@blamejs/pki 0.6.14 → 0.6.15

package/lib/schema-crl.js

@@ -29,8 +29,6 @@ var pkix = require("./schema-pkix");
 var oid = require("./oid");
 var frameworkError = require("./framework-error");
 var intrinsic = require("./guard-intrinsic");
-// Own-key membership through an operation taken at load. Written out, the question reads two
-// replaceable properties to answer one thing, and here it decides which CRLReason values are defined.
 var _hasOwn = intrinsic.hasOwn;
 
 var CrlError = frameworkError.CrlError;
@@ -38,52 +36,32 @@ var PemError = frameworkError.PemError;
 var TAGS = asn1.TAGS;
 
 
-// CRLReason ::= ENUMERATED (RFC 5280 sec. 5.3.1). Value 7 is unused/reserved.
-// The legal set lives once in pkix.CRL_REASON_NAMES (shared with the OCSP
-// RevokedInfo decoder, which surfaces the name; this decoder the numeric code).
 var CRL_REASONS = pkix.CRL_REASON_NAMES;
 
-// Extension-value decoding is keyed off the stable dotted OID (resolved once at
-// load from the canonical name) and not the mutable display name, so a caller's
-// pki.oid.register() display override cannot change parse behavior.
 var OID_CRL_NUMBER = oid.byName("cRLNumber");
 var OID_REASON_CODE = oid.byName("reasonCode");
 var OID_INVALIDITY_DATE = oid.byName("invalidityDate");
 
-// The crl error namespace the schema engine walks under. Shared PKIX sub-schemas
-// are instantiated here under crl/* so a structural fault reports a crl code.
 var NS = pkix.makeNS("crl", CrlError, oid);
 
 var ALGORITHM_IDENTIFIER = pkix.algorithmIdentifier(NS);
 var NAME = pkix.name(NS);
 var EXTENSIONS = pkix.extensions(NS);
-// pkix.time enforces the RFC 5280 encoding cutover on decode (sec. 5.1.2.4 -
-// 5.1.2.6: thisUpdate / nextUpdate / revocationDate through 2049 must be
-// UTCTime). invalidityDate stays GeneralizedTime-only (sec. 5.3.2, decodeExt).
 var TIME = pkix.time(NS);
 
-// CRL Version ::= INTEGER { v1(0), v2(1) }, a bare INTEGER (not [0] EXPLICIT).
-// A CRL is at most v2; reject an explicit v1 (DER forbids the default) and any
-// value >= 2. Do not reuse the certificate readVersion (it maps 2 -> v3).
 var CRL_VERSION = pkix.versionReader(NS, { "1": 2 });
 
-// The three cheap, high-value CRL extension values are decoded from their raw
-// extnValue octets (RFC 5280 sec. 5.2/sec. 5.3); GeneralNames-based extensions
-// (issuingDistributionPoint, certificateIssuer, authorityKeyIdentifier, ...) stay
-// raw with their bytes reachable. A malformed decoded value fails closed.
 function decodeExt(ext) {
   var value = ext.value;
   try {
-    if (ext.oid === OID_CRL_NUMBER) {         // cRLNumber ::= INTEGER (0..MAX)
+    if (ext.oid === OID_CRL_NUMBER) {
       value = asn1.read.integer(asn1.decode(ext.value));
       if (value < 0n) throw new Error("cRLNumber must be non-negative (INTEGER 0..MAX)");
-    } else if (ext.oid === OID_REASON_CODE) { // reasonCode ::= ENUMERATED (CRLReason)
-      // read.enumerated asserts the ENUMERATED tag (a bare INTEGER is rejected) --
-      // the codec owns the tag check, so this reader need not repeat it.
+    } else if (ext.oid === OID_REASON_CODE) {
       var reason = asn1.read.enumerated(asn1.decode(ext.value));
       if (!_hasOwn(CRL_REASONS, reason.toString())) throw new Error("undefined CRLReason " + reason.toString());
       value = Number(reason);
-    } else if (ext.oid === OID_INVALIDITY_DATE) { // invalidityDate ::= GeneralizedTime
+    } else if (ext.oid === OID_INVALIDITY_DATE) {
       var n = asn1.decode(ext.value);
       if (n.tagClass !== "universal" || n.tagNumber !== TAGS.GENERALIZED_TIME) {
         throw new Error("invalidityDate must be a GeneralizedTime");
@@ -96,8 +74,6 @@ function decodeExt(ext) {
   return { oid: ext.oid, name: ext.name, critical: ext.critical, value: value };
 }
 
