@blamejs/pki 0.5.4 → 0.5.6

package/lib/ocsp.js

@@ -57,14 +57,31 @@ var OID_EXTENDED_REVOKE = O("ocspExtendedRevoke");
 
 function _digest(wcHash, buf) { return subtle.digest(wcHash, buf).then(function (h) { return Buffer.from(h); }); }
 function _certOf(arg, what) {
-  if (arg && arg.subjectPublicKeyInfo && arg.tbsBytes) return arg;   // already parsed
-  var der;
-  if (Buffer.isBuffer(arg)) der = arg;
-  else if (arg instanceof Uint8Array) der = Buffer.from(arg);
-  else if (typeof arg === "string") { try { der = x509.pemDecode(arg); } catch (e) { throw _err("ocsp/bad-input", (what || "a certificate") + " PEM could not be decoded", e); } }
-  else throw _err("ocsp/bad-input", (what || "a certificate") + " must be a parsed certificate, a DER Buffer, or a PEM string");
-  try { return x509.parse(der); } catch (e) { throw _err("ocsp/bad-input", (what || "a certificate") + " is not a well-formed X.509 certificate", e); }
+  var label = what || "a certificate";
+  // Re-derived from the bytes its parser read, like every other certificate door. A CertID is an
+  // IDENTITY -- the issuer's name and key hashed, plus the serial -- so a certificate that names one
+  // identity while carrying another's signed bytes would have this verb ask about, or answer for,
+  // a certificate nobody issued.
+  return guard.parsed.acceptDerived(arg, "certificate", function (bytes) {
+    var der = bytes;
+    if (typeof bytes === "string") {
+      try { der = x509.pemDecode(bytes); } catch (e) { throw _err("ocsp/bad-input", label + " PEM could not be decoded", e); }
+    }
+    try { return x509.parse(der); } catch (e) { throw _err("ocsp/bad-input", label + " is not a well-formed X.509 certificate", e); }
+  }, _err, "ocsp/bad-input", label);
+}
+// The response, always parsed from the bytes the caller handed over. See verify's own comment for
+// why an object cannot be accepted here: the three parts of a signature check would come from three
+// independently-chosen properties. The claim is detected on any of the parsed-response fields, so a
+// caller who passes one is told what happened rather than getting a byte-parse fault about its type.
+var _RESPONSE_CLAIM = ["responseStatus", "basicResponse", "tbsResponseDataBytes"];
+function _responseFromBytes(response) {
+  return guard.parsed.fromTrustedSource(response, "ocspResponse", _RESPONSE_CLAIM, function (bytes) {
+    return ocspSchema.parseResponse(_toDer(bytes, "the OCSP response"));
+  }, _err, "ocsp/bad-input",
+  "the OCSP response must be its DER bytes, a PEM string, or an unmodified pki.schema.ocsp.parseResponse result: the signature, the algorithm that verifies it and the bytes it covers are separate properties of a parsed object, so a REBUILT response (Object.assign, spread, a JSON round-trip) could have the three describe different responses and is refused");
 }
+
 function _toDer(input, what) {
   if (Buffer.isBuffer(input)) return input;
   if (input instanceof Uint8Array) return Buffer.from(input);
@@ -239,7 +256,13 @@ function _normCertDer(cert, what) {
  *     { responderID: "byName", responses: [{ cert: leafDer, issuer: caDer, status: "good" }] },
  *     { cert: responderCertDer, key: responderPkcs8 });
  */
+// Documented `-> Promise`, so a fault leaves as a REJECTION (guard-async); the checks stay
+// synchronous because they read the responder's mutable cert and key.
 function sign(responseData, responder, opts) {
+  return guard.async.deferred(function () { return _sign(responseData, responder, opts); });
+}
+
+function _sign(responseData, responder, opts) {
   opts = opts || {};
   responseData = responseData || {};
   if (!responder || responder.cert == null || responder.key == null) throw _err("ocsp/bad-input", "a responder must be { cert, key }");
@@ -456,13 +479,26 @@ function verify(response, opts) {
   if (opts.cert == null || opts.issuer == null) return Promise.reject(_err("ocsp/bad-input", "verify requires opts.cert and opts.issuer"));
   var parsed, cert, issuerCert, time;
   try {
-    parsed = (response && response.responseStatus) ? response : ocspSchema.parseResponse(_toDer(response, "the OCSP response"));
+    // The response is parsed from BYTES, always. A claimed-parsed response carries the signature,
+    // the algorithm that verifies it and the byte range it covers as three independent properties,
+    // so an object could pair one structure's tbsResponseDataBytes with another's signature -- and a
+    // signature the issuing CA made over a certificate it issued would verify as a ResponseData
+    // signature, returning status "good" for a certificate the responder never spoke about.
+    // Parsing here binds all three to one byte string. pki.schema.ocsp.parseResponse remains the
+    // parse-only route for a caller who wants the structure without a verdict.
+    parsed = _responseFromBytes(response);
     cert = _certOf(opts.cert, "the target certificate");
     issuerCert = _certOf(opts.issuer, "the issuer certificate");
     // The time drives the currency + responder-cert validity windows; an invalid Date fails closed
     // via _asDate (a NaN compares false against every bound, silently disabling both), never defaults.
     time = opts.time == null ? new Date() : _asDate(opts.time);
   } catch (e) { return Promise.reject(e); }
+  // The object parsed HERE goes to the verdict verb, not the caller's argument again. It carries the
+  // parser's record, so the verdict verb re-derives from the same recorded bytes -- one snapshot,
+  // read by both. Passing the caller's argument a second time would take a SECOND snapshot of it,
+  // and a shared-memory view can differ between the two: the nonce compared below would belong to
+  // one response and the signature verified to another, which is the split this whole mechanism
+  // exists to close.
   return pathValidate.verifyOcspResponse(parsed, cert, issuerCert, time, { historicalMode: opts.historicalMode === true }).then(function (verdict) {
     // A client that sent no nonce still gets the field, as null. Leaving it absent would make
     // "not requested" indistinguishable from "the field is not there yet" for a consumer reading

