@blamejs/pki 0.6.16 → 0.6.18

package/CHANGELOG.md

@@ -4,6 +4,29 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.18 — 2026-09-01
+
+pki.cms.encrypt and pki.cms.decrypt envelope to and open a composite ML-KEM recipient, extending the CMS KEMRecipientInfo arm to the hybrid post-quantum key-establishment algorithms.
+
+### Added
+
+- pki.cms.encrypt accepts a recipient certificate carrying a composite ML-KEM public key (id-MLKEM768-* or id-MLKEM1024-*, twelve algorithms pairing ML-KEM-768/1024 with RSA-OAEP 2048/3072/4096, ECDH over P-256/P-384/P-521 and brainpoolP256r1/P384r1, X25519, or X448) and emits an id-ori-kem KEMRecipientInfo: the composite as the kem algorithm with absent parameters, the composite ciphertext, HKDF-SHA256 as the kdf, and AES-256 key wrap with a 32-octet key-encryption key (RFC 9629 / RFC 9936). The recipient certificate must assert the keyEncipherment key usage.
+- pki.cms.decrypt opens a composite ML-KEM KEMRecipientInfo with the recipient's composite PKCS#8 key, recovering the content-encryption key through the same KDF and unwrap. A wrong key, a tampered ciphertext, or a traditional-component decapsulation failure returns the uniform cms/decrypt-failed verdict, never a distinguishing error.
+
+## v0.6.17 — 2026-09-01
+
+pki.scep.getCert and pki.scep.getCrl retrieve an already-issued certificate or a CA's CRL over SCEP, sending RFC 8894 GetCert and GetCRL queries and reading the result out of the CA's signed CertRep.
+
+### Added
+
+- pki.scep.getCert(baseUrl, opts) retrieves an issued certificate over SCEP (RFC 8894 sec. 3.3.4). Name the target by { certificate } (the certificate whose issuer and serial identify it) or by { issuer, serialNumber } directly; the serial accepts a BigInt, a number, or a hex string. The CA response is verified against caCert (or responderCert), its recipientNonce must echo the query's fresh senderNonce, and the returned certificate is matched to the requested issuer and serial before it is handed back. A response carrying no matching certificate throws scep/cert-not-found; more than one throws scep/ambiguous-cert.
+- pki.scep.getCrl(baseUrl, opts) retrieves a CA's CRL over SCEP (RFC 8894 sec. 3.3.4), named the same way as getCert. The response is authenticated identically, and the returned CRL is bound to the query: getCrl returns the CRL whose issuer matches the requested CA, throwing scep/no-crl when the response carries no such CRL and scep/ambiguous-crl when it carries more than one. Per RFC 8894 sec. 2.7 a client should compose a GetCRL only when the CA supports neither a CRL distribution point nor HTTP access; prefer those and pki.schema.crl.parse where available.
+- pki.scep.build and pki.scep.parse now handle the GetCert (messageType 21) and GetCRL (messageType 22) queries: a pkcsPKIEnvelope carrying an IssuerAndSerialNumber (a CMS SEQUENCE of the issuer Name and the certificate serial), signed under the transaction attributes (RFC 8894 sec. 3.3.4).
+
+### Changed
+
+- pki.scep.parse accepts every messageType the RFC 8894 registry defines, including GetCert and GetCRL. A messageType outside the registry is still refused with scep/bad-message-type.
+
 ## v0.6.16 — 2026-09-01
 
 pki.scep.enroll and pki.scep.renew poll a PENDING enrollment to its issued certificate, sending RFC 8894 CertPoll requests until the CA answers or a bounded poll-count and wait budget is exhausted.

