@blamejs/pki 0.6.48 → 0.6.49

package/CHANGELOG.md

@@ -4,6 +4,26 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.49 — 2026-09-07
+
+A key that cannot sign for itself can still prove possession, by answering the authority's encrypted challenge.
+
+### Added
+
+- pki.schema.cmc.parse decodes the two controls of the challenge-response proof of possession (RFC 5272 section 6.7). An Encrypted POP control surfaces as encryptedPOP with its request, its enveloped challenge, the two algorithm identifiers and the witness; a Decrypted POP control surfaces as decryptedPOP with its body part, algorithm and proof. The enveloped challenge is surfaced as the bytes it arrived as, since it is opened with key material the parser does not hold. Both algorithm identifiers keep their parameters, so a client answers with what it was sent. A control of either kind that is not the structure the section defines is refused with cmc/bad-pop-challenge. The two travel in opposite directions, so an Encrypted POP in a request or a Decrypted POP in a response is refused with cmc/control-misplaced. The challenge is held to what a client would have to answer: its envelope to the CMS EnvelopedData definition, and the request it quotes to the definition of the arm it uses, so a challenge nothing could answer is refused rather than surfaced as one.
+- pki.cmc.build(spec, signer) takes spec popChallenge of { challenge, recipient } and answers it: the enveloped proof value is decrypted with the recipient key material, hashed under the witness algorithm the challenge names, and compared with the witness it carries. A value that does not decrypt, or that does not hash to that witness, is not the value the authority issued, so the request is refused with cmc/pop-failed and no proof is sent. The section makes that abort mandatory, and answering is not separable from checking: pki.cmc.build computes a proof only after the witness matches. A Decrypted POP control hand-encoded into spec.controls alongside spec popChallenge is refused, since a message carrying two leaves the authority no proof to check; the same now holds for the Identity Proof and POP Link controls that spec identityProof and spec popLink compute.
+- The answer is a MAC over the request the challenge carried, keyed by the decrypted proof value, under the algorithm the challenge named rather than one the client picks. A proof value longer than 64 bytes is truncated to 64 for the key, which the section states and an implementation that skips it will compute a different proof than the authority expects. The control names the certification request in the new request, so a request carrying more than one is refused rather than guessed at. All three request arms bind: a PKCS#10 request by its own bytes, a CRMF one by its message, and an other-message one by its type together with its value. Every way a challenge can be malformed carries cmc/bad-pop-challenge, from bytes that are not DER through a field of the wrong type, so a caller classifies them the same way. RFC 5274 section 4.2 sets what a conforming client answers under: SHA-1 or SHA-256 for the witness, HMAC-SHA1 or HMAC-SHA256 for the proof. Anything else is refused rather than defaulted, as is an identifier carrying a parameter value, since those four algorithms are encoded with the parameters absent or NULL and the answer copies the identifier it was sent. The decrypted proof value and the key derived from it are wiped once the answer is built.
+- A PKCS#10 request whose signature algorithm is id-alg-noSignature is accepted when this message answers a challenge for that same request. A decrypt-only key cannot sign the request that asks for its certificate, and RFC 5272 Appendix C.1 fills the signature field with an algorithm that proves nothing and sends the proof through the section 6.7 challenge instead; the request was previously refused with cmc/bad-popo, so the enrollment the challenge exists for could not be made. The challenge has to prove the key the request asks for: section 6.7 encrypts the proof value to that key, so the request is accepted only when the key that opened the challenge is the request's own subject public key. A challenge opened by any other key, or by a password or a key-encryption key, says nothing about the key being certified and does not stand in for the missing signature. The two keys are compared as keys rather than as encodings, so a curve point written in compressed form matches the same point written uncompressed. A key whose public half cannot be derived on the running Node, which today means the composite ML-KEM families, leaves the request refused rather than accepted. Without an answered challenge for that request it is still refused, since it carries no proof of possession at all, and its parameters must be present and encoded as NULL. A request that does carry a signature is still held to it.
+- pki.schema.cmc.parse also reports how many recipients the challenge names, as encryptedPOP cmsRecipientCount, so a client answering one knows how many to try without walking the envelope itself.
+- The client decrypts with the key alone, which is what the exchange requires: the key being certified has no certificate for a recipient identifier to name. Section 6.7 says the identifier should be the request's subject key identifier, and that form is answered. The alternative it allows, an issuer and serial number whose issuer is encoded as NULL, is not: that is not a Name, and the CMS EnvelopedData definition refuses it. A challenge addressed only that way is refused while parsing, with cmc/bad-pop-challenge naming the reason, and pki.cms.decrypt could not have opened it either. The proof also has to cover the request the message carries: a challenge quoting a different certification request is refused rather than answered for the wrong one.
+
+### Fixed
+
+- pki.schema.cmc.parse reports bytes that are not a CMS carrier as cmc/bad-der rather than cms/bad-der. Every other format parser answers for its own input in its own domain, and this one passed the carrier parser's code through, so a caller matching on the cmc prefix missed the most common malformed input there is.
+- pki.cms.decrypt opens a key-agreement recipient whose encrypted key is not the first one listed. One KeyAgreeRecipientInfo can carry an encrypted key for several recipients under a single originator, and a caller decrypting with a private key alone has no recipient identifier to select its own entry by, so only the first entry was tried and a message addressed to that caller was refused as undecryptable. A caller with no certificate is now offered every entry, and AES key wrap's integrity check settles which one belongs to the key, so an entry opens only for the key it was encrypted to. A caller that supplies a certificate is unaffected: its entry is still chosen by recipient identifier. At most 64 entries are tried, since the list arrives with the message; a longer list still opens on an entry within that bound, and one whose only openable entry sits past it is refused with cms/too-many-recipient-keys.
+- pki.schema.cms.parse refuses a key-agreement recipient that names no encrypted key. Such a recipient names nobody, so nothing could open the content it is attached to; it now fails with cms/bad-recipient-encrypted-keys while parsing rather than reaching a decrypt that has nothing to try.
+- pki.cms.decrypt takes the curve of a key-agreement originator that omitted its parameters from the recipient's own private key. RFC 5753 section 7.1 allows the originator to omit them because the recipient knows the curve, but the curve was read only from a recipient certificate, so a caller decrypting with a key alone was refused with cms/unsupported-algorithm.
+
 ## v0.6.48 — 2026-09-07
 
 A CMC enrollment request can be authenticated by a shared secret instead of a signature.

