@blamejs/pki 0.6.47 → 0.6.49

package/lib/cmc-verify.js

@@ -261,7 +261,9 @@ function _governingStatus(statuses, outcome) {
  *   - `dataReturn` (Buffer) -- the Data Return payload the request sent, echoed verbatim.
  *   - `certs` (Buffer[]) -- extra certificates for signer lookup, for a message that does not carry
  *     its own signer; the certificates the message carries are searched either way.
- *   - `recipient` (object) -- key material for an AuthenticatedData carrier, in the shape
+ *   - `recipient` (object) -- `{ identifier, secret }` for a response MACed under the shared secret
+ *     the client enrolled with, which derives the key the way RFC 5272 sec. 3.2(c) states, or key
+ *     material for an AuthenticatedData carrier, in the shape
  *     `pki.cms.decrypt` takes. Its MAC is then checked and the verdict reports
  *     `signatureVerified: true`; the content it authenticates is bound to the content the verdict
  *     was read from, so a MAC over other bytes cannot stand in for it.
@@ -288,14 +290,29 @@ function _governingStatus(statuses, outcome) {
  *   v.boundToRequest;      // false: nothing ties this response to a request either
  */
 function verify(response, sent) {
-  var frozenResponse, frozenSent;
+  var frozenResponse, frozenSent, ownedSecret = null;
+  /** @internal The options snapshot owns a copy of a byte-valued shared secret from the moment it is
+   * taken, so it is wiped when the verification settles however it settles: a malformed response, a
+   * carrier that never needed the secret, a refusal on the way to the MAC, and a failure in the rest
+   * of this prologue all reach here. A failure DURING the snapshot is cleared by the snapshot itself,
+   * which is the only place that can still reach a half-built copy. The caller's own buffer is theirs
+   * and is never touched. */
+  function _wipeOwnedSecret() {
+    if (ownedSecret) guard.secret.zeroize(ownedSecret, CmcError, "cmc/bad-input", "the shared-secret copy");
+    ownedSecret = null;
+  }
   try {
     frozenSent = _snapshotSent(_assertOpts(sent));
+    ownedSecret = frozenSent.recipient && guard.bytes.isByteSource(frozenSent.recipient.secret)
+      ? frozenSent.recipient.secret : null;
     frozenResponse = _snapshotIfBytes(response);
   } catch (e) {
+    _wipeOwnedSecret();
     return Promise.reject(e);
   }
-  return guard.async.deferred(function () { return _verify(frozenResponse, frozenSent); });
+  return guard.async.deferred(function () { return _verify(frozenResponse, frozenSent); })
+    .then(function (v) { _wipeOwnedSecret(); return v; },
+      function (e) { _wipeOwnedSecret(); throw e; });
 }
 
 function _assertOpts(sent) {
@@ -330,18 +347,30 @@ function _snapshotSent(sent) {
   if (Array.isArray(out.bodyPartPaths)) {
     out.bodyPartPaths = out.bodyPartPaths.map(function (p) { return Array.isArray(p) ? p.slice() : p; });
   }
-  if (out.recipient && typeof out.recipient === "object") {
-    var r = intrinsic.create(null), rk;
-    for (rk in out.recipient) {
-      if (!_hasOwn(out.recipient, rk)) continue;
-      r[rk] = _copyAnyBytes(out.recipient[rk]);
+  /** @internal Once a copy of a shared secret exists, EVERYTHING that follows is protected, to the
+   * return: the remaining copies, the last option reads, all of it. A caller field is read through
+   * whatever accessor the caller wrote, so any of these steps can throw, and the copy would then be
+   * left behind with nothing holding it. Guarding one step at a time is what let three earlier
+   * versions of this each miss the next one. */
+  var takenSecret = null;
+  try {
+    if (out.recipient && typeof out.recipient === "object") {
+      var r = intrinsic.create(null), rk;
+      for (rk in out.recipient) {
+        if (!_hasOwn(out.recipient, rk)) continue;
+        r[rk] = _copyAnyBytes(out.recipient[rk]);
+        if (rk === "secret" && guard.bytes.isByteSource(r[rk])) takenSecret = r[rk];
+      }
+      out.recipient = r;
     }
-    out.recipient = r;
+    if (Array.isArray(out.certs)) out.certs = out.certs.map(_copyAnyBytes);
+    out.allowUnverified = sent.allowUnverified === true;
+    out.allowUnbound = sent.allowUnbound === true;
+    return out;
+  } catch (e) {
+    if (takenSecret) guard.secret.zeroize(takenSecret, CmcError, "cmc/bad-input", "the shared-secret copy");
+    throw e;
   }
-  if (Array.isArray(out.certs)) out.certs = out.certs.map(_copyAnyBytes);
-  out.allowUnverified = sent.allowUnverified === true;
-  out.allowUnbound = sent.allowUnbound === true;
-  return out;
 }
 