package/lib/path-validate.js

@@ -1178,7 +1178,10 @@ async function validate(path, opts) {
   // crypto amplification from an oversized path). Entry-point tier: throw.
   var maxCerts = guard.limits.cap(opts.maxPathCerts, "validate: opts.maxPathCerts", constants.LIMITS.PATH_MAX_CERTS, { E: E, code: "path/bad-input", min: 1 });
   if (path.length > maxCerts) throw E("path/bad-input", "validate: the certification path has " + path.length + " certificates, exceeding the maxPathCerts limit (" + maxCerts + ")");
-  var certs = path.map(function (c) { return (c && c.tbsBytes) ? c : x509.parse(c); });
+  // Through the same door `build` uses, and for the same reason: every certificate this walk decides
+  // over is re-derived from the bytes its parser read (see coerceCert), so a rebuilt object cannot
+  // present a genuine signed range alongside substituted fields.
+  var certs = path.map(function (c, ci) { return coerceCert(c, "validate: path[" + ci + "]"); });
   var n = certs.length;
   if (n < 1) throw E("path/empty-path", "validate: the certification path is empty");
   if (!opts.trustAnchor) throw E("path/bad-input", "validate: a trustAnchor is required");
@@ -1856,7 +1859,16 @@ function selectDelta(candidates) {
  *   typeof checker.check;                     // "function"
  */
 function crlChecker(crls, opts) {
-  var parsed = (crls || []).map(function (c) { return (c && c.tbsBytes) ? c : crl.parse(c); });
+  var parsed = (crls || []).map(function (c, ci) {
+    // Re-derived from the bytes the parser read, exactly as a certificate is. A CRL's answer is a
+    // verdict, and its signature covers a byte range while the revocation list and the scope
+    // extensions are separate properties of the parsed object: keep a correctly signed CRL's
+    // `tbsBytes` and signature, empty `revokedCertificates`, and the signature still verifies while
+    // a revoked certificate reports good. The scope fields fail the same way -- an emptied
+    // `crlExtensions` turns a scope-restricted CRL into one that answers for everything.
+    return guard.parsed.acceptDerived(c, "crl", crl.parse, E, "path/bad-input",
+      "crlChecker: crls[" + ci + "]");
+  });
   // RFC 5280 sec. 6.3.1(b): use-deltas is an INPUT to the algorithm. Default ON --
   // a caller holding a delta wants it used -- and turning it off never makes a
   // verdict weaker, only less determined.
@@ -2296,7 +2308,10 @@ cmsVerify.setEngine({ build: build, validate: validate, toAnchor: toAnchor,
  *   typeof checker.check;                       // "function"
  */
 function ocspChecker(responses) {
-  var parsed = (responses || []).map(function (r) { return (r && r.responseStatus) ? r : ocsp.parseResponse(r); });
+  // The same door verifyOcspResponse uses. This checker's responses reach the identical three-part
+  // signature check, so accepting a parsed object here on a truthy responseStatus would leave the
+  // door shut on one of the two ways into that check and open on the other.
+  var parsed = (responses || []).map(function (r) { return _ocspFromBytes(r); });
   return {
     check: async function (cert, issuer, ctx) {
       var time = ctx.time;
@@ -2346,14 +2361,14 @@ function ocspChecker(responses) {
 