package/README.md

@@ -227,7 +227,7 @@ comment blocks, is at [pkijs.com](https://pkijs.com).
 | `pki.jose` | Flattened JWS (RFC 7515) and JWK thumbprints (RFC 7638). `sign` and `verify` run a Flattened JWS against declarative profiles (ACME outer, EAB inner, keyChange inner) that carry the required and forbidden header rules as data. `base64url` is the strict RFC 4648 §5 codec, rejecting padding, non-alphabet characters, and non-canonical trailing bits. `parseJson` is a bounded reader that refuses duplicate members at any depth. `thumbprint` is the RFC 7638 / 8037 / 9964 canonical digest. The algorithm registry binds each `alg` to its key type (ES/RS/PS/EdDSA/ML-DSA), leaving no code path for `alg:none`, an RS256→HS256 key confusion, or an all-zero ECDSA signature; `assertPublicJwk` refuses a JWK carrying private material, so an exported private key is never published. `opts.key` names the key a message must be signed under and governs: where the profile also permits an embedded header `jwk`, the two must be the same key — compared as RFC 7638 thumbprints, so member order cannot make equal keys differ — and a disagreement is refused rather than resolved in the message's favor. `keySource` reports which key answered, since a signature checked against a key you named is a different claim from one checked against the key the message carried — `sign`, `verify`, `base64url`, `parseJson`, `thumbprint`, `assertPublicJwk` |
 | `pki.acme` | ACME (RFC 8555 / 8737 / 8738 / 9773). `client(directoryUrl, opts)` is a stateful client driving a live CA directory over `pki.transport`: `newAccount`, `newOrder`, `newAuthz`, `getOrder`, `getAuthorization`, `getChallenge`, `respondToChallenge`, `finalize`, `pollOrder`, `pollAuthorization`, and `downloadCertificate` walk the issuance flow, with `newAuthz` pre-authorizing a single identifier (§7.4.1) and `downloadCertificate` binding the issued certificate to the order — its key, its identifiers, or both; at least one is required by default and the result reports `boundToKey` / `boundToIdentifiers` — before choosing among alternate chains (`Link rel="alternate"`, §7.4.2, via a `selectChain` predicate bounded by `maxAlternates`). `revokeCert` (account-key or certificate-key signed), `keyChange`, `updateAccount` (change the account contacts, §7.3.2), `listOrders` (the account's orders list, following the §7.1.2.1 `Link rel="next"` pagination bounded by a page cap and confined to the orders origin), `deactivateAccount`, `deactivateAuthorization`, `renewalInfo` (ARI), `renewalWindow` (the RFC 9773 §4.2/4.3 renewal decision), and `scheduleRenewal` (the §4.1 auto-sleeping renewal loop that sleeps until the selected instant and refetches until it is time to renew, stopping at the certificate's notAfter) complete the lifecycle. Every URL is HTTPS only, an explicit trust anchor is required, each request carries a fresh single-use nonce with a bounded badNonce retry (and, when `opts.resignKeys` supplies caller-approved alternative account-key algorithms, a bounded RFC 8555 §6.2 badSignatureAlgorithm re-sign that the CA's advertised list can only filter, never widen, so it cannot force a weaker algorithm), reads are POST-as-GET, polling is bounded and sleeps on a Retry-After via an injectable sleeper capped by a poll count and a total-wait budget, and every response body is size-capped. The transport is injectable via `opts.transport`. Over the message layer it composes resource-object validators (closed status enums, conditional-required fields, unknown fields ignored), the three §7.1.6 state machines, the request builders (newAccount with External Account Binding, newOrder with `replaces`, finalize with a CSR identifier-set match and account-key-reuse rejection, challenge responses, deactivation, revokeCert in both key modes, the keyChange nested JWS, POST-as-GET), the http-01 / dns-01 / tls-alpn-01 challenge computations, the dns and ip identifier validators, and the ARI certID with serial sign-padding preserved — `client`, `validate`, `identify`, `assertTransition`, the builders, `keyAuthorization`, `http01`, `dns01`, `tlsAlpn01Extension`, `verifyTlsAlpn01`, `ariCertId` |
 | `pki.schema.smime` | S/MIME ESS signed-attribute values (RFC 5035 / RFC 8551). `parseSigningCertificate` and `parseSigningCertificateV2` bind a signature to its signing certificate (cert hash, hash algorithm, issuer `GeneralNames` and serial); `parseSmimeCapabilities` decodes the ordered capability list; `decodeAttribute` dispatches a CMS attribute by OID, enforcing the single-value rule and deferring on unknown types. A companion decoder for CMS signed attributes rather than an auto-routed format — `parseSigningCertificate`, `parseSigningCertificateV2`, `parseSmimeCapabilities`, `decodeAttribute` |
-| `pki.cmc` | Build and interpret CMC messages (RFC 5272). `build(spec, signer)` assembles a Full PKI Request across all three request arms (PKCS#10, CRMF, other) and carries it either way RFC 5272 §3.2 allows: `{ cert, key }` signs it, while `{ mac: { identifier, secret } }` authenticates it under a shared secret for a client that holds no key yet, using the PasswordRecipientInfo that section requires and deriving the key from the identifier followed by the secret. A signed request goes through `pki.cms.sign` under `id-cct-PKIData`. A PKCS#10 (`tcr`) request is verified against its own proof-of-possession before signing, so a request whose self-signature does not verify under its subject public key is refused rather than signed into a message a CA would reject. Body-part identifiers are unique across the whole message and never the reserved 0; a caller's clash is refused rather than renumbered, since a control may already reference it. An Identity Proof V2 witness is computed over the `reqSequence` bytes exactly as emitted (§6.2.1 step 1) rather than a re-serialization, a POP Link Witness is emitted only alongside the POP Link Random control §6.3.1.1 requires beside it, and a renewal carries neither Identification nor Identity Proof in either version. `verify(response, sent)` takes what the CA returned plus the state the client retained and reduces it to one terminal outcome: `issued`, `pending`, `confirm-required`, `pop-required`, or `rejected`. It binds the exchange first — Transaction Identifier, the Sender and Recipient Nonce echo compared in constant time and by full value so a truncation cannot match, and the Data Return echo — with each check applying only if the client sent that half, and, once sent, an absent or differing echo being a refusal, which is the replay defense. `bodyPartIDs` extends the same rule to what the response is about: a status reporting on a body part the request never sent is refused, which the transaction and nonce cannot catch, because a server can echo both correctly while answering about a different message. Several status controls are permitted and the worst governs, so a failure cannot hide behind an earlier success; the absence of any status control is success, per §6.1.2. The carrier's signature must verify (§3.2.1.3.4): a conforming SignedData carries its own signer certificate, so the ordinary build-then-verify flow needs nothing extra and the verdict reports `signatureVerified: true`. Where the signer is found nowhere the posture is fail-closed with a named opt-out — supply `certs` with the responder's certificate, or `allowUnverified: true`, in which case the verdict reports `signatureVerified: false`. Doing neither is refused, the opt-out never excuses a signature that is present and wrong, and a carrier with no signer at all is refused outright. The response's own `cmsSequence` and `otherMsgs` come back raw, since a request whose only arm was the other-message form has no certificate to return and §4.1 puts its answer there. Nothing is trusted: issued certificates are read from the CMS certificate bag (§4.2) and surfaced raw for `pki.path.validate`, and a Publish Trust Anchors control is surfaced with `trusted: false` rather than added to a store — `build`, `verify` |
+| `pki.cmc` | Build and interpret CMC messages (RFC 5272). `build(spec, signer)` assembles a Full PKI Request across all three request arms (PKCS#10, CRMF, other) and carries it either way RFC 5272 §3.2 allows: `{ cert, key }` signs it, while `{ mac: { identifier, secret } }` authenticates it under a shared secret for a client that holds no key yet, using the PasswordRecipientInfo that section requires and deriving the key from the identifier followed by the secret. A key that cannot sign for itself proves possession another way: `spec.popChallenge` answers the authority's encrypted challenge (RFC 5272 §6.7), decrypting the proof value, confirming it hashes to the witness the challenge carries, and returning the MAC the authority asked for, with `cmc/pop-failed` when the value is not the one issued. A signed request goes through `pki.cms.sign` under `id-cct-PKIData`. A PKCS#10 (`tcr`) request is verified against its own proof-of-possession before signing, so a request whose self-signature does not verify under its subject public key is refused rather than signed into a message a CA would reject. Body-part identifiers are unique across the whole message and never the reserved 0; a caller's clash is refused rather than renumbered, since a control may already reference it. An Identity Proof V2 witness is computed over the `reqSequence` bytes exactly as emitted (§6.2.1 step 1) rather than a re-serialization, a POP Link Witness is emitted only alongside the POP Link Random control §6.3.1.1 requires beside it, and a renewal carries neither Identification nor Identity Proof in either version. `verify(response, sent)` takes what the CA returned plus the state the client retained and reduces it to one terminal outcome: `issued`, `pending`, `confirm-required`, `pop-required`, or `rejected`. It binds the exchange first — Transaction Identifier, the Sender and Recipient Nonce echo compared in constant time and by full value so a truncation cannot match, and the Data Return echo — with each check applying only if the client sent that half, and, once sent, an absent or differing echo being a refusal, which is the replay defense. `bodyPartIDs` extends the same rule to what the response is about: a status reporting on a body part the request never sent is refused, which the transaction and nonce cannot catch, because a server can echo both correctly while answering about a different message. Several status controls are permitted and the worst governs, so a failure cannot hide behind an earlier success; the absence of any status control is success, per §6.1.2. The carrier's signature must verify (§3.2.1.3.4): a conforming SignedData carries its own signer certificate, so the ordinary build-then-verify flow needs nothing extra and the verdict reports `signatureVerified: true`. Where the signer is found nowhere the posture is fail-closed with a named opt-out — supply `certs` with the responder's certificate, or `allowUnverified: true`, in which case the verdict reports `signatureVerified: false`. Doing neither is refused, the opt-out never excuses a signature that is present and wrong, and a carrier with no signer at all is refused outright. The response's own `cmsSequence` and `otherMsgs` come back raw, since a request whose only arm was the other-message form has no certificate to return and §4.1 puts its answer there. Nothing is trusted: issued certificates are read from the CMS certificate bag (§4.2) and surfaced raw for `pki.path.validate`, and a Publish Trust Anchors control is surfaced with `trusted: false` rather than added to a store — `build`, `verify` |
 | `pki.schema.cmc` | Decode CMC messages (RFC 5272 as updated by RFC 6402): a Full PKI Request (`PKIData`) or Full PKI Response (`PKIResponse`) riding inside a CMS SignedData, reached by the encapsulated content type (`id-cct-PKIData` / `id-cct-PKIResponse`). Controls are surfaced in wire order with their values raw, so an unrecognized one is data rather than a fault. Tagged requests decode across all three arms. The status verdicts (`CMCStatusInfo` v1 and `CMCStatusInfoV2`) are collected as an ordered list, and the RFC 6402 two-module `OtherStatusInfo` ambiguity — `pendInfo` and `extendedFailInfo` are both untagged SEQUENCEs in the 1988 module, told apart only by their first element — is resolved by inspection and refused when it cannot be told apart. Body-part identity is unique across the whole message rather than per sequence, 0 is reserved as the reference to the enclosing PKIData, and the `reqSequence` bytes are surfaced exactly as they appeared so an Identity Proof witness is computed over the wire bytes. A companion decoder for CMS content rather than an auto-routed format — `parse`, `parsePkiData`, `parsePkiResponse` |
 | `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk`, `encode`, `embeddedDer`, and the schema combinators |
 | `pki.path` | Certification-path validation (RFC 5280 §6). `validate` runs the §6.1 state machine over an ordered path and a trust anchor: signature chaining across RSA, ECDSA, EdDSA, ML-DSA, SLH-DSA and hybrid composite ML-DSA (a composite is accepted only when both its post-quantum and traditional components verify), validity windows, name chaining, basic constraints and path length, key usage, name constraints, and the certificate-policy tree. It returns a structured verdict with per-check reason codes and enforces a `pki.trust` anchor's per-purpose distrust-after dates and delegator purposes through `checkPurpose` — an anchor that carries either one with no purpose named to select by is refused as a configuration fault rather than validated as though it carried none. The verdict says what was established. `revocationChecked` takes the weakest outcome on the path: `false` with no checker supplied, `"determined"` when every certificate got an explicit good or revoked answer, `"waived"` when `softFail` turned an undetermined one into a pass, and `"undetermined"` when one could not be answered at all — which includes a checker that throws, a fault `softFail` does not waive because `softFail` opts into an undetermined answer, not into a broken checker. `anchorConstraints` names the purpose the anchor was judged under and whether each of its two constraints applied. `crlChecker` supplies CRL-based revocation, covering partitioned and sharded CRLs, whose §6.3.3 Distribution Point ↔ IDP correspondence lets corresponding shards accumulate reason coverage until all eight revocation reasons are covered, and delta CRLs, merged onto the complete CRL they may be combined with (§5.2.4) so a held certificate its delta releases reads good, while a delta that merges with nothing still reports what it lists and still withholds good. `ocspChecker` supplies OCSP-based revocation (RFC 6960: CertID binding, responder authorization, signature, currency) over the same pluggable hook. `build(leaf, opts)` is the discovering complement (RFC 4158): from a leaf, an untrusted pool of candidate CA certificates, and a trust store, it finds the ordered leaf-to-anchor path `validate` accepts, using name chaining plus the RFC 4158 §3.5 sort hints (an AKI/SKI match, an anchor-adjacent issuer, CA plus keyCertSign, validity at the check time — ordering hints, never filters), a depth-first search with backtracking so the first accepted path wins, and a bounded search (chain-length cap, candidate-expansion cap, identity-tuple visited set) so a cross-certificate cycle or Bridge-CA fan-out terminates deterministically. Every accept flows through `validate`, and its verdict is cross-checked against `openssl verify`. Opt-in AIA `caIssuers` fetching (`opts.fetchAia: true`) discovers a missing intermediate from a certificate's Authority Information Access URL (§4.2.2.1) over `pki.transport`, triggered only on a pool miss and bounded against SSRF and amplification: HTTPS only, a total fetch budget that caps fetching silently rather than throwing, a per-cert URL cap, a build-wide URL dedupe, a response-size and certificate-count cap, no redirect following, and every fault a silent skip. The TLS trust (`opts.tls`) stays distinct from the PKI `trustAnchors`, and every fetched certificate remains untrusted pool material that still flows through `validate` (never a trust anchor). It is off by default, so the default build is byte-identical offline. An `opts.direction` of `"reverse"` searches from a trust anchor toward the leaf (RFC 4158 §3.1), narrower when the anchor set is small and the leaf's issuer options fan out, and `"auto"` picks the direction by first-hop fan-out; reverse building reuses the same pool, visited set, caps, and `validate` gate, so the direction changes only search order, and the anchor is excluded from the returned path. Reverse building is pool-only and does not combine with `fetchAia`. When `opts.userInitialPolicySet` names acceptable certificate-policy OIDs and more than one path validates, build returns the accepted path whose user-constrained policy set best satisfies that set (RFC 4158 §4) rather than the first accepted path, the ranking bounded by the same candidate cap and a malformed set refused with `path/bad-input`; an `anyPolicy` entry is unconstrained and returns the first accepted path. In a mesh of cross-certified domains, where many candidates chain by name to the same place, a candidate is ranked by how many leading relative distinguished names it shares with the name the search is heading for (§3.5.16 and the §3.5.19 reverse method), so a certificate in the target's own domain is tried before one from a cross-certified domain, and forward building sorts a candidate under every candidate that can complete the path when its path length constraint cannot cover the certificates already below it (§3.5.7), an ordering that outranks the other hints rather than competing with them. No candidate is removed and an unbounded search still reaches every path the pool holds; a bounded one spends `maxCandidatesConsidered` on whichever branches the order steers it to. Pure and re-entrant — `validate`, `build`, `crlChecker`, `ocspChecker` |