package/README.md

@@ -222,7 +222,7 @@ comment blocks, is at [pkijs.com](https://pkijs.com).
 | `pki.schema.cmp` | CMP messages (RFC 9810): the header (version, sender and recipient including the anonymous NULL-DN, nonces, transaction id, general info), the 27-arm body (certificate requests via the CRMF parser, an encrypted certificate's EnvelopedData via CMS, response / revocation / confirmation / error / support / polling arms structural, the rest raw), and the exact `headerBytes` and `bodyBytes` slices an external verifier reconstructs the protected part from. The CMP-before-OCSP dispatch order is enforced Fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.csrattrs` | EST CSR Attributes (`CsrAttrs`, RFC 8951 §3.5 / RFC 9908) — the `AttrOrOID` items a server sends to shape an enrollment: bare OIDs, attributes with raw values, and decoded views of the RFC 9908 meaningful types (extension requests, EC and RSA key-type conventions, the certification-request-info template). Unknown types are surfaced raw; structure and the RFC 9908 semantic MUSTs are fail-closed — `parse` |
 | `pki.est` | Enrollment over Secure Transport (RFC 7030 / 8951 / 9908 / 7616). The client verbs `cacerts`, `simpleenroll`, `simplereenroll`, `serverkeygen`, `csrattrs`, and `fullcmc` drive the RFC 7030 flow over `pki.transport` (inject your own via `opts.transport`, or take the fail-closed default): HTTPS only, an explicit trust anchor required, same-origin redirects followed while a downgrade or loop is refused, a 202 Retry-After surfaced but never slept, HTTP Basic or Digest (RFC 7616, SHA-256 / SHA-512-256; MD5 and no-qop refused by default) answered only after the server is authenticated, and the issued certificate chosen by public-key match. `serverkeygen` requests a server-generated key, cleartext or an opaque CMS EnvelopedData, with encryption bound to the CSR's key-identifier attribute over a confidentiality-bearing cipher. `csrattrs` fetches the CA's RFC 9908 attributes policy. `fullcmc` (§4.3) carries a CMC Full PKI Request and reduces the CA's answer through `pki.cmc.verify` to one terminal outcome, refusing a response that fails to echo the transaction and nonce the request carried, or that covers a key the request never asked for; a certs-only reply to a bound request is refused rather than read as an issuance. Under the verbs sit the transport-agnostic codecs they compose: the RFC 8951 base64 transfer codec (which ignores Content-Transfer-Encoding), the `multipart/mixed` splitter, the certs-only and serverkeygen response validators over CMS, the enroll-attribute builders, and the HTTP response classifier — `transferDecode`/`transferEncode`, `parseCertsOnly`, `splitMultipartMixed`, `parseServerKeygenResponse`, `findIssuedCert`, `classifyResponse`, `paths`, and the builders |
-| `pki.scep` | SCEP pkiMessage codec (RFC 8894), the client side of Simple Certificate Enrollment. `build(spec)` assembles a `PKCSReq` or `RenewalReq` request: it verifies the PKCS#10 certification request's own proof-of-possession, encrypts it to the CA as the inner EnvelopedData (`pkcsPKIEnvelope`, AES-128-CBC), and signs that under the transaction attributes RFC 8894 §3.2 defines, a messageType, a caller-unique transactionId, and a 16-byte senderNonce. The recipient CA certificate must assert `keyEncipherment`. `parse(bytes, opts?)` reads a `PKCSReq`, `RenewalReq`, or `CertRep` back (the `CertPoll`, `GetCert`, and `GetCRL` client queries are refused): it verifies the outer signature first and refuses a message whose signature does not check, so the transaction attributes it returns come only from a verified signer, never alongside a false verdict. Because a valid signature only proves self-consistency with the embedded certificate, pass `opts.signerCert` to authenticate a CA response against the CA certificate you hold (a public-key mismatch is refused, `signerAuthenticated` reports the result); a caller that omits it gets a crypto-only verdict and must authenticate the surfaced `signerCert` itself. It maps the messageType, pkiStatus, failInfo, and the nonces from their RFC 8894 enumerants and refuses an unknown one; given `recipientKey` it decrypts the `pkcsPKIEnvelope` to the messageData, and given `expectedSenderNonce` it refuses a response whose recipientNonce does not echo it. It reads a CA's CertRep in full. `getCACaps(baseUrl, opts?)`, `getCACert(baseUrl, opts?)`, `getNextCACert(baseUrl, opts)`, `enroll(baseUrl, opts)`, and `renew(baseUrl, opts)` carry that codec to a live CA over HTTP (RFC 8894 §4) through an injectable transport (`pki.transport.https` by default): `getCACaps` reports the CA's advertised capabilities and never lowers the client's algorithm choice on the unauthenticated response, `getCACert` pins the CA certificate to an out-of-band `expectedFingerprint` a returned certificate must match, `getNextCACert` fetches the CA's next (rollover) certificate and verifies the SignedData response against the current CA certificate (`caCertificate`) before returning it, refusing a response signed by any other key, and `enroll` and `renew` POST a PKCSReq or RenewalReq, authenticate the CertRep against the CA certificate and its nonce echo, select the issued certificate by public-key match, throw on a FAILURE with the CA's failInfo, and return a PENDING to retry. Issuing a CertRep and automatic polling are not yet built — `build`, `parse`, `getCACaps`, `getCACert`, `getNextCACert`, `enroll`, `renew` |
+| `pki.scep` | SCEP pkiMessage codec (RFC 8894), the client side of Simple Certificate Enrollment. `build(spec)` assembles a request: a `PKCSReq` or `RenewalReq` wraps a PKCS#10 certification request, whose own proof-of-possession it verifies first; a `CertPoll` wraps an IssuerAndSubject naming the issuing CA and the request subject; and a `GetCert` or `GetCRL` wraps an IssuerAndSerialNumber naming a certificate by its issuer and a positive serial of at most 20 octets. It encrypts the messageData to the CA as the inner EnvelopedData (`pkcsPKIEnvelope`, AES-128-CBC), and signs that under the transaction attributes RFC 8894 §3.2 defines, a messageType, a caller-unique transactionId, and a 16-byte senderNonce. The recipient CA certificate must assert `keyEncipherment`. `parse(bytes, opts?)` reads a `PKCSReq`, `RenewalReq`, `CertPoll`, `GetCert`, `GetCRL`, or `CertRep` back (a messageType outside the RFC 8894 registry is refused): it verifies the outer signature first and refuses a message whose signature does not check, so the transaction attributes it returns come only from a verified signer, never alongside a false verdict. Because a valid signature only proves self-consistency with the embedded certificate, pass `opts.signerCert` to authenticate a CA response against the CA certificate you hold (a public-key mismatch is refused, `signerAuthenticated` reports the result); a caller that omits it gets a crypto-only verdict and must authenticate the surfaced `signerCert` itself. It maps the messageType, pkiStatus, failInfo, and the nonces from their RFC 8894 enumerants and refuses an unknown one; given `recipientKey` it decrypts the `pkcsPKIEnvelope` to the messageData, and given `expectedSenderNonce` it refuses a response whose recipientNonce does not echo it. It reads a CA's CertRep in full. `getCACaps(baseUrl, opts?)`, `getCACert(baseUrl, opts?)`, `getNextCACert(baseUrl, opts)`, `enroll(baseUrl, opts)`, `renew(baseUrl, opts)`, `getCert(baseUrl, opts)`, and `getCrl(baseUrl, opts)` carry that codec to a live CA over HTTP (RFC 8894 §4) through an injectable transport (`pki.transport.https` by default): `getCACaps` reports the CA's advertised capabilities and never lowers the client's algorithm choice on the unauthenticated response, `getCACert` pins the CA certificate to an out-of-band `expectedFingerprint` a returned certificate must match, `getNextCACert` fetches the CA's next (rollover) certificate and verifies the SignedData response against the current CA certificate (`caCertificate`) before returning it, refusing a response signed by any other key, and `enroll` and `renew` POST a PKCSReq or RenewalReq, authenticate the CertRep against the CA certificate and its nonce echo, select the issued certificate by public-key match, throw on a FAILURE with the CA's failInfo, and poll a PENDING response with CertPoll requests until the CA answers or a bounded poll-count and total-wait budget is spent. `getCert` and `getCrl` retrieve an already-issued certificate or a CA CRL by issuer and serial number, authenticated the same way; RFC 8894 §2.6, §2.7, and §3.3.4 recommend these queries only where HTTP certificate-store access (RFC 4387), LDAP, or a CRL distribution point is unavailable, so prefer those where a CA offers them. Issuing a CertRep (the certification-authority side) is not yet built — `build`, `parse`, `parseCapabilities`, `getCACaps`, `getCACert`, `getNextCACert`, `enroll`, `renew`, `getCert`, `getCrl` |
 | `pki.transport` | The shared, fail-closed `node:https` transport the enrollment clients drive. `pki.transport.https(defaults)` returns a `transport(request) → { status, headers, body, tls }`, where `tls` carries the negotiated `protocol`, `cipher`, and raw `peerCertificate`. This is the toolkit's only socket choke point: an explicit trust anchor (or an opt-in to the system store) is required, `rejectUnauthorized` is always on, TLS is floored at 1.2, the response body is capped while it streams, and a stalled socket times out. The EST, ACME, and CMP clients reuse it verbatim. If you inject your own transport, return `tls` too: `pki.est.serverkeygen` asserts the negotiated cipher can protect the delivered private key, and a transport that reports no cipher is trusted rather than refused, so omitting the field silently skips that check — `https` |
 | `pki.jose` | Flattened JWS (RFC 7515) and JWK thumbprints (RFC 7638). `sign` and `verify` run a Flattened JWS against declarative profiles (ACME outer, EAB inner, keyChange inner) that carry the required and forbidden header rules as data. `base64url` is the strict RFC 4648 §5 codec, rejecting padding, non-alphabet characters, and non-canonical trailing bits. `parseJson` is a bounded reader that refuses duplicate members at any depth. `thumbprint` is the RFC 7638 / 8037 / 9964 canonical digest. The algorithm registry binds each `alg` to its key type (ES/RS/PS/EdDSA/ML-DSA), leaving no code path for `alg:none`, an RS256→HS256 key confusion, or an all-zero ECDSA signature; `assertPublicJwk` refuses a JWK carrying private material, so an exported private key is never published. `opts.key` names the key a message must be signed under and governs: where the profile also permits an embedded header `jwk`, the two must be the same key — compared as RFC 7638 thumbprints, so member order cannot make equal keys differ — and a disagreement is refused rather than resolved in the message's favor. `keySource` reports which key answered, since a signature checked against a key you named is a different claim from one checked against the key the message carried — `sign`, `verify`, `base64url`, `parseJson`, `thumbprint`, `assertPublicJwk` |
 | `pki.acme` | ACME (RFC 8555 / 8737 / 8738 / 9773). `client(directoryUrl, opts)` is a stateful client driving a live CA directory over `pki.transport`: `newAccount`, `newOrder`, `newAuthz`, `getOrder`, `getAuthorization`, `getChallenge`, `respondToChallenge`, `finalize`, `pollOrder`, `pollAuthorization`, and `downloadCertificate` walk the issuance flow, with `newAuthz` pre-authorizing a single identifier (§7.4.1) and `downloadCertificate` binding the issued certificate to the order — its key, its identifiers, or both; at least one is required by default and the result reports `boundToKey` / `boundToIdentifiers` — before choosing among alternate chains (`Link rel="alternate"`, §7.4.2, via a `selectChain` predicate bounded by `maxAlternates`). `revokeCert` (account-key or certificate-key signed), `keyChange`, `updateAccount` (change the account contacts, §7.3.2), `listOrders` (the account's orders list, following the §7.1.2.1 `Link rel="next"` pagination bounded by a page cap and confined to the orders origin), `deactivateAccount`, `deactivateAuthorization`, `renewalInfo` (ARI), and `renewalWindow` (the RFC 9773 §4.2/4.3 renewal decision) complete the lifecycle. Every URL is HTTPS only, an explicit trust anchor is required, each request carries a fresh single-use nonce with a bounded badNonce retry (and, when `opts.resignKeys` supplies caller-approved alternative account-key algorithms, a bounded RFC 8555 §6.2 badSignatureAlgorithm re-sign that the CA's advertised list can only filter, never widen, so it cannot force a weaker algorithm), reads are POST-as-GET, polling is bounded and sleeps on a Retry-After via an injectable sleeper capped by a poll count and a total-wait budget, and every response body is size-capped. The transport is injectable via `opts.transport`. Over the message layer it composes resource-object validators (closed status enums, conditional-required fields, unknown fields ignored), the three §7.1.6 state machines, the request builders (newAccount with External Account Binding, newOrder with `replaces`, finalize with a CSR identifier-set match and account-key-reuse rejection, challenge responses, deactivation, revokeCert in both key modes, the keyChange nested JWS, POST-as-GET), the http-01 / dns-01 / tls-alpn-01 challenge computations, the dns and ip identifier validators, and the ARI certID with serial sign-padding preserved — `client`, `validate`, `identify`, `assertTransition`, the builders, `keyAuthorization`, `http01`, `dns01`, `tlsAlpn01Extension`, `verifyTlsAlpn01`, `ariCertId` |
@@ -239,7 +239,7 @@ comment blocks, is at [pkijs.com](https://pkijs.com).