 function _verify(response, sent) {
@@ -368,10 +397,28 @@ function _assertAuthentic(body, sent, responseBytes) {
             "authenticating an AuthenticatedData response needs the response as DER bytes or PEM, " +
             "because its MAC is computed over them -- pass the encoded response rather than a parsed one");
         }
-        return cmsDecrypt.decrypt(responseBytes, sent.recipient).then(null, function (e) {
-          throw E("cmc/unverified-response",
-            "the AuthenticatedData response did not authenticate under the supplied recipient key", e);
-        }).then(function (res) {
+        /** @internal A caller naming the shared secret it enrolled with gets the sec. 3.2(c) derivation
+         * from the same function the producer uses, rather than deriving it again by hand. Raw key
+         * material is still taken as it was, which is what an implementation that derived the key
+         * itself supplies. */
+        var recipient = sent.recipient, derivedKey = null;
+        /** @internal The concatenation this derivation owns. The secret copy it was built from belongs
+         * to the options snapshot, which `verify` wipes when the verification settles. */
+        function _wipeDerived() {
+          if (derivedKey) guard.secret.zeroize(derivedKey, CmcError, "cmc/bad-input", "the derived shared-secret key");
+          derivedKey = null;
+        }
+        if (recipient && typeof recipient === "object" && recipient.mac == null &&
+            (recipient.identifier != null || recipient.secret != null) && recipient.password == null) {
+          derivedKey = cmcBuild.macPassword(recipient);
+          recipient = { password: derivedKey };
+        }
+        return cmsDecrypt.decrypt(responseBytes, recipient).then(function (r) { _wipeDerived(); return r; },
+          function (e) {
+            _wipeDerived();
+            throw E("cmc/unverified-response",
+              "the AuthenticatedData response did not authenticate under the supplied recipient key", e);
+          }).then(function (res) {
           if (!res || res.authenticated !== true) {
             throw E("cmc/unverified-response", "the AuthenticatedData response did not authenticate under the supplied recipient key");
           }
@@ -470,7 +517,20 @@ function _shape(body, sent, signatureVerified, bound) {
  * requests, each naming exactly one arm: `tcr` (a PKCS#10 CSR), `crm` (a CRMF CertReqMsg, or the
  * CertReqMessages `pki.crmf.build` returns when it carries exactly one) or `orm`
  * (`{ type, value }`). `spec.controls` are additional controls as `{ type, value }`, and `signer`
- * is the `{ cert, key }` that signs the enclosing CMS SignedData. A `tcr` request is verified against
+ * is the `{ cert, key }` that signs the enclosing CMS SignedData. RFC 5272 sec. 3.2 gives a Full PKI
+ * Request a second carrier for a client that has no key to sign with: pass
+ * `{ mac: { identifier, secret } }` in place of `{ cert, key }` and the request is an
+ * AuthenticatedData whose MAC the shared secret keys, through the PasswordRecipientInfo sec. 3.2(a)
+ * requires. The key is derived from the identifier encoded as UTF-8 followed by the secret
+ * (sec. 3.2(c)), which is the derivation `pki.cmc.verify` reads a `recipient` under, so a caller names
+ * what it enrolled with at both ends rather than concatenating by hand. The request also carries the
+ * identifier in an Identification control, because a PasswordRecipientInfo names no recipient and that
+ * control is what "assists the server in locating the shared-secret" (RFC 5272 sec. 6.2.3); supplying
+ * a different name through `spec.identityProof.identity` is refused rather than chosen between. Since
+ * carrying that control also changes how an Identity Proof witness is derived (sec. 6.2.3), a request
+ * carrying both derives the witness with the name it carries, and its MAC and its Identity Proof are
+ * keyed from one secret rather than two. Naming a signature and a shared secret together is refused,
+ * since a request has one carrier. A `tcr` request is verified against
  * its own proof-of-possession first: a PKCS#10 whose self-signature does not verify under its subject
  * public key is refused (`cmc/bad-popo`) rather than signed into a message a CA would reject.
  *
@@ -490,6 +550,26 @@ function _shape(body, sent, signatureVerified, bound) {
  * carry neither Identification nor Identity Proof (sec. 3.2 (a)), so asking for both is refused
  * and never silently dropped.
  *
+ * `spec.popChallenge: { challenge, recipient }` answers an authority's challenge-response proof of
+ * possession, which is how a key that cannot sign for itself proves the client holds it (RFC 5272
+ * sec. 6.7). `challenge` is the Encrypted POP control's value and `recipient` is the key material
+ * `pki.cms.decrypt` takes. The proof value is decrypted, hashed under the witness algorithm the
+ * challenge names and compared with the witness it carries; a value that does not decrypt or does not
+ * match is not the one the authority issued, so the request is refused with `cmc/pop-failed` and no
+ * proof is sent. The answer is a MAC over the request the challenge carried, keyed by that value
+ * (truncated to 64 bytes, sec. 6.7) under the algorithm the challenge named, and it names the
+ * certification request in THIS request, so a request carrying more than one is refused. The
+ * algorithms are the ones RFC 5274 sec. 4.2 requires of a client: SHA-1 or SHA-256 for the witness,
+ * HMAC-SHA1 or HMAC-SHA256 for the proof.
+ *
+ * A `tcr` request signed with `id-alg-noSignature` (RFC 5272 App. C.1) is the request a decrypt-only
+ * key produces, and it carries no proof of its own. It is accepted only when this message answers a
+ * challenge for that same request and the key that opened the challenge is the request's own subject
+ * public key, compared as keys rather than as encodings. A challenge opened by a password or a
+ * key-encryption key identifies no key and does not qualify, and its parameters must be present and
+ * encoded as NULL. Without such an answer the request is refused with `cmc/bad-popo`, and a request
+ * that does carry a signature is still held to it.
+ *
  * `spec.transactionId` (number|bigint), `spec.senderNonce` and `spec.dataReturn` (bytes) attach the
  * exchange-binding controls (RFC 5272 sec. 6.6 / 6.4), the same three `pki.cmc.verify` checks the
  * response against. They are named fields, not something to hand-encode into
@@ -511,6 +591,7 @@ function _shape(body, sent, signatureVerified, bound) {
  *   var req = await pki.cmc.build({ requests: [{ tcr: csr }] }, { cert: cert, key: key });
  *   pki.schema.cmc.parse(req).requests[0].arm;   // "tcr"
  */
-var build = require("./cmc-build").build;
+var cmcBuild = require("./cmc-build");
+var build = cmcBuild.build;
 