package/lib/cmc-build.js

@@ -16,6 +16,9 @@ var cmcFmt = require("./schema-cmc");
 var oid = require("./oid");
 var cmsSign = require("./cms-sign");
 var cmsEncrypt = require("./cms-encrypt");
+var cmsDecrypt = require("./cms-decrypt");
+var key = require("./key");
+var _createPublicKey = nodeCrypto.createPublicKey;
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
 var _hasOwn = intrinsic.hasOwn;
@@ -23,6 +26,7 @@ var _isArray = intrinsic.isArray;
 var _isBuffer = intrinsic.isBuffer;
 var _bufferFrom = intrinsic.bufferFrom;
 var _bufferConcat = intrinsic.bufferConcat;
+var _subarray = intrinsic.subarray;
 var frameworkError = require("./framework-error");
 
 var CmcError = frameworkError.CmcError;
@@ -32,6 +36,7 @@ function O(name) { return oid.byName(name); }
 
 var OID_IDENTITY_PROOF_V2 = O("id-cmc-identityProofV2");
 var OID_POP_LINK_RANDOM = O("id-cmc-popLinkRandom");
+var OID_DECRYPTED_POP = O("id-cmc-decryptedPOP");
 var OID_IDENTIFICATION = O("id-cmc-identification");
 var OID_SHA256 = O("sha256");
 var OID_HMAC_SHA256 = O("hmacWithSHA256");
@@ -47,7 +52,7 @@ var POP_LINK_RANDOM_BYTES = 64;
 
 var KNOWN_SPEC_KEYS = intrinsic.assign(intrinsic.create(null), {
   requests: 1, controls: 1, cmsSequence: 1, otherMsgSequence: 1,
-  identityProof: 1, popLink: 1, renewal: 1,
+  identityProof: 1, popLink: 1, renewal: 1, popChallenge: 1,
   transactionId: 1, senderNonce: 1, dataReturn: 1,
 });
 
@@ -185,13 +190,59 @@ function fixedRequestId(req, index) {
   return req.bodyPartID == null ? null : req.bodyPartID;
 }
 
-async function _assertTcrPops(requests) {
+async function _assertTcrPops(requests, popProvenRequest) {
   for (var i = 0; i < requests.length; i++) {
-    if (requests[i] && requests[i].tcr != null) await _assertOneTcrPop(requests[i].tcr, i);
+    if (requests[i] && requests[i].tcr != null) await _assertOneTcrPop(requests[i].tcr, i, popProvenRequest);
   }
 }
-async function _assertOneTcrPop(tcr, i) {
-  var parsed = csr.parse(_der(tcr, "a tcr certificationRequest"));
+/** @internal The parameters an algorithm identifier carries, which for these four are absent or NULL. */
+function _assertNoAlgorithmParameters(algId, what) {
+  var params = algId.parameters;
+  if (params == null) return;
+  if (params.length === 2 && params[0] === 0x05 && params[1] === 0x00) return;
+  throw E("cmc/bad-pop-challenge",
+    "the challenge's " + what + " carries a parameter value, and the algorithms RFC 5274 sec. 4.2 " +
+    "names take none: they are encoded with the parameters absent or NULL");
+}
+
+/** @internal Whether these bytes are one DER OCTET STRING and nothing else. */
+function _isNoSignatureValue(bytes) {
+  if (!bytes || !bytes.length) return false;
+  var node;
+  try { node = asn1.decode(bytes); }
+  catch (_e) { return false; } // allow:swallow-unverified bytes that do not decode are not a NoSignatureValue
+  return node.tagClass === "universal" && node.tagNumber === asn1.TAGS.OCTET_STRING && !node.constructed;
+}
+
+/** @internal A key that can only decrypt cannot sign the request that asks for its certificate, so RFC
+ * 5272 App. C.1 gives it a signature algorithm that carries no proof and sends the proof through the
+ * sec. 6.7 challenge instead. A request in that form is accepted here only when this message answers a
+ * challenge for that same request; without one it carries no proof of possession at all. */
+async function _assertOneTcrPop(tcr, i, popProvenRequest) {
+  var der = _der(tcr, "a tcr certificationRequest");
+  var parsed = csr.parse(der);
+  if (parsed.signatureAlgorithm.oid === O("id-alg-noSignature")) {
+    var params = parsed.signatureAlgorithm.parameters;
+    if (!params || params.length !== 2 || params[0] !== 0x05 || params[1] !== 0x00) {
+      throw E("cmc/bad-popo", "a tcr request [" + i + "] uses id-alg-noSignature, whose parameters must be " +
+        "present and encoded as NULL (RFC 5272 App. C.1)");
+    }
+    /** @internal "NoSignatureValue ::= OCTET STRING" (App. C.1), carried in the signature BIT STRING.
+     * The section says it holds the hash of the request but names no algorithm, so the encoding is what
+     * can be checked here; a value that is not one is a request an authority would reject. */
+    var sig = parsed.signatureValue;
+    if (!sig || sig.unusedBits !== 0 || !_isNoSignatureValue(sig.bytes)) {
+      throw E("cmc/bad-popo", "a tcr request [" + i + "] uses id-alg-noSignature, whose signature is a " +
+        "NoSignatureValue OCTET STRING (RFC 5272 App. C.1)");
+    }
+    if (!popProvenRequest || popProvenRequest.length !== der.length ||
+        !guard.crypto.constantTimeEqual(popProvenRequest, der)) {
+      throw E("cmc/bad-popo", "a tcr request [" + i + "] is signed with id-alg-noSignature, which proves " +
+        "nothing about the key; such a request carries its proof of possession in an answered " +
+        "challenge, so pass the one the authority sent as popChallenge (RFC 5272 App. C.1, sec. 6.7)");
+    }
+    return;
+  }
   if (!(await csrVerify.verifyCsrSignature(parsed))) {
     throw E("cmc/bad-popo", "a tcr request [" + i + "] failed its proof-of-possession: the PKCS#10 signature does not verify under the request's own subject public key (RFC 5272 sec. 6.3), so a CA would reject it -- refusing it here rather than signing it");
   }
@@ -285,10 +336,58 @@ var BINDING_TYPE_NAME = intrinsic.assign(intrinsic.create(null), {
   dataReturn: "an OCTET STRING (RFC 5272 sec. 6.4)",
 });
 
