@blamejs/pki 0.6.34 → 0.6.35

package/CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.35 — 2026-09-04
+
+Three redundant C509 spellings are refused, so a certificate has one encoding and an issuer signature cannot cover two different C509 byte strings.
+
+### Fixed
+
+- pki.schema.c509.encode refuses a serialNumberHex that is not an even-length hexadecimal string instead of decoding a prefix of it. An odd-length or partly non-hexadecimal value previously became a different, valid serial number without any error, which the encoder's own re-parse could not catch. The check applies whether the result is re-emitted from its preserved field bytes or built field by field, so a caller is told the value is malformed rather than having it quietly ignored.
+
+### Security
+
+- pki.schema.c509.parse refuses an unsigned bignum whose first octet is 0x00, including a value that is only that octet, so every number has exactly one C509 encoding (draft sec. 3.1.2). A zero serial previously had two spellings that reconstructed byte-identical DER, letting one issuer signature cover two distinct C509 certificates. The rule covers the certificate serial number, the authorityKeyIdentifier serial, and the RSA modulus and exponent.
+- pki.schema.c509.parse refuses an RSA subjectPublicKey written as [modulus, 65537] instead of the bare modulus. Draft sec. 3.1.9 omits the array and the exponent when the exponent is 65537, so the array spelling of such a key is a second encoding of one certificate, reconstructing byte-identical DER. An RSA key with any other exponent still uses the array form.
+- pki.schema.c509.parse refuses a notAfter written as the epoch 253402300799 rather than the CBOR simple value null. Draft sec. 3.1.5 encodes the no-expiration time 99991231235959Z as null, so the explicit epoch is a second spelling that reconstructs the same GeneralizedTime and therefore the same DER. A notBefore is unaffected, and pki.schema.c509.encode refuses that Date on notAfter instead of emitting a form the decoder rejects.
+
 ## v0.6.34 — 2026-09-04
 
 An injected transport that does not return a promise is reported as a typed option error naming the option, in every client that accepts one.

package/lib/schema-c509.js

@@ -33,6 +33,7 @@ var C = constants;
 var C509Error = frameworkError.C509Error;
 function _err(code, message, cause) { return new C509Error(code, message, cause); }
 var MAX_EPOCH_SECONDS = 8640000000000n;
+var NO_EXPIRY_SECONDS = 253402300799n;
 
 function _name(n) { var d = oid.byName(n); if (!d) { throw new Error("schema-c509: unregistered OID name " + JSON.stringify(n)); } return n; }
 
@@ -142,14 +143,29 @@ function _biguint(node, code, label) {
   if (!node || node.majorType !== 2) throw _err(code, label + " must be an unwrapped CBOR byte string (~biguint)");
   var b = node.content;
   if (b.length > C.LIMITS.CBOR_MAX_BIGUINT_BYTES) throw _err(code, label + " exceeds the ~biguint byte cap");
-  if (b.length > 1 && b[0] === 0x00) throw _err("c509/non-minimal-serial", label + " has a redundant leading 0x00 (~biguint omits the sign octet)");
+  if (b.length > 0 && b[0] === 0x00) throw _err("c509/non-minimal-serial", label + " has a redundant leading 0x00 (~biguint omits the sign octet)");
   return b.length ? BigInt("0x" + b.toString("hex")) : 0n;
 }
 
