@blamejs/pki 0.6.35 → 0.6.36

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.36 — 2026-09-04
+
+A natively signed C509 certificate is refused when it spells an algorithm generically instead of using the registry entry that names the same value.
+
+### Added
+
+- The subjectPublicKeyAlgorithm on a pki.schema.c509.parse result carries a parameters buffer when the certificate used a C509 registry integer, holding the parameters that entry names: the DER NULL for rsaEncryption and the namedCurve OID for an EC key. The generic OID forms already surfaced this field, so it is now present for every form that has parameters.
+
+### Fixed
+
+- pki.schema.c509.parse refuses a natively signed certificate (c509CertificateType 2) that writes an algorithm as an OID, or as an OID with parameters, when a C509 registry entry names that same value. Draft section 3.7 reserves the generic form for re-encoded certificates, where it stays accepted. An algorithm with no registry entry, and a registry OID whose parameters differ from the entry's, both keep the generic form.
+- pki.schema.c509.parse refuses an rsaEncryption subjectPublicKeyAlgorithm that does not carry the DER NULL parameters RFC 3279 section 2.3.1 requires, including the bare OID form that carries none. The type-3 reconstruction previously emitted the OID and a NULL regardless, so the rebuilt DER described an algorithm identifier the certificate had not encoded.
+- pki.schema.c509.encode writes an algorithm back as the form naming the same value. It previously chose the form by algorithm name alone, so re-encoding a certificate field by field could move an algorithm that carried no parameters onto a registry entry that names some, and could miss the entry for a key identified by its namedCurve parameters rather than by a curve name.
+- pki.schema.c509.encode refuses a serialNumber, RSA modulus or RSA exponent that is not a BigInt. A string was previously read as hexadecimal and truncated to an even number of digits, so a caller passing "abc" received a certificate carrying the serial 0xab, and a number was silently converted. A missing modulus or exponent reached the emitter as an untyped fault rather than a c509 error naming the field.
+- pki.schema.c509.encode reports every field it reads off a result as a typed c509 error naming that field. An extensions entry or an RDN that is not an object, an extension carrying neither an OID nor a registry name, an extension OID that is not a dotted-decimal string, and a keyUsageBits that is not a safe integer previously surfaced as a TypeError, a RangeError, or a fault from the OID or CBOR builders. An RDN value that is not a string is refused rather than converted, so a caller passing a number no longer receives a certificate naming its decimal spelling.
+- pki.schema.c509.encode refuses a sparse extensions or rdns array. Array iteration skips a hole, so such a list emitted fewer entries than it held without reporting anything.
+
 ## v0.6.35 — 2026-09-04
 
 Three redundant C509 spellings are refused, so a certificate has one encoding and an issuer signature cannot cover two different C509 byte strings.

package/lib/schema-c509.js

@@ -32,6 +32,20 @@ var b = asn1.build;
 var C = constants;
 var C509Error = frameworkError.C509Error;
 function _err(code, message, cause) { return new C509Error(code, message, cause); }
+/** @internal Name a caller-supplied value in a diagnostic without converting it: a Symbol has no
+ * string form and a BigInt has no JSON form, so formatting either one would throw from the message. */
+function _describe(v) {
+  if (v === null) return "null";
+  var t = typeof v;
+  if (t === "string") return JSON.stringify(v);
+  return t === "number" || t === "boolean" || t === "undefined" ? String(v) : t;
+}
+/** @internal A hole is skipped by forEach, so a sparse list would emit fewer items than it holds. */
+function _assertDense(list, code, label) {
+  for (var i = 0; i < list.length; i++) {
+    if (!(i in list)) throw _err(code, label + " must not be a sparse array; index " + i + " is a hole");
+  }
+}
 var MAX_EPOCH_SECONDS = 8640000000000n;
 var NO_EXPIRY_SECONDS = 253402300799n;
 
@@ -178,19 +192,58 @@ function _oidName(node, code, label) {
   return { oid: dotted, name: oid.name(dotted) || dotted };
 }
 