+/** @internal Controls the builder computes for itself from a spec field. Their value is a proof, so a
+ * second one arriving hand-encoded cannot be reconciled with the computed one the way an Identification
+ * name can: the two would both be emitted, and a message carrying two proofs of the same thing is one an
+ * authority has no rule for. Naming the spec field that produces it says which of the two to drop. */
+var GENERATED_BY_OID = intrinsic.create(null);
+GENERATED_BY_OID[O("id-cmc-identityProofV2")] = { field: "identityProof" };
+GENERATED_BY_OID[O("id-cmc-popLinkWitnessV2")] = { field: "popLink" };
+GENERATED_BY_OID[O("id-cmc-popLinkRandom")] = { field: "popLink" };
+GENERATED_BY_OID[O("id-cmc-decryptedPOP")] = { field: "popChallenge", perTarget: true };
+
+/** @internal The bodyPartID a Decrypted POP names, which is the request its proof covers. Several may
+ * ride in one message, one per request, so it is the target that has to be unique rather than the
+ * control. A value that will not read as one is treated as naming nothing, and a second such control is
+ * refused because there is no target to tell the two apart by. */
+function _decryptedPopTarget(controlValue) {
+  try {
+    var node = asn1.decode(controlValue);
+    return intrinsic.bigIntToString(asn1.read.integer(node.children[0]), 10);
+  } catch (_e) { return null; } // allow:swallow-unverified an unreadable control names no request
+}
+
+function _assertNotAlsoComputed(controlType, controlValue, seen, spec) {
+  var generated = GENERATED_BY_OID[controlType];
+  if (!generated) return;
+  /** @internal Tested the way the producer tests it. A field this reads as present but the emitting
+   * code skips would refuse a message that carries one control, not two. */
+  if (spec[generated.field]) {
+    throw E("cmc/bad-input",
+      "spec." + generated.field + " computes this control, and spec.controls carries one as well; a " +
+      "request carries one or the other, since a message with two leaves the authority no proof to " +
+      "check (RFC 5272 sec. 6.2.1 / 6.3.1 / 6.7)");
+  }
+  var target = generated.perTarget ? _decryptedPopTarget(controlValue) : null;
+  var slot = generated.perTarget ? controlType + ":" + (target === null ? "?" : target) : controlType;
+  if (seen[guard.text.keyOf(slot)]) {
+    throw E("cmc/bad-input",
+      "spec.controls carries two " + (oid.name(controlType) || controlType) + " controls" +
+      (generated.perTarget
+        ? (target === null
+          ? " that name no readable certification request, so nothing tells the two proofs apart"
+          : " naming certification request " + target + ", so the authority has two proofs of one request")
+        : "") +
+      "; a message with two leaves the authority no proof to check (RFC 5272 sec. 6.2.1 / 6.3.1 / 6.7)");
+  }
+  seen[guard.text.keyOf(slot)] = true;
+}
+
 function _assertNoDuplicateBinding(callerControls, spec) {
   var seen = intrinsic.create(null);
   callerControls.forEach(function (c) {
-    var field = BINDING_BY_OID[_oidOf(c.type)];
+    var controlOid = _oidOf(c.type);
+    var field = BINDING_BY_OID[controlOid];
     if (!field) return;
     try { BINDING_READER[field](asn1.decode(_der(c.value, "a control value"))); }
     catch (e) {
@@ -374,6 +473,175 @@ function identityProofV2(secret, reqSequenceBytes, identity) {
   }
 }
 