 /**
  * @primitive  pki.path.verifyOcspResponse
- * @signature  pki.path.verifyOcspResponse(parsedResponse, cert, issuerCert, time, opts?) -> Promise<{ status, responderAuthorized, signatureValid, matched, thisUpdate, nextUpdate, revocationReason?, reason }>
+ * @signature  pki.path.verifyOcspResponse(response, cert, issuerCert, time, opts?) -> Promise<{ status, responderAuthorized, signatureValid, matched, thisUpdate, nextUpdate, revocationReason?, reason }>
  * @since       0.2.22
  * @status      stable
  * @spec        RFC 6960
  * @related     pki.ocsp.verify, pki.path.ocspChecker
  *
- * Verify a single already-parsed OCSP response for one certificate against its
- * already-parsed issuer certificate at `time` -- the lower-level primitive
+ * Verify a single OCSP response for one certificate
+ * against its already-parsed issuer certificate at `time` -- the lower-level primitive
  * `pki.ocsp.verify` composes after parsing its inputs (most callers want that
  * ergonomic entry, which also handles DER/PEM decoding and request-nonce
  * matching). It runs the EXACT SAME gates the path validator's `ocspChecker`
@@ -2374,6 +2389,16 @@ function ocspChecker(responses) {
  * `time` either way. `time` must be a valid `Date`. A malformed response's parse
  * fault surfaces as the parser's typed `ocsp/*` / `asn1/*` error.
  *
+ * The response is its DER bytes, a PEM string, or an unmodified
+ * `pki.schema.ocsp.parseResponse` result. A REBUILT parsed response is refused. A
+ * signature check has three parts -- the signature, the algorithm that verifies it,
+ * and the bytes it covers -- and on a parsed object all three are separate properties:
+ * a genuine CA signature over a certificate that CA issued, relabelled, verifies as a
+ * ResponseData signature for a response that never existed. The parser marks what it
+ * returns, so those three are known to have been derived together from one byte
+ * string; `Object.assign`, spread and a JSON round-trip all drop the mark, which is
+ * exactly how such an object is assembled.
+ *
  * @example
  *   var ca = await pki.key.generate("Ed25519");
  *   var caKey = await pki.key.export(ca.privateKey);
@@ -2389,11 +2414,49 @@ function ocspChecker(responses) {
  *     { responderID: "byName", responses: [{ cert: leafDer, issuer: caDer, status: "good" }] },
  *     { cert: caDer, key: caKey });
  *   var cert = pki.schema.x509.parse(leafDer), issuerCert = pki.schema.x509.parse(caDer);
- *   var resp = pki.schema.ocsp.parseResponse(der);
- *   var v = await pki.path.verifyOcspResponse(resp, cert, issuerCert, new Date());
+ *   var v = await pki.path.verifyOcspResponse(der, cert, issuerCert, new Date());
  *   v.status;   // "good" | "revoked" | "unknown"
  */
-function verifyOcspResponse(parsedResponse, cert, issuerCert, time, opts) {
+function verifyOcspResponse(response, cert, issuerCert, time, opts) {
+  var parsedResponse, subject, issuer;
+  try {
+    parsedResponse = _ocspFromBytes(response);
+    // The two certificates go through the same door as the response, for the same reason: this
+    // verdict is about a certificate's IDENTITY -- its serial and its issuer's name and key are
+    // what the CertID is matched against, and the issuer's key is what authorizes a delegated
+    // responder. A caller-assembled certificate could name one identity while carrying another's
+    // signed bytes, so both are re-derived from the bytes their parser read.
+    subject = coerceCert(cert, "the certificate");
+    issuer = coerceCert(issuerCert, "the issuer certificate");
+  } catch (e) { return Promise.reject(e); }
+  return _verifyOcspParsed(parsedResponse, subject, issuer, time, opts);
+}
+
+// The response, always parsed from the bytes the caller handed over.
+//
+// A signature check has three parts -- the signature, the algorithm that verifies it, and the byte
+// range it covers -- and on a claimed-parsed response all three are separate properties of one
+// caller-supplied object. Pair a real CA's signature over a certificate IT issued with that
+// certificate's own tbsBytes and algorithm, label them `signature` / `tbsResponseDataBytes` /
+// `signatureAlgorithm`, and the check verifies: a genuine signature, over the bytes it was made
+// over, under the right key -- for a structure the responder never produced. Parsing binds the three
+// to one byte string, which is the only thing that makes the verdict about a response at all.
+var _OCSP_CLAIM = ["responseStatus", "basicResponse", "tbsResponseDataBytes"];
+function _ocspFromBytes(response) {
+  return guard.parsed.fromTrustedSource(response, "ocspResponse", _OCSP_CLAIM, function (bytes) {
+    if (!Buffer.isBuffer(bytes) && !(bytes instanceof Uint8Array) && typeof bytes !== "string") {
+      throw E("path/bad-input", "verifyOcspResponse: the response must be an OCSP response DER Buffer, a PEM string, or a pki.schema.ocsp.parseResponse result");
+    }
+    return ocsp.parseResponse(bytes);
+  }, E, "path/bad-input",
+  "verifyOcspResponse: the response must be its DER bytes, a PEM string, or an unmodified pki.schema.ocsp.parseResponse result: the signature, the algorithm that verifies it and the bytes it covers are separate properties of a parsed object, so a REBUILT response (Object.assign, spread, a JSON round-trip) could have the three describe different responses and is refused");
+}
+
+// The verification over a response this module has ALREADY derived from bytes -- reached only
+// through the door above and through ocspChecker, which parses the responder's own reply. Not
+// exported: this module's export object IS pki.path, so anything on it is public surface and frozen
+// by the API snapshot, whatever a comment beside it claims.
+function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
   opts = opts || {};
   // The currency + responder-cert validity windows compare against `time`; a missing or invalid
   // check date must fail closed (a NaN compares false against every bound), never silently pass.
@@ -2451,41 +2514,22 @@ function nameMatchSoft(rdnsA, rdnsB) {
   catch (_e) { return false; }
 }
 
-// A parsed extension entry the search's findExt dereferences by .oid and, for
-// the subjectAltName, by .value (a Buffer in the identity key).
-function _isExtensionEntry(e) { return !!e && typeof e.oid === "string" && Buffer.isBuffer(e.value); }
-
-// The complete parsed-certificate shape build produces AND hands to validate --
-// every top-level field this module dereferences (grep-verified), each with the
-// type the code assumes. A claimed-parsed object satisfying this cannot throw a
-// raw TypeError anywhere in the search or the validate hand-off.
-function _isParsedCert(o) {
-  return Buffer.isBuffer(o.tbsBytes) &&
-    typeof o.serialNumberHex === "string" &&
-    !!o.signatureAlgorithm && typeof o.signatureAlgorithm.oid === "string" &&
-    !!o.signatureValue && Buffer.isBuffer(o.signatureValue.bytes) &&
-    !!o.validity && o.validity.notBefore instanceof Date && o.validity.notAfter instanceof Date &&
-    !!o.issuer && Array.isArray(o.issuer.rdns) &&
-    !!o.subject && Array.isArray(o.subject.rdns) && Buffer.isBuffer(o.subject.bytes) &&
-    !!o.subjectPublicKeyInfo && Buffer.isBuffer(o.subjectPublicKeyInfo.bytes) &&
-    !!o.subjectPublicKeyInfo.algorithm && typeof o.subjectPublicKeyInfo.algorithm.oid === "string" &&
-    !!o.subjectPublicKeyInfo.publicKey && Buffer.isBuffer(o.subjectPublicKeyInfo.publicKey.bytes) &&
-    typeof o.subjectPublicKeyInfo.publicKey.unusedBits === "number" &&
-    Array.isArray(o.extensions) && o.extensions.every(_isExtensionEntry);
-}
-
-function coerceCert(input) {
-  // An already-parsed certificate is passed through; a DER Buffer / PEM string is
-  // parsed (and its typed error normalized by the caller). A claimed-parsed object
-  // (a truthy tbsBytes) must carry the COMPLETE parsed-certificate shape build and
-  // the validate hand-off dereference -- a bare { tbsBytes } object, or any partial
-  // shape, fails closed here as a typed PathError rather than a raw TypeError deeper
-  // in the walk or inside validate.
-  if (input && typeof input === "object" && !Buffer.isBuffer(input) && input.tbsBytes !== undefined) {
-    if (!_isParsedCert(input)) throw E("path/bad-input", "build: an input has tbsBytes but is not a well-formed parsed certificate");
-    return input;
-  }
-  return x509.parse(input);
+// A certificate reaching a VERDICT is re-derived from the bytes the parser read, never trusted as
+// the object it arrives as. Completeness -- every field present with the right type -- is not enough
+// here, because a certificate's meaning is one signature over one byte range while a parsed
+// certificate presents that range, the signature, and the fields the range encodes as separate
+// properties. Keep a real CA certificate's `tbsBytes` and signature and substitute only its
+// `subjectPublicKeyInfo`, and every completeness rule passes, this walk verifies the ORIGINAL signed
+// range, and then uses the substituted key to check the next certificate -- a forged chain built out
+// of a genuine certificate. Emptying `extensions` is the same move against basicConstraints,
+// keyUsage, the name constraints and the unknown-critical rule.
+//
+// So the door takes the parser's record instead: a certificate from pki.schema.x509.parse re-parses
+// from the bytes it was read from, and anything done to that object since is discarded. One a caller
+// assembled has no record and is refused rather than silently believed.
+function coerceCert(input, label) {
+  return guard.parsed.acceptDerived(input, "certificate", x509.parse, E, "path/bad-input",
+    label || "a certificate");
 }
 