 | `pki.crl` | CRL issuance and verification (RFC 5280 §5). `sign(spec, issuer, opts)` builds and signs a `CertificateList` from a `spec` of `thisUpdate` and `nextUpdate`, an optional `crlNumber`, a `revoked` array (each entry a `serialNumber` and `revocationDate` with an optional `reason` or `invalidityDate`), and an optional `extensions` object (authority key identifier, issuing distribution point, delta-CRL indicator, freshest CRL, authority information access) or an array of pre-encoded Extension DER, with an `issuer` of `{ cert, key }` or `{ name, publicKey, key }`. The signature algorithm is resolved from the issuer key, so RSA (PKCS#1 v1.5 or PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch. The version is derived from the extension set (v2 when any CRL or entry extension is present, else v1), the outer `signatureAlgorithm` matches `tbsCertList.signature`, an empty revocation list omits the field rather than emitting an empty SEQUENCE, `reasonCode` is an ENUMERATED and `invalidityDate` is always GeneralizedTime, the RFC fixes per-extension criticality, and the produced signature is verified under the issuer key before return. `verify(crl, issuer)` checks a CRL signature through the one path-validation signature engine, algorithm-confusion and EdDSA low-order gates included; handed a certificate rather than a bare key it also asks what only a certificate can answer — that the certificate is the issuer the CRL names, and that its `keyUsage`, when present, asserts `cRLSign` — so a CRL minted under an end-entity certificate of the same CA does not verify as that CA's. `isRevoked(crl, serialNumber, opts)` looks a serial up, and first checks that the CRL is one a serial can be looked up in at all — it is handed a serial and nothing else, so a CRL that speaks for part of its issuer's certificates is refused rather than answered from. A delta CRL lists changes since a base, so an entry recording a release reads as a revocation when read alone; an indirect CRL carries other issuers' entries, whose serials are unrelated to yours; and any other `issuingDistributionPoint` narrows the CRL to one distribution point, one kind of certificate, or a subset of revocation reasons, none of which a serial can be matched against. A CRL speaks for a span as well as a set, so `opts.time` states the instant the question is asked at and a list that has stopped speaking for it — `nextUpdate` passed, `thisUpdate` later, or no `nextUpdate` stated at all — is refused rather than read as a clean bill of health; without `opts.time` the lookup is structural and an absent serial means only that it is not on that list. `pki.path.crlChecker` is the verb for all of them: it is handed the certificate, merges a delta with its base, performs the §6.3.3 correspondence, and decides currency against the material it fetched. Returns DER, or a PEM `X509 CRL` with `opts.pem`; malformed input throws a typed `CrlError`. Parsing stays at `pki.schema.crl.parse` — `sign`, `verify`, `isRevoked` |
 | `pki.key` | Key-material lifecycle (RFC 5958 / RFC 8018). `encrypt(privateKey, password, opts)` wraps a PKCS#8 private key (DER, PEM, or an extractable `CryptoKey`) into an `EncryptedPrivateKeyInfo` under PBES2 (PBKDF2 with AES-CBC-Pad), where `opts` selects the `cipher` (`aes-256-cbc` default, `aes-192-cbc`, `aes-128-cbc`), the `prf` (`hmacWithSHA256` default, SHA-384/512, SHA-1), the `iterations` (default 600000), and the `salt`. The plaintext is validated as PKCS#8 before encryption, a default `prf` and `keyLength` are omitted so the parameters are byte-exact with OpenSSL, and the output is re-parsed before return. `decrypt(encrypted, password, opts)` recovers the inner `PrivateKeyInfo`, re-validated through `pki.schema.pkcs8.parse`: only PBES2 / PBKDF2 / AES-CBC is accepted (PBES1, PBMAC1, and scrypt are refused), the salt and iteration count are bounded before any derivation (`opts.maxIterations` lowers the cap), and a malformed parameter set or wrong-length IV is a distinct typed error. Because a MAC-less PBES2-CBC decrypt must not become a padding oracle (RFC 8018 §8), a wrong password and a valid-pad-but-not-a-key both surface the one uniform `key/decrypt-failed`. `export(key, opts)` and `import(input, opts)` move a private key as PKCS#8 or a public key as SubjectPublicKeyInfo. The key may come from the platform's WebCrypto or from a separately installed copy of this toolkit, and is exported through whichever holds its material; a non-extractable key, or one whose implementation keeps its material out of reach, is refused with that as the reason. Encoding is delegated to WebCrypto, so RSA carries an explicit NULL, EC a named curve, and Ed25519/Ed448/X25519/X448 omit parameters, and an ambiguous RSA or EC import requires `opts.algorithm`. `generate(algorithm, opts)` produces a key pair over RSA, ECDSA/ECDH, the Edwards and Montgomery curves, and the FIPS post-quantum ML-DSA and ML-KEM; `publicFromPrivate(privateKey)` derives the public key. Returns DER or PEM, with a typed `KeyError` on failure. Parsing stays at `pki.schema.pkcs8.parse` — `encrypt`, `decrypt`, `export`, `import`, `generate`, `publicFromPrivate` |
 | `pki.pkcs12` | PKCS#12 (.p12/.pfx) issuance and reading (RFC 7292 / RFC 9579). `build(spec, opts)` assembles a store from the OpenSSL-style `{ key, cert, ca?, friendlyName?, localKeyId? }` or the full `{ safeContents: [...] }`, where each element is a plaintext or PBES2-encrypted `SafeContents` of key, shroudedKey, cert, crl, secret, or nested `safeContents` bags. Keys and certs are validated before wrapping, and `friendlyName` (BMPString) and `localKeyId` are single-value. Integrity is a classic Appendix B HMAC (the default, for maximum interoperability) or an RFC 9579 PBMAC1 (`opts.mac.algorithm`) over SHA-256/384/512, with shrouded keys and cert safes encrypted under RFC 8018 PBES2 (AES-128/192/256-CBC). Every password is encoded the PKCS#12 way — BMPString+NULL for the classic MAC, UTF-8 for the PBES2 bags and PBMAC1 — which is what OpenSSL and NSS consume, so a file it emits opens in both, cross-checked bidirectionally. The MAC covers the exact AuthenticatedSafe byte range, a DEFAULT-1 `MacData.iterations` is rejected up front, and the store is re-parsed before return. `verifyMac(pfx, password, opts)` recomputes a classic or PBMAC1 MAC over `macedBytes` and constant-time-compares it, throwing on a MAC-less or public-key-integrity store. Public-key integrity (`opts.integrity.mode: "public-key"`) wraps the AuthenticatedSafe in a CMS SignedData instead of a MAC, signed by any `pki.cms.sign` signer and carrying no MacData (§4); privacy stays independent, so `password` still PBES2-encrypts the bags. Public-key privacy wraps a SafeContents as a CMS EnvelopedData (AES-CBC, `id-envelopedData`, never GCM) encrypted to recipient public keys through the `pki.cms.encrypt` recipient model, via per-safe `recipients` or the `opts.recipientCerts` convenience, restricted to certificate recipients (RSA-OAEP, ECDH, X25519, X448, ML-KEM) since a password or KEK recipient could not be reopened by `open`. All four integrity-by-privacy combinations are permitted (§3.1). `open(pfx, password, opts)` reads a store back: it verifies the MAC first, so a wrong password is the MAC verdict rather than a decrypt error, then PBES2-decrypts every privacy safe and shrouded key bag and returns `{ integrityMode, macVerified, signers, keys, certs, crls, secrets }` — keys as re-validated PKCS#8 DER, certs, CRLs and secrets as raw DER, all with `friendlyName` and `localKeyId`, nested safes recursively. A MAC-less store is refused unless `opts.allowUnauthenticated`. A public-key-integrity store is verified through its CMS SignedData signature first (`pkcs12/signature-invalid` on failure), with the signer surfaced in `signers` but never trust-chained, which remains the caller's `pki.path.validate` step. A legacy-PBE store's Appendix C 3DES and RC2 bags are decrypted, RC2 through an in-tree RFC 2268 cipher, so an `openssl pkcs12 -legacy` or NSS store opens; the legacy RC4 schemes are refused. An `id-envelopedData` safe is decrypted with `opts.recipientKey` after the integrity gate (`pkcs12/no-recipient-key` when absent), every recipient-side fault and every post-integrity decrypt failure collapsing to the uniform `pkcs12/decrypt-failed`, and `opts.keys: 'crypto'` imports each key to a `CryptoKey`. It reads what OpenSSL and NSS produce. Returns DER or a PEM `PKCS12`, with a typed `Pkcs12Error` on failure. Parsing stays at `pki.schema.pkcs12.parse` — `build`, `verifyMac`, `open` |
-| `pki.cms` | CMS signing, verification, encryption, and compression (RFC 5652). `sign(content, signers, opts)` produces a SignedData (§5), attached or detached, with one or many signers over RSA, RSASSA-PSS, ECDSA, EdDSA, the post-quantum ML-DSA-44/65/87 (RFC 9882) and SLH-DSA (all twelve FIPS 205 sets, RFC 9814), and composite ML-DSA pairing ML-DSA with a traditional RSA, ECDSA, or EdDSA key (accepted only when both components verify, draft-ietf-lamps-cms-composite-sigs). It builds the signed attributes (content-type, message-digest, signing-time) as canonical DER, signs the exact §5.4 preimage, and emits a DER `Buffer` or PEM. The content may also be an async iterable of byte chunks, which signs a large detached payload without holding it in memory: the payload is hashed incrementally under every signer's digest algorithm in one pass, and `verify` accepts the same streamed form as its `content` option. A signer may also be key-only — `{ key, spki, keyIdentifier }` with no certificate — which RFC 5272 §3.2 requires when a Full PKI Request's signer is the key of a certification request that request carries: the signer identifier takes the subjectKeyIdentifier form carrying the identifier the request declares, the signature scheme resolves from the request's own public key, and no certificate is embedded. `verify(input, opts)` parses a SignedData over the strict `pki.schema.cms` codec, locates each SignerInfo's signer certificate by its issuerAndSerialNumber or subjectKeyIdentifier, and checks the signature over the exact §5.4 preimage: with signed attributes present it confirms the message-digest attribute equals the content digest and verifies over the DER re-encoding of the SignedAttributes (the on-wire `[0]` tag replaced by a universal SET OF), and otherwise directly over the content. It returns a per-signer verdict with the matched signer certificate. `valid` and `trusted` are separate claims and neither implies the other: a SignedData carries its own certificates, so `valid` says the signature is sound under one of them and nothing about who signed, while `trusted` says every signer chained to a root named in `opts.trustAnchors`, validated through the same RFC 5280 path engine `pki.path.validate` uses. Without anchors there is nothing to chain to and `trusted` is `false`; anchors that cannot be read throw, rather than reading as untrusted. An unrecognized option is refused rather than ignored. `countersign(cms, signers, opts)` adds a countersignature (§11.4) — a `SignerInfo` over the countersigned SignerInfo's signature value, any signer algorithm, nestable, with the primary bytes preserved so it still verifies — attached as the id-countersignature unsigned attribute; `verify` returns each countersignature's verdict under `signers[i].countersignatures` and every unsigned attribute — including an RFC 3161 timestamp token, attachable via `sign`'s `unsignedAttributes` — under `signers[i].unsignedAttrs`, surfaced unauthenticated. `encrypt(content, recipients, opts)` produces an EnvelopedData, AuthEnvelopedData (AES-GCM, the authenticated default), or EncryptedData, with recipients auto-dispatched off the certificate key to key transport (RSAES-OAEP; v1.5 is never emitted), key agreement (ephemeral-static ECDH over P-256/384/521 with the X9.63 KDF, and X25519/X448 with HKDF), symmetric key wrap, password (PBKDF2 with RFC 3211 PWRI-KEK), or the post-quantum ML-KEM KEMRecipientInfo (RFC 9629/9936), wrapping one fresh content key for every recipient. The content may also be an async iterable of byte chunks, streamed through the AES-GCM or AES-CBC content cipher so a large plaintext is encrypted without being buffered whole; the ciphertext is assembled before the definite-length encryptedContent is emitted, byte-for-byte the buffered form. `decrypt(input, keyMaterial, opts)` recovers the content through the matching arm and returns it with an `authenticated` flag; every secret-dependent failure collapses to one uniform `cms/decrypt-failed` verdict (Bleichenbacher, EFAIL, and password-oracle freedom), and PKCS#1 v1.5 is decrypt-only under the RFC 3218 implicit-rejection countermeasure. With `opts.stream: true` the recovered `content` is an async iterable of plaintext chunks instead of a single Buffer, for a payload too large to hold whole; the authenticated modes (AuthEnvelopedData, AuthenticatedData, AES-GCM) verify integrity before the iterable yields, so a forged message throws before any plaintext is exposed, while a CBC EnvelopedData or EncryptedData yields the plaintext as the cipher produces it. Every key-establishment secret the toolkit allocates is wiped once used, on the failing path as well as the succeeding one: the KEM shared secret and its derived key-encryption key, the raw ECDH / X25519 / X448 agreement secret, a password-derived key-encryption key, and the content-encryption key itself, cleared once the message is complete since all recipients share it. Caller-supplied key material is never written to (best-effort; NIST SP 800-227 §4.2, RFC 9629 §7). `authenticate(content, recipients, opts)` produces an `id-ct-authData` (§9): cleartext content plus an HMAC-SHA-256/384/512 MAC, authenticated but not encrypted, with the fresh MAC key wrapped for every recipient through the same RecipientInfo model. The MAC covers the authenticated attributes (content-type and message-digest) re-tagged to the EXPLICIT SET OF (§9.2), or the content octets directly; `decrypt` recovers the MAC key, recomputes the MAC and independently the message-digest (§9.3), and releases the content only after both pass, with every secret-dependent failure collapsing to the uniform `cms/decrypt-failed`. `compress(content, opts)` and `decompress(input, opts)` produce and consume a CompressedData (RFC 3274; ZLIB, version 0, id-alg-zlibCompress); decompress bounds the uncompressed output at 16 MiB and stops before it is materialized, so a decompression bomb fails closed as `cms/decompress-too-large`. Compression is a size transform with no integrity or confidentiality (RFC 8551 §2.4.5). `certsOnly(certs, opts?)` builds a certs-only certificate-management message (RFC 8551 §3.8): a degenerate SignedData with an empty signerInfos and no eContent that conveys certificates and CRLs without signing anything, `parseCertsOnly(input, opts?)` reads one back to its raw certificate and CRL DER (a CRL-only message is valid here, unlike the cert-required RFC 5272 form that `pki.est.parseCertsOnly` reads), and `isCertsOnly(input)` recognizes one structurally. Fail-closed with typed `cms/*` errors — `sign`, `verify`, `countersign`, `encrypt`, `authenticate`, `decrypt`, `compress`, `decompress`, `certsOnly`, `parseCertsOnly`, `isCertsOnly` |
