") {
+    // Verify the embedded request's proof-of-possession before it is protected and sent: a p10cr carries
+    // a PKCS#10 CertificationRequest (RFC 9810 sec. 5.3.3, whose structure is RFC 2986), and its
+    // self-signature under its own subject public key is that request's proof-of-possession. A CSR whose
+    // self-signature does not verify is one the CA will reject, so refuse it rather than send it -- through
+    // the shared inbound-PoP seam pki.csr.verify uses.
+    return _p10crBody(csrDer, parsedCsr, tag, state);
+  }
+  if (arm === "certConf") {
     inner = _encodeCertConfirmContent(bodySpec.certConf, state);
   } else if (arm === "pollReq") {
     inner = _encodePollReqContent(bodySpec.pollReq);
@@ -713,6 +722,16 @@ function _encodeBody(bodySpec, key, opts) {
   return Promise.resolve({ bodyTLV: b.explicit(tag, inner), usesCmp2021: state.usesCmp2021 });
 }
 
+// `await`, not a `.then` chain: the PoP verdict is read through the native promise job, not the
+// replaceable Promise.prototype.then a co-resident could swap to force `ok` true and slip an
+// unverified request past. The caller has already validated csrDer's structure synchronously.
+async function _p10crBody(csrDer, parsedCsr, tag, state) {
+  if (!(await csrVerify.verifyCsrSignature(parsedCsr))) {
+    throw _err("cmp/bad-popo", "the p10cr CertificationRequest failed its proof-of-possession: its PKCS#10 signature does not verify under its own subject public key, so a CA would reject it");
+  }
+  return { bodyTLV: b.explicit(tag, b.raw(csrDer)), usesCmp2021: state.usesCmp2021 };
+}
+
 // ---- protection ----
 
 
@@ -803,7 +822,7 @@ function build(message, opts) {
   ], _build);
 }
 
-function _build(message, opts) {
+async function _build(message, opts) {
   opts = opts || {};
   if (!message || typeof message !== "object" || Buffer.isBuffer(message)) throw _err("cmp/bad-input", "the PKIMessage spec must be an object { header, body }");
   guard.identifier.assertKnownKeys(message, KNOWN_MESSAGE_KEYS, _err, "cmp/bad-input", function (k) {
@@ -824,30 +843,31 @@ function _build(message, opts) {
   var prot = _resolveProtection(opts);
   var senderKey = opts.key;
 
-  return Promise.resolve(_encodeBody(message.body, senderKey, opts)).then(function (bodyResult) {
-    var bodyTLV = bodyResult.bodyTLV;
-    var pvno = message.header.pvno != null ? message.header.pvno : 2;
-    if (typeof pvno !== "number" || !Number.isInteger(pvno)) throw _err("cmp/bad-input", "header.pvno must be an integer");
-    if (bodyResult.usesCmp2021 && pvno < 3) pvno = 3;   // a certConf hashAlg forces cmp2021(3)
-
-    var headerTLV = _encodeHeader(message.header, prot.protectionAlgDer, pvno);   // built ONCE
-    var protectedPartDer = b.sequence([headerTLV, bodyTLV]);   // virtual ProtectedPart ::= SEQUENCE { header, body }
-
-    return prot.computeBits(protectedPartDer).then(function (protectionBits) {
-      var msgChildren = [headerTLV, bodyTLV, b.explicit(0, protectionBits)];   // reuse the SAME header/body TLVs
-      var extraCertsDers = _collectExtraCerts(opts, prot.certDer);
-      if (extraCertsDers.length) msgChildren.push(b.explicit(1, b.sequence(extraCertsDers)));
-      var der = b.sequence(msgChildren);
-
-      cmp.parse(der);   // round-trip re-validation: the emitted message MUST parse (protection<=>protectionAlg, pvno, freeText, etc.)
-      if (opts.pem != null) {
-        if (opts.pem === true) return cmp.pemEncode(der, "CMP");
-        if (typeof opts.pem !== "string" || !opts.pem) throw _err("cmp/bad-input", "opts.pem must be true or a non-empty PEM label string");
-        return cmp.pemEncode(der, opts.pem);
-      }
-      return der;
-    });
-  });
+  // `await`, not a `.then` chain: an embedded p10cr/crm proof-of-possession is enforced by _encodeBody
+  // REJECTING, so the verdict must reach here through the native promise job, not a Promise.prototype.then
+  // a co-resident could swap to fire this callback with a forged body and slip an unverified request past.
+  var bodyResult = await _encodeBody(message.body, senderKey, opts);
+  var bodyTLV = bodyResult.bodyTLV;
+  var pvno = message.header.pvno != null ? message.header.pvno : 2;
+  if (typeof pvno !== "number" || !Number.isInteger(pvno)) throw _err("cmp/bad-input", "header.pvno must be an integer");
+  if (bodyResult.usesCmp2021 && pvno < 3) pvno = 3;   // a certConf hashAlg forces cmp2021(3)
+
+  var headerTLV = _encodeHeader(message.header, prot.protectionAlgDer, pvno);   // built ONCE
+  var protectedPartDer = b.sequence([headerTLV, bodyTLV]);   // virtual ProtectedPart ::= SEQUENCE { header, body }
+
+  var protectionBits = await prot.computeBits(protectedPartDer);
+  var msgChildren = [headerTLV, bodyTLV, b.explicit(0, protectionBits)];   // reuse the SAME header/body TLVs
+  var extraCertsDers = _collectExtraCerts(opts, prot.certDer);
+  if (extraCertsDers.length) msgChildren.push(b.explicit(1, b.sequence(extraCertsDers)));
+  var der = b.sequence(msgChildren);
+
+  cmp.parse(der);   // round-trip re-validation: the emitted message MUST parse (protection<=>protectionAlg, pvno, freeText, etc.)
+  if (opts.pem != null) {
+    if (opts.pem === true) return cmp.pemEncode(der, "CMP");
+    if (typeof opts.pem !== "string" || !opts.pem) throw _err("cmp/bad-input", "opts.pem must be true or a non-empty PEM label string");
+    return cmp.pemEncode(der, opts.pem);
+  }
+  return der;
 }
 