 // A trust-store entry is either a ready anchor tuple { name, publicKey,

package/lib/pbes2.js

@@ -177,7 +177,12 @@ function pbes2Encrypt(pwBytes, plaintext, opts, E, prefix) {
 // <prefix>/bad-input a param guard raises is normalized to the structural <prefix>/bad-algorithm-parameters.
 // A wrong key / bad PKCS#7 pad collapses to the UNIFORM <prefix>/decrypt-failed (RFC 8018 sec. 8). The
 // plaintext integrity re-check (re-parse as a PrivateKeyInfo / SafeContents) is the CALLER's step.
-function pbes2Decrypt(pwBytes, params, ciphertext, opts, E, prefix) {
+// `budget` (optional) is a shared { rounds } tally a caller decrypting MANY structures under one
+// call charges against, so the per-structure iteration cap cannot simply reset each time: PBKDF2
+// runs on the event loop, and a store that repeats a costly bag up to the parser's element limit
+// otherwise multiplies the cap by that limit. A caller decrypting exactly one structure passes
+// nothing and is bounded by the cap alone.
+function pbes2Decrypt(pwBytes, params, ciphertext, opts, E, prefix, budget) {
   var keyBits, iv, pb;
   try {
     var p = seqChildren(params, 2, "PBES2 parameters", E, prefix);
@@ -197,6 +202,11 @@ function pbes2Decrypt(pwBytes, params, ciphertext, opts, E, prefix) {
     }
     throw E(prefix + "/bad-algorithm-parameters", "malformed PBES2 parameters", e);
   }
+  // Charge the shared budget BEFORE deriving, so the work is refused rather than performed.
+  if (budget) {
+    budget.rounds -= pb.iterations;
+    if (budget.rounds < 0) throw E(prefix + "/iteration-limit", "the aggregate PBKDF2 key-derivation work exceeds the budget (a hostile many-element input)");
+  }
   var dk = nodeCrypto.pbkdf2Sync(pwBytes, pb.salt, pb.iterations, keyBits / 8, pb.prfNode);
   try { return cbcDecrypt(dk, iv, ciphertext, keyBits); }
   catch (_e) { throw E(prefix + "/decrypt-failed", "decryption failed"); }

package/lib/pkcs12-build.js

@@ -69,12 +69,14 @@ var MAX_PBMAC1_KEYLEN = 1024;   // an HMAC key beyond a hash block is pointless
 // pkcs12-local (its KDF is bespoke here) while PBMAC1 reuses the toolkit-wide PBKDF2 ceiling. 1e6 is ~500x
 // the OpenSSL default (2048) yet still bounds the loop to ~1 second.
 var CLASSIC_MAC_MAX_ITERATIONS = 1000000;
-// The AGGREGATE cap on synchronous legacy-PBE App. B KDF work across a single open() -- SHA-1 rounds summed
-// over every legacy bag (its KDF block count x iterations). The per-bag iteration cap resets per bag, so a
-// hostile store that duplicates a costly legacy bag up to the parser's 1024-bag limit would otherwise block
-// the event loop for minutes; this bounds the total to ~the classic MAC ceiling. A conforming store runs only
-// a few thousand rounds (its handful of bags at ~2048 iterations).
-var LEGACY_KDF_MAX_ROUNDS = CLASSIC_MAC_MAX_ITERATIONS;
+// The AGGREGATE cap on synchronous KDF work across a single open() -- rounds summed over every encrypted
+// bag and safe, whichever scheme it uses: the legacy App. B KDF (its block count x iterations) and PBKDF2
+// alike. The per-bag iteration cap resets per bag, so a hostile store that duplicates a costly bag up to the
+// parser's 1024-element limit would otherwise block the event loop for minutes; this bounds the total to
+// ~the classic MAC ceiling. It covers BOTH schemes because covering only the legacy one left the modern
+// path -- the one every current producer emits -- free to multiply its cap by the element limit.
+// A conforming store runs only a few thousand rounds (its handful of bags at ~2048 iterations).
+var KDF_MAX_ROUNDS = CLASSIC_MAC_MAX_ITERATIONS;
 
 // The classic App. B.2 KDF (u = hash output bytes, v = compression block bytes) per RFC 7292 App. B.2.
 var P12_KDF_UV = {
@@ -102,6 +104,18 @@ var DIGEST_NAME = { sha1: "sha1", sha256: "sha256", sha384: "sha384", sha512: "s
 // is taken verbatim as already-formatted bytes (an escape hatch for a caller that pre-encodes).
 function _p12Password(pw) { return _p12PasswordOwned(pw).bytes; }
 