+| `pki.cms` | CMS signing, verification, encryption, and compression (RFC 5652). `sign(content, signers, opts)` produces a SignedData (§5), attached or detached, with one or many signers over RSA, RSASSA-PSS, ECDSA, EdDSA, the post-quantum ML-DSA-44/65/87 (RFC 9882) and SLH-DSA (all twelve FIPS 205 sets, RFC 9814), and composite ML-DSA pairing ML-DSA with a traditional RSA, ECDSA, or EdDSA key (accepted only when both components verify, draft-ietf-lamps-cms-composite-sigs). It builds the signed attributes (content-type, message-digest, signing-time) as canonical DER, signs the exact §5.4 preimage, and emits a DER `Buffer` or PEM. The content may also be an async iterable of byte chunks, which signs a large detached payload without holding it in memory: the payload is hashed incrementally under every signer's digest algorithm in one pass, and `verify` accepts the same streamed form as its `content` option. A signer may also be key-only — `{ key, spki, keyIdentifier }` with no certificate — which RFC 5272 §3.2 requires when a Full PKI Request's signer is the key of a certification request that request carries: the signer identifier takes the subjectKeyIdentifier form carrying the identifier the request declares, the signature scheme resolves from the request's own public key, and no certificate is embedded. `verify(input, opts)` parses a SignedData over the strict `pki.schema.cms` codec, locates each SignerInfo's signer certificate by its issuerAndSerialNumber or subjectKeyIdentifier, and checks the signature over the exact §5.4 preimage: with signed attributes present it confirms the message-digest attribute equals the content digest and verifies over the DER re-encoding of the SignedAttributes (the on-wire `[0]` tag replaced by a universal SET OF), and otherwise directly over the content. It returns a per-signer verdict with the matched signer certificate. `valid` and `trusted` are separate claims and neither implies the other: a SignedData carries its own certificates, so `valid` says the signature is sound under one of them and nothing about who signed, while `trusted` says every signer chained to a root named in `opts.trustAnchors`, validated through the same RFC 5280 path engine `pki.path.validate` uses. Without anchors there is nothing to chain to and `trusted` is `false`; anchors that cannot be read throw, rather than reading as untrusted. An unrecognized option is refused rather than ignored. `countersign(cms, signers, opts)` adds a countersignature (§11.4) — a `SignerInfo` over the countersigned SignerInfo's signature value, any signer algorithm, nestable, with the primary bytes preserved so it still verifies — attached as the id-countersignature unsigned attribute; `verify` returns each countersignature's verdict under `signers[i].countersignatures` and every unsigned attribute — including an RFC 3161 timestamp token, attachable via `sign`'s `unsignedAttributes` — under `signers[i].unsignedAttrs`, surfaced unauthenticated. `encrypt(content, recipients, opts)` produces an EnvelopedData, AuthEnvelopedData (AES-GCM, the authenticated default), or EncryptedData, with recipients auto-dispatched off the certificate key to key transport (RSAES-OAEP; v1.5 is never emitted), key agreement (ephemeral-static ECDH over P-256/384/521 with the X9.63 KDF, and X25519/X448 with HKDF), symmetric key wrap, password (PBKDF2 with RFC 3211 PWRI-KEK), or the post-quantum ML-KEM (and composite ML-KEM, draft-lamps-pq-composite-kem) KEMRecipientInfo (RFC 9629/9936), wrapping one fresh content key for every recipient. The content may also be an async iterable of byte chunks, streamed through the AES-GCM or AES-CBC content cipher so a large plaintext is encrypted without being buffered whole; the ciphertext is assembled before the definite-length encryptedContent is emitted, byte-for-byte the buffered form. `decrypt(input, keyMaterial, opts)` recovers the content through the matching arm and returns it with an `authenticated` flag; every secret-dependent failure collapses to one uniform `cms/decrypt-failed` verdict (Bleichenbacher, EFAIL, and password-oracle freedom), and PKCS#1 v1.5 is decrypt-only under the RFC 3218 implicit-rejection countermeasure. With `opts.stream: true` the recovered `content` is an async iterable of plaintext chunks instead of a single Buffer, for a payload too large to hold whole; the authenticated modes (AuthEnvelopedData, AuthenticatedData, AES-GCM) verify integrity before the iterable yields, so a forged message throws before any plaintext is exposed, while a CBC EnvelopedData or EncryptedData yields the plaintext as the cipher produces it. Every key-establishment secret the toolkit allocates is wiped once used, on the failing path as well as the succeeding one: the KEM shared secret and its derived key-encryption key, the raw ECDH / X25519 / X448 agreement secret, a password-derived key-encryption key, and the content-encryption key itself, cleared once the message is complete since all recipients share it. Caller-supplied key material is never written to (best-effort; NIST SP 800-227 §4.2, RFC 9629 §7). `authenticate(content, recipients, opts)` produces an `id-ct-authData` (§9): cleartext content plus an HMAC-SHA-256/384/512 MAC, authenticated but not encrypted, with the fresh MAC key wrapped for every recipient through the same RecipientInfo model. The MAC covers the authenticated attributes (content-type and message-digest) re-tagged to the EXPLICIT SET OF (§9.2), or the content octets directly; `decrypt` recovers the MAC key, recomputes the MAC and independently the message-digest (§9.3), and releases the content only after both pass, with every secret-dependent failure collapsing to the uniform `cms/decrypt-failed`. `compress(content, opts)` and `decompress(input, opts)` produce and consume a CompressedData (RFC 3274; ZLIB, version 0, id-alg-zlibCompress); decompress bounds the uncompressed output at 16 MiB and stops before it is materialized, so a decompression bomb fails closed as `cms/decompress-too-large`. Compression is a size transform with no integrity or confidentiality (RFC 8551 §2.4.5). `certsOnly(certs, opts?)` builds a certs-only certificate-management message (RFC 8551 §3.8): a degenerate SignedData with an empty signerInfos and no eContent that conveys certificates and CRLs without signing anything, `parseCertsOnly(input, opts?)` reads one back to its raw certificate and CRL DER (a CRL-only message is valid here, unlike the cert-required RFC 5272 form that `pki.est.parseCertsOnly` reads), and `isCertsOnly(input)` recognizes one structurally. Fail-closed with typed `cms/*` errors — `sign`, `verify`, `countersign`, `encrypt`, `authenticate`, `decrypt`, `compress`, `decompress`, `certsOnly`, `parseCertsOnly`, `isCertsOnly` |
 | `pki.smime` | S/MIME message assembly, verification, encryption, and compression over the CMS layer (RFC 8551). `sign(content, signers, opts)` wraps a MIME entity in either form: `multipart/signed`, where the content stays readable in any MUA and a detached CMS SignedData rides alongside as `application/pkcs7-signature` with a matching `micalg`, or `application/pkcs7-mime; smime-type=signed-data`, where the whole entity is a base64 CMS SignedData. The signed bytes are the entity's §3.1.1 canonical form with CRLF line endings, and `verify(message, opts)` unwraps both forms and recomputes over the same canonicalizer, so a transport that re-wraps line endings still verifies while a tampered part fails. `encrypt(content, recipients, opts)` envelopes a MIME entity as an opaque `application/pkcs7-mime` message and `decrypt(message, keyMaterial, opts)` opens one, as `smime-type=authEnveloped-data` (AES-GCM, confidentiality and integrity, the default) or `smime-type=enveloped-data` (AES-CBC, confidentiality only, so `decrypt` reports `authenticated: false`, the §3.3 no-integrity caveat). The `smime-type` is derived from the CMS body rather than the header, and decryption is fail-closed and oracle-free. The crypto is entirely `pki.cms.sign` / `verify` / `encrypt` / `decrypt`, so it is algorithm-agnostic: any RSA / RSASSA-PSS / ECDSA / EdDSA / ML-DSA / SLH-DSA signer and any RSA-OAEP / ECDH / X25519 / X448 / AES-KW / PBKDF2 / ML-KEM recipient carries through. As with `cms.verify`, `verify` returns the per-signer verdict plus the recovered content, and `valid` and `trusted` are separate claims: `valid` says the signature is sound under a certificate the message carried, `trusted` says every signer chained to a root named in `opts.trustAnchors`. Anchoring here is validated for email at both ends of the chain — the signer certificate must carry `emailProtection` (RFC 8551 §4.4.4) and the anchor's own trust metadata must permit that purpose, since a root can be distrusted for email while remaining a good TLS root. Override either with `requiredEku` / `checkPurpose`. `compress(content, opts)` and `decompress(message, opts)` add the opaque `application/pkcs7-mime; smime-type=compressed-data; name=smime.p7z` frame (§3.6, RFC 3274), a size transform with no integrity or confidentiality (§2.4.5), bounded against a bomb; the recovered content, which may itself be signed or enveloped, is returned for the caller to re-verify. Header protection (RFC 9788): `sign` and `encrypt` take `opts.protectHeaders`, which inlines the caller's `opts.headers` on the Cryptographic Payload root (its Content-Type gaining `hp="clear"` when signed or `hp="cipher"` when encrypted) so the CMS signature or encryption covers them, defeating a transport that rewrites or reads Subject, From, and the rest. `verify` and `decrypt` surface the authenticated inner set as `protectedHeaders` plus `headerProtection { present, mode, fromMismatch, confidential, legacy }`, so a tampered outer header cannot alter it and `fromMismatch` flags an outer From that disagrees. Encryption applies a Header Confidentiality Policy: the default `hcp_baseline` obscures the outer Subject to `[...]` and removes Comments and Keywords, so the real values live only in the ciphertext, and `decrypt` recovers them. Every emitted header routes through a fail-closed injection guard that rejects a CR, LF, or NUL value and a non-ftext name, and a malformed or contradictory `hp` wrap fails closed as `smime/bad-header-protection` rather than silently downgrading. The CMS crypto is unchanged. Inbound legacy RFC 8551 header protection is recognized opt-in: `verify` and `decrypt` with `opts.legacyHeaderProtection` detect a legacy `message/rfc822`-wrapped payload by the RFC 9788 §4.10.1 four-condition identification and surface the inner headers under `headerProtection.legacy = { headers, mode, fromMismatch, confidential }`, where `headers` is an ordered `[{ name, value }]` array retaining legally repeated fields such as `Received`. Those never appear in `protectedHeaders` and never set `present: true`. Because a legacy message is structurally indistinguishable from an ordinary forwarded `message/rfc822`, this is an explicit heuristic (§4.10.2, "no strong end-to-end guarantees"): a caller keying trust off `present` or `protectedHeaders` is never misled, and only one that explicitly reads `headerProtection.legacy.headers` and cross-checks `legacy.fromMismatch` consumes it. It is off by default, and a nested crypto layer, an inner `hp=`, a non-`message/rfc822` payload, or a duplicate Content-Type reports `legacy: null`. Bidirectionally interoperable with `openssl smime` and `openssl cms`. `buildCertsOnly(certs, opts?)` wraps a `pki.cms.certsOnly` certificate-management message in one `application/pkcs7-mime; smime-type=certs-only; name=smime.p7c` entity, read back by OpenSSL's `pkcs7 -print_certs`. Fail-closed with typed `smime/*` errors — `sign`, `verify`, `encrypt`, `decrypt`, `compress`, `decompress`, `buildCertsOnly` |
 | `pki.tsp` | Time-Stamp Protocol (RFC 3161). `sign(messageImprint, tsa, opts)` produces a TimeStampToken: a CMS SignedData over `pki.cms.sign` whose content is a `TSTInfo` carrying the timestamped message imprint, the TSA policy, a serial number, and `genTime` with optional accuracy, nonce, and ordering, plus the §2.4.2 signing-certificate attribute binding the token to the TSA certificate (SHA-2 imprints, any `pki.cms.sign` TSA key). `request` and `parseRequest` build and parse the TimeStampReq a client sends (imprint, requested policy, nonce, certReq); `response` and `parseResponse` handle the TimeStampResp a TSA returns, either a granted status wrapping a token or a rejection with PKIStatus and failure info, with the §2.4.2 status-to-token coupling enforced in both directions. `verify(token, data, opts)` verifies a token fail-closed: the CMS signature over the exact signed bytes, the message imprint recomputed from the data, the TSTInfo content type, the ESSCertID(V2) binding to the TSA certificate, the §2.3 critical timeStamping-only extendedKeyUsage, the request nonce when used, and, with a trust anchor supplied, full certification-path validation of the TSA certificate at the token's `genTime` — judged under the `timeStamping` purpose, so an anchor's own per-purpose trust metadata reaches the decision rather than sitting inert. It returns `{ valid, trusted, genTime, serialNumber, tstInfo, ... }`, where `trusted` is the separate claim that the authority chained to an anchor you named: without one there is nothing to chain to and it is `false`, which is the distinction a timestamp re-read years later turns on — `sign`, `request`, `parseRequest`, `response`, `parseResponse`, `verify` |
 | `pki.ocsp` | Online Certificate Status Protocol (RFC 6960), both the responder and relying-party surface. `buildRequest(query, opts)` builds an OCSPRequest for one or more `{ cert, issuer }` pairs, with the CertID hashed under SHA-1 by default per the RFC 5019 lightweight profile or under SHA-2, plus an optional RFC 9654 nonce and an optional requestor signature. `sign(responseData, responder, opts)` produces a signed BasicOCSPResponse over the exact `ResponseData` DER, from the issuing CA directly or a delegated responder, under any `pki.cms.sign` key including the post-quantum ML-DSA and SLH-DSA sets, with `good`, `revoked` (reason and time), or `unknown` per-certificate status. `buildErrorResponse(status)` produces the unsigned §2.3 error (`tryLater`, `unauthorized`, and the rest). `verify(response, opts)` verifies a response fail-closed against the same hardened gates `pki.path.ocspChecker` runs: the CertID binding, responder authorization (the issuing CA, or a CA-issued delegate bearing id-kp-OCSPSigning and id-pkix-ocsp-nocheck and passing the full out-of-path certificate gates), the signature over `tbsResponseDataBytes`, currency against `thisUpdate` and `nextUpdate`, and the request-nonce echo. It returns `{ status: "good" / "revoked" / "unknown", ... }` and never silently accepts. `verifyRequest(request, opts)` is the responder-side inverse of `buildRequest`: it verifies a client's signed request (RFC 6960 §4.1.1) under the requestor certificate the request carries, trying each embedded certificate since the field is unordered, and reports `signed`, `signatureValid`, every certificate whose key verified (`signerCerts`, so a key carried under an expired certificate beside its renewal is not hidden behind ordering) with the first one's decoded subject, the full embedded certificate bag (`certs`, including intermediates for path building), and the request's CertIDs; an unsigned request is reported with `signed: false` rather than refused. Transport-free — `buildRequest`, `sign`, `buildErrorResponse`, `verify`, `verifyRequest` |