-// RevokedCertificate ::= SEQUENCE { userCertificate CertificateSerialNumber,
-//   revocationDate Time, crlEntryExtensions Extensions OPTIONAL }
 var REVOKED_ENTRY = schema.seq([
   schema.field("userCertificate", schema.integerLeaf()),
   schema.field("revocationDate", TIME),
@@ -107,9 +83,6 @@ var REVOKED_ENTRY = schema.seq([
   build: function (m) {
     return {
       serialNumber: m.fields.userCertificate.value,
-      // Raw INTEGER content bytes (not a reserialized BigInt) so the hex matches
-      // the X.509 parser's serialNumberHex and preserves DER sign padding
-      // (a positive 0x80 serial encodes as content 00 80).
       serialNumberHex: m.fields.userCertificate.node.content.toString("hex"),
       revocationDate: m.fields.revocationDate.value,
       crlEntryExtensions: m.fields.crlEntryExtensions.present ? m.fields.crlEntryExtensions.value.result.map(decodeExt) : [],
@@ -122,18 +95,6 @@ var REVOKED_LIST = schema.seqOf(REVOKED_ENTRY, {
   build: function (m) { return m.items.map(function (it) { return it.value.result; }); },
 });
 
-// TBSCertList ::= SEQUENCE { version Version OPTIONAL, signature AlgorithmIdentifier,
-//   issuer Name, thisUpdate Time, nextUpdate Time OPTIONAL,
-//   revokedCertificates SEQUENCE OF SEQUENCE {...} OPTIONAL,
-//   crlExtensions [0] EXPLICIT Extensions OPTIONAL }.
-// The three OPTIONAL universal-tagged fields (version=INTEGER, nextUpdate=Time,
-// revokedCertificates=SEQUENCE) are disambiguated by their universal tag;
-// crlExtensions is modeled as a trailing [0]..[0] so a stray non-[0] trailing
-// context tag is REJECTED (crl/bad-tbs), not silently ignored.
-// `signature` is consumed by the CERTIFICATE_LIST build (the sec. 5.1.1.2
-// outer==inner agreement check reads tbsMatch.fields.signature.node.bytes);
-// the operator reads the surfaced outer signatureAlgorithm, which that
-// check proves byte-identical.
 // allow:schema-build-drops-parsed-field
 var TBS_CERTLIST = schema.seq([
   schema.optional("version", CRL_VERSION, { whenUniversal: [TAGS.INTEGER] }),
@@ -149,7 +110,7 @@ var TBS_CERTLIST = schema.seq([
   build: function (m) {
     return {
       version: m.fields.version.present ? m.fields.version.value : 1,
-      issuer: m.fields.issuer.value.result, // Name is a seqOf -> field.value is the match; .result is the {rdns, dn} build
+      issuer: m.fields.issuer.value.result,
       thisUpdate: m.fields.thisUpdate.value,
       nextUpdate: m.fields.nextUpdate.present ? m.fields.nextUpdate.value : null,
       revokedCertificates: m.fields.revokedCertificates.present ? m.fields.revokedCertificates.value.result : [],
@@ -159,23 +120,16 @@ var TBS_CERTLIST = schema.seq([
   },
 });
 
-// CertificateList ::= SEQUENCE { tbsCertList, signatureAlgorithm, signatureValue }
-// -- the shared SIGNED envelope. The CRL-specific invariants (outer==inner
-// signatureAlgorithm agreement, non-empty issuer, v2-only extensions) live in the
-// build; the envelope owns the SEQUENCE-of-3 shape and signature extraction.
 var CERTIFICATE_LIST = pkix.signedEnvelope(NS, TBS_CERTLIST, {
   code: "crl/not-a-crl", what: "CertificateList",
   build: function (e) {
     var tbs = e.tbsMatch.result;
-    // RFC 5280 sec. 5.1.1.2 -- the outer signatureAlgorithm MUST equal tbsCertList.signature.
     if (!e.outerSignatureAlgorithmBytes.equals(e.tbsMatch.fields.signature.node.bytes)) {
       throw NS.E("crl/bad-signature-algorithm", "signatureAlgorithm must match tbsCertList.signature (RFC 5280 sec. 5.1.1.2)");
     }
-    // RFC 5280 sec. 5.1.2.3 -- the issuer MUST be a non-empty distinguished name.
     if (!tbs.issuer.rdns.length) {
       throw NS.E("crl/bad-issuer", "issuer must be a non-empty distinguished name");
     }
-    // RFC 5280 sec. 5.1.2.1 -- crlExtensions / crlEntryExtensions appear only in a v2 CRL.
     var hasExtensions = tbs.crlExtensionsPresent ||
       tbs.revokedCertificates.some(function (r) { return r.crlEntryExtensions.length > 0; });
     if (hasExtensions && tbs.version !== 2) {
@@ -221,12 +175,6 @@ var CERTIFICATE_LIST = pkix.signedEnvelope(NS, TBS_CERTLIST, {
  *   var crl = pki.schema.crl.parse(der);
  *   crl.revokedCertificates[0].serialNumberHex;  // -> "0a3f"
  */
-// Recording, for the same reason the certificate parser is: a CRL is one signature over one byte
-// range, and a parsed CRL presents that range and the revocation list it encodes as separate
-// properties. Keep a correctly signed CRL's `tbsBytes` and signature and empty `revokedCertificates`
-// and the signature still verifies while the revocation answer comes from the edited list -- a
-// revoked certificate reported as good. The scope fields (`crlExtensions`, an IDP, a delta
-// indicator) fail the same way. The verdict verbs re-parse from what is recorded here.
 var parse = pkix.makeRecordingParser({ pemLabel: "X509 CRL", PemError: PemError, ErrorClass: CrlError, prefix: "crl", what: "CRL", topSchema: CERTIFICATE_LIST, ns: NS }, "crl");
 