+function _hexBytes(s, code, label) {
+  if (typeof s !== "string") throw _err(code, label + " must be a hexadecimal string");
+  if ((s.length % 2) !== 0) throw _err(code, label + " must have an even number of hexadecimal digits");
+  for (var i = 0; i < s.length; i++) {
+    var c = s.charCodeAt(i);
+    if (!((c >= 48 && c <= 57) || (c >= 97 && c <= 102) || (c >= 65 && c <= 70))) {
+      throw _err(code, label + " must be hexadecimal");
+    }
+  }
+  return Buffer.from(s, "hex");
+}
+
 function _time(node, allowNull, label) {
   if (allowNull && node.majorType === 7 && node.ai === 22) return null;
   if (node.majorType !== 0) throw _err("c509/bad-validity", label + " must be an unwrapped CBOR epoch integer (~time)");
   var secs = node.argument;
+  if (allowNull && secs === NO_EXPIRY_SECONDS) {
+    throw _err("c509/bad-validity", label + " of 99991231235959Z is encoded as the CBOR simple value null (draft sec. 3.1.5), not as the epoch " + NO_EXPIRY_SECONDS);
+  }
   if (secs > MAX_EPOCH_SECONDS) throw _err("c509/bad-validity", label + " is outside the representable Date range");
   return new Date(C.TIME.seconds(Number(secs)));
 }
@@ -1521,6 +1537,7 @@ function parse(input) {
     if (f[8].majorType === 2) rsaKey = { modulus: _biguint(f[8], "c509/bad-spki", "RSA modulus"), exponent: 65537n };
     else if (f[8].majorType === 4 && f[8].children && f[8].children.length === 2) {
       rsaKey = { modulus: _biguint(f[8].children[0], "c509/bad-spki", "RSA modulus"), exponent: _biguint(f[8].children[1], "c509/bad-spki", "RSA exponent") };
+      if (rsaKey.exponent === 65537n) throw _err("c509/bad-spki", "an RSA subjectPublicKey with exponent 65537 omits the array and the exponent (sec. 3.1.9)");
     } else throw _err("c509/bad-spki", "an RSA subjectPublicKey must be a ~biguint modulus or [modulus, exponent]");
     if (rsaKey.modulus < 1n || rsaKey.exponent < 1n) throw _err("c509/bad-spki", "an RSA modulus and public exponent must be positive");
   } else {
@@ -1650,6 +1667,7 @@ function _validityUint(date, label) {
 function _encodeC509Array(r) {
   if (Buffer.isBuffer(r._fieldBytes)) {
     if (!Buffer.isBuffer(r.signatureValue)) throw _err("c509/bad-input", "a re-emitted certificate must carry a Buffer signatureValue");
+    if (r.serialNumberHex != null) _hexBytes(r.serialNumberHex, "c509/bad-serial", "serialNumberHex");
     var out = Buffer.concat([Buffer.from([0x8b]), r._fieldBytes, cbor.build.byteString(r.signatureValue)]);
     parse(out);
     return out;
@@ -1658,7 +1676,7 @@ function _encodeC509Array(r) {
   var pkKey = r.subjectPublicKeyAlgorithm.curve ? r.subjectPublicKeyAlgorithm.name + "|" + r.subjectPublicKeyAlgorithm.curve : r.subjectPublicKeyAlgorithm.name;
   var arr = cbor.build.array([
     cbor.build.int(BigInt(r.certificateType)),
-    cbor.build.byteString(r.serialNumberHex != null ? Buffer.from(r.serialNumberHex, "hex") : _minBytes(r.serialNumber)),
+    cbor.build.byteString(r.serialNumberHex != null ? _hexBytes(r.serialNumberHex, "c509/bad-serial", "serialNumberHex") : _minBytes(r.serialNumber)),
     _encAlgorithm(r.signatureAlgorithm, SIG_ALG_TO_INT, r.signatureAlgorithm.name),
     _encName(r.issuer, false),
     _validityUint(r.validity.notBefore, "validityNotBefore"),
@@ -1753,7 +1771,7 @@ function _keyUsageBitsFromDer(extnValue) {
   }
   return _namedBitsFromContent(bs.bytes, bs.unusedBits);
 }
-var _NO_EXPIRY = Date.UTC(9999, 11, 31, 23, 59, 59);
+var _NO_EXPIRY = C.TIME.seconds(Number(NO_EXPIRY_SECONDS));
 var NODE_TO_WEBCRYPTO = Object.assign(Object.create(null), { "prime256v1": "P-256", "secp384r1": "P-384", "secp521r1": "P-521" });
 var WEBCRYPTO_FIELD_BYTES = Object.assign(Object.create(null), { "P-256": 32, "P-384": 48, "P-521": 66 });
 var SIG_ALG_TO_CURVE = Object.assign(Object.create(null), { "ecdsaWithSHA256": "P-256", "ecdsaWithSHA384": "P-384", "ecdsaWithSHA512": "P-521" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.34",
+  "version": "0.6.35",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:c595f123-cf34-46db-924e-ffa5c0c5018e",
+  "serialNumber": "urn:uuid:3601ee14-7f92-4a66-bdb2-bab4e6360e45",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-04T22:46:35.510Z",
+    "timestamp": "2026-09-04T23:41:31.757Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.34",
+      "bom-ref": "@blamejs/pki@0.6.35",
       "type": "application",
       "name": "pki",
-      "version": "0.6.34",
+      "version": "0.6.35",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.34",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.35",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.34",
+      "ref": "@blamejs/pki@0.6.35",
       "dependsOn": []
     }
   ]