package/index.js

@@ -160,7 +160,7 @@ module.exports = {
   // `kem` is composite ML-KEM key establishment (draft-ietf-lamps-pq-composite-kem):
   // pki.kem.encapsulate / decapsulate over a post-quantum ML-KEM hybridized with a
   // traditional RSA-OAEP / ECDH / X25519 / X448, mixed through the SHA3-256 combiner.
-  kem:       compositeKem,
+  kem:       { encapsulate: compositeKem.encapsulate, decapsulate: compositeKem.decapsulate },
   // `sigstore` verifies a Sigstore bundle (the npm --provenance artifact): a
   // keyless Fulcio signature over a DSSE-wrapped in-toto SLSA attestation with a
   // Rekor inclusion proof -- offline, zero-dep, against caller-pinned trust.
@@ -171,7 +171,7 @@ module.exports = {
   // splitter, certs-only + serverkeygen validators over CMS, the enroll-attribute
   // builders, the HTTP response classifier). est opens no socket; fail-closed.
   est:       est,
-  scep:      { build: scep.build, parse: scep.parse, getCACaps: scep.getCACaps, getCACert: scep.getCACert, getNextCACert: scep.getNextCACert, enroll: scep.enroll, renew: scep.renew, parseCapabilities: scep.parseCapabilities },
+  scep:      { build: scep.build, parse: scep.parse, getCACaps: scep.getCACaps, getCACert: scep.getCACert, getNextCACert: scep.getNextCACert, enroll: scep.enroll, renew: scep.renew, getCert: scep.getCert, getCrl: scep.getCrl, parseCapabilities: scep.parseCapabilities },
   // `transport` is the shared fail-closed node:https transport the enrollment clients
   // drive -- pki.transport.https(defaults) returns a transport(request) -> {status,
   // headers, body}. The toolkit's sole socket choke point: explicit trust anchors,

package/lib/cms-decrypt.js

@@ -15,6 +15,7 @@ var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
 var pbes2 = require("./pbes2");
+var compositeKem = require("./composite-kem");
 var C = require("./constants");
 var b = asn1.build;
 var subtle = webcrypto.webcrypto.subtle;
@@ -268,8 +269,9 @@ async function _pwriCek(ri, km, opts) {
 
 async function _kemriCek(ri, km) {
   var k = ri.kemri;
-  var wcName = _mlkemName(k.kem.oid);
-  if (!wcName) throw _err("cms/unsupported-algorithm", "unsupported KEM " + k.kem.oid);
+  var isComposite = compositeKem.isCompositeKem(k.kem.oid);
+  var wcName = isComposite ? null : _mlkemName(k.kem.oid);
+  if (!isComposite && !wcName) throw _err("cms/unsupported-algorithm", "unsupported KEM " + k.kem.oid);
   if (k.kdf.oid !== O("hkdfWithSha256")) throw _err("cms/unsupported-algorithm", "unsupported KEM key-derivation " + k.kdf.oid);
   var wantCt = KEM_CT_LENGTHS[k.kem.oid];
   var kemct = k.kemct;
@@ -277,14 +279,22 @@ async function _kemriCek(ri, km) {
   var kekBytes = Number(k.kekLength);
   var wrapAlg = k.wrap;
   if (WRAP_KEK_LENGTHS[wrapAlg.oid] !== kekBytes) throw _fail();
-  var keyCopy = _normKeyDer(km.key);
-  var priv;
-  try { priv = await subtle.importKey("pkcs8", keyCopy.der, { name: wcName }, false, ["decapsulateBits"]); }
-  finally { _releaseKeyDer(keyCopy); }
   var ss = null, kek = null, ssAb = null, kekAb = null;
   try {
-    ssAb = await subtle.decapsulateBits({ name: wcName }, priv, kemct);
-    ss = Buffer.from(ssAb);
+    if (isComposite) {
+      var ckey = _normKeyDer(km.key);
+      try {
+        if (pkcs8.parse(ckey.der).privateKeyAlgorithm.oid !== k.kem.oid) throw _fail();
+        ss = await compositeKem.decapsulate(ckey.der, kemct);
+      } finally { _releaseKeyDer(ckey); }
+    } else {
+      var keyCopy = _normKeyDer(km.key);
+      var priv;
+      try { priv = await subtle.importKey("pkcs8", keyCopy.der, { name: wcName }, false, ["decapsulateBits"]); }
+      finally { _releaseKeyDer(keyCopy); }
+      ssAb = await subtle.decapsulateBits({ name: wcName }, priv, kemct);
+      ss = Buffer.from(ssAb);
+    }
     var ssKey = await subtle.importKey("raw", ss, { name: "HKDF" }, false, ["deriveBits"]);
     kekAb = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt: Buffer.alloc(0), info: _kemOtherInfo(wrapAlg.name, kekBytes, k.ukm || null) }, ssKey, kekBytes * 8);
     kek = Buffer.from(kekAb);

package/lib/cms-encrypt.js

@@ -15,6 +15,7 @@ var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
 var pbes2 = require("./pbes2");
+var compositeKem = require("./composite-kem");
 var b = asn1.build;
 var subtle = webcrypto.webcrypto.subtle;
 var pkix = require("./schema-pkix");
@@ -212,17 +213,26 @@ function _kemOtherInfo(wrapName, kekBytes, ukm) {
   if (ukm) kids.push(b.explicit(0, b.octetString(ukm)));
   return b.sequence(kids);
 }
+async function _kemEncapsulate(keyOid, cert) {
+  if (KEM_WC[keyOid]) {
+    var pub = await subtle.importKey("spki", cert.subjectPublicKeyInfo.bytes, { name: KEM_WC[keyOid] }, false, ["encapsulateBits"]);
+    var kem = await subtle.encapsulateBits({ name: KEM_WC[keyOid] }, pub);
+    return { ss: Buffer.from(kem.sharedKey), kemct: Buffer.from(kem.ciphertext), wrapName: KEM_WRAP[keyOid], raw: kem.sharedKey };
+  }
+  if (compositeKem.isCompositeKem(keyOid)) {
+    var out = await compositeKem.encapsulate(cert.subjectPublicKeyInfo.bytes);
+    return { ss: out.sharedSecret, kemct: out.ciphertext, wrapName: "aes256-wrap", raw: null };
+  }
+  throw _err("cms/unsupported-algorithm", "unsupported KEM recipient key algorithm");
+}
 async function _buildKemri(cek, cert, opts) {
   _assertKeyUsage(cert, "keyEncipherment", "kemri");
   var keyOid = cert.subjectPublicKeyInfo.algorithm.oid;
-  var wcName = KEM_WC[keyOid];
-  if (!wcName) throw _err("cms/unsupported-algorithm", "unsupported KEM recipient key algorithm");
-  var wrapName = KEM_WRAP[keyOid];
-  var kekBytes = WRAP_KEK_LENGTHS[O(wrapName)];
   var ukm = opts.ukm ? guard.bytes.view(opts.ukm, CmsError, "cms/bad-input", "ukm") : null;
-  var pub = await subtle.importKey("spki", cert.subjectPublicKeyInfo.bytes, { name: wcName }, false, ["encapsulateBits"]);
-  var kem = await subtle.encapsulateBits({ name: wcName }, pub);
-  var ss = Buffer.from(kem.sharedKey), kemct = Buffer.from(kem.ciphertext);
+  var enc = await _kemEncapsulate(keyOid, cert);
+  var wrapName = enc.wrapName;
+  var kekBytes = WRAP_KEK_LENGTHS[O(wrapName)];
+  var ss = enc.ss, kemct = enc.kemct;
   var kek = null, kekAb = null;
   try {
     var ssKey = await subtle.importKey("raw", ss, { name: "HKDF" }, false, ["deriveBits"]);
@@ -236,7 +246,7 @@ async function _buildKemri(cek, cert, opts) {
     var kemri = b.sequence(kemriKids);
     return { tag: 4, node: b.sequence([b.oid(O("kem")), kemri]) };
   } finally {
-    guard.secret.zeroizeAll([ss, kek, kem.sharedKey ? new Uint8Array(kem.sharedKey) : null, kekAb ? new Uint8Array(kekAb) : null],
+    guard.secret.zeroizeAll([ss, kek, enc.raw ? new Uint8Array(enc.raw) : null, kekAb ? new Uint8Array(kekAb) : null],
       CmsError, "cms/bad-input", "the KEM shared secret");
   }
 }
@@ -316,7 +326,7 @@ async function _buildRecipient(cek, desc, opts, consumed) {
       _assertRecipientKeys(desc, _AGREE_RECIPIENT_KEYS, "key-agreement certificate");
       return _buildKari(cek, cert, mergeOpts(opts, desc, _AGREE_RECIPIENT_KEYS, consumed));
     }
-    if (KEM_WC[keyOid]) {
+    if (KEM_WC[keyOid] || compositeKem.isCompositeKem(keyOid)) {
       _assertRecipientKeys(desc, _AGREE_RECIPIENT_KEYS, "KEM certificate");
       return _buildKemri(cek, cert, mergeOpts(opts, desc, _AGREE_RECIPIENT_KEYS, consumed));
     }

