@blamejs/pki 0.6.35 → 0.6.37

package/CHANGELOG.md

@@ -4,6 +4,34 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.37 — 2026-09-05
+
+A natively signed C509 certificate is refused when it writes an extension in the generic OID form that the registry can carry as an identifier.
+
+### Fixed
+
+- pki.schema.c509.parse refuses a natively signed certificate (c509CertificateType 2) that writes an extension as an OID and a DER value when a C509 registry identifier carries the same extension value. Draft section 3.7 reserves the generic form for re-encoded certificates, where it stays accepted. An extension whose OID has no registry identifier, and one whose value the compact encodings cannot represent under that certificate type's rules, both keep the generic form.
+- pki.schema.c509.encode chooses an extension's form under the rules of the certificate type it is writing. It previously judged whether a value could be written compactly using the rules for a re-encoded certificate, so a natively signed certificate could be given a compact form its own decoder does not accept.
+- pki.schema.c509.encode resolves an extension named only by its OID to the matching registry identifier. It looked the identifier up by name alone, so an extension supplied without one was written in the generic OID form even where a compact encoding carried it.
+- pki.schema.c509 decides what belongs to the C509 registries by dotted OID rather than by the name pki.oid.register maps that OID to. Registering a different name for a built-in OID previously changed what the toolkit emitted for an unrelated certificate, and for commonName, a curve, ecPublicKey or an ECDSA signature algorithm it stopped a certificate converting to C509 at all.
+
+## v0.6.36 — 2026-09-04
+
+A natively signed C509 certificate is refused when it spells an algorithm generically instead of using the registry entry that names the same value.
+
+### Added
+
+- The subjectPublicKeyAlgorithm on a pki.schema.c509.parse result carries a parameters buffer when the certificate used a C509 registry integer, holding the parameters that entry names: the DER NULL for rsaEncryption and the namedCurve OID for an EC key. The generic OID forms already surfaced this field, so it is now present for every form that has parameters.
+
+### Fixed
+
+- pki.schema.c509.parse refuses a natively signed certificate (c509CertificateType 2) that writes an algorithm as an OID, or as an OID with parameters, when a C509 registry entry names that same value. Draft section 3.7 reserves the generic form for re-encoded certificates, where it stays accepted. An algorithm with no registry entry, and a registry OID whose parameters differ from the entry's, both keep the generic form.
+- pki.schema.c509.parse refuses an rsaEncryption subjectPublicKeyAlgorithm that does not carry the DER NULL parameters RFC 3279 section 2.3.1 requires, including the bare OID form that carries none. The type-3 reconstruction previously emitted the OID and a NULL regardless, so the rebuilt DER described an algorithm identifier the certificate had not encoded.
+- pki.schema.c509.encode writes an algorithm back as the form naming the same value. It previously chose the form by algorithm name alone, so re-encoding a certificate field by field could move an algorithm that carried no parameters onto a registry entry that names some, and could miss the entry for a key identified by its namedCurve parameters rather than by a curve name.
+- pki.schema.c509.encode refuses a serialNumber, RSA modulus or RSA exponent that is not a BigInt. A string was previously read as hexadecimal and truncated to an even number of digits, so a caller passing "abc" received a certificate carrying the serial 0xab, and a number was silently converted. A missing modulus or exponent reached the emitter as an untyped fault rather than a c509 error naming the field.
+- pki.schema.c509.encode reports every field it reads off a result as a typed c509 error naming that field. An extensions entry or an RDN that is not an object, an extension carrying neither an OID nor a registry name, an extension OID that is not a dotted-decimal string, and a keyUsageBits that is not a safe integer previously surfaced as a TypeError, a RangeError, or a fault from the OID or CBOR builders. An RDN value that is not a string is refused rather than converted, so a caller passing a number no longer receives a certificate naming its decimal spelling.
+- pki.schema.c509.encode refuses a sparse extensions or rdns array. Array iteration skips a hole, so such a list emitted fewer entries than it held without reporting anything.
+
 ## v0.6.35 — 2026-09-04
 
 Three redundant C509 spellings are refused, so a certificate has one encoding and an issuer signature cannot cover two different C509 byte strings.