 /**
@@ -275,24 +223,13 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || "X509 CRL
  */
 function pemEncode(der, label) { return pkix.pemEncode(der, label || "X509 CRL", PemError); }
 
-// Certificate and CertificateList share the outer SEQUENCE-of-3 shape; a CRL is
-// distinguished by its tbsCertList -- the first tbs element is a bare INTEGER
-// (version) or an AlgorithmIdentifier (signature) SEQUENCE, and crucially the
-// field at the certificate's Validity position is a bare Time (thisUpdate). The
-// orchestrator uses `matches` to route; a cert's tbs leads with a [0] EXPLICIT
-// version or an INTEGER serial FOLLOWED by an AlgorithmIdentifier and a Name,
-// then a Validity SEQUENCE, never a bare Time at that depth.
 function matches(root) {
   var tbs = pkix.signedEnvelopeTbs(root);
   if (!tbs) return false;
-  // A certificate's tbs leads with [0] EXPLICIT version -- a CRL never does.
   if (tbs.children[0] && tbs.children[0].tagClass === "context") return false;
-  // Walk to the thisUpdate / validity position: skip an optional bare INTEGER
-  // version, then signature (SEQUENCE) + issuer (SEQUENCE); the next element is
-  // thisUpdate (Time) for a CRL, Validity (SEQUENCE) for a certificate.
   var i = 0;
   if (schema.isUniversal(tbs.children[i], TAGS.INTEGER)) i++;
-  i += 2; // signature + issuer
+  i += 2;
   var pos = tbs.children[i];
   return schema.isUniversalOneOf(pos, [TAGS.UTC_TIME, TAGS.GENERALIZED_TIME]);
 }

package/lib/schema-crmf.js

@@ -48,43 +48,27 @@ var NS = pkix.makeNS("crmf", CrmfError, oid);
 
 var TAGS = asn1.TAGS;
 
-// ---- dual-accept Name (issuer [3] / subject [5]) ---------------------
-// RFC 4211 Appendix B is IMPLICIT TAGS, but Name is a CHOICE so X.680 sec. 31.2.7
-// forces EXPLICIT tagging -- the standards-compliant wire is a context [tag]
-// EXPLICIT wrapper around a universal RDNSequence. The dominant tooling
-// (pyasn1-modules, BouncyCastle) instead encodes IMPLICIT (the [tag] REPLACES the
-// RDNSequence 0x30, so the children ARE the RDN SETs). Both occur in real CMP /
-// EST, so accept either, disambiguated by the first inner element's tag: a
-// universal SET leads the IMPLICIT form; a single universal SEQUENCE is the
-// EXPLICIT wrapper. Anything else fails closed.
 function crmfName(tag) {
-  var NAME = pkix.name(NS);                          // EXPLICIT arm walks a universal RDNSequence
-  var INAME = pkix.name(NS, { implicitTag: tag });   // IMPLICIT arm: [tag] children ARE the RDN SETs
+  var NAME = pkix.name(NS);
+  var INAME = pkix.name(NS, { implicitTag: tag });
   return schema.decode(function (n, ctx) {
     if (n.tagClass !== "context" || n.tagNumber !== tag || !n.children) {
       throw ctx.E("crmf/bad-name", "issuer/subject [" + tag + "] must be a Name (RFC 4211 sec. 5)");
     }
-    if (n.children.length === 0) return schema.walk(INAME, n, ctx).result; // IMPLICIT empty RDNSequence
+    if (n.children.length === 0) return schema.walk(INAME, n, ctx).result;
     var c0 = n.children[0];
     if (c0.tagClass === "universal" && c0.tagNumber === TAGS.SET) {
-      return schema.walk(INAME, n, ctx).result;                            // IMPLICIT: children ARE RDN SETs
+      return schema.walk(INAME, n, ctx).result;
     }
     if (n.children.length === 1 && c0.tagClass === "universal" && c0.tagNumber === TAGS.SEQUENCE) {
-      return schema.walk(NAME, c0, ctx).result;                            // EXPLICIT: [tag] wraps RDNSequence
+      return schema.walk(NAME, c0, ctx).result;
     }
     throw ctx.E("crmf/bad-name", "issuer/subject [" + tag + "] Name must be an IMPLICIT RDNSequence (SET-led) or an EXPLICIT-wrapped RDNSequence");
   }, function (value) {
-    // encode the IMPLICIT form (the dominant wire encoding): the [tag] whose children
-    // ARE the RDN SETs, built from the decoded `rdns` via the shared Name schema.
     return schema.encode(INAME, value.rdns, NS);
   });
 }
 