 function _collectExtraCerts(opts, protCertDer) {
@@ -889,8 +909,10 @@ function _collectExtraCerts(opts, protCertDer) {
  * one of `{ key, cert }` (a signature under the sender key over the message, using any registry algorithm: RSA
  * / ECDSA / EdDSA / ML-DSA / SLH-DSA / composite, resolved from the certificate) or `{ mac }` (a PBMAC1
  * shared-secret MAC). The protection is computed over the exact DER of the virtual
- * `ProtectedPart ::= SEQUENCE { header, body }` and self-verified before the message is returned. The
- * emitted PKIMessage round-trips byte-identically through `pki.schema.cmp.parse`.
+ * `ProtectedPart ::= SEQUENCE { header, body }` and self-verified before the message is returned. An
+ * embedded `p10cr` request is checked against its own proof-of-possession first: a PKCS#10 whose
+ * self-signature does not verify under its subject public key is refused (`cmp/bad-popo`) rather than
+ * protected and sent. The emitted PKIMessage round-trips byte-identically through `pki.schema.cmp.parse`.
  *
  * @opts
  *   - `key` (Buffer|CryptoKey) + `cert` (Buffer): signature protection under the sender key; `cert` is
@@ -1116,7 +1138,7 @@ function wellKnownUrl(base, opts) {
  * @primitive  pki.cmp.transfer
  * @signature  pki.cmp.transfer(url, message, opts?) -> Promise<{ response, responseBytes, status, contentType, tls }>
  * @since      0.3.19
- * @status     experimental
+ * @status     stable
  * @spec       RFC 9811, RFC 9810
  * @related    pki.cmp.build, pki.cmp.wellKnownUrl, pki.schema.cmp.parse, pki.transport.https
  *
@@ -1159,7 +1181,7 @@ function wellKnownUrl(base, opts) {
  * @primitive  pki.cmp.wellKnownUrl
  * @signature  pki.cmp.wellKnownUrl(base, opts?) -> string
  * @since      0.3.19
- * @status     experimental
+ * @status     stable
  * @spec       RFC 9811, RFC 8615
  * @related    pki.cmp.transfer
  *

package/lib/cmp-session.js

@@ -390,7 +390,7 @@ function _certConfHash(certDer) {
  * @primitive  pki.cmp.session
  * @signature  pki.cmp.session(opts) -> session
  * @since      0.3.27
- * @status     experimental
+ * @status     stable
  * @spec       RFC 9810, RFC 9811, RFC 9483
  * @related    pki.cmp.build, pki.cmp.verify, pki.cmp.transfer
  *