package/lib/schema-c509.js

@@ -32,6 +32,20 @@ var b = asn1.build;
 var C = constants;
 var C509Error = frameworkError.C509Error;
 function _err(code, message, cause) { return new C509Error(code, message, cause); }
+/** @internal Name a caller-supplied value in a diagnostic without converting it: a Symbol has no
+ * string form and a BigInt has no JSON form, so formatting either one would throw from the message. */
+function _describe(v) {
+  if (v === null) return "null";
+  var t = typeof v;
+  if (t === "string") return JSON.stringify(v);
+  return t === "number" || t === "boolean" || t === "undefined" ? String(v) : t;
+}
+/** @internal A hole is skipped by forEach, so a sparse list would emit fewer items than it holds. */
+function _assertDense(list, code, label) {
+  for (var i = 0; i < list.length; i++) {
+    if (!(i in list)) throw _err(code, label + " must not be a sparse array; index " + i + " is a hole");
+  }
+}
 var MAX_EPOCH_SECONDS = 8640000000000n;
 var NO_EXPIRY_SECONDS = 253402300799n;
 
@@ -49,6 +63,11 @@ var PK_ALG_BY_INT = {
   3: { alg: _name("ecPublicKey"), curve: _name("secp521r1") },
 };
 var EC_FIELD_BYTES = Object.assign(Object.create(null), { "prime256v1": 32, "secp384r1": 48, "secp521r1": 66 });
+/** @internal Curve identity follows the dotted OID; pki.oid.register can rename one at any time. */
+var EC_CURVE_BY_OID = Object.create(null);
+Object.keys(EC_FIELD_BYTES).forEach(function (n) { EC_CURVE_BY_OID[oid.byName(n)] = n; });
+var SIG_ALG_BY_OID = Object.create(null);
+Object.keys(SIG_ALG_BY_INT).forEach(function (k) { SIG_ALG_BY_OID[oid.byName(SIG_ALG_BY_INT[k])] = SIG_ALG_BY_INT[k]; });
 
 var ATTR_BY_INT = {
   0: _name("emailAddress"),
@@ -178,19 +197,58 @@ function _oidName(node, code, label) {
   return { oid: dotted, name: oid.name(dotted) || dotted };
 }
 
-function _algorithm(node, byInt, code, label) {
+/**
+ * @internal Draft sec. 8.14 and 8.15 give each registry row a full DER AlgorithmIdentifier, so the
+ * row's parameters are part of the value it denotes: a signature row carries none, the rsaEncryption
+ * row carries NULL, and an ecPublicKey row carries its namedCurve.
+ */
+function _rowParameters(row) {
+  if (typeof row === "string") return null;
+  if (row.curve) return asn1.build.oid(oid.byName(row.curve));
+  return asn1.build.nullValue();
+}
+function _rowParametersMatch(row, params) {
+  if (row === undefined) return false;
+  var rowParams = _rowParameters(row);
+  return rowParams === null ? params === null : (params !== null && rowParams.equals(params));
+}
+function _specificInt(byInt, dotted, params, curve) {
+  var keys = Object.keys(byInt);
+  for (var i = 0; i < keys.length; i++) {
+    var row = byInt[keys[i]];
+    if (oid.byName(typeof row === "string" ? row : row.alg) !== dotted) continue;
+    var hit = params === null && curve ? (typeof row !== "string" && row.curve === curve)
+      : _rowParametersMatch(row, params);
+    if (hit) return Number(keys[i]);
+  }
+  return undefined;
+}
+function _hasSpecificForm(byInt, dotted, params) {
+  return _specificInt(byInt, dotted, params) !== undefined;
+}
+function _assertSpecificForm(byInt, dotted, params, isNative, label) {
+  if (!isNative || !_hasSpecificForm(byInt, dotted, params)) return;
+  throw _err("c509/non-specific-encoding", label + " has a C509 registry row, and a natively signed certificate uses only the specific CBOR encoding (draft sec. 3.7)");
+}
+
+function _algorithm(node, byInt, code, label, isNative) {
   if (node.majorType === 0 || node.majorType === 1) {
     var i = Number(cbor.read.int(node));
     var mapped = byInt[i];
     if (mapped === undefined) throw _err("c509/unknown-algorithm", label + " integer " + i + " has no C509 registry row");
