@blamejs/pki 0.6.36 → 0.6.37

package/CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.37 — 2026-09-05
+
+A natively signed C509 certificate is refused when it writes an extension in the generic OID form that the registry can carry as an identifier.
+
+### Fixed
+
+- pki.schema.c509.parse refuses a natively signed certificate (c509CertificateType 2) that writes an extension as an OID and a DER value when a C509 registry identifier carries the same extension value. Draft section 3.7 reserves the generic form for re-encoded certificates, where it stays accepted. An extension whose OID has no registry identifier, and one whose value the compact encodings cannot represent under that certificate type's rules, both keep the generic form.
+- pki.schema.c509.encode chooses an extension's form under the rules of the certificate type it is writing. It previously judged whether a value could be written compactly using the rules for a re-encoded certificate, so a natively signed certificate could be given a compact form its own decoder does not accept.
+- pki.schema.c509.encode resolves an extension named only by its OID to the matching registry identifier. It looked the identifier up by name alone, so an extension supplied without one was written in the generic OID form even where a compact encoding carried it.
+- pki.schema.c509 decides what belongs to the C509 registries by dotted OID rather than by the name pki.oid.register maps that OID to. Registering a different name for a built-in OID previously changed what the toolkit emitted for an unrelated certificate, and for commonName, a curve, ecPublicKey or an ECDSA signature algorithm it stopped a certificate converting to C509 at all.
+
 ## v0.6.36 — 2026-09-04
 
 A natively signed C509 certificate is refused when it spells an algorithm generically instead of using the registry entry that names the same value.

package/lib/schema-c509.js

@@ -63,6 +63,11 @@ var PK_ALG_BY_INT = {
   3: { alg: _name("ecPublicKey"), curve: _name("secp521r1") },
 };
 var EC_FIELD_BYTES = Object.assign(Object.create(null), { "prime256v1": 32, "secp384r1": 48, "secp521r1": 66 });
+/** @internal Curve identity follows the dotted OID; pki.oid.register can rename one at any time. */
+var EC_CURVE_BY_OID = Object.create(null);
+Object.keys(EC_FIELD_BYTES).forEach(function (n) { EC_CURVE_BY_OID[oid.byName(n)] = n; });
+var SIG_ALG_BY_OID = Object.create(null);
+Object.keys(SIG_ALG_BY_INT).forEach(function (k) { SIG_ALG_BY_OID[oid.byName(SIG_ALG_BY_INT[k])] = SIG_ALG_BY_INT[k]; });
 
 var ATTR_BY_INT = {
   0: _name("emailAddress"),
@@ -1351,7 +1356,9 @@ function _sdaFromDer(node) {
     var setNode = attr.children[1];
     if (setNode.tagClass !== "universal" || setNode.tagNumber !== asn1.TAGS.SET || !setNode.children || setNode.children.length < 1) return null;
     var dotted = asn1.read.oid(attr.children[0]);
-    var nm = oid.name(dotted), tint = nm != null ? ATTR_TO_INT[nm] : undefined;
+    var canonAttr = ATTR_NAME_BY_OID[dotted];
+    var nm = canonAttr === undefined ? oid.name(dotted) : canonAttr;
+    var tint = canonAttr === undefined ? undefined : ATTR_TO_INT[canonAttr];
     var intForm = _sdaTryIntForm(tint, nm, setNode.children);
     if (intForm != null) {
       out.push(cbor.build.int(BigInt(intForm.sign < 0 ? -tint : tint)));
@@ -1364,12 +1371,24 @@ function _sdaFromDer(node) {
   return cbor.build.array(out);
 }
 
-function _tryCompactExtValue(name, der) {
+/**
+ * @internal Draft sec. 3.7 for extensions. The specific form was available when the registry names
+ * this extension AND the int form can carry this exact value: a compact-codec extension only when
+ * the codec represents it, and one without a codec always, since its int form carries the same
+ * bytes. An extension the codec cannot represent keeps the generic form on every certificate type.
+ */
+function _assertSpecificExtension(dotted, valContent, isNative) {
+  var canon = EXT_NAME_BY_OID[dotted];
+  if (!isNative || canon === undefined) return;
+  if (EXT_COMPACT[canon] && (!Buffer.isBuffer(valContent) || _tryCompactExtValue(canon, valContent, isNative) == null)) return;
+  throw _err("c509/non-specific-encoding", "extension " + canon + " has a C509 registry id that carries this value, and a natively signed certificate uses only the specific CBOR encoding (draft sec. 3.7)");
+}
+function _tryCompactExtValue(name, der, isNative) {
   var compact = _extValueFromDer(name, der);
   if (compact == null) return null;
   var recon;
   try {
-    recon = _extValueToDer(name, cbor.decode(compact));
+    recon = _extValueToDer(name, cbor.decode(compact), isNative);
   } catch (_e) {
     return null;
   }
@@ -1418,6 +1437,7 @@ function _extensions(node, isNative) {
         if (valNode.majorType !== 2) throw _err("c509/bad-extensions", "a non-critical ~oid extension value must be a byte string");
         valContent = valNode.content;
       }
+      _assertSpecificExtension(extOid, valContent, isNative);
     }
     out.push({ name: name, oid: extOid, critical: critical, value: valContent || null });
   }
@@ -1637,8 +1657,14 @@ function matches(node) {
 