package/lib/ct.js

@@ -154,7 +154,7 @@ function _parseSct(r, sctLen) {
  * @primitive  pki.ct.parseSctList
  * @signature  pki.ct.parseSctList(extValue) -> { scts, unknownScts, all }
  * @since      0.1.20
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962, RFC 5246, RFC 8446
  * @related    pki.ct.reconstructSignedData, pki.ct.encodeSctList, pki.schema.x509.parse
  *
@@ -252,7 +252,7 @@ function _u24Bytes(n) {
  * @primitive  pki.ct.reconstructSignedData
  * @signature  pki.ct.reconstructSignedData(entry, sct) -> Buffer
  * @since      0.1.20
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962
  * @related    pki.ct.parseSctList
  *
@@ -378,7 +378,7 @@ function _spkiAlg(spki) {
  * @primitive  pki.ct.verifySct
  * @signature  pki.ct.verifySct(entry, sct, logPublicKey) -> Promise<boolean>
  * @since      0.2.12
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962
  * @defends    sct-signature-forgery (CWE-347)
  * @related    pki.ct.parseSctList, pki.ct.reconstructSignedData
@@ -498,7 +498,7 @@ function _encodeSctBody(sct) {
  * @primitive  pki.ct.encodeSctList
  * @signature  pki.ct.encodeSctList(scts) -> Buffer
  * @since      0.2.24
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962, RFC 5246
  * @related    pki.ct.parseSctList, pki.ct.signSct
  *
@@ -573,7 +573,7 @@ function _logKeyMaterial(logKey) {
  * @primitive  pki.ct.signSct
  * @signature  pki.ct.signSct(entry, logKey, opts?) -> Promise<sct>
  * @since      0.2.24
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962
  * @related    pki.ct.verifySct, pki.ct.reconstructSignedData, pki.ct.encodeSctList
  *
@@ -723,7 +723,7 @@ function _logsAgree(a, b) {
  * @primitive  pki.ct.parseLogList
  * @signature  pki.ct.parseLogList(json, opts?) -> { logs, byLogId, version, timestamp }
  * @since      0.2.28
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962
  * @related    pki.ct.verifySctWithLogList, pki.ct.verifySct
  *
@@ -815,7 +815,7 @@ function _resolveNotAfter(entry, opts) {
  * @primitive  pki.ct.verifySctWithLogList
  * @signature  pki.ct.verifySctWithLogList(entry, sct, logList, opts?) -> Promise<boolean>
  * @since      0.2.28
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962
  * @related    pki.ct.parseLogList, pki.ct.verifySct
  *
@@ -878,7 +878,7 @@ async function verifySctWithLogList(entry, sct, logList, opts) {
  * @primitive  pki.ct.verifyLogListSignature
  * @signature  pki.ct.verifyLogListSignature(json, signature, publicKey) -> Promise<boolean>
  * @since      0.2.29
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962, RFC 8017
  * @related    pki.ct.parseLogList, pki.ct.verifySct
  *
@@ -1019,7 +1019,7 @@ function _fetchBody(transport, url, req, label) {
  * @primitive  pki.ct.fetchLogList
  * @signature  pki.ct.fetchLogList(opts) -> Promise<{ logs, byLogId, version, timestamp, raw, status, contentType, tls }>
  * @since      0.3.21
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962
  * @related    pki.ct.parseLogList, pki.ct.verifyLogListSignature, pki.ct.verifySctWithLogList
  *