     if (typeof mapped === "string") return { name: mapped, oid: oid.byName(mapped) };
-    return { name: mapped.alg, oid: oid.byName(mapped.alg), curve: mapped.curve || null };
+    return { name: mapped.alg, oid: oid.byName(mapped.alg), curve: mapped.curve || null, parameters: _rowParameters(mapped) };
+  }
+  if (node.majorType === 2) {
+    var r = _oidName(node, code, label);
+    _assertSpecificForm(byInt, r.oid, null, isNative, label);
+    return { name: r.name, oid: r.oid };
   }
-  if (node.majorType === 2) { var r = _oidName(node, code, label); return { name: r.name, oid: r.oid }; }
   if (node.majorType === 4 && node.children && node.children.length === 2) {
     var a = _oidName(node.children[0], code, label);
     if (node.children[1].majorType !== 2) throw _err(code, label + " algorithm parameters must be a CBOR byte string");
     if (node.children[1].content.length === 0) throw _err(code, label + " algorithm parameters must not be an empty byte string; omit them with the bare ~oid form (draft sec. 3.1.3)");
+    _assertSpecificForm(byInt, a.oid, node.children[1].content, isNative, label);
     return { name: a.name, oid: a.oid, parameters: node.children[1].content };
   }
   throw _err(code, label + " is not a C509 AlgorithmIdentifier (int / ~oid / [~oid, params])");
@@ -1298,7 +1356,9 @@ function _sdaFromDer(node) {
     var setNode = attr.children[1];
     if (setNode.tagClass !== "universal" || setNode.tagNumber !== asn1.TAGS.SET || !setNode.children || setNode.children.length < 1) return null;
     var dotted = asn1.read.oid(attr.children[0]);
-    var nm = oid.name(dotted), tint = nm != null ? ATTR_TO_INT[nm] : undefined;
+    var canonAttr = ATTR_NAME_BY_OID[dotted];
+    var nm = canonAttr === undefined ? oid.name(dotted) : canonAttr;
+    var tint = canonAttr === undefined ? undefined : ATTR_TO_INT[canonAttr];
     var intForm = _sdaTryIntForm(tint, nm, setNode.children);
     if (intForm != null) {
       out.push(cbor.build.int(BigInt(intForm.sign < 0 ? -tint : tint)));
@@ -1311,12 +1371,24 @@ function _sdaFromDer(node) {
   return cbor.build.array(out);
 }
 
-function _tryCompactExtValue(name, der) {
+/**
+ * @internal Draft sec. 3.7 for extensions. The specific form was available when the registry names
+ * this extension AND the int form can carry this exact value: a compact-codec extension only when
+ * the codec represents it, and one without a codec always, since its int form carries the same
+ * bytes. An extension the codec cannot represent keeps the generic form on every certificate type.
+ */
+function _assertSpecificExtension(dotted, valContent, isNative) {
+  var canon = EXT_NAME_BY_OID[dotted];
+  if (!isNative || canon === undefined) return;
+  if (EXT_COMPACT[canon] && (!Buffer.isBuffer(valContent) || _tryCompactExtValue(canon, valContent, isNative) == null)) return;
+  throw _err("c509/non-specific-encoding", "extension " + canon + " has a C509 registry id that carries this value, and a natively signed certificate uses only the specific CBOR encoding (draft sec. 3.7)");
+}
+function _tryCompactExtValue(name, der, isNative) {
   var compact = _extValueFromDer(name, der);
   if (compact == null) return null;
   var recon;
   try {
-    recon = _extValueToDer(name, cbor.decode(compact));
+    recon = _extValueToDer(name, cbor.decode(compact), isNative);
   } catch (_e) {
     return null;
   }
@@ -1365,6 +1437,7 @@ function _extensions(node, isNative) {
         if (valNode.majorType !== 2) throw _err("c509/bad-extensions", "a non-critical ~oid extension value must be a byte string");
         valContent = valNode.content;
       }
+      _assertSpecificExtension(extOid, valContent, isNative);