 module.exports = { verify: verify, build: build };

package/lib/cms-decrypt.js

@@ -160,7 +160,7 @@ function _kekIdMatches(ri, kekId) {
   return Buffer.compare(id, guard.bytes.view(kekId, CmsError, "cms/bad-input", "kekId")) === 0;
 }
 
-var _passThrough = intrinsic.assign(intrinsic.create(null), { "cms/unsupported-algorithm": 1, "cms/unsupported-recipient-type": 1, "cms/bad-input": 1, "cms/iteration-limit": 1, "cms/missing-key-derivation": 1, "cms/no-encrypted-content": 1 });
+var _passThrough = intrinsic.assign(intrinsic.create(null), { "cms/unsupported-algorithm": 1, "cms/unsupported-recipient-type": 1, "cms/bad-input": 1, "cms/iteration-limit": 1, "cms/missing-key-derivation": 1, "cms/no-encrypted-content": 1, "cms/too-many-recipient-keys": 1 });
 
 async function _acquireCek(ri, km, opts) {
   try {
@@ -198,6 +198,29 @@ async function _ktriCek(ri, km) {
   }
 }
 
+/** @internal One KeyAgreeRecipientInfo can carry an encrypted key for several recipients under one
+ * originator and one key-derivation, and a caller decrypting with a private key alone has no identifier
+ * to select its own entry by. The key-encryption key is derived once and every entry is offered to it;
+ * AES key wrap's integrity check settles which entry belongs to this key, so an entry that opens is one
+ * this key was addressed by. The attempt count is bounded because the list is attacker-supplied. */
+async function _kariUnwrapAny(kek, reks) {
+  var list = reks || [];
+  /** @internal The list arrives with the message, so the number of unwraps it can demand is bounded.
+   * The bound caps the attempts rather than refusing the list, so an entry within it still opens the
+   * message it always opened. */
+  var tried = list.length < C.LIMITS.CMS_MAX_KARI_ENCRYPTED_KEYS
+    ? list.length : C.LIMITS.CMS_MAX_KARI_ENCRYPTED_KEYS;
+  for (var i = 0; i < tried; i++) {
+    try { return await _aesKwUnwrap(kek, list[i].encryptedKey); }
+    catch (_e) { continue; } // allow:swallow-unverified this entry is not addressed to this key; a later one may be
+  }
+  if (list.length > tried) {
+    throw _err("cms/too-many-recipient-keys", "a KeyAgreeRecipientInfo names " + list.length +
+      " encrypted keys and none of the first " + tried + " opened; at most " + tried + " are tried");
+  }
+  throw _fail();
+}
+
 async function _kariCek(ri, km) {
   var k = _normKeyDer(km.key);
   var kek, z, mz;
@@ -207,7 +230,7 @@ async function _kariCek(ri, km) {
     var wrapAlg = _kariWrap(kea);
     var scheme = kea.oid;
     var origSpki = _originatorSpki(ri.originator);
-    var rek = (km.cert != null && _kariRekFor(ri, x509.parse(_normCertDer(km.cert)))) || ri.recipientEncryptedKeys[0];
+    var rek = (km.cert != null && _kariRekFor(ri, x509.parse(_normCertDer(km.cert)))) || null;
     var kekBytes = WRAP_KEK_LENGTHS[wrapAlg.oid];
     if (!kekBytes) throw _err("cms/unsupported-algorithm", "unsupported kari key-wrap");
     var ukm = ri.ukm || null;
@@ -222,7 +245,8 @@ async function _kariCek(ri, km) {
     } else {
       var origAlg = asn1.decode(origSpki).children[0];
       var origHasParams = origAlg.children.length > 1;
-      var curveOid = (km.cert != null && _ecCurveFromCert(km.cert)) || (origHasParams ? asn1.read.oid(origAlg.children[1]) : null);
+      var curveOid = (km.cert != null && _ecCurveFromCert(km.cert)) ||
+        (origHasParams ? asn1.read.oid(origAlg.children[1]) : _ecCurveFromPrivateKey(keyDer));
       var curve = curveOid ? CURVE[curveOid] : null;
       if (!curve) throw _err("cms/unsupported-algorithm", "unsupported or missing originator EC curve");
       var origSpkiFull = origHasParams ? origSpki : _withEcCurveParams(origSpki, curveOid);
@@ -232,7 +256,15 @@ async function _kariCek(ri, km) {
       var zKey = await subtle.importKey("raw", z, { name: "X963KDF" }, false, ["deriveBits"]);
       kek = Buffer.from(await subtle.deriveBits({ name: "X963KDF", hash: _x963Hash(scheme), info: _eccSharedInfo(wrapAlg.name, ukm, kekBytes) }, zKey, kekBytes * 8));
     }
-    return await _aesKwUnwrap(kek, rek.encryptedKey);
+    /** @internal A caller that supplied a certificate selects its entry by recipient identifier, which
+     * is what that certificate is for. Offering every entry is for the caller that has only a key, and
+     * so has no identifier to select by. */
+    if (km.cert != null) {
+      var chosen = rek || ri.recipientEncryptedKeys[0];
+      if (!chosen) throw _fail();
+      return await _aesKwUnwrap(kek, chosen.encryptedKey);
+    }
+    return await _kariUnwrapAny(kek, ri.recipientEncryptedKeys);
   } finally {
     guard.secret.zeroizeAll([z, mz, kek], CmsError, "cms/bad-input", "the key-agreement shared secret");
     _releaseKeyDer(k);
@@ -507,6 +539,19 @@ function _ecCurveFromCert(cert) {
   if (spki.algorithm.oid !== O("ecPublicKey") || spki.algorithm.parameters == null) return null;
   return asn1.read.oid(asn1.decode(spki.algorithm.parameters));
 }
+/** @internal The curve of the recipient's own private key. RFC 5753 sec. 7.1 lets an originator omit its
+ * curve parameters because the recipient already knows the curve; a recipient decrypting with a key and
+ * no certificate has that knowledge in the key itself, and nowhere else. */
+function _ecCurveFromPrivateKey(keyDer) {
+  var spki;
+  try {
+    spki = nodeCrypto.createPublicKey({ key: keyDer, format: "der", type: "pkcs8" })
+      .export({ format: "der", type: "spki" });
+  } catch (_e) { return null; } // allow:swallow-unverified a key this runtime cannot read names no curve
+  var alg = asn1.decode(spki).children[0];
+  if (asn1.read.oid(alg.children[0]) !== O("ecPublicKey") || alg.children.length < 2) return null;
+  return asn1.read.oid(alg.children[1]);
+}
 function _withEcCurveParams(spki, curveOid) {
   var node = asn1.decode(spki);
   var alg = node.children[0];