+// An ABSENT password is refused rather than encoded as the empty one. The two are not the same
+// credential, and the difference is invisible at the call site: a caller who misspells the option,
+// or threads it through a layer that drops it, otherwise gets a store whose private key is
+// protected by nothing and no error anywhere saying so. The empty password remains available --
+// it just has to be asked for, as "".
+var _MISSING_PASSWORD = "a password must be a string, Buffer, or Uint8Array -- an omitted password " +
+  "is not the empty password; pass \"\" to use the empty one deliberately";
+
+// Every field opts.integrity reads. Adding one here is the only way to make it accepted, so a
+// capability cannot arrive with its option silently ignored at this boundary.
+var _INTEGRITY_OPTS = { mode: 1, signer: 1, signers: 1, certificates: 1, sid: 1, signingTime: 1 };
+
 // The same encoding, reporting OWNERSHIP -- mirroring pbes2.passwordBytesOwned. A caller-supplied
 // Buffer is returned AS-IS and is BORROWED: clearing it would destroy the caller's own credential,
 // which is a worse defect than leaving a copy readable. Every other input is re-encoded into a
@@ -111,10 +125,9 @@ function _p12PasswordOwned(pw) {
   return { bytes: _p12Encode(pw), owned: true };
 }
 function _p12Encode(pw) {
-  if (pw == null) pw = "";
   if (Buffer.isBuffer(pw)) return pw;
   if (pw instanceof Uint8Array) return Buffer.from(pw);
-  if (typeof pw !== "string") throw _err("pkcs12/bad-input", "a password must be a string, Buffer, or Uint8Array");
+  if (typeof pw !== "string") throw _err("pkcs12/bad-input", _MISSING_PASSWORD);
   var out = Buffer.alloc(pw.length * 2 + 2);   // + the 2-byte NULL terminator
   for (var i = 0; i < pw.length; i++) {
     var u = pw.charCodeAt(i);
@@ -130,12 +143,19 @@ function _p12Encode(pw) {
 // PBKDF2 the raw UTF-8 password for these modern schemes (confirmed byte-for-byte against `openssl pkcs12`),
 // reserving the BMPString+NULL form for the bespoke Appendix B KDF only. A file we emit must open in OpenSSL,
 // so the modern schemes use UTF-8 here; only the classic Appendix B MAC uses `_p12Password`.
-function _pbePassword(pw) {
-  if (pw == null) pw = "";
-  if (Buffer.isBuffer(pw)) return pw;
-  if (pw instanceof Uint8Array) return Buffer.from(pw);
-  if (typeof pw !== "string") throw _err("pkcs12/bad-input", "a password must be a string, Buffer, or Uint8Array");
-  return Buffer.from(pw, "utf8");
+// The UTF-8 encoding, reporting OWNERSHIP -- the sibling of _p12PasswordOwned, and it exists
+// for the same reason. A caller-supplied Buffer is BORROWED and left alone; every other input is
+// re-encoded into a buffer this module allocated, and a plaintext password copy this module made
+// is cleared once the derivation has consumed it. Without it the App. B.1 copy taken from the same
+// argument in the same call was wiped while this one was not.
+function _pbePasswordOwned(pw) {
+  if (Buffer.isBuffer(pw)) return { bytes: pw, owned: false };
+  if (pw instanceof Uint8Array) return { bytes: Buffer.from(pw), owned: true };
+  if (typeof pw !== "string") throw _err("pkcs12/bad-input", _MISSING_PASSWORD);
+  return { bytes: Buffer.from(pw, "utf8"), owned: true };
+}
+function _wipePw(owned) {
+  if (owned.owned) guard.secret.zeroize(owned.bytes, Pkcs12Error, "pkcs12/bad-input", "the password encoding");
 }
 
 // Concatenate copies of `src` to the smallest positive multiple of `blockSize` (>= src length), truncating
@@ -267,8 +287,10 @@ function _buildBag(bag, opts, depth) {
       var kDer = _coerceDer(bag.key, "shroudedKey key");
       try { pkcs8.parse(kDer); } catch (e2) { throw _err("pkcs12/bad-input", "shroudedKey key is not a well-formed PKCS#8 PrivateKeyInfo", e2); }
       var enc = bag.encrypt || {};
-      var pw = _pbePassword(enc.password != null ? enc.password : opts.password);
-      var r = pbes2.pbes2Encrypt(pw, kDer, _pbeOpts(enc), _err, "pkcs12");
+      var pw = _pbePasswordOwned(enc.password != null ? enc.password : opts.password);
+      var r;
+      try { r = pbes2.pbes2Encrypt(pw.bytes, kDer, _pbeOpts(enc), _err, "pkcs12"); }
+      finally { _wipePw(pw); }
       return _safeBag("pkcs8ShroudedKeyBag", b.sequence([r.algId, b.octetString(r.ct)]), bag);   // EncryptedPrivateKeyInfo
     }
     case "cert": {
@@ -296,6 +318,24 @@ function _buildBag(bag, opts, depth) {
 }
 