     }
     out.push({ name: name, oid: extOid, critical: critical, value: valContent || null });
   }
@@ -1420,6 +1493,10 @@ function _reconSpki(spkAlg, keyBytes, rsaKey) {
     return b.sequence([b.sequence([b.oid(oid.byName("ecPublicKey")), b.oid(oid.byName(spkAlg.curve))]), b.bitString(point, 0)]);
   }
   if (spkAlg.name === "rsaEncryption") {
+    /** @internal RFC 3279 sec. 2.3.1 fixes rsaEncryption parameters to the DER NULL. */
+    if (!spkAlg.parameters || !spkAlg.parameters.equals(b.nullValue())) {
+      throw _err("c509/bad-spki", "rsaEncryption parameters must be the DER NULL (RFC 3279 sec. 2.3.1); the bare ~oid form carries none");
+    }
     var rsaPk = b.sequence([b.integer(rsaKey.modulus), b.integer(rsaKey.exponent)]);
     return b.sequence([b.sequence([b.oid(oid.byName("rsaEncryption")), b.nullValue()]), b.bitString(rsaPk, 0)]);
   }
@@ -1523,7 +1600,7 @@ function parse(input) {
   var serial = _biguint(serialBytes, "c509/bad-serial", "certificateSerialNumber");
   var sHex = serialBytes.content.toString("hex");
 
-  var sigAlg = _algorithm(f[2], SIG_ALG_BY_INT, "c509/unknown-algorithm", "issuerSignatureAlgorithm");
+  var sigAlg = _algorithm(f[2], SIG_ALG_BY_INT, "c509/unknown-algorithm", "issuerSignatureAlgorithm", type === 2);
   var issuer = _name509(f[3], false, type === 2);
   var notBefore = _time(f[4], false, "validityNotBefore");
   var notAfter = _time(f[5], true, "validityNotAfter");
@@ -1531,7 +1608,7 @@ function parse(input) {
   if (issuer === null && (!subject || !subject.rdns || subject.rdns.length === 0)) {
     throw _err("c509/bad-name", "a self-signed C509 (issuer == subject) requires a non-empty subject, since it is also the issuer (RFC 5280 sec. 4.1.2.4)");
   }
-  var spkAlg = _algorithm(f[7], PK_ALG_BY_INT, "c509/unknown-algorithm", "subjectPublicKeyAlgorithm");
+  var spkAlg = _algorithm(f[7], PK_ALG_BY_INT, "c509/unknown-algorithm", "subjectPublicKeyAlgorithm", type === 2);
   var subjectPublicKey = null, rsaKey = null;
   if (spkAlg.name === "rsaEncryption") {
     if (f[8].majorType === 2) rsaKey = { modulus: _biguint(f[8], "c509/bad-spki", "RSA modulus"), exponent: 65537n };
@@ -1578,29 +1655,41 @@ function matches(node) {
 }
 
 
-var SIG_ALG_TO_INT = Object.assign(Object.create(null), { ecdsaWithSHA256: 0, ecdsaWithSHA384: 1, ecdsaWithSHA512: 2 });
-var PK_ALG_TO_INT = Object.assign(Object.create(null), { rsaEncryption: 0, "ecPublicKey|prime256v1": 1, "ecPublicKey|secp384r1": 2, "ecPublicKey|secp521r1": 3 });
 var ATTR_TO_INT = Object.create(null);
 Object.keys(ATTR_BY_INT).forEach(function (k) { ATTR_TO_INT[ATTR_BY_INT[k]] = Number(k); });
+/** @internal An attribute's C509 registry membership follows its dotted OID, not its display name. */
+var ATTR_NAME_BY_OID = Object.create(null);
+Object.keys(ATTR_BY_INT).forEach(function (k) { ATTR_NAME_BY_OID[oid.byName(ATTR_BY_INT[k])] = ATTR_BY_INT[k]; });
 var EXT_TO_INT = Object.create(null);
 Object.keys(EXT_BY_INT).forEach(function (k) { if (EXT_COMPACT[EXT_BY_INT[k]]) EXT_TO_INT[EXT_BY_INT[k]] = Number(k); });
+/** @internal An extension's C509 registry membership follows its dotted OID, not its display name. */
+var EXT_NAME_BY_OID = Object.create(null);
+Object.keys(EXT_BY_INT).forEach(function (k) { EXT_NAME_BY_OID[oid.byName(EXT_BY_INT[k])] = EXT_BY_INT[k]; });
 
 function _minBytes(n) {
+  if (typeof n !== "bigint") throw _err("c509/bad-serial", "a ~biguint value must be a BigInt, got " + _describe(n));
   if (n < 0n) throw _err("c509/bad-serial", "a ~biguint value must be non-negative");
   if (n === 0n) return Buffer.alloc(0);
   var hex = n.toString(16); if (hex.length % 2) hex = "0" + hex;
   return Buffer.from(hex, "hex");
 }
-function _encAlgorithm(alg, toInt, key) {