package/lib/constants.js

@@ -124,6 +124,7 @@ var LIMITS = Object.assign(Object.create(null), {
   CBOR_MAX_ITEMS: 1000000,
   SCT_MAX_BYTES: BYTES.kib(64) + 1,
   SCT_MAX_COUNT: 256,
+  CMS_MAX_KARI_ENCRYPTED_KEYS: 64,
   MERKLE_MAX_PROOF_NODES: 65,
   PROXY_MAX_TLS_ANCHORS: 256,
   PATH_MAX_CERTS: 100,

package/lib/guard-intrinsic.js

@@ -4,6 +4,7 @@
 // @internal
 
 var _utilTypes = require("util").types;
+var _nodeCrypto = require("node:crypto");
 
 var _call = Function.prototype.call;
 var _bind = Function.prototype.bind;
@@ -19,6 +20,10 @@ var _bufferByteLength = Buffer.byteLength;
 var _bufferCompare = Buffer.compare;
 var _bufferEquals = uncurry(Buffer.prototype.equals);
 var _bufferToString = uncurry(Buffer.prototype.toString);
+/** @internal Key identity, taken off the KeyObject prototype at load. A caller that replaced this
+ * method could make two different keys answer as one, which is the question a proof of possession
+ * turns on. */
+var _keyEquals = uncurry(_nodeCrypto.KeyObject.prototype.equals);
 
 var _isView = ArrayBuffer.isView;
 var _isInteger = Number.isInteger;
@@ -146,6 +151,7 @@ module.exports = Object.freeze({
   byteLength: _bufferByteLength,
   compare: _bufferCompare,
   bufferEquals: _bufferEquals,
+  keyEquals: _keyEquals,
   isView: _isView,
   isInteger: _isInteger,
   isSafeInteger: _isSafeInteger,

package/lib/schema-cmc.js

@@ -42,6 +42,8 @@ var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
 var oid = require("./oid");
 var cms = require("./schema-cms");
+var csr = require("./schema-csr");
+var crmf = require("./schema-crmf");
 var guard = require("./guard-all");
 var frameworkError = require("./framework-error");
 
@@ -55,6 +57,8 @@ function O(name) { return oid.byName(name); }
 
 var OID_PKI_DATA = O("id-cct-PKIData");
 var OID_PKI_RESPONSE = O("id-cct-PKIResponse");
+var OID_ENCRYPTED_POP = O("id-cmc-encryptedPOP");
+var OID_DECRYPTED_POP = O("id-cmc-decryptedPOP");
 var OID_STATUS_INFO = O("id-cmc-statusInfo");
 var OID_STATUS_INFO_V2 = O("id-cmc-statusInfoV2");
 var OID_RESPONSE_BODY = O("id-cmc-responseBody");
@@ -79,6 +83,11 @@ var CMC_CARRIERS = Object.assign(Object.create(null), { signedData: 1, authData:
 var CONTROL_PLACEMENT = Object.create(null);
 CONTROL_PLACEMENT[OID_RESPONSE_BODY] = "pkiResponse";
 CONTROL_PLACEMENT[OID_RA_IDENTITY_WITNESS] = "pkiData";
+/** @internal The two halves of the challenge-response exchange travel in opposite directions: the
+ * authority sends the challenge in its response, and the client answers in its next request (RFC 5272
+ * sec. 6.7). A message carrying the other one is not the message that section describes. */
+CONTROL_PLACEMENT[OID_ENCRYPTED_POP] = "pkiResponse";
+CONTROL_PLACEMENT[OID_DECRYPTED_POP] = "pkiData";
 
 
 function readBodyPartId(node, label) {
@@ -429,6 +438,181 @@ var PKI_RESPONSE = schema.seq([
   },
 });
 