package/lib/est.js

@@ -162,7 +162,7 @@ function _knownOpts(opts, known, verb) {
  * @primitive  pki.est.transferDecode
  * @signature  pki.est.transferDecode(body) -> Buffer
  * @since      0.1.24
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8951, RFC 4648
  * @related    pki.est.transferEncode
  *
@@ -200,7 +200,7 @@ function transferDecode(body) {
  * @primitive  pki.est.transferEncode
  * @signature  pki.est.transferEncode(der) -> string
  * @since      0.1.24
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8951, RFC 4648
  * @related    pki.est.transferDecode
  *
@@ -389,7 +389,7 @@ function splitMultipartMixed(body, contentType) {
  * @primitive  pki.est.parseCertsOnly
  * @signature  pki.est.parseCertsOnly(der) -> { certificates, crls }
  * @since      0.1.24
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030, RFC 5272, RFC 5652
  * @related    pki.est.findIssuedCert, pki.schema.cms.parse
  *
@@ -695,7 +695,7 @@ var NOT_IMPLEMENTED_OPS = { fullcmc: 1 };
  * @primitive  pki.est.classifyResponse
  * @signature  pki.est.classifyResponse(status, headers, body, opts?) -> verdict
  * @since      0.1.24
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030, RFC 8951
  * @related    pki.est.paths, pki.est.parseCertsOnly
  *
@@ -796,7 +796,7 @@ function classifyResponse(status, headers, body, opts) {
  * @primitive  pki.est.paths
  * @signature  pki.est.paths(baseUrl, opts?) -> { cacerts, simpleenroll, ... }
  * @since      0.1.24
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030
  * @related    pki.est.classifyResponse
  *
@@ -1310,7 +1310,7 @@ function _certsResult(op, res, opts, csrSpki) {
  * @primitive  pki.est.fullcmc
  * @signature  pki.est.fullcmc(baseUrl, request, opts?) -> Promise<verdict | { retry, retryAfterSeconds }>
  * @since      0.4.16
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030, RFC 8951, RFC 5273, RFC 5272
  * @related    pki.cmc.build, pki.cmc.verify, pki.est.simpleenroll
  *
@@ -2024,7 +2024,7 @@ function _enroll(op, baseUrl, csrInput, opts) {
  * @primitive  pki.est.cacerts
  * @signature  pki.est.cacerts(baseUrl, opts?) -> Promise<{ certificates, crls } | { retry, retryAfterSeconds }>
  * @since      0.3.16
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030, RFC 8951
  * @related    pki.est.simpleenroll, pki.transport.https
  *
@@ -2068,7 +2068,7 @@ function cacerts(baseUrl, opts) {
  * @primitive  pki.est.simpleenroll
  * @signature  pki.est.simpleenroll(baseUrl, csr, opts?) -> Promise<{ certificate, chain, certificates } | { retry, retryAfterSeconds }>
  * @since      0.3.16
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030, RFC 5272
  * @related    pki.csr.sign, pki.est.simplereenroll, pki.est.cacerts
  *
@@ -2106,7 +2106,7 @@ function simpleenroll(baseUrl, csrInput, opts) {
  * @primitive  pki.est.simplereenroll
  * @signature  pki.est.simplereenroll(baseUrl, csr, opts?) -> Promise<{ certificate, chain, certificates } | { retry, retryAfterSeconds }>
  * @since      0.3.16
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030
  * @related    pki.est.simpleenroll, pki.est.reenrollGuard
  *
@@ -2285,7 +2285,7 @@ async function _serverkeygenResult(res, opts, derived) {
  * @primitive  pki.est.serverkeygen
  * @signature  pki.est.serverkeygen(baseUrl, csr, opts?) -> Promise<{ certificates, privateKey } | { certificates, encryptedKey } | { retry, retryAfterSeconds, retryAfterDate }>
  * @since      0.3.28
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030, RFC 8951
  * @related    pki.est.simpleenroll, pki.est.parseServerKeygenResponse
  *
@@ -2364,7 +2364,7 @@ function _csrattrsResult(res, opts) {
  * @primitive  pki.est.csrattrs
  * @signature  pki.est.csrattrs(baseUrl, opts?) -> Promise<{ available: true, attrs, plan } | { available: false, attrs: null }>
  * @since      0.3.28
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030, RFC 8951, RFC 9908
  * @related    pki.est.simpleenroll, pki.est.buildEnrollAttributes
  *

package/lib/hpke.js

@@ -455,7 +455,7 @@ var suites = {
  * @primitive pki.hpke.setupS
  * @signature pki.hpke.setupS(suiteIds, recipientPublicKey, opts?) -> { enc, context }
  * @since 0.2.2
- * @status experimental
+ * @status stable
  * @spec RFC 9180
  * @related pki.hpke.setupR, pki.hpke.seal
  *
@@ -495,7 +495,7 @@ function _setupS(ids, pkR, opts) {
  * @primitive pki.hpke.setupR
  * @signature pki.hpke.setupR(suiteIds, enc, recipientPrivateKey, opts?) -> context
  * @since 0.2.2
- * @status experimental
+ * @status stable
  * @spec RFC 9180
  * @related pki.hpke.setupS, pki.hpke.open
  *
@@ -538,7 +538,7 @@ function _setupR(ids, enc, skR, opts) {
  * @primitive pki.hpke.seal
  * @signature pki.hpke.seal(suiteIds, recipientPublicKey, opts, aad, pt) -> { enc, ct }
  * @since 0.2.2
- * @status experimental
+ * @status stable
  * @spec RFC 9180
  * @related pki.hpke.open, pki.hpke.setupS
  *
@@ -574,7 +574,7 @@ function seal(ids, pkR, opts, aad, pt) {
  * @primitive pki.hpke.open
  * @signature pki.hpke.open(suiteIds, enc, recipientPrivateKey, opts, aad, ct) -> pt
  * @since 0.2.2
- * @status experimental
+ * @status stable
  * @spec RFC 9180
  * @related pki.hpke.seal, pki.hpke.setupR
  *