-function _algorithm(node, byInt, code, label) {
+/**
+ * @internal Draft sec. 8.14 and 8.15 give each registry row a full DER AlgorithmIdentifier, so the
+ * row's parameters are part of the value it denotes: a signature row carries none, the rsaEncryption
+ * row carries NULL, and an ecPublicKey row carries its namedCurve.
+ */
+function _rowParameters(row) {
+  if (typeof row === "string") return null;
+  if (row.curve) return asn1.build.oid(oid.byName(row.curve));
+  return asn1.build.nullValue();
+}
+function _rowParametersMatch(row, params) {
+  if (row === undefined) return false;
+  var rowParams = _rowParameters(row);
+  return rowParams === null ? params === null : (params !== null && rowParams.equals(params));
+}
+function _specificInt(byInt, dotted, params, curve) {
+  var keys = Object.keys(byInt);
+  for (var i = 0; i < keys.length; i++) {
+    var row = byInt[keys[i]];
+    if (oid.byName(typeof row === "string" ? row : row.alg) !== dotted) continue;
+    var hit = params === null && curve ? (typeof row !== "string" && row.curve === curve)
+      : _rowParametersMatch(row, params);
+    if (hit) return Number(keys[i]);
+  }
+  return undefined;
+}
+function _hasSpecificForm(byInt, dotted, params) {
+  return _specificInt(byInt, dotted, params) !== undefined;
+}
+function _assertSpecificForm(byInt, dotted, params, isNative, label) {
+  if (!isNative || !_hasSpecificForm(byInt, dotted, params)) return;
+  throw _err("c509/non-specific-encoding", label + " has a C509 registry row, and a natively signed certificate uses only the specific CBOR encoding (draft sec. 3.7)");
+}
+
+function _algorithm(node, byInt, code, label, isNative) {
   if (node.majorType === 0 || node.majorType === 1) {
     var i = Number(cbor.read.int(node));
     var mapped = byInt[i];
     if (mapped === undefined) throw _err("c509/unknown-algorithm", label + " integer " + i + " has no C509 registry row");
     if (typeof mapped === "string") return { name: mapped, oid: oid.byName(mapped) };
-    return { name: mapped.alg, oid: oid.byName(mapped.alg), curve: mapped.curve || null };
+    return { name: mapped.alg, oid: oid.byName(mapped.alg), curve: mapped.curve || null, parameters: _rowParameters(mapped) };
+  }
+  if (node.majorType === 2) {
+    var r = _oidName(node, code, label);
+    _assertSpecificForm(byInt, r.oid, null, isNative, label);
+    return { name: r.name, oid: r.oid };
   }
-  if (node.majorType === 2) { var r = _oidName(node, code, label); return { name: r.name, oid: r.oid }; }
   if (node.majorType === 4 && node.children && node.children.length === 2) {
     var a = _oidName(node.children[0], code, label);
     if (node.children[1].majorType !== 2) throw _err(code, label + " algorithm parameters must be a CBOR byte string");
     if (node.children[1].content.length === 0) throw _err(code, label + " algorithm parameters must not be an empty byte string; omit them with the bare ~oid form (draft sec. 3.1.3)");
+    _assertSpecificForm(byInt, a.oid, node.children[1].content, isNative, label);
     return { name: a.name, oid: a.oid, parameters: node.children[1].content };
   }
   throw _err(code, label + " is not a C509 AlgorithmIdentifier (int / ~oid / [~oid, params])");
@@ -1420,6 +1473,10 @@ function _reconSpki(spkAlg, keyBytes, rsaKey) {
     return b.sequence([b.sequence([b.oid(oid.byName("ecPublicKey")), b.oid(oid.byName(spkAlg.curve))]), b.bitString(point, 0)]);
   }
   if (spkAlg.name === "rsaEncryption") {
+    /** @internal RFC 3279 sec. 2.3.1 fixes rsaEncryption parameters to the DER NULL. */
+    if (!spkAlg.parameters || !spkAlg.parameters.equals(b.nullValue())) {
+      throw _err("c509/bad-spki", "rsaEncryption parameters must be the DER NULL (RFC 3279 sec. 2.3.1); the bare ~oid form carries none");
+    }
     var rsaPk = b.sequence([b.integer(rsaKey.modulus), b.integer(rsaKey.exponent)]);
     return b.sequence([b.sequence([b.oid(oid.byName("rsaEncryption")), b.nullValue()]), b.bitString(rsaPk, 0)]);
   }
@@ -1523,7 +1580,7 @@ function parse(input) {
   var serial = _biguint(serialBytes, "c509/bad-serial", "certificateSerialNumber");
   var sHex = serialBytes.content.toString("hex");
 
-  var sigAlg = _algorithm(f[2], SIG_ALG_BY_INT, "c509/unknown-algorithm", "issuerSignatureAlgorithm");
+  var sigAlg = _algorithm(f[2], SIG_ALG_BY_INT, "c509/unknown-algorithm", "issuerSignatureAlgorithm", type === 2);
   var issuer = _name509(f[3], false, type === 2);
   var notBefore = _time(f[4], false, "validityNotBefore");
   var notAfter = _time(f[5], true, "validityNotAfter");
@@ -1531,7 +1588,7 @@ function parse(input) {
   if (issuer === null && (!subject || !subject.rdns || subject.rdns.length === 0)) {
     throw _err("c509/bad-name", "a self-signed C509 (issuer == subject) requires a non-empty subject, since it is also the issuer (RFC 5280 sec. 4.1.2.4)");
   }
-  var spkAlg = _algorithm(f[7], PK_ALG_BY_INT, "c509/unknown-algorithm", "subjectPublicKeyAlgorithm");
+  var spkAlg = _algorithm(f[7], PK_ALG_BY_INT, "c509/unknown-algorithm", "subjectPublicKeyAlgorithm", type === 2);
   var subjectPublicKey = null, rsaKey = null;
   if (spkAlg.name === "rsaEncryption") {
     if (f[8].majorType === 2) rsaKey = { modulus: _biguint(f[8], "c509/bad-spki", "RSA modulus"), exponent: 65537n };
@@ -1578,29 +1635,35 @@ function matches(node) {
 }
 