 // A pre-encoded DER value (one well-formed TLV, no trailing bytes) supplied verbatim (secretValue).
+// The store, always parsed from the BYTES the caller handed over.
+//
+// Both verbs that use this decide integrity, and integrity is the one operation that must not read
+// its inputs from two independently-chosen properties. Accepting a claimed-parsed store let
+// `macedBytes` -- the range the MAC is verified over -- and `safeBags` / `encryptedSafes` -- the
+// content returned as verified -- come from different sources: verify store A's MAC, hand back store
+// B's bags. Parsing here binds them, because both are then derived from one byte string.
+//
+// `pki.schema.pkcs12.parse` remains the parse-only route for a caller who wants the structure
+// without an integrity decision.
+var _STORE_CLAIM = ["integrityMode", "mac", "macedBytes"];
+function _storeFromBytes(pfx) {
+  return guard.parsed.fromTrustedSource(pfx, "pkcs12Store", _STORE_CLAIM, function (bytes) {
+    return schemaPkcs12.parse(_coerceDer(bytes, "pfx"));
+  }, _err, "pkcs12/bad-input",
+  "pfx must be the store's DER bytes, a PEM string, or an unmodified pki.schema.pkcs12.parse result: the MAC is verified over a byte range carried on the object and the bags returned as verified are a separate property of it, so a REBUILT store (Object.assign, spread, a JSON round-trip) could have the two describe different stores and is refused");
+}
+
 function _reqDer(input, label) {
   if (input == null) throw _err("pkcs12/bad-input", label + " is required");
   var der = _bytes(input, label);
@@ -358,8 +398,10 @@ async function _buildAuthSafeElement(sc, opts) {
     return b.sequence([b.oid(O("data")), b.explicit(0, b.octetString(safeContentsDer))]);
   }
   if (!sc.encrypt || typeof sc.encrypt !== "object") throw _err("pkcs12/bad-input", "safeContents.encrypt must be an object { password? } (RFC 7292 sec. 5.1) -- omit it entirely for a plaintext safe");
-  var pw = _pbePassword(sc.encrypt.password != null ? sc.encrypt.password : opts.password);
-  var r = pbes2.pbes2Encrypt(pw, safeContentsDer, _pbeOpts(sc.encrypt), _err, "pkcs12");
+  var pw = _pbePasswordOwned(sc.encrypt.password != null ? sc.encrypt.password : opts.password);
+  var r;
+  try { r = pbes2.pbes2Encrypt(pw.bytes, safeContentsDer, _pbeOpts(sc.encrypt), _err, "pkcs12"); }
+  finally { _wipePw(pw); }
   var eci = b.sequence([b.oid(O("data")), r.algId, b.contextPrimitive(0, r.ct)]);   // EncryptedContentInfo, [0] IMPLICIT ct
   var encData = b.sequence([b.integer(0n), eci]);                                    // EncryptedData { version 0, eci }
   return b.sequence([b.oid(O("encryptedData")), b.explicit(0, encData)]);
@@ -402,7 +444,10 @@ async function _buildMacData(macOpts, sharedPassword, authSafeDer) {
     var iter2 = _assertMacIter(macOpts.iterations == null ? DEFAULT_PBMAC1_ITER : macOpts.iterations, C.LIMITS.PBKDF2_MAX_ITERATIONS);
     var keyLen = macOpts.keyLength != null ? macOpts.keyLength : prf.keyLen;
     if (typeof keyLen !== "number" || !Number.isInteger(keyLen) || keyLen < 20 || keyLen > MAX_PBMAC1_KEYLEN) throw _err("pkcs12/bad-input", "PBMAC1 keyLength must be an integer in [20, " + MAX_PBMAC1_KEYLEN + "] (RFC 9579 sec. 9)");
-    var mac = await pbes2.pbmac1(_pbePassword(password), salt, iter2, keyLen, prf.wc, prf.wc, authSafeDer);   // PBKDF2 -> UTF-8; prf == messageAuthScheme on build
+    var macPw2 = _pbePasswordOwned(password);
+    var mac;
+    try { mac = await pbes2.pbmac1(macPw2.bytes, salt, iter2, keyLen, prf.wc, prf.wc, authSafeDer); }   // PBKDF2 -> UTF-8; prf == messageAuthScheme on build
+    finally { _wipePw(macPw2); }
     var desc = { salt: salt, iterationCount: iter2, keyLength: keyLen, prfName: prf.prfName, macName: prf.prfName };
     var digestInfo2 = b.sequence([pbes2.pbmac1AlgId(desc), b.octetString(mac)]);
     // MacData.macSalt + iterations are ignored on a PBMAC1 verify but MUST be present + non-1 (RFC 9579 4c/4d).
@@ -480,7 +525,18 @@ function _normalizeSpec(spec, opts) {
  */
 async function build(spec, opts) {
   opts = opts || {};
-  var pubKey = opts.integrity != null && opts.integrity.mode === "public-key";
+  // The integrity mode is checked against the permitted set rather than compared to one literal.
+  // Compared, any other spelling reads as "not public-key" and silently selects password integrity,
+  // dropping the signer with it: a caller who wrote "publicKey" gets a MAC where they asked for a
+  // signature, and nothing in the store or the call says which they got.
+  if (opts.integrity != null) {
+    if (typeof opts.integrity !== "object" || Array.isArray(opts.integrity)) throw _err("pkcs12/bad-input", "opts.integrity must be an object { mode, signer|signers, ... }");
+    guard.identifier.assertKnownKeys(opts.integrity, _INTEGRITY_OPTS, _err, "pkcs12/bad-input", "opts.integrity has an unknown option ");
+    if (opts.integrity.mode !== "public-key") {
+      throw _err("pkcs12/bad-integrity-mode", "opts.integrity.mode must be \"public-key\" (the only mode it selects); omit opts.integrity for password integrity, got " + JSON.stringify(opts.integrity.mode));
+    }
+  }
+  var pubKey = opts.integrity != null;
   // RFC 7292 sec. 4: public-key integrity OMITS MacData entirely -- a caller combining opts.mac with it is a
   // config-time reject (the self-check re-parse would otherwise fail the coherence rule anyway).
   if (pubKey && opts.mac != null && opts.mac !== false) throw _err("pkcs12/bad-integrity-mode", "public-key integrity has no MacData -- do not combine opts.mac with opts.integrity.mode 'public-key' (RFC 7292 sec. 4)");
@@ -522,8 +578,10 @@ async function build(spec, opts) {
  * @defends pkcs12-mac-forgery (CWE-347)
  * @related pki.pkcs12.build, pki.schema.pkcs12.parse
  *
- * Verify a password-integrity PKCS#12 store's MAC. `pfx` is a `pki.schema.pkcs12.parse` result, a DER
- * `Buffer`, or a PEM string. The password is BMPString+NULL encoded (RFC 7292 App. B.1), the MAC is
+ * Verify a password-integrity PKCS#12 store's MAC. `pfx` is the store's DER `Buffer`, a PEM string, or an
+ * unmodified `pki.schema.pkcs12.parse` result. A REBUILT parsed store is refused: the MAC is verified over
+ * a byte range the object carries, and the parser's mark is what says that range and the store it describes
+ * came from one place. `Object.assign`, spread and a JSON round-trip drop the mark. The password is BMPString+NULL encoded (RFC 7292 App. B.1), the MAC is