-// ---- OptionalValidity (sec. 5) -------------------------------------------
-// validity [4] IMPLICIT SEQUENCE { notBefore [0] Time OPTIONAL, notAfter [1] Time
-// OPTIONAL }. Time is a CHOICE of UTCTime / GeneralizedTime, so [0]/[1] are
-// EXPLICIT (an IMPLICIT tag would erase the UTCTime-vs-GeneralizedTime
-// discriminator). RFC 4211 sec. 5 requires at least one of the two to be present.
 var OPTIONAL_VALIDITY = schema.seq([
   schema.trailing([
     { tag: 0, name: "notBefore", schema: schema.time(NS), explicit: true, emptyCode: "crmf/bad-validity" },
@@ -101,38 +85,19 @@ var OPTIONAL_VALIDITY = schema.seq([
   },
 });
 
-// ---- ProofOfPossession (sec. 4) ------------------------------------------
-// raVerified [0] NULL: the RA has already verified POP out of band.
 var POPO_RAVERIFIED = schema.decode(function (n, ctx) {
   try { asn1.read.nullImplicit(n, 0); }
   catch (e) { throw ctx.E("crmf/bad-popo", "raVerified [0] must be an IMPLICIT NULL", e); }
   return { type: "raVerified" };
 });
 
-// When poposkInput is present the POP signature is over the DER of the
-// POPOSigningKeyInput value (RFC 4211 sec. 4.1), which is a SEQUENCE. But on the wire
-// poposkInput is an IMPLICIT [0] field, so its bytes lead with the context tag
-// (0xA0) and not the SEQUENCE tag a verifier hashes. `asn1.sequenceTlv` recovers
-// the SEQUENCE-tagged signed region from the field's content; `signedBytes` is that
-// region and `bytes` keeps the raw wire [0] TLV, so a verifier can use either
-// encoding its peer produced.
 
-// POPOSigningKeyInput ::= SEQUENCE { authInfo CHOICE { sender [0] GeneralName,
-// publicKeyMAC PKMACValue }, publicKey SubjectPublicKeyInfo } (sec. 4.1). Structurally
-// validated (not deferred raw), so an empty or malformed poposkInput fails closed
-// and never surfaces a signed region that was not a well-formed POP input.
-// PKMACValue ::= SEQUENCE { algId AlgorithmIdentifier, value BIT STRING }. The
-// MAC value is octet-string algorithm output handed to an external verifier;
-// with no in-tree POP verify layer, octet alignment is enforced at parse.
 var PKMAC_VALUE = schema.seq([
   schema.field("algId", pkix.algorithmIdentifier(NS)),
   schema.field("value", schema.bitString()),
 ], {
   assert: "sequence", arity: { exact: 2 }, code: "crmf/bad-popo", what: "PKMACValue",
   build: function (m, ctx) {
-    // The parsed BIT STRING structure { unusedBits, bytes }, a structural
-    // octet-alignment check on the unused-bit COUNT, not a comparison of the
-    // MAC secret (there is no in-tree POP verify), so no timing oracle exists.
     var macBitString = m.fields.value.value;
     if (macBitString.unusedBits !== 0) {
       throw ctx.E("crmf/bad-popo", "a PKMACValue MAC BIT STRING must be octet-aligned (0 unused bits)");
@@ -141,8 +106,6 @@ var PKMAC_VALUE = schema.seq([
   },
 });
 
-// authInfo CHOICE: sender [0] GeneralName is EXPLICIT (GeneralName is itself a
-// CHOICE); publicKeyMAC is a bare PKMACValue SEQUENCE, disjoint by tag class.
 var POPOSK_AUTH_INFO = schema.choice([
   { when: { tagClass: "context", tagNumber: 0 }, schema: schema.explicit(0, pkix.generalName(NS, { code: "crmf/bad-popo" }), { code: "crmf/bad-popo" }) },
   { when: { tagClass: "universal", tagNumber: TAGS.SEQUENCE }, schema: PKMAC_VALUE },
@@ -153,12 +116,8 @@ var POPOSK_INPUT = schema.seq([
   schema.field("publicKey", pkix.spki(NS)),
 ], { assert: "implicit", implicitTag: 0, arity: { exact: 2 }, code: "crmf/bad-popo", what: "POPOSigningKeyInput" });
 
-// POPOSigningKey ::= SEQUENCE { poposkInput [0] POPOSigningKeyInput OPTIONAL,
-// algorithmIdentifier AlgorithmIdentifier, signature BIT STRING }, IMPLICIT [1].
 var POPO_SIGNING_KEY = schema.seq([
   schema.optional("poposkInput", schema.decode(function (n, ctx) {
-    // Validate the full POPOSigningKeyInput structure fail-closed, then surface the
-    // raw [0] node plus its decoded publicKey (for the sec. 4.1 template-match check).
     var m = schema.walk(POPOSK_INPUT, n, ctx);
     return { node: n, publicKey: m.fields.publicKey.value.result.bytes };
   }), { tag: 0 }),
@@ -169,9 +128,6 @@ var POPO_SIGNING_KEY = schema.seq([
   build: function (m, ctx) {
     var pin = m.fields.poposkInput;
     var sig = m.fields.signature.value;
-    // The POP signature is octet-string algorithm output an external verifier
-    // consumes; with no in-tree POP verify layer, octet alignment is enforced
-    // at parse (RFC 4211 sec. 4.1).
     if (sig.unusedBits !== 0) {
       throw ctx.E("crmf/bad-popo", "a POPOSigningKey signature BIT STRING must be octet-aligned (0 unused bits)");
     }
@@ -184,19 +140,6 @@ var POPO_SIGNING_KEY = schema.seq([
   },
 });
 