package/lib/http-transport.js

@@ -245,7 +245,7 @@ function _classifyError(e, C) {
  * @primitive  pki.transport.https
  * @signature  pki.transport.https(defaults?) -> transport
  * @since      0.3.16
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030, RFC 8996
  * @defends    tls-downgrade (CWE-757), server-impersonation (CWE-297), response-flooding (CWE-770), ssrf (CWE-918)
  * @related    pki.est.cacerts, pki.est.simpleenroll

package/lib/lint.js

@@ -714,7 +714,7 @@ function _applyThreshold(report, severity) {
  * @primitive  pki.lint.certificate
  * @signature  pki.lint.certificate(input, opts?) -> LintReport
  * @since      0.2.10
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5280, CA/Browser Forum TLS BR
  * @related    pki.schema.x509.parse, pki.inspect.certificate, pki.path.validate
  *
@@ -772,7 +772,7 @@ function certificate(input, opts) {
  * @primitive  pki.lint.rules
  * @signature  pki.lint.rules(profile?) -> [{id, severity, source, citation}]
  * @since      0.2.10
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5280, CA/Browser Forum TLS BR
  *
  * Enumerate the rule registry (all rules, or one profile's). Each entry exposes its
@@ -790,7 +790,7 @@ function rules(profile) {
  * @primitive  pki.lint.profiles
  * @signature  pki.lint.profiles() -> [string]
  * @since      0.2.10
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5280, CA/Browser Forum TLS BR
  *
  * List the known lint-profile names.

package/lib/ocsp-request-verify.js

@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- the single signature seam for an inbound signed OCSPRequest (RFC 6960 sec. 4.1.1),
+// composed by pki.ocsp.verifyRequest. It routes the request-signature check through the same
+// certification-path signature engine (its EdDSA low-order-point and algorithm-confusion gates
+// included) that pki.ocsp.verify uses for a response and pki.crl.verify / pki.cms.verify use for
+// theirs, so no second, weaker verifier of an untrusted request can drift. The producing side runs
+// its own check over what it just signed (pki.ocsp.buildRequest's signer path); this is the
+// different question a responder asks about a request someone else produced. The slot, the wiring
+// assertion and the octet-alignment refusal are the shared seam (lib/verify-seam.js). It is not
+// wired into index.js and is reached only by require.
+
+var frameworkError = require("./framework-error");
+var seam = require("./verify-seam");
+
+var _seam = seam.makeSeam("ocsp-request-verify", frameworkError.OcspError, "ocsp/bad-input");
+
+// Verify a signed OCSPRequest's signature over its exact tbsRequest bytes under the SPKI of the
+// requestor certificate the request carries (RFC 6960 sec. 4.1.1). Unlike a CSR there is no
+// self-signature: the verifying key is the requestor's, identified to the responder by
+// requestorName and proven by the certificate embedded in (or supplied alongside) the request.
+function verifyRequestSignature(signatureAlgorithm, signature, signerSpkiBytes, tbsRequestBytes) {
+  return _seam.verify(signatureAlgorithm, signature, signerSpkiBytes, tbsRequestBytes);
+}
+
+module.exports = { setEngine: _seam.setEngine, verifyRequestSignature: verifyRequestSignature };

package/lib/ocsp.js

@@ -32,6 +32,7 @@ var ocspSchema = require("./schema-ocsp");
 var pathValidate = require("./path-validate");
 var signScheme = require("./sign-scheme");
 var ocspVerify = require("./ocsp-verify");
+var ocspRequestVerify = require("./ocsp-request-verify");   // path-validate (required above) injects its signature engine into this seam at load
 var webcrypto = require("./webcrypto");
 var subtle = webcrypto.webcrypto.subtle;
 var guard = require("./guard-all");
@@ -579,9 +580,164 @@ function _responseNonce(parsed) {
   return null;
 }
 