-  var i = toInt[key];
-  if (i !== undefined && !(alg.parameters && alg.parameters.length)) return cbor.build.int(BigInt(i));
-  var oidBytes = cbor.build.byteString(asn1.encodeOidContent(alg.oid));
-  if (alg.parameters && alg.parameters.length) return cbor.build.array([oidBytes, cbor.build.byteString(alg.parameters)]);
+function _encAlgorithm(alg, byInt) {
+  var dotted = alg.oid || oid.byName(alg.name);
+  if (!dotted) throw _err("c509/bad-input", "algorithm " + alg.name + " carries no OID and its name is not in the OID registry");
+  var supplied = alg.parameters && alg.parameters.length ? alg.parameters : null;
+  var i = _specificInt(byInt, dotted, supplied, alg.curve);
+  if (i !== undefined) return cbor.build.int(BigInt(i));
+  var oidBytes = cbor.build.byteString(asn1.encodeOidContent(dotted));
+  if (supplied !== null) return cbor.build.array([oidBytes, cbor.build.byteString(supplied)]);
   return oidBytes;
 }
 function _encSpecialText(rdn) {
-  if (rdn.eui64) return cbor.build.tag(48, cbor.build.byteString(rdn.eui64));
-  var v = String(rdn.value);
+  if (rdn.eui64 != null) {
+    if (!Buffer.isBuffer(rdn.eui64)) throw _err("c509/bad-name", "an RDN eui64 must be a Buffer, got " + _describe(rdn.eui64));
+    return cbor.build.tag(48, cbor.build.byteString(rdn.eui64));
+  }
+  if (typeof rdn.value !== "string") throw _err("c509/bad-name", "an RDN value must be a string, got " + _describe(rdn.value));
+  var v = rdn.value;
   if (v.length >= 2 && _isEvenHexLower(v)) return cbor.build.byteString(Buffer.from(v, "hex"));
   return cbor.build.textString(v);
 }
@@ -1610,11 +1699,15 @@ function _encName(name, isSubject) {
     throw _err("c509/bad-name", "the subject Name is required");
   }
   var rdns = name.rdns || [];
+  _assertDense(rdns, "c509/bad-name", "the rdns array");
+  rdns.forEach(function (rdn) {
+    if (!rdn || typeof rdn !== "object") throw _err("c509/bad-name", "each RDN must be an object, got " + _describe(rdn));
+  });
   if (rdns.length === 1 && rdns[0].type === "commonName" && !rdns[0].printable) return _encSpecialText(rdns[0]);
   var items = [];
   rdns.forEach(function (rdn) {
     var ai = ATTR_TO_INT[rdn.type];
-    if (ai === undefined) throw _err("c509/bad-name", "attribute type " + rdn.type + " has no C509 registry int");
+    if (ai === undefined) throw _err("c509/bad-name", "attribute type " + _describe(rdn.type) + " has no C509 registry int");
     items.push(cbor.build.int(BigInt(rdn.printable ? -ai : ai)));
     items.push(_encSpecialText(rdn));
   });
@@ -1629,19 +1722,52 @@ function _encSpk(r) {
   if (!Buffer.isBuffer(r.subjectPublicKey)) throw _err("c509/bad-spki", "the subjectPublicKey bytes are missing");
   return cbor.build.byteString(r.subjectPublicKey);
 }
-function _encExtensions(exts) {
-  if (exts.length === 1 && exts[0].name === "keyUsage" && typeof exts[0].keyUsageBits === "number") {
-    return cbor.build.int(BigInt(exts[0].critical ? -exts[0].keyUsageBits : exts[0].keyUsageBits));
+/** @internal An extension names itself by name, by OID, or by both; the registry is keyed by name. */
+function _extIdentity(ext) {
+  var dotted = ext.oid || (typeof ext.name === "string" ? oid.byName(ext.name) : null);
+  var canon = dotted ? EXT_NAME_BY_OID[dotted] : undefined;
+  if (canon !== undefined) return { dotted: dotted, name: canon };
+  return { dotted: dotted, name: typeof ext.name === "string" ? ext.name : (dotted ? oid.name(dotted) : null) };
+}
+/**
+ * @internal The bits a lone keyUsage is written as. Derived from a DER value only when the compact
+ * form reproduces that value byte for byte, since the bare integer covers the nine defined bits and
+ * a wider BIT STRING would lose the rest.