 var ATTR_TO_INT = Object.create(null);
 Object.keys(ATTR_BY_INT).forEach(function (k) { ATTR_TO_INT[ATTR_BY_INT[k]] = Number(k); });
+/** @internal An attribute's C509 registry membership follows its dotted OID, not its display name. */
+var ATTR_NAME_BY_OID = Object.create(null);
+Object.keys(ATTR_BY_INT).forEach(function (k) { ATTR_NAME_BY_OID[oid.byName(ATTR_BY_INT[k])] = ATTR_BY_INT[k]; });
 var EXT_TO_INT = Object.create(null);
 Object.keys(EXT_BY_INT).forEach(function (k) { if (EXT_COMPACT[EXT_BY_INT[k]]) EXT_TO_INT[EXT_BY_INT[k]] = Number(k); });
+/** @internal An extension's C509 registry membership follows its dotted OID, not its display name. */
+var EXT_NAME_BY_OID = Object.create(null);
+Object.keys(EXT_BY_INT).forEach(function (k) { EXT_NAME_BY_OID[oid.byName(EXT_BY_INT[k])] = EXT_BY_INT[k]; });
 
 function _minBytes(n) {
   if (typeof n !== "bigint") throw _err("c509/bad-serial", "a ~biguint value must be a BigInt, got " + _describe(n));
@@ -1696,7 +1722,24 @@ function _encSpk(r) {
   if (!Buffer.isBuffer(r.subjectPublicKey)) throw _err("c509/bad-spki", "the subjectPublicKey bytes are missing");
   return cbor.build.byteString(r.subjectPublicKey);
 }
-function _encExtensions(exts) {
+/** @internal An extension names itself by name, by OID, or by both; the registry is keyed by name. */
+function _extIdentity(ext) {
+  var dotted = ext.oid || (typeof ext.name === "string" ? oid.byName(ext.name) : null);
+  var canon = dotted ? EXT_NAME_BY_OID[dotted] : undefined;
+  if (canon !== undefined) return { dotted: dotted, name: canon };
+  return { dotted: dotted, name: typeof ext.name === "string" ? ext.name : (dotted ? oid.name(dotted) : null) };
+}
+/**
+ * @internal The bits a lone keyUsage is written as. Derived from a DER value only when the compact
+ * form reproduces that value byte for byte, since the bare integer covers the nine defined bits and
+ * a wider BIT STRING would lose the rest.
+ */
+function _extKeyUsageBits(ext, isNative) {
+  if (typeof ext.keyUsageBits === "number") return ext.keyUsageBits;
+  if (!Buffer.isBuffer(ext.value) || _tryCompactExtValue("keyUsage", ext.value, isNative) == null) return null;
+  return _keyUsageBitsFromDer(ext.value);
+}
+function _encExtensions(exts, isNative) {
   _assertDense(exts, "c509/bad-input", "the extensions array");
   exts.forEach(function (ext) {
     if (!ext || typeof ext !== "object") throw _err("c509/bad-input", "each extension must be an object, got " + _describe(ext));
@@ -1709,18 +1752,20 @@ function _encExtensions(exts) {
       throw _err("c509/bad-extensions", "keyUsageBits must be a safe integer, got " + _describe(ext.keyUsageBits));
     }
   });
-  if (exts.length === 1 && exts[0].name === "keyUsage" && typeof exts[0].keyUsageBits === "number") {
-    return cbor.build.int(BigInt(exts[0].critical ? -exts[0].keyUsageBits : exts[0].keyUsageBits));
+  if (exts.length === 1 && _extIdentity(exts[0]).name === "keyUsage") {
+    var onlyBits = _extKeyUsageBits(exts[0], isNative);
+    if (typeof onlyBits === "number") return cbor.build.int(BigInt(exts[0].critical ? -onlyBits : onlyBits));
   }
   var items = [];
   exts.forEach(function (ext) {
-    var ei = EXT_TO_INT[ext.name];
-    var compact = (ei !== undefined && Buffer.isBuffer(ext.value)) ? _tryCompactExtValue(ext.name, ext.value) : null;
+    var ident = _extIdentity(ext);
+    var extDotted = ident.dotted, extName = ident.name;
+    var ei = extName == null ? undefined : EXT_TO_INT[extName];
+    var compact = (ei !== undefined && Buffer.isBuffer(ext.value)) ? _tryCompactExtValue(extName, ext.value, isNative) : null;