 
-var SIG_ALG_TO_INT = Object.assign(Object.create(null), { ecdsaWithSHA256: 0, ecdsaWithSHA384: 1, ecdsaWithSHA512: 2 });
-var PK_ALG_TO_INT = Object.assign(Object.create(null), { rsaEncryption: 0, "ecPublicKey|prime256v1": 1, "ecPublicKey|secp384r1": 2, "ecPublicKey|secp521r1": 3 });
 var ATTR_TO_INT = Object.create(null);
 Object.keys(ATTR_BY_INT).forEach(function (k) { ATTR_TO_INT[ATTR_BY_INT[k]] = Number(k); });
 var EXT_TO_INT = Object.create(null);
 Object.keys(EXT_BY_INT).forEach(function (k) { if (EXT_COMPACT[EXT_BY_INT[k]]) EXT_TO_INT[EXT_BY_INT[k]] = Number(k); });
 
 function _minBytes(n) {
+  if (typeof n !== "bigint") throw _err("c509/bad-serial", "a ~biguint value must be a BigInt, got " + _describe(n));
   if (n < 0n) throw _err("c509/bad-serial", "a ~biguint value must be non-negative");
   if (n === 0n) return Buffer.alloc(0);
   var hex = n.toString(16); if (hex.length % 2) hex = "0" + hex;
   return Buffer.from(hex, "hex");
 }
-function _encAlgorithm(alg, toInt, key) {
-  var i = toInt[key];
-  if (i !== undefined && !(alg.parameters && alg.parameters.length)) return cbor.build.int(BigInt(i));
-  var oidBytes = cbor.build.byteString(asn1.encodeOidContent(alg.oid));
-  if (alg.parameters && alg.parameters.length) return cbor.build.array([oidBytes, cbor.build.byteString(alg.parameters)]);
+function _encAlgorithm(alg, byInt) {
+  var dotted = alg.oid || oid.byName(alg.name);
+  if (!dotted) throw _err("c509/bad-input", "algorithm " + alg.name + " carries no OID and its name is not in the OID registry");
+  var supplied = alg.parameters && alg.parameters.length ? alg.parameters : null;
+  var i = _specificInt(byInt, dotted, supplied, alg.curve);
+  if (i !== undefined) return cbor.build.int(BigInt(i));
+  var oidBytes = cbor.build.byteString(asn1.encodeOidContent(dotted));
+  if (supplied !== null) return cbor.build.array([oidBytes, cbor.build.byteString(supplied)]);
   return oidBytes;
 }
 function _encSpecialText(rdn) {
-  if (rdn.eui64) return cbor.build.tag(48, cbor.build.byteString(rdn.eui64));
-  var v = String(rdn.value);
+  if (rdn.eui64 != null) {
+    if (!Buffer.isBuffer(rdn.eui64)) throw _err("c509/bad-name", "an RDN eui64 must be a Buffer, got " + _describe(rdn.eui64));
+    return cbor.build.tag(48, cbor.build.byteString(rdn.eui64));
+  }
+  if (typeof rdn.value !== "string") throw _err("c509/bad-name", "an RDN value must be a string, got " + _describe(rdn.value));
+  var v = rdn.value;
   if (v.length >= 2 && _isEvenHexLower(v)) return cbor.build.byteString(Buffer.from(v, "hex"));
   return cbor.build.textString(v);
 }
@@ -1610,11 +1673,15 @@ function _encName(name, isSubject) {
     throw _err("c509/bad-name", "the subject Name is required");
   }
   var rdns = name.rdns || [];
+  _assertDense(rdns, "c509/bad-name", "the rdns array");
+  rdns.forEach(function (rdn) {
+    if (!rdn || typeof rdn !== "object") throw _err("c509/bad-name", "each RDN must be an object, got " + _describe(rdn));
+  });
   if (rdns.length === 1 && rdns[0].type === "commonName" && !rdns[0].printable) return _encSpecialText(rdns[0]);
   var items = [];
   rdns.forEach(function (rdn) {
     var ai = ATTR_TO_INT[rdn.type];
-    if (ai === undefined) throw _err("c509/bad-name", "attribute type " + rdn.type + " has no C509 registry int");
+    if (ai === undefined) throw _err("c509/bad-name", "attribute type " + _describe(rdn.type) + " has no C509 registry int");
     items.push(cbor.build.int(BigInt(rdn.printable ? -ai : ai)));
     items.push(_encSpecialText(rdn));
   });
@@ -1630,6 +1697,18 @@ function _encSpk(r) {
   return cbor.build.byteString(r.subjectPublicKey);
 }
 function _encExtensions(exts) {
+  _assertDense(exts, "c509/bad-input", "the extensions array");