+ */
+function _extKeyUsageBits(ext, isNative) {
+  if (typeof ext.keyUsageBits === "number") return ext.keyUsageBits;
+  if (!Buffer.isBuffer(ext.value) || _tryCompactExtValue("keyUsage", ext.value, isNative) == null) return null;
+  return _keyUsageBitsFromDer(ext.value);
+}
+function _encExtensions(exts, isNative) {
+  _assertDense(exts, "c509/bad-input", "the extensions array");
+  exts.forEach(function (ext) {
+    if (!ext || typeof ext !== "object") throw _err("c509/bad-input", "each extension must be an object, got " + _describe(ext));
+    if (ext.oid != null) {
+      if (typeof ext.oid !== "string") throw _err("c509/bad-input", "an extension oid must be a dotted-decimal string, got " + _describe(ext.oid));
+      try { asn1.encodeOidContent(ext.oid); }
+      catch (_oe) { throw _err("c509/bad-input", "an extension oid must be a dotted-decimal string, got " + _describe(ext.oid), _oe); }
+    }
+    if (ext.keyUsageBits != null && (typeof ext.keyUsageBits !== "number" || !Number.isSafeInteger(ext.keyUsageBits))) {
+      throw _err("c509/bad-extensions", "keyUsageBits must be a safe integer, got " + _describe(ext.keyUsageBits));
+    }
+  });
+  if (exts.length === 1 && _extIdentity(exts[0]).name === "keyUsage") {
+    var onlyBits = _extKeyUsageBits(exts[0], isNative);
+    if (typeof onlyBits === "number") return cbor.build.int(BigInt(exts[0].critical ? -onlyBits : onlyBits));
   }
   var items = [];
   exts.forEach(function (ext) {
-    var ei = EXT_TO_INT[ext.name];
-    var compact = (ei !== undefined && Buffer.isBuffer(ext.value)) ? _tryCompactExtValue(ext.name, ext.value) : null;
+    var ident = _extIdentity(ext);
+    var extDotted = ident.dotted, extName = ident.name;
+    var ei = extName == null ? undefined : EXT_TO_INT[extName];
+    var compact = (ei !== undefined && Buffer.isBuffer(ext.value)) ? _tryCompactExtValue(extName, ext.value, isNative) : null;
     if (compact != null) {
       items.push(cbor.build.int(BigInt(ext.critical ? -ei : ei)));
       items.push(compact);
     } else {
-      items.push(cbor.build.byteString(asn1.encodeOidContent(ext.oid || oid.byName(ext.name))));
+      if (!extDotted) throw _err("c509/bad-input", "an extension must carry an OID or a name in the OID registry, got " + _describe(ext.name));
+      items.push(cbor.build.byteString(asn1.encodeOidContent(extDotted)));
       if (!Buffer.isBuffer(ext.value)) throw _err("c509/non-invertible", "extension " + (ext.oid || ext.name) + " has no byte-string value to encode");
       var bs = cbor.build.byteString(ext.value);
       items.push(ext.critical ? cbor.build.array([bs]) : bs);
@@ -1673,18 +1799,17 @@ function _encodeC509Array(r) {
     return out;
   }
   _requireResultShape(r);
-  var pkKey = r.subjectPublicKeyAlgorithm.curve ? r.subjectPublicKeyAlgorithm.name + "|" + r.subjectPublicKeyAlgorithm.curve : r.subjectPublicKeyAlgorithm.name;
   var arr = cbor.build.array([
     cbor.build.int(BigInt(r.certificateType)),
     cbor.build.byteString(r.serialNumberHex != null ? _hexBytes(r.serialNumberHex, "c509/bad-serial", "serialNumberHex") : _minBytes(r.serialNumber)),
-    _encAlgorithm(r.signatureAlgorithm, SIG_ALG_TO_INT, r.signatureAlgorithm.name),
+    _encAlgorithm(r.signatureAlgorithm, SIG_ALG_BY_INT),
     _encName(r.issuer, false),
     _validityUint(r.validity.notBefore, "validityNotBefore"),