+var _VERIFY_REQUEST_OPTS = { certs: 1 };
+// Parsed from BYTES so the signature, the algorithm that verifies it and the tbsRequest it covers
+// are bound to one byte string, the same discipline pki.ocsp.verify follows for a response. A
+// BufferSource is SNAPSHOT first: parseRequest surfaces tbsRequest / signature / embedded certs as
+// views into it, and the signature check awaits, so without a copy a caller could mutate the buffer
+// mid-verification and be judged on bytes other than the parser read. A PEM string decodes to a
+// fresh buffer already; parseRequest owns that decode and a non-bytes input is its typed refusal.
+function _requestFromBytes(request) {
+  if (guard.bytes.isByteSource(request)) request = guard.bytes.snapshotSource(request, OcspError, "ocsp/bad-input", "the OCSP request");
+  return ocspSchema.parseRequest(request);
+}
+function _reqVerdict(parsed, extra) {
+  return {
+    signed: extra.signed, signatureValid: extra.signatureValid,
+    signerCert: extra.signerCert != null ? extra.signerCert : null,
+    signerCerts: extra.signerCerts != null ? extra.signerCerts : [],
+    certs: extra.certs != null ? extra.certs : [],
+    signerSubject: extra.signerSubject != null ? extra.signerSubject : null,
+    requestorName: parsed.requestorName, requestList: parsed.requestList,
+    requestExtensions: parsed.requestExtensions, version: parsed.version,
+    reason: extra.reason != null ? extra.reason : null,
+  };
+}
+// Collect EVERY candidate certificate whose key verified the request signature. RFC 6960 sec. 4.1.1
+// certs is an unordered SEQUENCE OF Certificate, and several may share the signing key (an expired
+// certificate carried beside its renewal), so all matches are surfaced rather than one
+// position-dependent pick: the responder builds a trusted path to one of them to select a usable
+// one, and no valid match is hidden behind an unusable one that happened to appear first. `strict` separates the
+// responder's own opts.certs (a malformed entry is its config error, a typed throw) from the
+// request's untrusted embedded certs (a malformed one is skipped, never fatal).
+async function _findRequestSigners(candidates, strict, parsed, sig, sigBits) {
+  var parsedList = [];
+  for (var i = 0; i < candidates.length; i++) {
+    try { parsedList.push({ der: candidates[i], cert: x509.parse(candidates[i]) }); }
+    catch (e) { if (strict) throw _err("ocsp/bad-signer-cert", "an opts.certs entry does not parse as an X.509 certificate", e); }
+  }
+  // The certs surfaced for path building are the PARSEABLE ones: a malformed embedded entry (skipped
+  // above rather than fatal) is excluded so it is never handed to pki.path.build as a candidate.
+  var parseable = parsedList.map(function (p) { return p.der; });
+  // signerCerts is every candidate whose key VERIFIES the request signature, identified by the
+  // verification itself rather than by comparing encoded key bytes. A request carries one signature
+  // under one key, but that key can appear across several certificates in the unordered certs field
+  // (an expired certificate beside its renewal), and the one key can be encoded differently between
+  // them -- rsaEncryption with NULL versus absent parameters, an EC point compressed versus
+  // uncompressed -- so a byte comparison would drop a genuine match, while a coincidental byte match
+  // under a different algorithm would be a false one. Verifying each candidate answers both exactly,
+  // through the algorithm-confusion gate (RFC 9814 sec. 4) in the shared engine. The work is bounded:
+  // the parser already caps the certificate count at OCSP_MAX_CERTS, and the engine returns false
+  // (never throws) for a candidate whose key does not match the signature, so a non-signer is skipped
+  // rather than aborting the verdict.
+  var matches = [];
+  for (var j = 0; j < parsedList.length; j++) {
+    if (await ocspRequestVerify.verifyRequestSignature(sig.signatureAlgorithm, sigBits, parsedList[j].cert.subjectPublicKeyInfo.bytes, parsed.tbsRequestBytes)) {
+      matches.push({ der: parsedList[j].der, subject: parsedList[j].cert.subject });
+    }
+  }
+  return { matches: matches, parseable: parseable };
+}
+// The verdict from `_findRequestSigners`: signerCerts is every match (so the caller's trust decision
+// does not depend on ordering), signerCert / signerSubject the first for the common single-signer
+// case. `certs` is every PARSEABLE certificate the request carried (or opts.certs supplied), so the
+// responder has the intermediates it needs to chain a signer to an anchor -- those do not sign the
+// request, so they never appear in signerCerts. No match is signatureValid:false with the reason.
+function _signerVerdict(parsed, found, failReason) {
+  if (!found.matches.length) return _reqVerdict(parsed, { signed: true, signatureValid: false, certs: found.parseable, reason: failReason });
+  return _reqVerdict(parsed, {
+    signed: true, signatureValid: true, signerCert: found.matches[0].der,
+    signerCerts: found.matches.map(function (m) { return m.der; }), certs: found.parseable,
+    signerSubject: { dn: found.matches[0].subject.dn, rdns: found.matches[0].subject.rdns }, reason: null,
+  });
+}
+
+/**
+ * @primitive  pki.ocsp.verifyRequest
+ * @signature  pki.ocsp.verifyRequest(request, opts?) -> Promise<{ signed, signatureValid, signerCert, signerCerts, certs, signerSubject, requestorName, requestList, requestExtensions, version, reason }>
+ * @since      0.6.0
+ * @status     stable
+ * @spec       RFC 6960
+ * @related    pki.ocsp.buildRequest, pki.ocsp.verify, pki.schema.ocsp.parseRequest, pki.csr.verify