-// keyEncipherment [2] / keyAgreement [3] POPOPrivKey (sec. 4). POPOPrivKey is a
-// 5-arm CHOICE { thisMessage [0], subsequentMessage [1], dhMAC [2], agreeMAC [3],
-// encryptedKey [4] }, so X.680 sec. 31.2.7 forces the outer [2]/[3] tag to be EXPLICIT
-// (a CHOICE has no single tag to replace). Validate that shell, a constructed
-// wrapper around exactly one inner context [0]..[4] alternative, before surfacing
-// the arm raw, so a primitive, empty or mis-tagged node is rejected and never
-// reported to a verifier as a well-formed POP. The inner alternative's own value
-// (incl. the encryptedKey [4] EnvelopedData) stays deferred to the verify layer.
-// POPOPrivKey ::= CHOICE { thisMessage [0] BIT STRING (deprecated), subsequentMessage
-// [1] SubsequentMessage, dhMAC [2] BIT STRING (deprecated), agreeMAC [3] PKMACValue,
-// encryptedKey [4] EnvelopedData } (RFC 4211 sec. 4.2). The deprecated arms are still
-// parsed. The inner VALUE stays deferred raw (the EnvelopedData / MAC decode is a
-// verify-layer concern), but the alternative's shape is validated fail-closed.
 var POPOPRIVKEY_METHODS = { 0: "thisMessage", 1: "subsequentMessage", 2: "dhMAC", 3: "agreeMAC", 4: "encryptedKey" };
 function popoPrivKey(type) {
   return schema.decode(function (n, ctx) {
@@ -207,23 +150,13 @@ function popoPrivKey(type) {
     if (inner.tagClass !== "context" || inner.tagNumber < 0 || inner.tagNumber > 4) {
       throw ctx.E("crmf/bad-popo", type + " POPOPrivKey alternative must be a context [0]..[4] CHOICE element (RFC 4211 sec. 4)");
     }
-    // RFC 4211 sec. 4.2/sec. 4.3 -- the MAC alternatives dhMAC [2] / agreeMAC [3] are the
-    // key-agreement "fourth method"; key-encipherment POP uses only the
-    // thisMessage / subsequentMessage / encryptedKey methods, so a MAC arm under
-    // keyEncipherment is non-conforming.
     if (type === "keyEncipherment" && (inner.tagNumber === 2 || inner.tagNumber === 3)) {
       throw ctx.E("crmf/bad-popo", "keyEncipherment POP cannot use the MAC alternative " + POPOPRIVKEY_METHODS[inner.tagNumber] + " (RFC 4211 sec. 4.2)");
     }
-    // FORM: thisMessage [0] / subsequentMessage [1] / dhMAC [2] are primitive (BIT
-    // STRING / INTEGER / BIT STRING); agreeMAC [3] PKMACValue and encryptedKey [4]
-    // EnvelopedData are constructed (SEQUENCE). A wrong-form node is malformed.
     var mustBeConstructed = inner.tagNumber === 3 || inner.tagNumber === 4;
     if (mustBeConstructed !== !!inner.children) {
       throw ctx.E("crmf/bad-popo", type + " POPOPrivKey [" + inner.tagNumber + "] has the wrong primitive/constructed form (RFC 4211 sec. 4)");
     }
-    // Each alternative's PAYLOAD is decoded fail-closed, not just its form:
-    // thisMessage [0] / dhMAC [2] are BIT STRINGs; subsequentMessage [1] an INTEGER
-    // in {0,1}; agreeMAC [3] a PKMACValue SEQUENCE; encryptedKey [4] an EnvelopedData.
     if (inner.tagNumber === 0 || inner.tagNumber === 2) {
       try { asn1.read.bitStringImplicit(inner, inner.tagNumber); }
       catch (e) { throw ctx.E("crmf/bad-popo", POPOPRIVKEY_METHODS[inner.tagNumber] + " [" + inner.tagNumber + "] must be a BIT STRING (RFC 4211 sec. 4.2)", e); }
@@ -240,32 +173,19 @@ function popoPrivKey(type) {
       try { schema.embeddedDer(PKMAC_VALUE, asn1.sequenceTlv(inner), NS, { code: "crmf/bad-popo", what: "agreeMAC [3] PKMACValue" }); }
       catch (e) { throw ctx.E("crmf/bad-popo", "agreeMAC [3] must be a PKMACValue SEQUENCE { algId, BIT STRING } (RFC 4211 sec. 4.2)", e); }
     }
-    // encryptedKey [4] EnvelopedData: validate the CMS structure fail-closed by
-    // composing the shared EnvelopedData decoder (retag the IMPLICIT [4] to the
-    // universal SEQUENCE it decodes as). The EncKeyWithID identity check lives inside
-    // the ENCRYPTED content, so it stays a verify-layer concern.
     if (inner.tagNumber === 4) {
       var env;
       try { env = cms.walkEnvelopedData(asn1.decode(asn1.sequenceTlv(inner))); }
       catch (e) { throw ctx.E("crmf/bad-popo", "encryptedKey [4] must be a well-formed EnvelopedData (RFC 4211 sec. 4.2, RFC 5652 sec. 6.1)", e); }
-      // RFC 4211 sec. 4.2: the enveloped content type MUST be id-ct-encKeyWithID (the
-      // ContentType OID is in the clear even though the content itself is encrypted).
       if (env.encryptedContentInfo.contentType !== oid.byName("encKeyWithID")) {
         throw ctx.E("crmf/bad-popo", "encryptedKey [4] EnvelopedData content type MUST be id-ct-encKeyWithID (RFC 4211 sec. 4.2)");
       }
-      // The encrypted key material MUST be present. CMS allows a detached
-      // EnvelopedData (encryptedContent OPTIONAL), but a POP with no key to verify
-      // or archive is meaningless. The shared CMS assert rejects a null OR
-      // zero-length attached ciphertext (the rule the EST / PKCS#12 siblings hold).
       cms.assertAttachedCiphertext(env.encryptedContentInfo, ctx.E, "crmf/bad-popo", "encryptedKey [4] EnvelopedData");
     }
     return { type: type, method: POPOPRIVKEY_METHODS[inner.tagNumber], bytes: n.bytes };
   });
 }
 