+/** @internal RFC 5274 sec. 4.2 names what a conforming client implements for this exchange: SHA-1 MUST
+ * and SHA-256 SHOULD for the witness, HMAC-SHA1 MUST and HMAC-SHA256 SHOULD for the proof. Both MUSTs
+ * are legacy algorithms and are accepted because the profile requires them of a client answering a
+ * challenge, which is a server's choice to make rather than this side's. Anything else is refused: a
+ * proof computed under an algorithm the server did not ask for is not an answer. */
+var POP_WITNESS_HASH = intrinsic.create(null);
+POP_WITNESS_HASH[O("sha1")] = "sha1";
+POP_WITNESS_HASH[O("sha256")] = "sha256";
+var POP_MAC_HASH = intrinsic.create(null);
+POP_MAC_HASH[O("hmacWithSHA1")] = "sha1";
+POP_MAC_HASH[O("hmacWithSHA256")] = "sha256";
+var POP_MAC_KEY_MAX_BYTES = 64;
+var KNOWN_POP_CHALLENGE_KEYS = intrinsic.assign(intrinsic.create(null),
+  { challenge: 1, recipient: 1 });
+
+/** @internal The key this challenge is addressed to is the one being certified, which by definition has
+ * no certificate yet, so the recipient cannot be selected by matching one. Sec. 6.7 says the identifier
+ * "SHOULD be the SKI" of the request, and that an issuerAndSerialNumber form carries a NULL issuer with
+ * the request's bodyPartID as the serial: neither names a certificate this caller holds. So each
+ * recipient is tried with the key, and the WITNESS decides which attempt recovered the right value,
+ * which is the check the section already requires and the only one that can answer the question. A
+ * caller who does hold the certificate can still pass it and select the ordinary way. */
+var POP_MAX_RECIPIENTS = 8;
+
+/** @internal The CMS recipient kinds that identify a key. A password or a key-encryption key opens the
+ * envelope without saying whose it is, so a decryption through one proves possession of no key. */
+var ASYMMETRIC_RECIPIENT = intrinsic.assign(intrinsic.create(null), { ktri: 1, kari: 1, ori: 1 });
+
+/** @internal What identifies a request within its arm, which is everything a TaggedRequest carries
+ * except the body part identifier the new message is entitled to renumber. Defined once, so the two
+ * sides of the comparison below cannot read different things: the other-message arm is identified by
+ * its type together with its value, since a value alone could belong to another type. */
+function _requestIdentity(parsed) {
+  if (!parsed) return null;
+  if (parsed.arm === "tcr") return { arm: "tcr", bytes: parsed.certificationRequestBytes };
+  if (parsed.arm === "crm") return { arm: "crm", bytes: parsed.certReqMsgBytes };
+  if (parsed.arm === "orm" && parsed.requestMessageType) {
+    return { arm: "orm",
+      bytes: _bufferConcat([b.oid(parsed.requestMessageType), parsed.requestMessageValueBytes]) };
+  }
+  return null;
+}
+
+/** @internal Whether the key that opened the challenge is the key the request asks to have certified.
+ * Only a tcr is answered this way: a crm request carries its own proof-of-possession field. */
+function _provesRequestKey(openingKey, outgoing) {
+  if (!openingKey || !outgoing || !outgoing.certificationRequestBytes) return false;
+  var requested;
+  /** @internal Compared as keys rather than as encodings: an elliptic-curve point written in compressed
+   * form and the same point written uncompressed are different bytes and the same key, and it is the key
+   * the section is about. */
+  try {
+    requested = _createPublicKey({
+      key: csr.parse(outgoing.certificationRequestBytes).subjectPublicKeyInfo.bytes,
+      format: "der", type: "spki",
+    });
+  } catch (_e) { return false; } // allow:swallow-unverified a key this runtime cannot read proves nothing here
+  return intrinsic.keyEquals(requested, openingKey);
+}
+
+/** @internal The public half of the key that OPENED the challenge. The recipient kind comes from the
+ * decryption that succeeded rather than from the caller's object, so key material the envelope never
+ * exercised is not read as the key that answered it. A key whose public half this runtime cannot derive
+ * yields null, and the request is then refused rather than accepted on an unproven key. */
+async function _openingPublicKey(recipient, recipientType) {
+  if (!ASYMMETRIC_RECIPIENT[recipientType]) return null;
+  try {
+    return _createPublicKey({
+      key: await key.publicFromPrivate(recipient.key), format: "der", type: "spki",
+    });
+  } catch (_e) { return null; } // allow:swallow-unverified a key whose public half cannot be derived proves nothing here
+}
+
+async function _recoverProofValue(decoded, recipient, witnessHash) {
+  /** @internal The count is read off the parse rather than re-walked here, so the structure the parser
+   * accepted and the structure this loop iterates cannot disagree. */
+  var count = decoded.cmsRecipientCount;
+  if (count > POP_MAX_RECIPIENTS) {
+    throw E("cmc/bad-pop-challenge",
+      "the challenge's enveloped proof value names " + count + " recipients; a challenge is addressed to " +
+      "the key being certified, and at most " + POP_MAX_RECIPIENTS + " are tried (RFC 5272 sec. 6.7)");
+  }
+  for (var i = 0; i < count; i++) {
+    var opened;
+    try {
+      opened = await cmsDecrypt.decrypt(decoded.cms, recipient, { recipientIndex: i });
+    } catch (_e) {
+      continue;   // allow:swallow-unverified this recipient is not addressed to the supplied key; the witness decides
+    }
+    var candidate = opened.content;
+    var computed = nodeCrypto.createHash(witnessHash).update(candidate).digest();
+    var matches = computed.length === decoded.witness.length &&
+      guard.crypto.constantTimeEqual(computed, decoded.witness);
+    guard.secret.zeroize(computed, CmcError, "cmc/bad-input", "the computed witness");
+    /** @internal The kind of recipient that actually opened it travels with the value, so what proved
+     * possession is decided by the decryption that happened rather than by the caller's object. */
+    if (matches) return { value: candidate, recipientType: opened.recipientType };
+    guard.secret.zeroize(candidate, CmcError, "cmc/bad-input", "a rejected proof value");
+  }
+  throw E("cmc/pop-failed",
+    "no recipient of the challenge yielded a proof value hashing to the witness it carries, so this " +
+    "client cannot prove possession and the enrollment is abandoned (RFC 5272 sec. 6.7 step 3)");
+}
+
+/** @internal The client half of RFC 5272 sec. 6.7: decrypt the challenge, confirm it is the value the
+ * server hashed into the witness, and answer with a MAC over the request it carried. The witness check
+ * is not separable from the answer, because a client that cannot confirm the value "MUST abort the
+ * enrollment process" rather than prove possession of something it could not read. */
+async function answerPopChallenge(popChallenge, ids) {
+  if (!popChallenge || typeof popChallenge !== "object" || _isArray(popChallenge) || _isBuffer(popChallenge)) {
+    throw E("cmc/bad-input", "popChallenge is { challenge, recipient } (RFC 5272 sec. 6.7)");
+  }
+  guard.identifier.assertKnownKeys(popChallenge, KNOWN_POP_CHALLENGE_KEYS, E, "cmc/bad-input",
+    "unknown popChallenge field ");
+  var recipient = popChallenge.recipient;
+  if (!recipient || typeof recipient !== "object" || _isArray(recipient) || _isBuffer(recipient)) {
+    throw E("cmc/bad-input",
+      "popChallenge.recipient is the CMS key material that opens the challenge, in the shape " +
+      "pki.cms.decrypt takes (RFC 5272 sec. 6.7)");
+  }
+  /** @internal The challenge arrives from the authority, so bytes that are not DER at all are a
+   * malformed challenge like any other and carry the same code rather than the codec's. */
+  var challengeBytes = _der(popChallenge.challenge, "the popChallenge challenge");
+  var challengeNode;
+  try { challengeNode = asn1.decode(challengeBytes); }
+  catch (e) {
+    throw E("cmc/bad-pop-challenge",
+      "the popChallenge challenge is the DER of an EncryptedPOP control value: " +
+      ((e && e.message) || "malformed") + " (RFC 5272 sec. 6.7)", e);
+  }
+  var decoded = cmcFmt.parseEncryptedPop(challengeNode);
+  var witnessHash = POP_WITNESS_HASH[guard.text.keyOf(decoded.witnessAlgID.oid)];
+  var macHash = POP_MAC_HASH[guard.text.keyOf(decoded.thePOPAlgID.oid)];
+  if (!witnessHash || !macHash) {
+    throw E("cmc/bad-pop-challenge",
+      "the challenge names an algorithm this client does not answer under: RFC 5274 sec. 4.2 requires " +
+      "SHA-1 or SHA-256 for the witness and HMAC-SHA1 or HMAC-SHA256 for the proof, got " +
+      decoded.witnessAlgID.oid + " and " + decoded.thePOPAlgID.oid);
+  }
+  /** @internal These four algorithms take no parameters: a SHA-2 identifier carries them absent or as
+   * NULL (RFC 5754 sec. 2), and the SHA-1 and HMAC identifiers carry NULL. A parameter value that is
+   * neither is not one of the algorithms named, and copying it into the answer would send the authority
+   * an identifier it cannot read. */
+  _assertNoAlgorithmParameters(decoded.witnessAlgID, "witnessAlgID");
+  _assertNoAlgorithmParameters(decoded.thePOPAlgID, "thePOPAlgID");
+
+  var proofValue = null, macKey = null;
+  try {
+    var recovered = await _recoverProofValue(decoded, recipient, witnessHash);
+    proofValue = recovered.value;
+    /** @internal "The POP Proof Value is used as the secret value in the HMAC algorithm and the request
+     * is used as the data. If the POP Proof Value is greater than 64 bytes, only the first 64 bytes of
+     * the POP Proof Value is used as the secret." The data is the TaggedRequest exactly as the
+     * challenge carried it, which is the copy the server holds and the reason sec. 6.7 puts the request
+     * in the challenge at all: neither side re-encodes it. */
+    macKey = _bufferFrom(proofValue.length > POP_MAC_KEY_MAX_BYTES
+      ? _subarray(proofValue, 0, POP_MAC_KEY_MAX_BYTES) : proofValue);
+    var thePOP = nodeCrypto.createHmac(macHash, macKey).update(decoded.requestBytes).digest();
+    return { algBytes: decoded.thePOPAlgID.bytes, thePOP: thePOP, ids: ids,
+      recipientSpki: await _openingPublicKey(recipient, recovered.recipientType),
+      challengedRequest: _requestIdentity(decoded.request) };
+  } finally {
+    var owned = [];
+    if (proofValue && _isBuffer(proofValue)) guard.list.append(owned, proofValue);
+    if (macKey) guard.list.append(owned, macKey);
+    if (owned.length) guard.secret.zeroizeAll(owned, CmcError, "cmc/bad-input", "the POP proof value");
+  }
+}
+
 function popLinkWitnessV2(secret, R) {
   _assertSecret(secret, "a POP Link Witness V2 control");
   var key = nodeCrypto.createHash("sha256").update(secret, "utf8").digest();
@@ -458,6 +726,9 @@ async function _build(spec, signer, opts) {
   /** @internal The names a caller-written Identification control gives this client, collected as those
    * controls are encoded so the name checked is the name carried (RFC 5272 sec. 6.2.3). */
   var controlIdentifiers = [], controlIdentificationCount = 0, controlIdentifierUnreadable = false;
+  /** @internal Which of the controls the builder computes have already arrived hand-encoded, checked
+   * against the bytes being encoded rather than a second read of the caller's object. */
+  var generatedSeen = intrinsic.create(null);
   callerControls.forEach(function (c) {
     if (!c || typeof c !== "object" || c.type == null || c.value == null) {
       throw E("cmc/bad-input", "each control is { type, value }");
@@ -471,6 +742,7 @@ async function _build(spec, signer, opts) {
      * it carries. The Identification name below is read off THESE bytes for the same reason. */
     var controlType = _oidOf(c.type);
     var controlValue = _der(c.value, "a control value");
+    _assertNotAlsoComputed(controlType, controlValue, generatedSeen, spec);
     if (controlType === OID_IDENTIFICATION) {
       controlIdentificationCount += 1;
       var idNode;
@@ -485,7 +757,7 @@ async function _build(spec, signer, opts) {
         controlIdentifierUnreadable = true;
       }
     }
-    controls.push(encodeControl(controlType, [controlValue], ids));
+    guard.list.append(controls, encodeControl(controlType, [controlValue], ids));
   });
 
   _assertNoDuplicateBinding(callerControls, spec);
@@ -572,6 +844,45 @@ async function _build(spec, signer, opts) {
     }
   }
 