+ *
+ * The responder-side counterpart to `pki.ocsp.buildRequest`: verify a client's signed OCSP request
+ * (RFC 6960 sec. 4.1.1). Signing a request is OPTIONAL, so an unsigned request is not an error; it is
+ * reported with `signed: false` and authenticates no requestor. For a signed request the requestor's
+ * signature over the exact `tbsRequest` is checked under the public key of the requestor certificate
+ * the request carries, through the same certification-path signature engine `pki.ocsp.verify` uses
+ * for a response (with its EdDSA low-order-point and algorithm-confusion gates). `request` is DER
+ * `Buffer` / `Uint8Array` or a PEM `OCSP REQUEST` string, parsed from bytes so the signature, its
+ * algorithm and the covered `tbsRequest` are one byte string and cannot be split.
+ *
+ * `signatureValid` means only that a certificate's key made this signature over this request. It
+ * says nothing about whether that certificate is trusted: `signerCerts` is every certificate the
+ * request carries whose key verified the signature (RFC 6960 sec. 4.1.1 certs is unordered, and a
+ * key may appear under an expired certificate beside its renewal), so the responder builds a trusted
+ * path to one of them rather than depend on ordering. `signerCert` and the decoded `signerSubject`
+ * are the first of those, the common single-signer case. `certs` is every parseable certificate the
+ * request carried (or opts.certs supplied), including intermediates that do not sign and so are absent
+ * from `signerCerts`: the responder passes it as the `opts.candidates` pool to `pki.path.build`, which
+ * discovers and validates the ordered path from a `signerCerts` entry (leaf) up to a trust anchor.
+ * The responder then confirms that certificate is authorized to sign the request -- its `keyUsage`,
+ * where present, must assert `digitalSignature` (RFC 5280 sec. 4.2.1.3, since the certificate signed
+ * the request) -- and compares its subject to the `requestorName` it expects. The decoded
+ * `requestList`, `requestExtensions` and `version` are
+ * returned so the CertIDs being asked about need no re-parse.
+ *
+ * @opts
+ *   - `certs`  An array of certificates (DER `Buffer` / `Uint8Array` or PEM strings) supplying the
+ *              requestor certificate when the request omits its own `certs` (RFC 6960 lets them
+ *              travel out of band); every entry whose key verifies is surfaced in `signerCerts`,
+ *              and is ignored when the request embeds its own certificates.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey), spki = await pki.key.export(pair.publicKey);
+ *   var caDer = await pki.x509.sign({ subject: "OCSP CA", subjectPublicKey: spki,
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2027-01-01T00:00:00Z") }, { key: key });
+ *   var request = await pki.ocsp.buildRequest({ cert: caDer, issuer: caDer },
+ *     { signer: { cert: caDer, key: key }, requestorName: pki.schema.x509.parse(caDer).subject.bytes });
+ *   var v = await pki.ocsp.verifyRequest(request);
+ *   // v.signed && v.signatureValid -> for a signerCerts entry, pki.path.build(entry, { candidates:
+ *   // v.certs, trustAnchors, time }) discovers and validates the path (several signerCerts may share
+ *   // the key, e.g. an expired one beside its renewal); confirm that entry's keyUsage asserts
+ *   // digitalSignature, then bind its subject to the requestor you expect before honoring v.requestList.
+ */
+async function verifyRequest(request, opts) {
+  opts = guard.identifier.optionsObject(opts, _err, "ocsp/bad-input", "pki.ocsp.verifyRequest options");
+  guard.identifier.assertKnownKeys(opts, _VERIFY_REQUEST_OPTS, _err, "ocsp/bad-input",
+    "pki.ocsp.verifyRequest has an unknown option (out-of-band requestor certificates are `certs`): ");
+  var parsed = _requestFromBytes(request);
+  var sig = parsed.optionalSignature;
+  if (sig == null) {
+    return _reqVerdict(parsed, { signed: false, signatureValid: false,
+      reason: "the OCSP request is unsigned (RFC 6960 sec. 4.1.1 makes optionalSignature OPTIONAL); no requestor is authenticated" });
+  }
+  // sig.signature is the raw signature the parser already refused unless octet-aligned; the seam
+  // re-checks alignment, so it is handed the BIT STRING shape the seam verifies.
+  var sigBits = { unusedBits: 0, bytes: sig.signature };
+  // Prefer the certificates the request carries; fall back to opts.certs only when it carries none.
+  if (sig.certs.length) {
+    return _signerVerdict(parsed, await _findRequestSigners(sig.certs, false, parsed, sig, sigBits),
+      "the OCSP request signature does not verify over tbsRequest under any certificate the request carries (RFC 6960 sec. 4.1.1)");
+  }
+  var suppliedCerts = [];
+  if (opts.certs != null) {
+    var list = pkiBuild.reqDenseArray(opts.certs, "opts.certs", _err, "ocsp/bad-input");
+    for (var i = 0; i < list.length; i++) suppliedCerts.push(_normCertDer(list[i], "an opts.certs entry"));
+  }
+  if (!suppliedCerts.length) {
+    return _reqVerdict(parsed, { signed: true, signatureValid: false,
+      reason: "the signed OCSP request carries no certificate and opts.certs was not supplied, so its signature cannot be verified" });
+  }
+  return _signerVerdict(parsed, await _findRequestSigners(suppliedCerts, true, parsed, sig, sigBits),
+    "the OCSP request signature does not verify over tbsRequest under any opts.certs entry");
+}
+
 module.exports = {
   buildRequest: buildRequest,
   sign: sign,
   buildErrorResponse: buildErrorResponse,
   verify: verify,
+  verifyRequest: verifyRequest,
 };