     r.validity.notAfter === null ? cbor.build.nullValue() : _validityUint(r.validity.notAfter, "validityNotAfter"),
     _encName(r.subject, true),
-    _encAlgorithm(r.subjectPublicKeyAlgorithm, PK_ALG_TO_INT, pkKey),
+    _encAlgorithm(r.subjectPublicKeyAlgorithm, PK_ALG_BY_INT),
     _encSpk(r),
-    _encExtensions(r.extensions),
+    _encExtensions(r.extensions, Number(r.certificateType) === 2),
     cbor.build.byteString(r.signatureValue),
   ]);
   parse(arr);
@@ -1748,7 +1873,9 @@ function _c509NameFromDer(nameBytes) {
   (node.children || []).forEach(function (rdnSet) {
     if (!rdnSet.children || rdnSet.children.length !== 1) throw _err("c509/non-invertible", "a C509 Name requires single-attribute RDNs");
     var attr = rdnSet.children[0];
-    var attrName = oid.name(asn1.read.oid(attr.children[0]));
+    var attrDotted = asn1.read.oid(attr.children[0]);
+    var attrCanon = ATTR_NAME_BY_OID[attrDotted];
+    var attrName = attrCanon === undefined ? oid.name(attrDotted) : attrCanon;
     if (attrName == null || ATTR_TO_INT[attrName] === undefined) throw _err("c509/non-invertible", "attribute type " + attrName + " has no C509 registry integer");
     var valNode = attr.children[1];
     var value;
@@ -1795,19 +1922,19 @@ function _minCurveForMag(mag) {
   for (var i = 0; i < CURVE_ORDER.length; i++) { if (mag <= WEBCRYPTO_FIELD_BYTES[CURVE_ORDER[i]]) return CURVE_ORDER[i]; }
   return null;
 }
-function _resolveIssuerSigCurve(c, opts) {
+function _resolveIssuerSigCurve(c, opts, sigAlgName) {
   var mag = _sigMagWidth(c.signatureValue.bytes), curve;
   if (opts && opts.issuerCurve != null) {
     curve = String(opts.issuerCurve);
     if (NODE_TO_WEBCRYPTO[curve]) curve = NODE_TO_WEBCRYPTO[curve];
     if (!WEBCRYPTO_FIELD_BYTES[curve]) throw _err("c509/bad-input", "opts.issuerCurve must be P-256 / P-384 / P-521 (or prime256v1 / secp384r1 / secp521r1); got " + opts.issuerCurve);
   } else {
-    curve = SIG_ALG_TO_CURVE[c.signatureAlgorithm.name];
-    if (!curve) throw _err("c509/non-invertible", "cannot resolve the issuer signing curve for signature algorithm " + c.signatureAlgorithm.name);
+    curve = SIG_ALG_TO_CURVE[sigAlgName];
+    if (!curve) throw _err("c509/non-invertible", "cannot resolve the issuer signing curve for signature algorithm " + sigAlgName);
     var minCurve = _minCurveForMag(mag);
     if (!minCurve) throw _err("c509/non-invertible", "the ECDSA signature r/s width " + mag + " exceeds every supported curve field");
-    if (WEBCRYPTO_FIELD_BYTES[curve] < mag) throw _err("c509/non-invertible", "the issuer signed with a non-standard digest/curve pairing (r/s width " + mag + " exceeds the " + curve + " field implied by " + c.signatureAlgorithm.name + "); pass opts.issuerCurve (P-256 / P-384 / P-521)");
-    if (WEBCRYPTO_FIELD_BYTES[curve] > WEBCRYPTO_FIELD_BYTES[minCurve]) throw _err("c509/non-invertible", "signature algorithm " + c.signatureAlgorithm.name + " does not uniquely determine the issuer curve (r/s width " + mag + " also fits " + minCurve + "); pass opts.issuerCurve (P-256 / P-384 / P-521)");
+    if (WEBCRYPTO_FIELD_BYTES[curve] < mag) throw _err("c509/non-invertible", "the issuer signed with a non-standard digest/curve pairing (r/s width " + mag + " exceeds the " + curve + " field implied by " + sigAlgName + "); pass opts.issuerCurve (P-256 / P-384 / P-521)");