+  /** @internal The answer to a challenge-response proof of possession (RFC 5272 sec. 6.7 step 4). Its
+   * bodyPartID names the certification request in THIS request, not the one the challenge quoted, so
+   * the server can tie the proof to what is being asked for now. With more than one request there is
+   * no single answer to give, and guessing which one the proof covers is not this side's call. */
+  var popProvenRequest = null;
+  if (spec.popChallenge) {
+    if (encodedRequests.length !== 1) {
+      throw E("cmc/bad-input",
+        "a challenge-response proof of possession answers for one certification request, and this " +
+        "request carries " + encodedRequests.length + " (RFC 5272 sec. 6.7)");
+    }
+    var answered = await answerPopChallenge(spec.popChallenge, ids);
+    /** @internal The proof covers the request the CHALLENGE carried, and the control names the request
+     * in THIS message. If those are not the same certification request, the message proves possession
+     * of a key for a request it does not contain, so the two are compared on everything but the body
+     * part identifier, which the new message is entitled to renumber. */
+    var outgoing = cmcFmt.parseTaggedRequest(asn1.decode(encodedRequests[0].der));
+    var outgoingId = _requestIdentity(outgoing);
+    if (!answered.challengedRequest || !outgoingId ||
+        answered.challengedRequest.arm !== outgoingId.arm ||
+        answered.challengedRequest.bytes.length !== outgoingId.bytes.length ||
+        !guard.crypto.constantTimeEqual(answered.challengedRequest.bytes, outgoingId.bytes)) {
+      throw E("cmc/bad-input",
+        "the challenge answers for a different certification request than this message carries, so the " +
+        "proof would not cover the request it names (RFC 5272 sec. 6.7 step 4)");
+    }
+    /** @internal What the challenge proved possession of. A request signed with id-alg-noSignature has
+     * no signature to prove it, and App. C.1 sends exactly that case here, so this is the request that
+     * is then allowed to carry one. Opening the challenge shows possession of the key it was encrypted
+     * to, which sec. 6.7 says is the key in the request; a challenge opened by any other key says
+     * nothing about the key being certified, so it does not stand in for the missing signature. */
+    popProvenRequest = _provesRequestKey(answered.recipientSpki, outgoing) ? outgoingId.bytes : null;
+    guard.list.append(controls, encodeControl(OID_DECRYPTED_POP, [b.sequence([
+      b.integer(BigInt(encodedRequests[0].bodyPartID)),
+      b.raw(answered.algBytes),
+      b.octetString(answered.thePOP),
+    ])], ids));
+  }
+
   if (spec.popLink) {
     guard.identifier.assertKnownKeys(spec.popLink, KNOWN_POP_LINK_KEYS, E, "cmc/bad-input",
       function (k) { return "unknown field " + JSON.stringify(k) + " on popLink -- it is { secret }"; });
@@ -611,7 +922,7 @@ async function _build(spec, signer, opts) {
     guard.identifier.assertKnownKeys(signer, KNOWN_MAC_CARRIER_KEYS, E, "cmc/bad-input", "unknown shared-secret carrier field ");
     var macBytes = macPassword(signer.mac);
     try {
-      await _assertTcrPops(requests);
+      await _assertTcrPops(requests, popProvenRequest);
       /** @internal The Password Recipient Info option, which sec. 3.2(a) requires, is what the CMS
        * producer selects for a password recipient, and it generates the MAC key sec. 3.2(b) calls for. */
       return await cmsEncrypt.authenticate(pkiData, [{ password: macBytes }],
@@ -630,7 +941,7 @@ async function _build(spec, signer, opts) {
     ownedKeyBytes.length = 0;
   }
   try {
-    await _assertTcrPops(requests);
+    await _assertTcrPops(requests, popProvenRequest);
     return await cmsSign.sign(pkiData, copiedSigner, { eContentType: "id-cct-PKIData", pem: opts.pem });
   } finally {
     _wipeOwnedKeys();

package/lib/cmc-verify.js

@@ -550,6 +550,26 @@ function _shape(body, sent, signatureVerified, bound) {
  * carry neither Identification nor Identity Proof (sec. 3.2 (a)), so asking for both is refused
  * and never silently dropped.
  *
+ * `spec.popChallenge: { challenge, recipient }` answers an authority's challenge-response proof of
+ * possession, which is how a key that cannot sign for itself proves the client holds it (RFC 5272
+ * sec. 6.7). `challenge` is the Encrypted POP control's value and `recipient` is the key material
+ * `pki.cms.decrypt` takes. The proof value is decrypted, hashed under the witness algorithm the
+ * challenge names and compared with the witness it carries; a value that does not decrypt or does not
+ * match is not the one the authority issued, so the request is refused with `cmc/pop-failed` and no
+ * proof is sent. The answer is a MAC over the request the challenge carried, keyed by that value
+ * (truncated to 64 bytes, sec. 6.7) under the algorithm the challenge named, and it names the
+ * certification request in THIS request, so a request carrying more than one is refused. The
+ * algorithms are the ones RFC 5274 sec. 4.2 requires of a client: SHA-1 or SHA-256 for the witness,
+ * HMAC-SHA1 or HMAC-SHA256 for the proof.
+ *
+ * A `tcr` request signed with `id-alg-noSignature` (RFC 5272 App. C.1) is the request a decrypt-only
+ * key produces, and it carries no proof of its own. It is accepted only when this message answers a
+ * challenge for that same request and the key that opened the challenge is the request's own subject
+ * public key, compared as keys rather than as encodings. A challenge opened by a password or a
+ * key-encryption key identifies no key and does not qualify, and its parameters must be present and
+ * encoded as NULL. Without such an answer the request is refused with `cmc/bad-popo`, and a request
+ * that does carry a signature is still held to it.
+ *
  * `spec.transactionId` (number|bigint), `spec.senderNonce` and `spec.dataReturn` (bytes) attach the
  * exchange-binding controls (RFC 5272 sec. 6.6 / 6.4), the same three `pki.cmc.verify` checks the
  * response against. They are named fields, not something to hand-encode into

package/lib/cms-decrypt.js

@@ -160,7 +160,7 @@ function _kekIdMatches(ri, kekId) {
   return Buffer.compare(id, guard.bytes.view(kekId, CmsError, "cms/bad-input", "kekId")) === 0;
 }
 
-var _passThrough = intrinsic.assign(intrinsic.create(null), { "cms/unsupported-algorithm": 1, "cms/unsupported-recipient-type": 1, "cms/bad-input": 1, "cms/iteration-limit": 1, "cms/missing-key-derivation": 1, "cms/no-encrypted-content": 1 });
+var _passThrough = intrinsic.assign(intrinsic.create(null), { "cms/unsupported-algorithm": 1, "cms/unsupported-recipient-type": 1, "cms/bad-input": 1, "cms/iteration-limit": 1, "cms/missing-key-derivation": 1, "cms/no-encrypted-content": 1, "cms/too-many-recipient-keys": 1 });
 
 async function _acquireCek(ri, km, opts) {
   try {
@@ -198,6 +198,29 @@ async function _ktriCek(ri, km) {
   }
 }
 