  * recomputed over the store's exact AuthenticatedSafe byte range (`macedBytes`) using the store's own MAC
  * parameters -- the classic Appendix B (ID=3) HMAC or the RFC 9579 PBMAC1 -- and constant-time-compared to
  * the stored MAC value. Returns `true` / `false` for the password match; throws `Pkcs12Error` on a MAC-less
@@ -538,8 +596,14 @@ async function build(spec, opts) {
  *   var ok = await pki.pkcs12.verifyMac(p12, 'changeit');
  */
 async function verifyMac(pfx, password, opts) {
+  return _verifyMacOfStore(_storeFromBytes(pfx), password, opts);
+}
+
+// The MAC computation over a store this module has ALREADY parsed from bytes. Separate from the
+// public verb so `open` can verify the store it just parsed without going back through the door --
+// the door's job is to establish that the store came from the caller's bytes, and by here it has.
+async function _verifyMacOfStore(m, password, opts) {
   opts = opts || {};
-  var m = (pfx && pfx.integrityMode !== undefined && pfx.mac !== undefined) ? pfx : schemaPkcs12.parse(_coerceDer(pfx, "pfx"));
   if (m.integrityMode !== "password" || !m.mac) throw _err("pkcs12/bad-input", "the store carries no password MAC (integrityMode " + m.integrityMode + ")");
   var expected = m.mac.macValue;
   var computed;
@@ -564,7 +628,9 @@ async function verifyMac(pfx, password, opts) {
     // downgraded store cannot pass under a weak MAC even though the algorithm identifiers parse.
     if (prfWc === "SHA-1" || macWc === "SHA-1") throw _err("pkcs12/unsupported-algorithm", "PBMAC1 with a <= 160-bit digest (SHA-1) is refused (RFC 9579 sec. 5/7)");
     _capWork(kdf.iterationCount, kdf.salt, opts, kdf.keyLength, C.LIMITS.PBKDF2_MAX_ITERATIONS);
-    computed = await pbes2.pbmac1(_pbePassword(password), kdf.salt, kdf.iterationCount, kdf.keyLength, prfWc, macWc, m.macedBytes);   // PBKDF2 -> UTF-8
+    var vPw = _pbePasswordOwned(password);
+    try { computed = await pbes2.pbmac1(vPw.bytes, kdf.salt, kdf.iterationCount, kdf.keyLength, prfWc, macWc, m.macedBytes); }   // PBKDF2 -> UTF-8
+    finally { _wipePw(vPw); }
   }
   return computed.length === expected.length && guard.crypto.constantTimeEqual(computed, expected);
 }
@@ -600,8 +666,9 @@ function _capWork(iterations, salt, opts, keyLength, hardCap) {
  * (public-key privacy) safe with `opts.recipientKey` (RFC 7292 sec. 3.1, via `pki.cms.decrypt`) -- returning a
  * structured bundle `{ integrityMode, macVerified, signers, keys, certs, crls, secrets }` -- each private key as PKCS#8
  * `PrivateKeyInfo` DER (re-validated), each certificate / CRL / secret as raw DER, all carrying their
- * `friendlyName` / `localKeyId` for pairing. `pfx` is a DER `Buffer`, PEM string, or a
- * `pki.schema.pkcs12.parse` result.
+ * `friendlyName` / `localKeyId` for pairing. `pfx` is the store's DER `Buffer`, a PEM string, or an
+ * unmodified `pki.schema.pkcs12.parse` result; a REBUILT parsed store is refused, since the bytes whose
+ * integrity is checked and the bags returned as checked are separate properties of it.
  *
  * A MAC-less store is refused (`pkcs12/no-integrity`) unless `opts.allowUnauthenticated` is set. A public-key
  * integrity store is verified through `pki.cms.verify` before any bag is trusted; a signature failure is
@@ -635,7 +702,7 @@ async function open(pfx, password, opts) {
   if (opts.maxIterations != null && (typeof opts.maxIterations !== "number" || !isFinite(opts.maxIterations) || opts.maxIterations < 1 || Math.floor(opts.maxIterations) !== opts.maxIterations)) {
     throw _err("pkcs12/bad-input", "maxIterations must be a positive integer");
   }
-  var m = (pfx && pfx.integrityMode !== undefined && pfx.mac !== undefined) ? pfx : schemaPkcs12.parse(_coerceDer(pfx, "pfx"));
+  var m = _storeFromBytes(pfx);
   var macVerified = false;
   var signers = null;
   if (m.integrityMode === "public-key") {
@@ -649,7 +716,7 @@ async function open(pfx, password, opts) {
     if (!res.valid) throw _err("pkcs12/signature-invalid", "the PKCS#12 SignedData signature did not verify (an untrusted or tampered store)");
     signers = res.signers;
   } else if (m.integrityMode === "password") {
-    macVerified = await verifyMac(m, password, opts);
+    macVerified = await _verifyMacOfStore(m, password, opts);
     if (!macVerified) throw _err("pkcs12/mac-mismatch", "the PKCS#12 MAC did not verify (wrong password or a tampered store)");
   } else if (!opts.allowUnauthenticated) {
     throw _err("pkcs12/no-integrity", "the store carries no integrity MAC (integrityMode " + m.integrityMode + "); set opts.allowUnauthenticated to open it anyway");
@@ -660,7 +727,7 @@ async function open(pfx, password, opts) {
   // wrong bag password fails at the first encrypted bag as the uniform pkcs12/decrypt-failed.
   var out = { integrityMode: m.integrityMode, macVerified: macVerified, signers: signers, keys: [], certs: [], crls: [], secrets: [] };
   var i;
-  var kdfBudget = { rounds: LEGACY_KDF_MAX_ROUNDS };   // aggregate legacy-PBE KDF work budget for this whole open()
+  var kdfBudget = { rounds: KDF_MAX_ROUNDS };   // aggregate KDF work budget for this whole open(), both schemes
   for (i = 0; i < m.safeBags.length; i++) _openBag(m.safeBags[i], password, opts, out, 0, kdfBudget);
   for (i = 0; i < m.encryptedSafes.length; i++) await _openEncryptedSafe(m.encryptedSafes[i], password, opts, out, 0, kdfBudget);
   if (opts.keys === "crypto") {
@@ -774,7 +841,15 @@ function _decryptLegacyPbe(ea, ct, password, opts, budget) {
 // Decrypt a PBES2 (RFC 8018) or legacy-PBE (RFC 7292 App. C) bag/safe -- dispatch on the encryptionAlgorithm
 // OID. PBES2 uses the UTF-8 password (the pinned interop convention); legacy PBE uses the App. B.1 BMPString.
 function _decryptBag(ea, ct, password, opts, budget) {
-  if (ea.oid === O("pbes2")) return pbes2.pbes2Decrypt(_pbePassword(password), ea.parameters, ct, opts, _err, "pkcs12");
+  // BOTH arms charge the one shared budget. Charging only the legacy arm left the modern one --
+  // the arm every current producer emits -- able to reset its per-bag cap on every bag, so a store
+  // that repeats a costly PBES2 bag up to the parser's element limit multiplied the cap by that
+  // limit in blocking pbkdf2Sync work.
+  if (ea.oid === O("pbes2")) {
+    var pw = _pbePasswordOwned(password);
+    try { return pbes2.pbes2Decrypt(pw.bytes, ea.parameters, ct, opts, _err, "pkcs12", budget); }
+    finally { _wipePw(pw); }
+  }
   return _decryptLegacyPbe(ea, ct, password, opts, budget);
 }
 