+  exts.forEach(function (ext) {
+    if (!ext || typeof ext !== "object") throw _err("c509/bad-input", "each extension must be an object, got " + _describe(ext));
+    if (ext.oid != null) {
+      if (typeof ext.oid !== "string") throw _err("c509/bad-input", "an extension oid must be a dotted-decimal string, got " + _describe(ext.oid));
+      try { asn1.encodeOidContent(ext.oid); }
+      catch (_oe) { throw _err("c509/bad-input", "an extension oid must be a dotted-decimal string, got " + _describe(ext.oid), _oe); }
+    }
+    if (ext.keyUsageBits != null && (typeof ext.keyUsageBits !== "number" || !Number.isSafeInteger(ext.keyUsageBits))) {
+      throw _err("c509/bad-extensions", "keyUsageBits must be a safe integer, got " + _describe(ext.keyUsageBits));
+    }
+  });
   if (exts.length === 1 && exts[0].name === "keyUsage" && typeof exts[0].keyUsageBits === "number") {
     return cbor.build.int(BigInt(exts[0].critical ? -exts[0].keyUsageBits : exts[0].keyUsageBits));
   }
@@ -1641,7 +1720,9 @@ function _encExtensions(exts) {
       items.push(cbor.build.int(BigInt(ext.critical ? -ei : ei)));
       items.push(compact);
     } else {
-      items.push(cbor.build.byteString(asn1.encodeOidContent(ext.oid || oid.byName(ext.name))));
+      var extDotted = ext.oid || (typeof ext.name === "string" ? oid.byName(ext.name) : null);
+      if (!extDotted) throw _err("c509/bad-input", "an extension must carry an OID or a name in the OID registry, got " + _describe(ext.name));
+      items.push(cbor.build.byteString(asn1.encodeOidContent(extDotted)));
       if (!Buffer.isBuffer(ext.value)) throw _err("c509/non-invertible", "extension " + (ext.oid || ext.name) + " has no byte-string value to encode");
       var bs = cbor.build.byteString(ext.value);
       items.push(ext.critical ? cbor.build.array([bs]) : bs);
@@ -1673,16 +1754,15 @@ function _encodeC509Array(r) {
     return out;
   }
   _requireResultShape(r);
-  var pkKey = r.subjectPublicKeyAlgorithm.curve ? r.subjectPublicKeyAlgorithm.name + "|" + r.subjectPublicKeyAlgorithm.curve : r.subjectPublicKeyAlgorithm.name;
   var arr = cbor.build.array([
     cbor.build.int(BigInt(r.certificateType)),
     cbor.build.byteString(r.serialNumberHex != null ? _hexBytes(r.serialNumberHex, "c509/bad-serial", "serialNumberHex") : _minBytes(r.serialNumber)),
-    _encAlgorithm(r.signatureAlgorithm, SIG_ALG_TO_INT, r.signatureAlgorithm.name),
+    _encAlgorithm(r.signatureAlgorithm, SIG_ALG_BY_INT),
     _encName(r.issuer, false),
     _validityUint(r.validity.notBefore, "validityNotBefore"),
     r.validity.notAfter === null ? cbor.build.nullValue() : _validityUint(r.validity.notAfter, "validityNotAfter"),
     _encName(r.subject, true),
-    _encAlgorithm(r.subjectPublicKeyAlgorithm, PK_ALG_TO_INT, pkKey),
+    _encAlgorithm(r.subjectPublicKeyAlgorithm, PK_ALG_BY_INT),
     _encSpk(r),
     _encExtensions(r.extensions),
     cbor.build.byteString(r.signatureValue),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.35",
+  "version": "0.6.36",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3601ee14-7f92-4a66-bdb2-bab4e6360e45",
+  "serialNumber": "urn:uuid:8d50e6dd-1ddf-46f8-b8db-ed97195096c3",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-04T23:41:31.757Z",
+    "timestamp": "2026-09-05T01:58:33.232Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.35",
+      "bom-ref": "@blamejs/pki@0.6.36",
       "type": "application",
       "name": "pki",
-      "version": "0.6.35",
+      "version": "0.6.36",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.35",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.36",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.35",
+      "ref": "@blamejs/pki@0.6.36",
       "dependsOn": []
     }
   ]