     if (compact != null) {
       items.push(cbor.build.int(BigInt(ext.critical ? -ei : ei)));
       items.push(compact);
     } else {
-      var extDotted = ext.oid || (typeof ext.name === "string" ? oid.byName(ext.name) : null);
       if (!extDotted) throw _err("c509/bad-input", "an extension must carry an OID or a name in the OID registry, got " + _describe(ext.name));
       items.push(cbor.build.byteString(asn1.encodeOidContent(extDotted)));
       if (!Buffer.isBuffer(ext.value)) throw _err("c509/non-invertible", "extension " + (ext.oid || ext.name) + " has no byte-string value to encode");
@@ -1764,7 +1809,7 @@ function _encodeC509Array(r) {
     _encName(r.subject, true),
     _encAlgorithm(r.subjectPublicKeyAlgorithm, PK_ALG_BY_INT),
     _encSpk(r),
-    _encExtensions(r.extensions),
+    _encExtensions(r.extensions, Number(r.certificateType) === 2),
     cbor.build.byteString(r.signatureValue),
   ]);
   parse(arr);
@@ -1828,7 +1873,9 @@ function _c509NameFromDer(nameBytes) {
   (node.children || []).forEach(function (rdnSet) {
     if (!rdnSet.children || rdnSet.children.length !== 1) throw _err("c509/non-invertible", "a C509 Name requires single-attribute RDNs");
     var attr = rdnSet.children[0];
-    var attrName = oid.name(asn1.read.oid(attr.children[0]));
+    var attrDotted = asn1.read.oid(attr.children[0]);
+    var attrCanon = ATTR_NAME_BY_OID[attrDotted];
+    var attrName = attrCanon === undefined ? oid.name(attrDotted) : attrCanon;
     if (attrName == null || ATTR_TO_INT[attrName] === undefined) throw _err("c509/non-invertible", "attribute type " + attrName + " has no C509 registry integer");
     var valNode = attr.children[1];
     var value;
@@ -1875,19 +1922,19 @@ function _minCurveForMag(mag) {
   for (var i = 0; i < CURVE_ORDER.length; i++) { if (mag <= WEBCRYPTO_FIELD_BYTES[CURVE_ORDER[i]]) return CURVE_ORDER[i]; }
   return null;
 }
-function _resolveIssuerSigCurve(c, opts) {
+function _resolveIssuerSigCurve(c, opts, sigAlgName) {
   var mag = _sigMagWidth(c.signatureValue.bytes), curve;
   if (opts && opts.issuerCurve != null) {
     curve = String(opts.issuerCurve);
     if (NODE_TO_WEBCRYPTO[curve]) curve = NODE_TO_WEBCRYPTO[curve];
     if (!WEBCRYPTO_FIELD_BYTES[curve]) throw _err("c509/bad-input", "opts.issuerCurve must be P-256 / P-384 / P-521 (or prime256v1 / secp384r1 / secp521r1); got " + opts.issuerCurve);
   } else {
-    curve = SIG_ALG_TO_CURVE[c.signatureAlgorithm.name];
-    if (!curve) throw _err("c509/non-invertible", "cannot resolve the issuer signing curve for signature algorithm " + c.signatureAlgorithm.name);
+    curve = SIG_ALG_TO_CURVE[sigAlgName];
+    if (!curve) throw _err("c509/non-invertible", "cannot resolve the issuer signing curve for signature algorithm " + sigAlgName);
     var minCurve = _minCurveForMag(mag);
     if (!minCurve) throw _err("c509/non-invertible", "the ECDSA signature r/s width " + mag + " exceeds every supported curve field");
-    if (WEBCRYPTO_FIELD_BYTES[curve] < mag) throw _err("c509/non-invertible", "the issuer signed with a non-standard digest/curve pairing (r/s width " + mag + " exceeds the " + curve + " field implied by " + c.signatureAlgorithm.name + "); pass opts.issuerCurve (P-256 / P-384 / P-521)");
-    if (WEBCRYPTO_FIELD_BYTES[curve] > WEBCRYPTO_FIELD_BYTES[minCurve]) throw _err("c509/non-invertible", "signature algorithm " + c.signatureAlgorithm.name + " does not uniquely determine the issuer curve (r/s width " + mag + " also fits " + minCurve + "); pass opts.issuerCurve (P-256 / P-384 / P-521)");