-// ProofOfPossession ::= CHOICE { raVerified [0] NULL, signature [1] POPOSigningKey,
-// keyEncipherment [2] POPOPrivKey, keyAgreement [3] POPOPrivKey }. Each arm yields
-// the final object so the CertReqMsg build reads one uniform popo shape.
 var PROOF_OF_POSSESSION = schema.choice([
   { when: { tagClass: "context", tagNumber: 0 }, schema: POPO_RAVERIFIED },
   { when: { tagClass: "context", tagNumber: 1 }, schema: schema.decode(function (n, ctx) { return schema.walk(POPO_SIGNING_KEY, n, ctx).result; }) },
@@ -273,10 +193,6 @@ var PROOF_OF_POSSESSION = schema.choice([
   { when: { tagClass: "context", tagNumber: 3 }, schema: popoPrivKey("keyAgreement") },
 ], { code: "crmf/bad-popo" });
 
-// ---- Controls / regInfo (sec. 5, sec. 6, sec. 7) ---------------------------------
-// AttributeTypeAndValue ::= SEQUENCE { type OBJECT IDENTIFIER, value ANY DEFINED BY
-// type }. The list is decoded; each value stays raw (the per-OID value semantics
-// are deferred). Shared shape for both controls and regInfo.
 var CONTROL = schema.seq([
   schema.field("type", schema.oidLeaf()),
   schema.field("value", schema.any()),
@@ -288,17 +204,9 @@ var CONTROL = schema.seq([
   },
 });
 function mapControls(m) { return m.items.map(function (it) { return it.value.result; }); }
-// Controls ::= SEQUENCE SIZE(1..MAX) OF AttributeTypeAndValue (sec. 5).
 var CONTROLS = schema.seqOf(CONTROL, { assert: "sequence", min: 1, code: "crmf/bad-controls", what: "Controls", build: mapControls });
-// regInfo ::= SEQUENCE SIZE(1..MAX) OF AttributeTypeAndValue (sec. 7).
 var REG_INFO = schema.seqOf(CONTROL, { assert: "sequence", min: 1, code: "crmf/bad-reg-info", what: "regInfo", build: mapControls });
 
-// ---- CertTemplate (sec. 5), the IMPLICIT-TAGS core ------------------------
-// CertTemplate ::= SEQUENCE { version [0], serialNumber [1], signingAlg [2],
-// issuer [3] Name, validity [4] OptionalValidity, subject [5] Name, publicKey [6]
-// SubjectPublicKeyInfo, issuerUID [7], subjectUID [8], extensions [9] }, where every
-// field IMPLICIT and OPTIONAL, so the whole body is one ascending [0..9] trailing
-// run. issuer/subject Name and the [4] validity times are the CHOICE exceptions.
 var CERT_TEMPLATE = schema.seq([
   schema.trailing([
     { tag: 0, name: "version", schema: schema.implicitInteger(0) },
@@ -316,17 +224,6 @@ var CERT_TEMPLATE = schema.seq([
   assert: "sequence", code: "crmf/bad-cert-template", what: "CertTemplate",
   build: function (m, ctx) {
     var f = m.fields;
-    // version MUST be 2 (v3) when supplied; SHOULD be omitted (RFC 4211 sec. 5). This
-    // is a structural CertTemplate rule (it holds wherever the template appears);
-    // the CA-assigned-field omission rule is REQUEST-context-specific and lives in
-    // CERT_REQUEST.build, because the same CertTemplate structure identifies an
-    // existing certificate -- serialNumber and issuer present -- inside a CMP
-    // RevDetails (RFC 9810 sec. 5.3.9). Every field is surfaced so both the request
-    // omission check and the revocation consumer read them off one result.
-    // The single profile override: RFC 9810 Appendix D.6 profiles the CMP
-    // cross-certification (ccr) template as "version v1 or v3", so the caller
-    // opts in to v1 (0) via ctx.allowV1Version, the same base-section-vs-
-    // profile-appendix override mechanism as the signingAlg relaxation below.
     if (f.version.present && f.version.value !== 2n &&
         !(ctx.allowV1Version && f.version.value === 0n)) {
       throw ctx.E("crmf/bad-version", "CertTemplate version MUST be 2 (v3) if supplied (RFC 4211 sec. 5)");
@@ -346,10 +243,6 @@ var CERT_TEMPLATE = schema.seq([
   },
 });
 