+/** @internal The challenge-response proof of possession a server sends when the key being certified
+ * cannot sign for itself (RFC 5272 sec. 6.7). The `cms` field is surfaced as the bytes it arrived as,
+ * because it is an EnvelopedData a caller decrypts with its own key material rather than something
+ * this parser opens. */
+/** @internal The request a challenge quotes is one the client answers for, so it is held to the
+ * definition of the arm it uses rather than to its outer tag alone: a proof computed over a request
+ * that is not one could never be checked against anything. This is asked of a CHALLENGED request only.
+ * A request body carries what its sender sent, and judging it is the enrollment's business, not the
+ * decoder's. */
+function _assertAnswerableRequest(request) {
+  if (request.arm !== "tcr" && request.arm !== "crm") return;
+  /** @internal A CertReqMessages of one, which is the shape the CRMF parser takes; built outside the
+   * catch below so only the parse it wraps can be what fails. */
+  var payload = request.arm === "tcr" ? request.certificationRequestBytes
+    : asn1.build.sequence([asn1.build.raw(request.certReqMsgBytes)]);
+  try {
+    if (request.arm === "tcr") { csr.parse(payload); } else { crmf.parse(payload); }
+  } catch (e) {
+    throw E("cmc/bad-pop-challenge",
+      "the request an EncryptedPOP quotes is not a " +
+      (request.arm === "tcr" ? "PKCS#10 CertificationRequest" : "CRMF CertReqMsg") +
+      ", so a proof over it could not be checked: " + ((e && e.message) || "malformed") +
+      " (RFC 5272 sec. 6.7)", e);
+  }
+}
+
+function parseEncryptedPop(node) {
+  if (node.tagClass !== "universal" || node.tagNumber !== TAGS.SEQUENCE || !node.constructed ||
+      node.children.length !== 5) {
+    throw E("cmc/bad-pop-challenge",
+      "an EncryptedPOP is SEQUENCE { request, cms, thePOPAlgID, witnessAlgID, witness } (RFC 5272 sec. 6.7)");
+  }
+  var envelope = _assertEnvelopedChallenge(node.children[1]);
+  var request;
+  try { request = parseTaggedRequest(node.children[0]); }
+  catch (e) {
+    throw E("cmc/bad-pop-challenge",
+      "an EncryptedPOP quotes the request it challenges as a TaggedRequest: " +
+      ((e && e.message) || "malformed") + " (RFC 5272 sec. 6.7)", e);
+  }
+  _assertAnswerableRequest(request);
+  return {
+    request: request,
+    /** @internal The TaggedRequest exactly as it arrived. A proof of possession is a MAC over these
+     * bytes, and the challenge carries them so neither side has to re-encode the request to agree on
+     * what was covered (RFC 5272 sec. 6.7). */
+    requestBytes: node.children[0].bytes,
+    cms: envelope.bytes,
+    cmsRecipientCount: envelope.recipientCount,
+    thePOPAlgID: _popAlgorithm(node.children[2], "thePOPAlgID"),
+    witnessAlgID: _popAlgorithm(node.children[3], "witnessAlgID"),
+    witness: _popOctetString(node.children[4], "witness"),
+  };
+}
+
+/** @internal A leaf of one of the POP controls. A malformed one is a malformed challenge, so it carries
+ * this control's code rather than the codec's. */
+function _popOctetString(node, what) {
+  try { return asn1.read.octetString(node); }
+  catch (e) {
+    throw E("cmc/bad-pop-challenge", "a POP " + what + " is an OCTET STRING (RFC 5272 sec. 6.7)", e);
+  }
+}
+
+function parseDecryptedPop(node) {
+  if (node.tagClass !== "universal" || node.tagNumber !== TAGS.SEQUENCE || !node.constructed ||
+      node.children.length !== 3) {
+    throw E("cmc/bad-pop-challenge",
+      "a DecryptedPOP is SEQUENCE { bodyPartID, thePOPAlgID, thePOP } (RFC 5272 sec. 6.7)");
+  }
+  var bodyPartID;
+  try { bodyPartID = readBodyPartIdentity(node.children[0]); }
+  catch (e) {
+    throw E("cmc/bad-pop-challenge",
+      "a DecryptedPOP names the certification request it proves with a BodyPartID: " +
+      ((e && e.message) || "malformed") + " (RFC 5272 sec. 6.7)", e);
+  }
+  return {
+    bodyPartID: bodyPartID,
+    thePOPAlgID: _popAlgorithm(node.children[1], "thePOPAlgID"),
+    thePOP: _popOctetString(node.children[2], "thePOP"),
+  };
+}
+
+/** @internal The proof value travels in an EnvelopedData (RFC 5272 sec. 6.7), and the bytes are handed
+ * on unopened because opening them needs key material this parser does not hold. Unopened is not