package/lib/cms-verify.js

@@ -787,7 +787,9 @@ var countersign = cmsSign.countersign;
  * recipient certificate's public-key algorithm -- RSA yields a ktri with RSAES-OAEP-SHA256 (PKCS#1
  * v1.5 is never emitted); EC P-256/384/521 a kari with ephemeral-static ECDH and the X9.63 KDF;
  * X25519/X448 a kari per RFC 8418 (HKDF); ML-KEM-512/768/1024 an ori/KEMRecipientInfo per RFC
- * 9629 + 9936. `{ password }` yields a pwri (PBKDF2 + RFC 3211 PWRI-KEK); `{ kek, kekId }` a kekri
+ * 9629 + 9936; a composite ML-KEM (id-MLKEM768-* / id-MLKEM1024-*, draft-lamps-pq-composite-kem) the
+ * same ori/KEMRecipientInfo with the composite as the kem algorithm and AES-256-Wrap. `{ password }`
+ * yields a pwri (PBKDF2 + RFC 3211 PWRI-KEK); `{ kek, kekId }` a kekri
  * (AES key wrap). For EncryptedData (no RecipientInfos), pass a single non-array `{ cek }` or
  * `{ password }` descriptor. The default AES-256-GCM content encryption produces an
  * authenticated AuthEnvelopedData; a CBC choice produces an unauthenticated EnvelopedData.
@@ -829,7 +831,7 @@ var encrypt = cmsEncrypt.encrypt;
  * authenticated but not encrypted, the authenticated-only sibling of AuthEnvelopedData. A single
  * fresh MAC key is minted and wrapped for every recipient with the same RecipientInfo model
  * `pki.cms.encrypt` uses for a content-encryption key, so `recipients` is the identical array of
- * descriptors: `{ cert }` (RSA -> ktri RSAES-OAEP, EC/X25519/X448 -> kari, ML-KEM -> ori/KEMRI),
+ * descriptors: `{ cert }` (RSA -> ktri RSAES-OAEP, EC/X25519/X448 -> kari, ML-KEM or composite ML-KEM -> ori/KEMRI),
  * `{ password }` (pwri), or `{ kek, kekId }` (kekri). By default the MAC covers the authenticated
  * attributes (a content-type and a message-digest = digest of the content) re-tagged to the EXPLICIT
  * SET OF (RFC 5652 sec. 9.2); with `authenticatedAttributes: false` (id-data content only) it covers
@@ -870,7 +872,7 @@ var authenticate = cmsEncrypt.authenticate;
  * Decrypt a CMS EnvelopedData / AuthEnvelopedData / EncryptedData, or verify a CMS AuthenticatedData
  * (DER Buffer or PEM). It selects the recipient the key material targets, acquires the
  * content-encryption or MAC key through the matching arm (ktri OAEP or PKCS#1 v1.5 decrypt-only; kari
- * ECDH / X25519 / X448; kekri; pwri; ori/ML-KEM), and decrypts (or MAC-verifies) the content.
+ * ECDH / X25519 / X448; kekri; pwri; ori/ML-KEM or composite ML-KEM), and decrypts (or MAC-verifies) the content.
  * `keyMaterial` is `{ key, cert }` (the recipient private key + its certificate, which drives recipient
  * matching), `{ password }`, `{ kek, kekId? }`, or `{ cek }` (EncryptedData raw-key mode). Fail-closed
  * and oracle-free: every secret-dependent failure collapses to the SINGLE uniform

package/lib/composite-kem.js

@@ -307,7 +307,10 @@ async function _encapsulate(publicKey) {
   return { sharedSecret: ss, ciphertext: Buffer.concat([r[0].ct, r[1].ct]) };
 }
 
+function _isCompositeKem(algOid) { return COMPOSITE_KEM[algOid] != null; }
+
 module.exports = {
   encapsulate: _encapsulate,
   decapsulate: _decapsulate,
+  isCompositeKem: _isCompositeKem,
 };

package/lib/scep.js

@@ -16,7 +16,8 @@
  *   outer SignedData that signs it under a set of authenticated transaction
  *   attributes -- messageType, transactionID, pkiStatus, failInfo, and the
  *   sender/recipient nonces (RFC 8894 sec. 3). `pki.scep.build` assembles a
- *   request pkiMessage (PKCSReq / RenewalReq); `pki.scep.parse` verifies the
+ *   request pkiMessage (PKCSReq, RenewalReq, CertPoll, GetCert, or GetCRL);
+ *   `pki.scep.parse` verifies the
  *   outer signature, reads the transaction attributes BOUND to the verified
  *   signer, and (given the recipient key) decrypts the pkcsPKIEnvelope to the
  *   messageData.
@@ -28,10 +29,10 @@
  *   pki.transport separately.
  *
  * @card
- *   Build and read SCEP (RFC 8894) enrollment messages: a PKCSReq / RenewalReq
- *   request wrapped in the signed-over-encrypted CMS layering, and a PKCSReq,
- *   RenewalReq, or CertRep parsed back to its verified transaction attributes and
- *   decrypted messageData.
+ *   Build and read SCEP (RFC 8894) client messages: a PKCSReq, RenewalReq,
+ *   CertPoll, GetCert, or GetCRL request wrapped in the signed-over-encrypted CMS
+ *   layering, and any of those or a CertRep parsed back to its verified transaction
+ *   attributes and decrypted messageData.
  */
 
 var frameworkError = require("./framework-error");
@@ -50,6 +51,7 @@ var schemaCsr = require("./schema-csr");
 var schemaX509 = require("./schema-x509");
 var schemaCrl = require("./schema-crl");
 var pkix = require("./schema-pkix");
+var schema = require("./schema-engine");
 var guard = require("./guard-all");
 var C = require("./constants");
 var httpTransport = require("./http-transport");
@@ -68,7 +70,7 @@ var FAIL_INFO = { badAlg: "0", badMessageCheck: "1", badRequest: "2", badTime: "
 function _invert(table) { var o = Object.create(null); for (var k in table) if (Object.prototype.hasOwnProperty.call(table, k)) o[table[k]] = k; return o; }
 var MESSAGE_TYPE_BY_CODE = _invert(MESSAGE_TYPE), PKI_STATUS_BY_CODE = _invert(PKI_STATUS), FAIL_INFO_BY_CODE = _invert(FAIL_INFO);
 
-var _PARSE_SUPPORTED = { PKCSReq: 1, RenewalReq: 1, CertRep: 1, CertPoll: 1 };
+var _PARSE_SUPPORTED = { PKCSReq: 1, RenewalReq: 1, CertRep: 1, CertPoll: 1, GetCert: 1, GetCRL: 1 };
 
 var ENVELOPE_CIPHER = "aes-128-cbc";
 
@@ -209,7 +211,10 @@ function _captureRecipientKey(rk) {
  * Assemble a SCEP pkiMessage (RFC 8894 sec. 3). A request (`PKCSReq` / `RenewalReq`) encrypts the
  * supplied PKCS#10 `messageData` to the recipient CA certificate as the inner EnvelopedData
  * (`pkcsPKIEnvelope`, AES-128-CBC), then signs it under the transaction attributes with the caller's
- * signer certificate and key. `transactionId` is a caller-unique PrintableString; `senderNonce` is a
+ * signer certificate and key. A `CertPoll` (GetCertInitial) query wraps an IssuerAndSubject that names
+ * the issuing CA and the request subject; a `GetCert` or `GetCRL` query wraps an IssuerAndSerialNumber
+ * that names a certificate by its issuer and serial. Every form is enveloped and signed the same way.
+ * `transactionId` is a caller-unique PrintableString; `senderNonce` is a
  * 16-byte value (a fresh random one is generated when omitted). The recipient CA certificate must
  * assert the `keyEncipherment` key usage (the EnvelopedData uses RSA key transport). The content key
  * is transported under RSAES-OAEP (SHA-256), the toolkit's key-transport algorithm; the legacy
@@ -221,8 +226,11 @@ function _captureRecipientKey(rk) {
  * match. The proof-of-possession over the PKCS#10 itself is verified regardless.
  *
  * @opts
- *   - `messageType` -- "PKCSReq" | "RenewalReq" (this release's request set).
- *   - `messageData` -- the PKCS#10 CertificationRequest DER to enrol.
+ *   - `messageType` -- "PKCSReq" | "RenewalReq" | "CertPoll" | "GetCert" | "GetCRL".
+ *   - `messageData` -- the PKCS#10 CertificationRequest DER, for a PKCSReq or RenewalReq.
+ *   - `requestSubject` -- the request subject Name DER, for a CertPoll.
+ *   - `certificate` -- for a GetCert or GetCRL, the certificate DER whose issuer and serial name the target (the convenience form).
+ *   - `issuer` / `serialNumber` -- for a GetCert or GetCRL, the issuer Name DER and a positive serial (a BigInt, number, or hex string) naming the target directly. For a CertPoll, `issuer` alone names the issuing CA (defaulting to the recipient's subject) when the request is encrypted to a separate RA.
  *   - `recipient` -- the CA (or RA) certificate DER the messageData is encrypted to (an RSA key-transport certificate; a non-RSA recipient is refused, since the envelope uses RSAES-OAEP).
  *   - `signer` -- `{ cert, key }`, the outer SignedData signer (the client for a request).
  *   - `transactionId` -- a caller-unique PrintableString identifying the transaction.
@@ -241,8 +249,8 @@ async function build(spec) {
   guard.identifier.assertKnownKeys(spec, _BUILD_KEYS, _err, "scep/bad-input", "pki.scep.build has an unknown option: ");
   var mtCode = MESSAGE_TYPE[spec.messageType];
   if (mtCode == null) throw _err("scep/bad-message-type", "unknown messageType " + JSON.stringify(spec.messageType) + " (RFC 8894 sec. 3.2.1.2)");
-  if (spec.messageType !== "PKCSReq" && spec.messageType !== "RenewalReq" && spec.messageType !== "CertPoll") {
-    throw _err("scep/bad-message-type", "pki.scep.build issues a request (PKCSReq / RenewalReq / CertPoll); " + spec.messageType + " is not built in this release");
+  if (spec.messageType !== "PKCSReq" && spec.messageType !== "RenewalReq" && spec.messageType !== "CertPoll" && spec.messageType !== "GetCert" && spec.messageType !== "GetCRL") {
+    throw _err("scep/bad-message-type", "pki.scep.build issues a request (PKCSReq / RenewalReq / CertPoll / GetCert / GetCRL); " + spec.messageType + " is not built in this release");
   }
   if (spec.signer == null || typeof spec.signer !== "object") throw _err("scep/bad-input", "a signer { cert, key } is required");
   var senderNonce = _nonce(spec.senderNonce, "senderNonce");
@@ -255,6 +263,8 @@ async function build(spec) {
   var messageData;
   if (spec.messageType === "CertPoll") {
     messageData = _buildIssuerAndSubject(recipient, spec.requestSubject, spec.issuer);
+  } else if (spec.messageType === "GetCert" || spec.messageType === "GetCRL") {
+    messageData = _buildIssuerAndSerial(spec);
   } else {
     messageData = guard.bytes.snapshotSource(spec.messageData, ScepError, "scep/bad-input", "messageData");
     var parsedCsr;
@@ -283,7 +293,7 @@ async function build(spec) {
     throw e;
   }
 }
-var _BUILD_KEYS = { messageType: 1, messageData: 1, recipient: 1, requestSubject: 1, issuer: 1, signer: 1, transactionId: 1, senderNonce: 1 };
+var _BUILD_KEYS = { messageType: 1, messageData: 1, recipient: 1, requestSubject: 1, issuer: 1, certificate: 1, serialNumber: 1, signer: 1, transactionId: 1, senderNonce: 1 };
 
 function _buildIssuerAndSubject(recipientCertDer, requestSubjectSource, issuerOverride) {
   var subject = guard.bytes.snapshotSource(requestSubjectSource, ScepError, "scep/bad-input", "requestSubject");
@@ -298,12 +308,59 @@ function _buildIssuerAndSubject(recipientCertDer, requestSubjectSource, issuerOv
     if (e instanceof ScepError) throw e;
     throw _err("scep/bad-input", "the CertPoll IssuerAndSubject Names are not valid DER (RFC 8894 sec. 3.3.3): " + e.message, e);
   }
-  if (!pkix.rootSequenceChildren(issuerNode, 0) || !pkix.rootSequenceChildren(subjNode, 0)) {
-    throw _err("scep/bad-input", "the CertPoll issuer and requestSubject must each be a Name (a SEQUENCE) DER (RFC 8894 sec. 3.3.3)");
-  }
+  _assertNameNode(issuerNode, "scep/bad-input", "the CertPoll issuer must be an X.509 Name DER (RFC 8894 sec. 3.3.3)", true);
+  _assertNameNode(subjNode, "scep/bad-input", "the CertPoll requestSubject must be an X.509 Name DER (RFC 8894 sec. 3.3.3)");
   return b.sequence([issuer, subject]);
 }
 