+/** @internal One KeyAgreeRecipientInfo can carry an encrypted key for several recipients under one
+ * originator and one key-derivation, and a caller decrypting with a private key alone has no identifier
+ * to select its own entry by. The key-encryption key is derived once and every entry is offered to it;
+ * AES key wrap's integrity check settles which entry belongs to this key, so an entry that opens is one
+ * this key was addressed by. The attempt count is bounded because the list is attacker-supplied. */
+async function _kariUnwrapAny(kek, reks) {
+  var list = reks || [];
+  /** @internal The list arrives with the message, so the number of unwraps it can demand is bounded.
+   * The bound caps the attempts rather than refusing the list, so an entry within it still opens the
+   * message it always opened. */
+  var tried = list.length < C.LIMITS.CMS_MAX_KARI_ENCRYPTED_KEYS
+    ? list.length : C.LIMITS.CMS_MAX_KARI_ENCRYPTED_KEYS;
+  for (var i = 0; i < tried; i++) {
+    try { return await _aesKwUnwrap(kek, list[i].encryptedKey); }
+    catch (_e) { continue; } // allow:swallow-unverified this entry is not addressed to this key; a later one may be
+  }
+  if (list.length > tried) {
+    throw _err("cms/too-many-recipient-keys", "a KeyAgreeRecipientInfo names " + list.length +
+      " encrypted keys and none of the first " + tried + " opened; at most " + tried + " are tried");
+  }
+  throw _fail();
+}
+
 async function _kariCek(ri, km) {
   var k = _normKeyDer(km.key);
   var kek, z, mz;
@@ -207,7 +230,7 @@ async function _kariCek(ri, km) {
     var wrapAlg = _kariWrap(kea);
     var scheme = kea.oid;
     var origSpki = _originatorSpki(ri.originator);
-    var rek = (km.cert != null && _kariRekFor(ri, x509.parse(_normCertDer(km.cert)))) || ri.recipientEncryptedKeys[0];
+    var rek = (km.cert != null && _kariRekFor(ri, x509.parse(_normCertDer(km.cert)))) || null;
     var kekBytes = WRAP_KEK_LENGTHS[wrapAlg.oid];
     if (!kekBytes) throw _err("cms/unsupported-algorithm", "unsupported kari key-wrap");
     var ukm = ri.ukm || null;
@@ -222,7 +245,8 @@ async function _kariCek(ri, km) {
     } else {
       var origAlg = asn1.decode(origSpki).children[0];
       var origHasParams = origAlg.children.length > 1;
-      var curveOid = (km.cert != null && _ecCurveFromCert(km.cert)) || (origHasParams ? asn1.read.oid(origAlg.children[1]) : null);
+      var curveOid = (km.cert != null && _ecCurveFromCert(km.cert)) ||
+        (origHasParams ? asn1.read.oid(origAlg.children[1]) : _ecCurveFromPrivateKey(keyDer));
       var curve = curveOid ? CURVE[curveOid] : null;
       if (!curve) throw _err("cms/unsupported-algorithm", "unsupported or missing originator EC curve");
       var origSpkiFull = origHasParams ? origSpki : _withEcCurveParams(origSpki, curveOid);
@@ -232,7 +256,15 @@ async function _kariCek(ri, km) {
       var zKey = await subtle.importKey("raw", z, { name: "X963KDF" }, false, ["deriveBits"]);
       kek = Buffer.from(await subtle.deriveBits({ name: "X963KDF", hash: _x963Hash(scheme), info: _eccSharedInfo(wrapAlg.name, ukm, kekBytes) }, zKey, kekBytes * 8));
     }
-    return await _aesKwUnwrap(kek, rek.encryptedKey);
+    /** @internal A caller that supplied a certificate selects its entry by recipient identifier, which
+     * is what that certificate is for. Offering every entry is for the caller that has only a key, and
+     * so has no identifier to select by. */
+    if (km.cert != null) {
+      var chosen = rek || ri.recipientEncryptedKeys[0];
+      if (!chosen) throw _fail();
+      return await _aesKwUnwrap(kek, chosen.encryptedKey);
+    }
+    return await _kariUnwrapAny(kek, ri.recipientEncryptedKeys);
   } finally {
     guard.secret.zeroizeAll([z, mz, kek], CmsError, "cms/bad-input", "the key-agreement shared secret");
     _releaseKeyDer(k);
@@ -507,6 +539,19 @@ function _ecCurveFromCert(cert) {
   if (spki.algorithm.oid !== O("ecPublicKey") || spki.algorithm.parameters == null) return null;
   return asn1.read.oid(asn1.decode(spki.algorithm.parameters));
 }
+/** @internal The curve of the recipient's own private key. RFC 5753 sec. 7.1 lets an originator omit its
+ * curve parameters because the recipient already knows the curve; a recipient decrypting with a key and
+ * no certificate has that knowledge in the key itself, and nowhere else. */
+function _ecCurveFromPrivateKey(keyDer) {
+  var spki;
+  try {
+    spki = nodeCrypto.createPublicKey({ key: keyDer, format: "der", type: "pkcs8" })
+      .export({ format: "der", type: "spki" });
+  } catch (_e) { return null; } // allow:swallow-unverified a key this runtime cannot read names no curve
+  var alg = asn1.decode(spki).children[0];
+  if (asn1.read.oid(alg.children[0]) !== O("ecPublicKey") || alg.children.length < 2) return null;
+  return asn1.read.oid(alg.children[1]);
+}
 function _withEcCurveParams(spki, curveOid) {
   var node = asn1.decode(spki);
   var alg = node.children[0];

package/lib/constants.js

@@ -124,6 +124,7 @@ var LIMITS = Object.assign(Object.create(null), {
   CBOR_MAX_ITEMS: 1000000,
   SCT_MAX_BYTES: BYTES.kib(64) + 1,
   SCT_MAX_COUNT: 256,
+  CMS_MAX_KARI_ENCRYPTED_KEYS: 64,
   MERKLE_MAX_PROOF_NODES: 65,
   PROXY_MAX_TLS_ANCHORS: 256,
   PATH_MAX_CERTS: 100,

package/lib/guard-intrinsic.js

@@ -4,6 +4,7 @@
 // @internal
 
 var _utilTypes = require("util").types;
+var _nodeCrypto = require("node:crypto");
 
 var _call = Function.prototype.call;
 var _bind = Function.prototype.bind;
@@ -19,6 +20,10 @@ var _bufferByteLength = Buffer.byteLength;
 var _bufferCompare = Buffer.compare;
 var _bufferEquals = uncurry(Buffer.prototype.equals);
 var _bufferToString = uncurry(Buffer.prototype.toString);
+/** @internal Key identity, taken off the KeyObject prototype at load. A caller that replaced this
+ * method could make two different keys answer as one, which is the question a proof of possession
+ * turns on. */
+var _keyEquals = uncurry(_nodeCrypto.KeyObject.prototype.equals);
 
 var _isView = ArrayBuffer.isView;
 var _isInteger = Number.isInteger;
@@ -146,6 +151,7 @@ module.exports = Object.freeze({
   byteLength: _bufferByteLength,
   compare: _bufferCompare,
   bufferEquals: _bufferEquals,
+  keyEquals: _keyEquals,
   isView: _isView,
   isInteger: _isInteger,
   isSafeInteger: _isSafeInteger,

package/lib/schema-cmc.js

@@ -42,6 +42,8 @@ var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
 var oid = require("./oid");
 var cms = require("./schema-cms");
+var csr = require("./schema-csr");
+var crmf = require("./schema-crmf");
 var guard = require("./guard-all");
 var frameworkError = require("./framework-error");
 
@@ -55,6 +57,8 @@ function O(name) { return oid.byName(name); }
 
 var OID_PKI_DATA = O("id-cct-PKIData");
 var OID_PKI_RESPONSE = O("id-cct-PKIResponse");
+var OID_ENCRYPTED_POP = O("id-cmc-encryptedPOP");
+var OID_DECRYPTED_POP = O("id-cmc-decryptedPOP");
 var OID_STATUS_INFO = O("id-cmc-statusInfo");
 var OID_STATUS_INFO_V2 = O("id-cmc-statusInfoV2");
 var OID_RESPONSE_BODY = O("id-cmc-responseBody");
@@ -79,6 +83,11 @@ var CMC_CARRIERS = Object.assign(Object.create(null), { signedData: 1, authData:
 var CONTROL_PLACEMENT = Object.create(null);
 CONTROL_PLACEMENT[OID_RESPONSE_BODY] = "pkiResponse";
 CONTROL_PLACEMENT[OID_RA_IDENTITY_WITNESS] = "pkiData";
+/** @internal The two halves of the challenge-response exchange travel in opposite directions: the
+ * authority sends the challenge in its response, and the client answers in its next request (RFC 5272
+ * sec. 6.7). A message carrying the other one is not the message that section describes. */
+CONTROL_PLACEMENT[OID_ENCRYPTED_POP] = "pkiResponse";
+CONTROL_PLACEMENT[OID_DECRYPTED_POP] = "pkiData";
 
 
 function readBodyPartId(node, label) {
@@ -429,6 +438,181 @@ var PKI_RESPONSE = schema.seq([
   },
 });
 