+ * unchecked: a field that is not a ContentInfo carrying an EnvelopedData cannot be a challenge, and
+ * saying so here is what keeps a control that could never be answered from reading as one. */
+function _assertEnvelopedChallenge(node) {
+  var kids = pkix.rootSequenceChildren(node, 2, 2);
+  if (!kids) {
+    throw E("cmc/bad-pop-challenge",
+      "an EncryptedPOP carries the proof value in a CMS ContentInfo, which is a SEQUENCE of a content " +
+      "type and its content (RFC 5272 sec. 6.7)");
+  }
+  var contentType;
+  try { contentType = asn1.read.oid(kids[0]); }
+  catch (e) {
+    throw E("cmc/bad-pop-challenge",
+      "an EncryptedPOP's ContentInfo names its content type with an OBJECT IDENTIFIER (RFC 5272 sec. 6.7)", e);
+  }
+  if (contentType !== O("envelopedData")) {
+    throw E("cmc/bad-pop-challenge",
+      "an EncryptedPOP carries the proof value in an EnvelopedData, got " +
+      (oid.name(contentType) || contentType) + " (RFC 5272 sec. 6.7)");
+  }
+  var content = kids[1];
+  if (content.tagClass !== "context" || content.tagNumber !== 0 || !content.constructed ||
+      content.children.length !== 1) {
+    throw E("cmc/bad-pop-challenge",
+      "an EncryptedPOP's ContentInfo carries its content in [0] EXPLICIT (RFC 5652 sec. 3)");
+  }
+  /** @internal Validated by the CMS EnvelopedData schema itself rather than by a shape check written
+   * here, so every field is held to one definition and the count reported below is the count of
+   * recipients that same definition accepted. Sec. 6.7 also allows a recipient identified by an
+   * issuerAndSerialNumber whose issuer is encoded as NULL, which is not the Name that schema requires;
+   * a challenge addressed only that way is refused here, and `pki.cms.decrypt` could not open it
+   * either, so it is refused where the reason can be named rather than after a failed answer. */
+  var enveloped;
+  try { enveloped = cms.walkEnvelopedData(content.children[0]); }
+  catch (e) {
+    throw E("cmc/bad-pop-challenge",
+      "an EncryptedPOP's ContentInfo does not carry an EnvelopedData a recipient could open: " +
+      ((e && e.message) || "malformed") + " (RFC 5652 sec. 6.1)", e);
+  }
+  var recipients = (enveloped.recipientInfos || []).length;
+  if (recipients < 1) {
+    throw E("cmc/bad-pop-challenge",
+      "an EnvelopedData names at least one recipient in its recipientInfos SET (RFC 5652 sec. 6.1)");
+  }
+  return { bytes: node.bytes, recipientCount: recipients };
+}
+
+/** @internal Both fields are AlgorithmIdentifiers, and both are read the same way: the OID names the
+ * algorithm and the parameters travel with it, so a caller answering a challenge copies what it was
+ * sent rather than reconstructing it. */
+function _popAlgorithm(node, what) {
+  if (node.tagClass !== "universal" || node.tagNumber !== TAGS.SEQUENCE || !node.constructed ||
+      node.children.length < 1 || node.children.length > 2) {
+    throw E("cmc/bad-pop-challenge", "a POP " + what + " is an AlgorithmIdentifier (RFC 5272 sec. 6.7)");
+  }
+  var algOid;
+  try { algOid = asn1.read.oid(node.children[0]); }
+  catch (e) {
+    throw E("cmc/bad-pop-challenge",
+      "a POP " + what + " names its algorithm with an OBJECT IDENTIFIER (RFC 5272 sec. 6.7)", e);
+  }
+  return {
+    oid: algOid,
+    name: oid.name(algOid) || null,
+    parameters: node.children.length === 2 ? node.children[1].bytes : null,
+    bytes: node.bytes,
+  };
+}
+
+/** @internal One AttributeValue, which is what a control carrying a single structure holds. */
+function _onlyValue(c, what) {
+  if (c.values.length !== 1) {
+    throw E("cmc/bad-pop-challenge",
+      "a " + what + " control carries exactly one AttributeValue, got " + c.values.length);
+  }
+  return asn1.decode(c.values[0]);
+}
+
+function _decodePopChallenges(controls) {
+  for (var i = 0; i < controls.length; i++) {
+    var c = controls[i];
+    if (c.attrType === OID_ENCRYPTED_POP) {
+      c.encryptedPOP = parseEncryptedPop(_onlyValue(c, "an Encrypted POP"));
+    } else if (c.attrType === OID_DECRYPTED_POP) {
+      c.decryptedPOP = parseDecryptedPop(_onlyValue(c, "a Decrypted POP"));
+    }
+  }
+}
+
 function _collectStatuses(controls) {
   var out = [];
   for (var i = 0; i < controls.length; i++) {
@@ -445,6 +629,7 @@ function _collectStatuses(controls) {
 