package/lib/path-validate.js

@@ -44,6 +44,7 @@ var crlVerify = require("./crl-verify");
 var csrVerify = require("./csr-verify");
 var crmfVerify = require("./crmf-verify");
 var attrcertVerify = require("./attrcert-verify");
+var ocspRequestVerify = require("./ocsp-request-verify");
 var cmpVerify = require("./cmp-verify");
 var cmsVerify = require("./cms-verify");
 var cmpSession = require("./cmp-session");
@@ -2369,6 +2370,10 @@ crmfVerify.setEngine(_verifyWithSpki);
 // same way.
 attrcertVerify.setEngine(_verifyWithSpki);
 
+// And for a signed OCSPRequest (RFC 6960 sec. 4.1.1), so pki.ocsp.verifyRequest checks a requestor's
+// signature through the same one engine that verifies a response, never a second, weaker request path.
+ocspRequestVerify.setEngine(_verifyWithSpki);
+
 // ---- the OCSP revocation checker (RFC 6960) -------------------------------
 
 // The OCSP response-verification core (responder authorization + CertID binding + currency +
@@ -3346,7 +3351,7 @@ async function _fetchAiaIssuers(current, aia) {
  * @primitive  pki.path.build
  * @signature  pki.path.build(leaf, opts) -> Promise<{ valid, path, trustAnchor, result, candidatesConsidered, aiaFetches }>
  * @since       0.3.7
- * @status      experimental
+ * @status      stable
  * @spec        RFC 4158, RFC 5280
  * @related     pki.path.validate, pki.schema.x509.parse, pki.trust.parseCertdata
  *

package/lib/schema-c509.js

@@ -2014,7 +2014,7 @@ function _reconstructDer(r, sigNode) {
  * @primitive  pki.schema.c509.parse
  * @signature  pki.schema.c509.parse(bytes) -> { certificateType, serialNumber, serialNumberHex, ... }
  * @since      0.2.30
- * @status     experimental
+ * @status     stable
  * @spec       draft-ietf-cose-cbor-encoded-cert, RFC 8949, RFC 9090, RFC 5280
  *
  * Decode a C509 certificate (draft-ietf-cose-cbor-encoded-cert) from its deterministic-CBOR bytes.
@@ -2274,7 +2274,7 @@ function _encodeC509Array(r) {
  * @primitive  pki.schema.c509.encode
  * @signature  pki.schema.c509.encode(input[, opts]) -> Buffer
  * @since      0.3.4
- * @status     experimental
+ * @status     stable
  * @spec       draft-ietf-cose-cbor-encoded-cert, RFC 8949, RFC 9090
  * @related    pki.schema.c509.parse
  *