+function _serialToInteger(s) {
+  var n;
+  if (typeof s === "bigint") n = s;
+  else if (typeof s === "number") { if (!Number.isSafeInteger(s)) throw _err("scep/bad-input", "serialNumber as a number must be a safe integer"); n = BigInt(s); }
+  else if (typeof s === "string" && s.length > 0) {
+    var t = (s.slice(0, 2) === "0x" || s.slice(0, 2) === "0X") ? s.slice(2) : s;
+    try { n = BigInt("0x" + t); } catch (_e) { throw _err("scep/bad-input", "serialNumber must be a hex string, a non-negative safe integer, or a BigInt: " + JSON.stringify(s)); }
+  } else {
+    throw _err("scep/bad-input", "serialNumber must be a hex string, a non-negative safe integer, or a BigInt");
+  }
+  if (n <= 0n) throw _err("scep/bad-input", "serialNumber must be a positive integer (RFC 5280 sec. 4.1.2.2)");
+  return n;
+}
+
+function _assertNameNode(node, code, message, requireNonEmpty) {
+  var walked;
+  try { walked = schema.walk(pkix.name(_KU_NS), node, _KU_NS); }
+  catch (e) {
+    throw _err(code, message + " (RFC 5280 sec. 4.1.2.4): " + e.message, e);
+  }
+  if (requireNonEmpty && !walked.result.rdns.length) {
+    throw _err(code, message + ": a distinguished name naming a certificate issuer must be non-empty (RFC 5280 sec. 4.1.2.4)");
+  }
+}
+
+function _buildIssuerAndSerial(spec) {
+  var hasCert = spec.certificate != null;
+  var hasExplicit = spec.issuer != null || spec.serialNumber != null;
+  if (hasCert === hasExplicit) throw _err("scep/bad-input", "a GetCert / GetCRL query needs exactly one of { certificate } or { issuer, serialNumber } (RFC 8894 sec. 3.3.4)");
+  var issuer, serial;
+  if (hasCert) {
+    var cert = guard.bytes.snapshotSource(spec.certificate, ScepError, "scep/bad-input", "certificate");
+    try { var w = schemaX509.parse(cert); issuer = w.issuer.bytes; serial = w.serialNumber; }
+    catch (e) { throw _err("scep/bad-input", "certificate is not a parseable X.509 certificate (RFC 8894 sec. 3.3.4): " + e.message, e); }
+  } else {
+    if (spec.issuer == null || spec.serialNumber == null) throw _err("scep/bad-input", "the explicit form of a GetCert / GetCRL query needs both issuer and serialNumber (RFC 8894 sec. 3.3.4)");
+    serial = _serialToInteger(spec.serialNumber);
+    issuer = guard.bytes.snapshotSource(spec.issuer, ScepError, "scep/bad-input", "issuer");
+    var node;
+    try { node = asn1.decode(issuer); } catch (e) { throw _err("scep/bad-input", "issuer is not a valid Name DER (RFC 8894 sec. 3.3.4): " + e.message, e); }
+    _assertNameNode(node, "scep/bad-input", "issuer must be an X.509 Name DER (RFC 8894 sec. 3.3.4)", true);
+  }
+  if (serial <= 0n) throw _err("scep/bad-input", "the query serialNumber must be a positive integer; a certificate with a non-positive serial cannot be named in a conforming query (RFC 5280 sec. 4.1.2.2)");
+  var serialTlv = b.integer(serial);
+  if (asn1.decode(serialTlv).content.length > 20) throw _err("scep/bad-input", "the query serialNumber must not exceed 20 octets (RFC 5280 sec. 4.1.2.2)");
+  return b.sequence([issuer, serialTlv]);
+}
+
 /**
  * @primitive  pki.scep.parse
  * @signature  pki.scep.parse(bytes, opts?) -> Promise<verdict>
@@ -315,8 +372,8 @@ function _buildIssuerAndSubject(recipientCertDer, requestSubjectSource, issuerOv
  * Disassemble a SCEP pkiMessage (RFC 8894 sec. 3): verify the outer SignedData signature, read the
  * transaction attributes BOUND to the verified signer (never from a separate untrusted parse), and,
  * given the recipient key, decrypt the pkcsPKIEnvelope to recover the messageData. It reads the
- * enrollment message types PKCSReq, RenewalReq, CertRep, and CertPoll; the GetCert and GetCRL client
- * queries a CA processes are refused (`scep/unsupported-message-type`). The verdict is
+ * message types PKCSReq, RenewalReq, CertRep, CertPoll, GetCert, and GetCRL; a messageType the RFC 8894
+ * registry does not define is refused (`scep/bad-message-type`). The verdict is
  * `{ signatureValid, signerAuthenticated, signerCert, messageType, transactionId, senderNonce,
  * recipientNonce, pkiStatus, failInfo, failInfoText, messageData, certificates, crls }` (fields null
  * when the message does not carry them). For a decrypted SUCCESS CertRep, `certificates` and `crls`
@@ -449,9 +506,21 @@ async function parse(bytes, opts) {
       try { ias = asn1.decode(dec.content); }
       catch (e) { throw _err("scep/bad-request-payload", "a CertPoll messageData must be an IssuerAndSubject (RFC 8894 sec. 3.3.3)", e); }
       var iasCh = pkix.rootSequenceChildren(ias, 2, 2);
-      if (!iasCh || !pkix.rootSequenceChildren(iasCh[0], 0) || !pkix.rootSequenceChildren(iasCh[1], 0)) {
-        throw _err("scep/bad-request-payload", "a CertPoll messageData must be an IssuerAndSubject: a SEQUENCE of two Name values (RFC 8894 sec. 3.3.3)");
-      }
+      if (!iasCh) throw _err("scep/bad-request-payload", "a CertPoll messageData must be an IssuerAndSubject: a SEQUENCE of two Name values (RFC 8894 sec. 3.3.3)");
+      _assertNameNode(iasCh[0], "scep/bad-request-payload", "a CertPoll messageData issuer must be an X.509 Name (RFC 8894 sec. 3.3.3)", true);
+      _assertNameNode(iasCh[1], "scep/bad-request-payload", "a CertPoll messageData requestSubject must be an X.509 Name (RFC 8894 sec. 3.3.3)");
+    } else if (messageType === "GetCert" || messageType === "GetCRL") {
+      var isn;
+      try { isn = asn1.decode(dec.content); }
+      catch (e) { throw _err("scep/bad-request-payload", "a " + messageType + " messageData must be an IssuerAndSerialNumber (RFC 8894 sec. 3.3.4)", e); }
+      var isnCh = pkix.rootSequenceChildren(isn, 2, 2);
+      if (!isnCh) throw _err("scep/bad-request-payload", "a " + messageType + " messageData must be an IssuerAndSerialNumber: a SEQUENCE of a Name and an INTEGER (RFC 8894 sec. 3.3.4)");
+      _assertNameNode(isnCh[0], "scep/bad-request-payload", "a " + messageType + " messageData issuer must be an X.509 Name (RFC 8894 sec. 3.3.4)", true);
+      var isnSerial;
+      try { isnSerial = asn1.read.integer(isnCh[1]); }
+      catch (e) { throw _err("scep/bad-request-payload", "a " + messageType + " messageData serialNumber must be a DER INTEGER (RFC 8894 sec. 3.3.4)", e); }
+      if (isnSerial <= 0n) throw _err("scep/bad-request-payload", "a " + messageType + " messageData serialNumber must be a positive integer (RFC 5280 sec. 4.1.2.2)");
+      if (isnCh[1].content.length > 20) throw _err("scep/bad-request-payload", "a " + messageType + " messageData serialNumber must not exceed 20 octets (RFC 5280 sec. 4.1.2.2)");
     }
   }
   return out;
@@ -967,12 +1036,164 @@ function enroll(baseUrl, opts) { return _pkiOperation("PKCSReq", baseUrl, opts,
  */
 function renew(baseUrl, opts) { return _pkiOperation("RenewalReq", baseUrl, opts, "renew"); }
 