 function _finishBody(body, where) {
   for (var i = 0; i < body.controls.length; i++) assertControlPlacement(body.controls[i], where);
+  _decodePopChallenges(body.controls);
   body.statuses = _collectStatuses(body.controls);
   body.unhandled = body.controls.filter(function (c) {
     return c.attrType !== OID_STATUS_INFO && c.attrType !== OID_STATUS_INFO_V2 && c.attrName === null;
@@ -541,9 +726,20 @@ function parsePkiResponse(input) {
  *   pki.schema.cmc.parse(der).kind;   // "pkiData"
  */
 function parse(input) {
-  var parsedCms = (input && typeof input === "object" && !ArrayBuffer.isView(input) &&
-    !guard.bytes.isByteSource(input) && input.encapContentInfo != null)
-    ? input : cms.parse(input);
+  var alreadyParsed = input && typeof input === "object" && !ArrayBuffer.isView(input) &&
+    !guard.bytes.isByteSource(input) && input.encapContentInfo != null;
+  var parsedCms;
+  if (alreadyParsed) { parsedCms = input; }
+  else {
+    /** @internal Bytes that are not a CMS message at all are a CMC message this cannot read, and every
+     * other format parser answers for its own input in its own domain. */
+    try { parsedCms = cms.parse(input); }
+    catch (e) {
+      throw E("cmc/bad-der",
+        "a CMC message is carried in a CMS SignedData or AuthenticatedData, and these bytes are not " +
+        "one: " + ((e && e.message) || "malformed") + " (RFC 5272 sec. 3.2 / 4.2)", e);
+    }
+  }
   if (CMC_CARRIERS[parsedCms.contentTypeName] !== 1) {
     throw E("cmc/not-cmc",
       "a Full PKI Request / Response is carried in a CMS SignedData or AuthenticatedData, got " +
@@ -568,6 +764,8 @@ function parse(input) {
 }
 