+    if (WEBCRYPTO_FIELD_BYTES[curve] > WEBCRYPTO_FIELD_BYTES[minCurve]) throw _err("c509/non-invertible", "signature algorithm " + sigAlgName + " does not uniquely determine the issuer curve (r/s width " + mag + " also fits " + minCurve + "); pass opts.issuerCurve (P-256 / P-384 / P-521)");
   }
   if (mag > WEBCRYPTO_FIELD_BYTES[curve]) throw _err("c509/non-invertible", "the ECDSA signature r/s width " + mag + " does not fit the resolved " + curve + " field");
   return curve;
@@ -1822,13 +1949,16 @@ _derToType3 = function (input, opts) {
   var c;
   try { c = x509.parse(input); } catch (e) { throw _err("c509/bad-input", "the input is not a valid X.509 certificate", e); }
   if (c.version !== 3) throw _err("c509/non-invertible", "C509 covers X.509 v3 certificates; got v" + c.version);
-  if (String(c.signatureAlgorithm.name || "").toLowerCase().indexOf("ecdsa") !== 0) throw _err("c509/non-invertible", "type-3 C509 encoding covers only ECDSA-signed certificates; got " + (c.signatureAlgorithm.name || "an unregistered algorithm"));
-  if (c.subjectPublicKeyInfo.algorithm.name !== "ecPublicKey") throw _err("c509/non-invertible", "type-3 C509 encoding covers only EC (ecPublicKey) certificates in v1; got " + (c.subjectPublicKeyInfo.algorithm.name || "an unregistered algorithm"));
+  var sigCanon = SIG_ALG_BY_OID[c.signatureAlgorithm.oid];
+  var sigAlgName = sigCanon === undefined ? c.signatureAlgorithm.name : sigCanon;
+  if (String(sigAlgName || "").toLowerCase().indexOf("ecdsa") !== 0) throw _err("c509/non-invertible", "type-3 C509 encoding covers only ECDSA-signed certificates; got " + (sigAlgName || "an unregistered algorithm"));
+  if (c.subjectPublicKeyInfo.algorithm.oid !== oid.byName("ecPublicKey")) throw _err("c509/non-invertible", "type-3 C509 encoding covers only EC (ecPublicKey) certificates in v1; got " + (c.subjectPublicKeyInfo.algorithm.name || "an unregistered algorithm"));
   var curveOid = asn1.read.oid(asn1.decode(c.subjectPublicKeyInfo.algorithm.parameters));
-  var curve = oid.name(curveOid);
+  var curveCanon = EC_CURVE_BY_OID[curveOid];
+  var curve = curveCanon === undefined ? oid.name(curveOid) : curveCanon;
   var coordLen = EC_FIELD_BYTES[curve];
   if (!coordLen) throw _err("c509/non-invertible", "unsupported EC subject curve " + (curve || curveOid));
-  var sigCurve = _resolveIssuerSigCurve(c, opts);
+  var sigCurve = _resolveIssuerSigCurve(c, opts, sigAlgName);
   var spkiNode = asn1.decode(c.subjectPublicKeyInfo.bytes);
   return {
     certificateType: 3,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.35",
+  "version": "0.6.37",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3601ee14-7f92-4a66-bdb2-bab4e6360e45",
+  "serialNumber": "urn:uuid:82faf919-c224-4430-992b-dd3055e65ed3",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-04T23:41:31.757Z",
+    "timestamp": "2026-09-05T03:43:35.188Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.35",
+      "bom-ref": "@blamejs/pki@0.6.37",
       "type": "application",
       "name": "pki",
-      "version": "0.6.35",
+      "version": "0.6.37",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.35",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.37",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.35",
+      "ref": "@blamejs/pki@0.6.37",
       "dependsOn": []
     }
   ]