-// ---- CertRequest / CertReqMsg / CertReqMessages (sec. 3, sec. 5) --------------
-// CertRequest ::= SEQUENCE { certReqId INTEGER, certTemplate CertTemplate,
-// controls Controls OPTIONAL }. certReqId is a SIGNED INTEGER with no value
-// constraint -- a negative value (the RFC 9483 -1 sentinel) is legal.
 var CERT_REQUEST = schema.seq([
   schema.field("certReqId", schema.integerLeaf()),
   schema.field("certTemplate", CERT_TEMPLATE),
@@ -358,18 +251,6 @@ var CERT_REQUEST = schema.seq([
   assert: "sequence", code: "crmf/bad-cert-request", what: "CertRequest",
   build: function (m, ctx) {
     var tpl = m.fields.certTemplate.value.result;
-    // RFC 4211 sec. 5 -- serialNumber, signingAlg, issuerUID, and subjectUID MUST be
-    // omitted from a REQUEST's CertTemplate: serialNumber and signingAlg are
-    // assigned by the CA, and the UID pair is deprecated. A requester must not
-    // dictate a CA-assigned value (a requester-chosen serialNumber is a real
-    // hazard), so a request template that sets any of them is rejected
-    // fail-closed. The check lives HERE, not in CERT_TEMPLATE, because the same
-    // structure legitimately carries serialNumber/issuer in a CMP RevDetails.
-    // A cross-certification request (ccr) is the one exception: RFC 9810 Appendix
-    // D.6 profiles its template with signingAlg PRESENT (the requesting CA states
-    // the algorithm it wants the cross-certificate signed with), so the caller
-    // relaxes that single field via ctx.allowSigningAlg; serialNumber and the UID
-    // pair stay forbidden.
     var caAssigned = ctx.allowSigningAlg
       ? ["serialNumber", "issuerUID", "subjectUID"]
       : ["serialNumber", "signingAlg", "issuerUID", "subjectUID"];
@@ -383,15 +264,11 @@ var CERT_REQUEST = schema.seq([
       certReqIdHex:  m.fields.certReqId.node.content.toString("hex"),
       certTemplate:  tpl,
       controls:      m.fields.controls.present ? m.fields.controls.value.result : null,
-      certReqBytes:  m.node.bytes,   // the exact CertRequest TLV the POP signature covers (sec. 4.1)
+      certReqBytes:  m.node.bytes,
     };
   },
 });
 
-// CertReqMsg ::= SEQUENCE { certReq CertRequest, popo ProofOfPossession OPTIONAL,
-// regInfo SEQUENCE OF AttributeTypeAndValue OPTIONAL }. popo is a CHOICE of context
-// [0]..[3]; regInfo is a bare universal SEQUENCE, so the two OPTIONAL positions are
-// disambiguated by tag class.
 var CERT_REQ_MSG = schema.seq([
   schema.field("certReq", CERT_REQUEST),
   schema.optional("popo", PROOF_OF_POSSESSION, { tags: [0, 1, 2, 3] }),
@@ -401,14 +278,7 @@ var CERT_REQ_MSG = schema.seq([
   build: function (m, ctx) {
     var certReq = m.fields.certReq.value.result;
     var popo = m.fields.popo.present ? m.fields.popo.value : null;
-    // A POP whose signature/MAC covers the certReq requires the CertTemplate to
-    // contain both subject and publicKey -- otherwise there is no complete request
-    // to sign / MAC over, and a verifier would be bound to the wrong identity/key.
     var complete = certReq.certTemplate.subject !== null && certReq.certTemplate.publicKey !== null;
-    // RFC 4211 sec. 4.1 -- for a signature POP, poposkInput's presence is fixed by the
-    // CertTemplate: it MUST be omitted when the template carries both subject and
-    // publicKey (the signature is then over the DER of the CertRequest), and MUST be
-    // present otherwise.
     if (popo && popo.type === "signature") {
       if (complete && popo.poposkInput !== null) {
         throw ctx.E("crmf/bad-popo", "poposkInput MUST be omitted when the CertTemplate contains both subject and publicKey (RFC 4211 sec. 4.1)");
@@ -416,16 +286,11 @@ var CERT_REQ_MSG = schema.seq([
       if (!complete && popo.poposkInput === null) {
         throw ctx.E("crmf/bad-popo", "poposkInput MUST be present when the CertTemplate lacks subject or publicKey (RFC 4211 sec. 4.1)");
       }
-      // RFC 4211 sec. 4.1 -- the POPOSigningKeyInput publicKey MUST be exactly the template
-      // publicKey (both surfaced as canonical SubjectPublicKeyInfo DER), so a request
-      // cannot sign one key while asking for a certificate over a different key.
       if (popo.poposkInput !== null && certReq.certTemplate.publicKey !== null &&
           !popo.poposkInput.publicKey.equals(certReq.certTemplate.publicKey.bytes)) {
         throw ctx.E("crmf/bad-popo", "POPOSigningKeyInput publicKey MUST equal the CertTemplate publicKey (RFC 4211 sec. 4.1)");
       }
     }
-    // RFC 4211 sec. 4.2/sec. 4.3 -- a MAC-based POPOPrivKey (dhMAC / agreeMAC) proves
-    // possession by MACing the certReq, which MUST include both subject and publicKey.
     if (popo && (popo.type === "keyEncipherment" || popo.type === "keyAgreement") &&
         (popo.method === "dhMAC" || popo.method === "agreeMAC") && !complete) {
       throw ctx.E("crmf/bad-popo", "a MAC-based key-agreement/encipherment POP (dhMAC/agreeMAC) requires the CertTemplate to contain both subject and publicKey (RFC 4211 sec. 4.2/sec. 4.3)");
@@ -438,16 +303,11 @@ var CERT_REQ_MSG = schema.seq([
   },
 });
 