 module.exports = {
+  parseEncryptedPop: parseEncryptedPop,
+  parseTaggedRequest: parseTaggedRequest,
   parse: parse,
   parsePkiData: parsePkiData,
   parsePkiResponse: parsePkiResponse,

package/lib/schema-cms.js

@@ -555,7 +555,9 @@ var KEY_AGREE_RECIPIENT_INFO = schema.seq([
   schema.field("originator", schema.explicit(0, ORIGINATOR_IDENTIFIER_OR_KEY, { code: "cms/bad-kari" })),
   schema.optional("ukm", schema.octetString(), { tag: 1, explicit: true, emptyCode: "cms/bad-kari" }),
   schema.field("keyEncryptionAlgorithm", ALGORITHM_IDENTIFIER),
-  schema.field("recipientEncryptedKeys", schema.seqOf(RECIPIENT_ENCRYPTED_KEY, { code: "cms/bad-recipient-encrypted-keys", what: "recipientEncryptedKeys" })),
+  /** @internal At least one encrypted key: a key-agreement recipient info that names none names no
+   * recipient, so nothing could open the content it is attached to. */
+  schema.field("recipientEncryptedKeys", schema.seqOf(RECIPIENT_ENCRYPTED_KEY, { min: 1, code: "cms/bad-recipient-encrypted-keys", what: "recipientEncryptedKeys" })),
 ], {
   assert: "constructed", code: "cms/bad-kari", what: "KeyAgreeRecipientInfo",
   build: function (m) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.47",
+  "version": "0.6.49",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:39d93a95-6e56-4af5-9029-94a73a8e00c4",
+  "serialNumber": "urn:uuid:082f242e-4786-4518-b201-8797b47662eb",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-06T15:41:11.254Z",
+    "timestamp": "2026-09-07T02:07:15.421Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.47",
+      "bom-ref": "@blamejs/pki@0.6.49",
       "type": "application",
       "name": "pki",
-      "version": "0.6.47",
+      "version": "0.6.49",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.47",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.49",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.47",
+      "ref": "@blamejs/pki@0.6.49",
       "dependsOn": []
     }
   ]