+function _dispatchQueryRep(rep, transactionId) {
+  if (rep.messageType !== "CertRep") throw _err("scep/unexpected-message-type", "the SCEP response is a " + rep.messageType + ", not a CertRep");
+  if (rep.transactionId !== transactionId) throw _err("scep/transaction-id-mismatch", "the CertRep transactionID does not match the request (RFC 8894 sec. 3.2.1.1)");
+  if (rep.pkiStatus === "FAILURE") {
+    var e = _err("scep/query-failed", "the CA refused the query with failInfo " + JSON.stringify(rep.failInfo) + (rep.failInfoText ? " (" + rep.failInfoText + ")" : ""));
+    e.failInfo = rep.failInfo;
+    e.failInfoText = rep.failInfoText;
+    throw e;
+  }
+  if (rep.pkiStatus === "PENDING") throw _err("scep/unexpected-pending", "a GetCert / GetCRL query cannot be answered PENDING; the CA grants or rejects it (RFC 8894 sec. 4.5.1)");
+}
+
+function _resolveQueryTarget(opts) {
+  var hasCert = opts.certificate != null;
+  var hasExplicit = opts.issuer != null || opts.serialNumber != null;
+  if (hasCert === hasExplicit) throw _err("scep/bad-input", "a GetCert / GetCRL query needs exactly one of { certificate } or { issuer, serialNumber } (RFC 8894 sec. 3.3.4)");
+  if (hasCert) {
+    var certDer = guard.bytes.snapshotSource(opts.certificate, ScepError, "scep/bad-input", "certificate");
+    var w;
+    try { w = schemaX509.parse(certDer); }
+    catch (e) { throw _err("scep/bad-input", "certificate is not a parseable X.509 certificate (RFC 8894 sec. 3.3.4): " + e.message, e); }
+    return { issuerRdns: w.issuer.rdns, serial: w.serialNumber, buildSpec: { certificate: certDer } };
+  }
+  if (opts.issuer == null || opts.serialNumber == null) throw _err("scep/bad-input", "the explicit form of a GetCert / GetCRL query needs both issuer and serialNumber (RFC 8894 sec. 3.3.4)");
+  var serial = _serialToInteger(opts.serialNumber);
+  var issuerDer = guard.bytes.snapshotSource(opts.issuer, ScepError, "scep/bad-input", "issuer");
+  var issuerRdns;
+  try { issuerRdns = schema.walk(pkix.name(_KU_NS), asn1.decode(issuerDer), _KU_NS).result.rdns; }
+  catch (e) { throw _err("scep/bad-input", "issuer is not a valid Name DER (RFC 8894 sec. 3.3.4): " + e.message, e); }
+  return { issuerRdns: issuerRdns, serial: serial, buildSpec: { issuer: issuerDer, serialNumber: opts.serialNumber } };
+}
+
+async function _queryOperation(messageType, baseUrl, opts, verbName) {
+  opts = guard.identifier.optionsObject(opts, _err, "scep/bad-input", "pki.scep." + verbName + " options");
+  guard.identifier.assertKnownKeys(opts, _QUERY_KEYS, _err, "scep/bad-input", "pki.scep." + verbName + " has an unknown option: ");
+  if (opts.caCert == null) throw _err("scep/bad-input", "a caCert (the SCEP CA certificate DER) is required");
+  if (opts.signer == null || typeof opts.signer !== "object") throw _err("scep/bad-input", "a signer { cert, key } is required");
+  if (opts.recipientKey == null || typeof opts.recipientKey !== "object") throw _err("scep/bad-input", "a recipientKey { cert, key } is required to decrypt the CA response");
+  var caCert = guard.bytes.snapshotSource(opts.caCert, ScepError, "scep/bad-input", "the caCert");
+  var signerCert = opts.responderCert != null ? guard.bytes.snapshotSource(opts.responderCert, ScepError, "scep/bad-input", "the responderCert") : caCert;
+  var recipientKey = _captureRecipientKey(opts.recipientKey);
+  var signer = { cert: guard.bytes.snapshotSource(opts.signer.cert, ScepError, "scep/bad-input", "signer.cert"), key: opts.signer.key };
+  var want = _resolveQueryTarget(opts);
+  var clientOpts = { transport: opts.transport, tls: opts.tls != null ? Object.assign({}, opts.tls) : opts.tls, maxRedirects: opts.maxRedirects, allowCrossOriginRedirect: opts.allowCrossOriginRedirect, timeout: opts.timeout, maxResponseBytes: opts.maxResponseBytes };
+  var senderNonce = nodeCrypto.randomBytes(16);
+  var transactionId = opts.transactionId != null ? opts.transactionId : _defaultTransactionId();
+  var reqMsg = await build(Object.assign({ messageType: messageType, recipient: caCert, signer: signer, transactionId: transactionId, senderNonce: senderNonce }, want.buildSpec));
+  var res = await _client("POST", _scepUrl(baseUrl, "PKIOperation"), reqMsg, { "content-type": CT_PKI_MESSAGE }, clientOpts);
+  var body = _requireOk(res, [CT_PKI_MESSAGE], "PKIOperation");
+  var rep = await parse(body, { signerCert: signerCert, expectedSenderNonce: senderNonce, recipientKey: recipientKey });
+  _dispatchQueryRep(rep, transactionId);
+  return { rep: rep, want: want, transactionId: transactionId };
+}
+
+/**
+ * @primitive  pki.scep.getCert
+ * @signature  pki.scep.getCert(baseUrl, opts) -> Promise<{ certificate, certificates, transactionId }>
+ * @since      0.6.17
+ * @status     stable
+ * @spec       RFC 8894
+ * @related    pki.scep.enroll, pki.scep.getCrl
+ *
+ * Retrieve an already-issued certificate over SCEP (RFC 8894 sec. 3.3.4): POST a GetCert query naming the
+ * certificate's issuer and serial number, and select it out of the CA's certs-only CertRep by canonical
+ * issuer-name and serial match. This is an OPTIONAL fallback: RFC 8894 sec. 3.3.4 advises a client to prefer
+ * an HTTP certificate store (RFC 4387) or LDAP and to use this only against a CA that offers no such access.
+ * The response is authenticated against the CA certificate and its recipientNonce must echo the request's
+ * fresh senderNonce; a FAILURE throws `scep/query-failed`, a PENDING is refused (`scep/unexpected-pending`, a
+ * query grants or rejects), and a SUCCESS not carrying the requested certificate throws `scep/cert-not-found`.
+ * `certificate` is the one matched to the requested issuer and serial; `certificates` is every certificate the
+ * authenticated response carried, raw, so a caller relies on `certificate` for the queried identity.
+ *
+ * @opts
+ *   - `certificate` -- the certificate DER whose issuer and serial name the one to retrieve (the convenience form).
+ *   - `issuer` / `serialNumber` -- the issuer Name DER and serial (a BigInt, number, or hex string) naming the certificate, for a caller that did not retain it.
+ *   - `caCert` -- the SCEP CA certificate DER the query is encrypted to.
+ *   - `signer` -- `{ cert, key }`, the outer SignedData signer.
+ *   - `recipientKey` -- `{ cert, key }`, the RSA key the CA encrypts the response to, to decrypt the CertRep.
+ *   - `responderCert` -- the certificate to authenticate the CA response signature against (defaults to `caCert`).
+ *   - `transactionId` -- a caller-unique PrintableString (defaults to 16 random bytes, hex-encoded).
+ *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` -- transport bounds.
+ * @example
+ *   // requires: clientCertDer, caCertDer, clientKeyPkcs8, scepTransport
+ *   var out = await pki.scep.getCert("http://ca.example/scep", { certificate: clientCertDer, caCert: caCertDer,
+ *     signer: { cert: clientCertDer, key: clientKeyPkcs8 },
+ *     recipientKey: { cert: clientCertDer, key: clientKeyPkcs8 }, transport: scepTransport });
+ *   out.certificate;   // the retrieved certificate DER
+ */
+async function getCert(baseUrl, opts) {
+  var q = await _queryOperation("GetCert", baseUrl, opts, "getCert");
+  var certs = q.rep.certificates || [];
+  var match = null;
+  for (var i = 0; i < certs.length; i++) {
+    var w = schemaX509.parse(certs[i]);
+    if (guard.name.dnEqual(w.issuer.rdns, q.want.issuerRdns, _err, "scep/bad-response", "the returned certificate issuer") && w.serialNumber === q.want.serial) {
+      if (match != null) throw _err("scep/ambiguous-cert", "the CA returned more than one certificate matching the requested issuer and serial (RFC 8894 sec. 3.3.4)");
+      match = certs[i];
+    }
+  }
+  if (match == null) throw _err("scep/cert-not-found", "the CA response did not carry a certificate matching the requested issuer and serial (RFC 8894 sec. 3.3.4)");
+  return { certificate: match, certificates: certs, transactionId: q.transactionId };
+}
+
+/**
+ * @primitive  pki.scep.getCrl
+ * @signature  pki.scep.getCrl(baseUrl, opts) -> Promise<{ crl, crls, transactionId }>
+ * @since      0.6.17
+ * @status     stable
+ * @spec       RFC 8894
+ * @related    pki.scep.getCert, pki.crl.verify
+ *
+ * Retrieve a CRL over SCEP (RFC 8894 sec. 3.3.4): POST a GetCRL query naming the CA by the issuer and serial
+ * of a certificate it issued, and read the CRL out of the CA's CRL-only CertRep. This is an OPTIONAL fallback:
+ * RFC 8894 sec. 2.7 says a client should compose a GetCRL only if the CA supports neither a CRL distribution
+ * point nor HTTP access, and prefer those. The response is authenticated against the CA certificate and its
+ * recipientNonce must echo the request's fresh senderNonce; a FAILURE throws `scep/query-failed`, and a PENDING is
+ * refused. The returned CRL is bound to the query: `crl` is the one whose issuer matches the requested CA, so a
+ * response carrying no such CRL throws `scep/no-crl` and one carrying more than one throws `scep/ambiguous-crl`.
+ * The full response list is on `crls`, raw for the caller to validate with `pki.crl.verify`.
+ *
+ * @opts
+ *   - `certificate` -- a certificate DER the CA issued, whose issuer and serial name the CA to query (the convenience form).
+ *   - `issuer` / `serialNumber` -- the issuer Name DER and serial (a BigInt, number, or hex string) naming the CA, when the caller did not retain such a certificate.
+ *   - `caCert` -- the SCEP CA certificate DER the query is encrypted to.
+ *   - `signer` -- `{ cert, key }`, the outer SignedData signer.
+ *   - `recipientKey` -- `{ cert, key }`, the RSA key the CA encrypts the response to.
+ *   - `responderCert` -- the certificate to authenticate the CA response against (defaults to `caCert`).
+ *   - `transactionId` -- a caller-unique PrintableString (defaults to 16 random bytes, hex-encoded).
+ *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` -- transport bounds.
+ * @example
+ *   // requires: clientCertDer, caCertDer, clientKeyPkcs8, scepTransport
+ *   var out = await pki.scep.getCrl("http://ca.example/scep", { certificate: clientCertDer, caCert: caCertDer,
+ *     signer: { cert: clientCertDer, key: clientKeyPkcs8 },
+ *     recipientKey: { cert: clientCertDer, key: clientKeyPkcs8 }, transport: scepTransport });
+ *   out.crl;   // the retrieved CRL DER
+ */
+async function getCrl(baseUrl, opts) {
+  var q = await _queryOperation("GetCRL", baseUrl, opts, "getCrl");
+  var crls = q.rep.crls || [];
+  var match = null;
+  for (var i = 0; i < crls.length; i++) {
+    var w = schemaCrl.parse(crls[i]);
+    if (guard.name.dnEqual(w.issuer.rdns, q.want.issuerRdns, _err, "scep/bad-response", "the returned CRL issuer")) {
+      if (match != null) throw _err("scep/ambiguous-crl", "the CA returned more than one CRL issued by the requested CA (RFC 8894 sec. 3.3.4)");
+      match = crls[i];
+    }
+  }
+  if (match == null) throw _err("scep/no-crl", "the CA response did not carry a CRL issued by the requested CA (RFC 8894 sec. 3.3.4)");
+  return { crl: match, crls: crls, transactionId: q.transactionId };
+}
+
 var _TRANSPORT_KEYS = { transport: 1, timeout: 1, maxResponseBytes: 1, maxRedirects: 1, tls: 1, allowCrossOriginRedirect: 1 };
 function _withKeys(extra) { var o = {}, k; for (k in _TRANSPORT_KEYS) o[k] = 1; for (k in extra) o[k] = 1; return o; }
 var _CACAPS_KEYS = _withKeys({ expectSCEPStandard: 1, requireStrongProfile: 1 });
 var _CACERT_KEYS = _withKeys({ expectedFingerprint: 1, fingerprintAlgorithm: 1 });
 var _NEXTCACERT_KEYS = _withKeys({ caCertificate: 1 });
 var _ENROLL_KEYS = _withKeys({ csr: 1, caCert: 1, signer: 1, recipientKey: 1, responderCert: 1, issuerCert: 1, transactionId: 1, pollCount: 1, maxTotalWait: 1, sleep: 1, onRetryAfter: 1 });
+var _QUERY_KEYS = _withKeys({ certificate: 1, issuer: 1, serialNumber: 1, caCert: 1, signer: 1, recipientKey: 1, responderCert: 1, transactionId: 1 });
 
 module.exports = {
   build: build,
@@ -982,6 +1203,8 @@ module.exports = {
   getNextCACert: getNextCACert,
   enroll: enroll,
   renew: renew,
+  getCert: getCert,
+  getCrl: getCrl,
   parseCapabilities: parseCapabilities,
   MESSAGE_TYPES: MESSAGE_TYPE,
   PKI_STATUS: PKI_STATUS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.16",
+  "version": "0.6.18",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:e63bdf7d-807a-4e39-8cb7-7eb6a47b5808",
+  "serialNumber": "urn:uuid:12f32901-e931-42b5-b817-2f304d987943",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-01T10:42:10.477Z",
+    "timestamp": "2026-09-01T15:21:55.160Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.16",
+      "bom-ref": "@blamejs/pki@0.6.18",
       "type": "application",
       "name": "pki",
-      "version": "0.6.16",
+      "version": "0.6.18",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.16",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.18",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.16",
+      "ref": "@blamejs/pki@0.6.18",
       "dependsOn": []
     }
   ]