package/lib/pki-build.js

@@ -395,4 +395,15 @@ function tbsNameField(cert, which) {
   return tbs.children[(hasVersion ? 1 : 0) + (which === "subject" ? 4 : 2)].bytes;
 }
 
-module.exports = { makeBuilder: makeBuilder, KU_BIT: KU_BIT, tbsNameField: tbsNameField };
+// The serialNumber of a parsed X.509 certificate, read from the SIGNED bytes rather than off the
+// object. Same tbs layout as above, and the same reason: where a producer binds an identity to an
+// existing certificate, that identity is issuer AND serial together. Deriving one from the bytes
+// and reading the other from the object lets the halves name different certificates -- a Holder
+// whose issuer is genuine and whose serial is whatever the caller wrote.
+function tbsSerialNumber(cert) {
+  var tbs = asn1.decode(cert.tbsBytes);
+  var hasVersion = tbs.children[0].tagClass === "context" && tbs.children[0].tagNumber === 0;
+  return asn1.read.integer(tbs.children[hasVersion ? 1 : 0]);
+}
+
+module.exports = { makeBuilder: makeBuilder, KU_BIT: KU_BIT, tbsNameField: tbsNameField, tbsSerialNumber: tbsSerialNumber };

package/lib/schema-cms.js

@@ -47,6 +47,7 @@
 var asn1 = require("./asn1-der");
 var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
+var guard = require("./guard-all");
 var oid = require("./oid");
 var frameworkError = require("./framework-error");
 var schemaX509 = require("./schema-x509");
@@ -1150,7 +1151,15 @@ var CONTENT_INFO = schema.seq([
  *   cms.signerInfos[0].sid.serialNumberHex;   // -> "0a1b"
  *   cms.encapContentInfo.eContent;            // -> Buffer | null (detached)
  */
-var parse = pkix.makeParser({ pemLabel: "CMS", PemError: PemError, ErrorClass: CmsError, prefix: "cms", what: "CMS ContentInfo", topSchema: CONTENT_INFO, ns: NS });
+// Recording, for the reason the certificate and CRL parsers are: a SignedData is one or more
+// signatures over byte ranges, and a parsed one presents those ranges (`signedAttrsBytes`, the
+// encapsulated `eContent`), the signatures, and the certificates that verify them as separate
+// properties of one object. Keep a genuine signer's `signature` and `signedAttrsBytes` and replace
+// the `eContent` beside them, and every part of the check still passes for content that signer never
+// signed -- which is exactly the forgery pki.cms.verify's own block claims to defend. The verdict
+// verbs re-derive from what is recorded here, so the object a caller passes names bytes rather than
+// asserting facts.
+var parse = pkix.makeRecordingParser({ pemLabel: "CMS", PemError: PemError, ErrorClass: CmsError, prefix: "cms", what: "CMS ContentInfo", topSchema: CONTENT_INFO, ns: NS }, "cms");
 
 /**
  * @primitive  pki.schema.cms.pemDecode
@@ -1220,7 +1229,13 @@ function walkEnvelopedData(node) { return schema.walk(ENVELOPED_DATA, node, NS).
 // (an RFC 7292 PFX authSafe or encrypted safe, whose wire encoding may be BER
 // that the strict `parse` entry would refuse). Same contract as
 // walkEnvelopedData: the node is the bare structure, typed cms/* on rejection.
-function walkSignedData(node) { return schema.walk(SIGNED_DATA, node, NS).result; }
+// Records provenance, like parse: the structure a consumer hands to pki.cms.verify must be
+// re-derivable from the bytes it was walked from, and a PFX authSafe reaches verify this way. The
+// walker's own BER-tolerant decode is what replays it -- the strict `parse` entry would refuse the
+// indefinite-length encoding real stores carry.
+var walkSignedData = guard.parsed.recordingWalker("cms", function (node) {
+  return schema.walk(SIGNED_DATA, node, NS).result;
+}, function (der) { return asn1.decode(der, { ber: true }); });
 function walkEncryptedData(node) { return schema.walk(ENCRYPTED_DATA, node, NS).result; }
 // Validate + surface one countersignature value (RFC 5652 sec. 11.4, Countersignature ::=
 // SignerInfo) into the same parsed shape parse() gives a top-level SignerInfo -- so pki.cms.verify