-// CertReqMessages ::= SEQUENCE SIZE(1..MAX) OF CertReqMsg (sec. 3), where an empty sequence
-// is malformed. The top-level reject code predates the
-// `<prefix>/not-a-<structure>` convention and stays frozen on the public
-// error-code surface.
 var CERT_REQ_MESSAGES = schema.seqOf(CERT_REQ_MSG, {
   assert: "sequence", min: 1, code: "crmf/bad-cert-req-messages", what: "CertReqMessages",
   build: function (m) { return { messages: m.items.map(function (it) { return it.value.result; }) }; },
 });
 
-// ---- parse -----------------------------------------------------------
 
 /**
  * @primitive  pki.schema.crmf.parse
@@ -489,9 +349,6 @@ var CERT_REQ_MESSAGES = schema.seqOf(CERT_REQ_MSG, {
  *   var m = pki.schema.crmf.parse(der);
  *   m.messages[0].certReq.certTemplate.subject.dn;   // "CN=req.example"
  */
-// Recording, because pki.crmf.verifyPop reaches a verdict from this result: the byte range a
-// proof of possession covers, the key that possession is proven for, and the subject the CA will
-// issue to are separate properties here, so the record is what binds them to one another.
 var parse = pkix.makeRecordingParser({
   pemLabel: null, PemError: PemError, ErrorClass: CrmfError, prefix: "crmf",
   what: "certificate request message", topSchema: CERT_REQ_MESSAGES, ns: NS,
@@ -540,12 +397,6 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || null, Pem
  */
 function pemEncode(der, label) { return pkix.pemEncode(der, label, PemError); }
 
-// matches(root): a CertReqMessages is a universal SEQUENCE whose first CertReqMsg
-// is a SEQUENCE whose first CertRequest is a SEQUENCE leading with a universal
-// INTEGER (certReqId) then a universal SEQUENCE (certTemplate). This 3-level probe
-// is disjoint from every registered root PROVIDED crmf is checked before
-// ocsp-request: an OCSPRequest's tbsRequest never leads with the INTEGER-then-
-// SEQUENCE pair (its children[0] is a context [0] version or a requestList).
 function matches(root) {
   var k = pkix.rootSequenceChildren(root, 1);
   if (!k) return false;
@@ -558,15 +409,6 @@ function matches(root) {
     schema.isUniversal(tpl, TAGS.SEQUENCE) && !!tpl.children;
 }
 
-// Validate a bare, already-decoded CertReqMessages / CertTemplate node -- for a
-// composer that carries these structures inside its own envelope (an RFC 9810
-// CMP PKIBody's ir/cr/kur/krr/ccr arms; a RevDetails.certDetails). NS-bound to
-// crmf so an interior failure throws CrmfError with a crmf/* code, never the
-// composer's class wearing a foreign code. Same contract as the CMS walkers.
-// The opts carry the RFC 9810 Appendix D.6 ccr-profile overrides of RFC 4211 sec. 5,
-// applied by the CMP composer to the cross-certification arm only:
-// opts.allowSigningAlg relaxes the request-template signingAlg-omission rule and
-// opts.allowV1Version accepts a CertTemplate version of v1 ("version v1 or v3").
 function walkCertReqMessages(node, opts) {
   var ctx = NS;
   if (opts && (opts.allowSigningAlg || opts.allowV1Version)) {
@@ -585,8 +427,5 @@ module.exports = {
   matches: matches,
   walkCertReqMessages: walkCertReqMessages,
   walkCertTemplate: walkCertTemplate,
-  // The top schema, exposed (not on the curated pki.schema.crmf surface) so a
-  // round-trip test can prove schema.encode(schema, v) -> decode -> parse recovers
-  // v -- the invariant that structurally validates the IMPLICIT/EXPLICIT tag handling.
   certReqMessagesSchema: CERT_REQ_MESSAGES,
 };