+    if (WEBCRYPTO_FIELD_BYTES[curve] < mag) throw _err("c509/non-invertible", "the issuer signed with a non-standard digest/curve pairing (r/s width " + mag + " exceeds the " + curve + " field implied by " + sigAlgName + "); pass opts.issuerCurve (P-256 / P-384 / P-521)");
+    if (WEBCRYPTO_FIELD_BYTES[curve] > WEBCRYPTO_FIELD_BYTES[minCurve]) throw _err("c509/non-invertible", "signature algorithm " + sigAlgName + " does not uniquely determine the issuer curve (r/s width " + mag + " also fits " + minCurve + "); pass opts.issuerCurve (P-256 / P-384 / P-521)");
   }
   if (mag > WEBCRYPTO_FIELD_BYTES[curve]) throw _err("c509/non-invertible", "the ECDSA signature r/s width " + mag + " does not fit the resolved " + curve + " field");
   return curve;
@@ -1902,13 +1949,16 @@ _derToType3 = function (input, opts) {
   var c;
   try { c = x509.parse(input); } catch (e) { throw _err("c509/bad-input", "the input is not a valid X.509 certificate", e); }
   if (c.version !== 3) throw _err("c509/non-invertible", "C509 covers X.509 v3 certificates; got v" + c.version);
-  if (String(c.signatureAlgorithm.name || "").toLowerCase().indexOf("ecdsa") !== 0) throw _err("c509/non-invertible", "type-3 C509 encoding covers only ECDSA-signed certificates; got " + (c.signatureAlgorithm.name || "an unregistered algorithm"));
-  if (c.subjectPublicKeyInfo.algorithm.name !== "ecPublicKey") throw _err("c509/non-invertible", "type-3 C509 encoding covers only EC (ecPublicKey) certificates in v1; got " + (c.subjectPublicKeyInfo.algorithm.name || "an unregistered algorithm"));
+  var sigCanon = SIG_ALG_BY_OID[c.signatureAlgorithm.oid];
+  var sigAlgName = sigCanon === undefined ? c.signatureAlgorithm.name : sigCanon;
+  if (String(sigAlgName || "").toLowerCase().indexOf("ecdsa") !== 0) throw _err("c509/non-invertible", "type-3 C509 encoding covers only ECDSA-signed certificates; got " + (sigAlgName || "an unregistered algorithm"));
+  if (c.subjectPublicKeyInfo.algorithm.oid !== oid.byName("ecPublicKey")) throw _err("c509/non-invertible", "type-3 C509 encoding covers only EC (ecPublicKey) certificates in v1; got " + (c.subjectPublicKeyInfo.algorithm.name || "an unregistered algorithm"));
   var curveOid = asn1.read.oid(asn1.decode(c.subjectPublicKeyInfo.algorithm.parameters));
-  var curve = oid.name(curveOid);
+  var curveCanon = EC_CURVE_BY_OID[curveOid];
+  var curve = curveCanon === undefined ? oid.name(curveOid) : curveCanon;
   var coordLen = EC_FIELD_BYTES[curve];
   if (!coordLen) throw _err("c509/non-invertible", "unsupported EC subject curve " + (curve || curveOid));
-  var sigCurve = _resolveIssuerSigCurve(c, opts);
+  var sigCurve = _resolveIssuerSigCurve(c, opts, sigAlgName);
   var spkiNode = asn1.decode(c.subjectPublicKeyInfo.bytes);
   return {
     certificateType: 3,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.36",
+  "version": "0.6.37",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:8d50e6dd-1ddf-46f8-b8db-ed97195096c3",
+  "serialNumber": "urn:uuid:82faf919-c224-4430-992b-dd3055e65ed3",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-05T01:58:33.232Z",
+    "timestamp": "2026-09-05T03:43:35.188Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.36",
+      "bom-ref": "@blamejs/pki@0.6.37",
       "type": "application",
       "name": "pki",
-      "version": "0.6.36",
+      "version": "0.6.37",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.36",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.37",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.36",
+      "ref": "@blamejs/pki@0.6.37",
       "dependsOn": []
     }
   ]