+/** @internal The challenge-response proof of possession a server sends when the key being certified
+ * cannot sign for itself (RFC 5272 sec. 6.7). The `cms` field is surfaced as the bytes it arrived as,
+ * because it is an EnvelopedData a caller decrypts with its own key material rather than something
+ * this parser opens. */
+/** @internal The request a challenge quotes is one the client answers for, so it is held to the
+ * definition of the arm it uses rather than to its outer tag alone: a proof computed over a request
+ * that is not one could never be checked against anything. This is asked of a CHALLENGED request only.
+ * A request body carries what its sender sent, and judging it is the enrollment's business, not the
+ * decoder's. */
+function _assertAnswerableRequest(request) {
+  if (request.arm !== "tcr" && request.arm !== "crm") return;
+  /** @internal A CertReqMessages of one, which is the shape the CRMF parser takes; built outside the
+   * catch below so only the parse it wraps can be what fails. */
+  var payload = request.arm === "tcr" ? request.certificationRequestBytes
+    : asn1.build.sequence([asn1.build.raw(request.certReqMsgBytes)]);
+  try {
+    if (request.arm === "tcr") { csr.parse(payload); } else { crmf.parse(payload); }
+  } catch (e) {
+    throw E("cmc/bad-pop-challenge",
+      "the request an EncryptedPOP quotes is not a " +
+      (request.arm === "tcr" ? "PKCS#10 CertificationRequest" : "CRMF CertReqMsg") +
+      ", so a proof over it could not be checked: " + ((e && e.message) || "malformed") +
+      " (RFC 5272 sec. 6.7)", e);
+  }
+}
+
+function parseEncryptedPop(node) {
+  if (node.tagClass !== "universal" || node.tagNumber !== TAGS.SEQUENCE || !node.constructed ||
+      node.children.length !== 5) {
+    throw E("cmc/bad-pop-challenge",
+      "an EncryptedPOP is SEQUENCE { request, cms, thePOPAlgID, witnessAlgID, witness } (RFC 5272 sec. 6.7)");
+  }
+  var envelope = _assertEnvelopedChallenge(node.children[1]);
+  var request;
+  try { request = parseTaggedRequest(node.children[0]); }
+  catch (e) {
+    throw E("cmc/bad-pop-challenge",
+      "an EncryptedPOP quotes the request it challenges as a TaggedRequest: " +
+      ((e && e.message) || "malformed") + " (RFC 5272 sec. 6.7)", e);
+  }
+  _assertAnswerableRequest(request);
+  return {
+    request: request,
+    /** @internal The TaggedRequest exactly as it arrived. A proof of possession is a MAC over these
+     * bytes, and the challenge carries them so neither side has to re-encode the request to agree on
+     * what was covered (RFC 5272 sec. 6.7). */
+    requestBytes: node.children[0].bytes,
+    cms: envelope.bytes,
+    cmsRecipientCount: envelope.recipientCount,
+    thePOPAlgID: _popAlgorithm(node.children[2], "thePOPAlgID"),
+    witnessAlgID: _popAlgorithm(node.children[3], "witnessAlgID"),
+    witness: _popOctetString(node.children[4], "witness"),
+  };
+}
+
+/** @internal A leaf of one of the POP controls. A malformed one is a malformed challenge, so it carries
+ * this control's code rather than the codec's. */
+function _popOctetString(node, what) {
+  try { return asn1.read.octetString(node); }
+  catch (e) {
+    throw E("cmc/bad-pop-challenge", "a POP " + what + " is an OCTET STRING (RFC 5272 sec. 6.7)", e);
+  }
+}
+
+function parseDecryptedPop(node) {
+  if (node.tagClass !== "universal" || node.tagNumber !== TAGS.SEQUENCE || !node.constructed ||
+      node.children.length !== 3) {
+    throw E("cmc/bad-pop-challenge",
+      "a DecryptedPOP is SEQUENCE { bodyPartID, thePOPAlgID, thePOP } (RFC 5272 sec. 6.7)");
+  }
+  var bodyPartID;
+  try { bodyPartID = readBodyPartIdentity(node.children[0]); }
+  catch (e) {
+    throw E("cmc/bad-pop-challenge",
+      "a DecryptedPOP names the certification request it proves with a BodyPartID: " +
+      ((e && e.message) || "malformed") + " (RFC 5272 sec. 6.7)", e);
+  }
+  return {
+    bodyPartID: bodyPartID,
+    thePOPAlgID: _popAlgorithm(node.children[1], "thePOPAlgID"),
+    thePOP: _popOctetString(node.children[2], "thePOP"),
+  };
+}
+
+/** @internal The proof value travels in an EnvelopedData (RFC 5272 sec. 6.7), and the bytes are handed
+ * on unopened because opening them needs key material this parser does not hold. Unopened is not
+ * unchecked: a field that is not a ContentInfo carrying an EnvelopedData cannot be a challenge, and
+ * saying so here is what keeps a control that could never be answered from reading as one. */
+function _assertEnvelopedChallenge(node) {
+  var kids = pkix.rootSequenceChildren(node, 2, 2);
+  if (!kids) {
+    throw E("cmc/bad-pop-challenge",
+      "an EncryptedPOP carries the proof value in a CMS ContentInfo, which is a SEQUENCE of a content " +
+      "type and its content (RFC 5272 sec. 6.7)");
+  }
+  var contentType;
+  try { contentType = asn1.read.oid(kids[0]); }
+  catch (e) {
+    throw E("cmc/bad-pop-challenge",
+      "an EncryptedPOP's ContentInfo names its content type with an OBJECT IDENTIFIER (RFC 5272 sec. 6.7)", e);
+  }
+  if (contentType !== O("envelopedData")) {
+    throw E("cmc/bad-pop-challenge",
+      "an EncryptedPOP carries the proof value in an EnvelopedData, got " +
+      (oid.name(contentType) || contentType) + " (RFC 5272 sec. 6.7)");
+  }
+  var content = kids[1];
+  if (content.tagClass !== "context" || content.tagNumber !== 0 || !content.constructed ||
+      content.children.length !== 1) {
+    throw E("cmc/bad-pop-challenge",
+      "an EncryptedPOP's ContentInfo carries its content in [0] EXPLICIT (RFC 5652 sec. 3)");
+  }
+  /** @internal Validated by the CMS EnvelopedData schema itself rather than by a shape check written
+   * here, so every field is held to one definition and the count reported below is the count of
+   * recipients that same definition accepted. Sec. 6.7 also allows a recipient identified by an
+   * issuerAndSerialNumber whose issuer is encoded as NULL, which is not the Name that schema requires;
+   * a challenge addressed only that way is refused here, and `pki.cms.decrypt` could not open it
+   * either, so it is refused where the reason can be named rather than after a failed answer. */
+  var enveloped;
+  try { enveloped = cms.walkEnvelopedData(content.children[0]); }
+  catch (e) {
+    throw E("cmc/bad-pop-challenge",
+      "an EncryptedPOP's ContentInfo does not carry an EnvelopedData a recipient could open: " +
+      ((e && e.message) || "malformed") + " (RFC 5652 sec. 6.1)", e);
+  }
+  var recipients = (enveloped.recipientInfos || []).length;
+  if (recipients < 1) {
+    throw E("cmc/bad-pop-challenge",
+      "an EnvelopedData names at least one recipient in its recipientInfos SET (RFC 5652 sec. 6.1)");
+  }
+  return { bytes: node.bytes, recipientCount: recipients };
+}
+
+/** @internal Both fields are AlgorithmIdentifiers, and both are read the same way: the OID names the
+ * algorithm and the parameters travel with it, so a caller answering a challenge copies what it was
+ * sent rather than reconstructing it. */
+function _popAlgorithm(node, what) {
+  if (node.tagClass !== "universal" || node.tagNumber !== TAGS.SEQUENCE || !node.constructed ||
+      node.children.length < 1 || node.children.length > 2) {
+    throw E("cmc/bad-pop-challenge", "a POP " + what + " is an AlgorithmIdentifier (RFC 5272 sec. 6.7)");
+  }
+  var algOid;
+  try { algOid = asn1.read.oid(node.children[0]); }
+  catch (e) {
+    throw E("cmc/bad-pop-challenge",
+      "a POP " + what + " names its algorithm with an OBJECT IDENTIFIER (RFC 5272 sec. 6.7)", e);
+  }
+  return {
+    oid: algOid,
+    name: oid.name(algOid) || null,
+    parameters: node.children.length === 2 ? node.children[1].bytes : null,
+    bytes: node.bytes,
+  };
+}
+
+/** @internal One AttributeValue, which is what a control carrying a single structure holds. */
+function _onlyValue(c, what) {
+  if (c.values.length !== 1) {
+    throw E("cmc/bad-pop-challenge",
+      "a " + what + " control carries exactly one AttributeValue, got " + c.values.length);
+  }
+  return asn1.decode(c.values[0]);
+}
+
+function _decodePopChallenges(controls) {
+  for (var i = 0; i < controls.length; i++) {
+    var c = controls[i];
+    if (c.attrType === OID_ENCRYPTED_POP) {
+      c.encryptedPOP = parseEncryptedPop(_onlyValue(c, "an Encrypted POP"));
+    } else if (c.attrType === OID_DECRYPTED_POP) {
+      c.decryptedPOP = parseDecryptedPop(_onlyValue(c, "a Decrypted POP"));
+    }
+  }
+}
+
 function _collectStatuses(controls) {
   var out = [];
   for (var i = 0; i < controls.length; i++) {
@@ -445,6 +629,7 @@ function _collectStatuses(controls) {
 
 function _finishBody(body, where) {
   for (var i = 0; i < body.controls.length; i++) assertControlPlacement(body.controls[i], where);
+  _decodePopChallenges(body.controls);
   body.statuses = _collectStatuses(body.controls);
   body.unhandled = body.controls.filter(function (c) {
     return c.attrType !== OID_STATUS_INFO && c.attrType !== OID_STATUS_INFO_V2 && c.attrName === null;
@@ -541,9 +726,20 @@ function parsePkiResponse(input) {
  *   pki.schema.cmc.parse(der).kind;   // "pkiData"
  */
 function parse(input) {
-  var parsedCms = (input && typeof input === "object" && !ArrayBuffer.isView(input) &&
-    !guard.bytes.isByteSource(input) && input.encapContentInfo != null)
-    ? input : cms.parse(input);
+  var alreadyParsed = input && typeof input === "object" && !ArrayBuffer.isView(input) &&
+    !guard.bytes.isByteSource(input) && input.encapContentInfo != null;
+  var parsedCms;
+  if (alreadyParsed) { parsedCms = input; }
+  else {
+    /** @internal Bytes that are not a CMS message at all are a CMC message this cannot read, and every
+     * other format parser answers for its own input in its own domain. */
+    try { parsedCms = cms.parse(input); }
+    catch (e) {
+      throw E("cmc/bad-der",
+        "a CMC message is carried in a CMS SignedData or AuthenticatedData, and these bytes are not " +
+        "one: " + ((e && e.message) || "malformed") + " (RFC 5272 sec. 3.2 / 4.2)", e);
+    }
+  }
   if (CMC_CARRIERS[parsedCms.contentTypeName] !== 1) {
     throw E("cmc/not-cmc",
       "a Full PKI Request / Response is carried in a CMS SignedData or AuthenticatedData, got " +
@@ -568,6 +764,8 @@ function parse(input) {
 }
 
 module.exports = {
+  parseEncryptedPop: parseEncryptedPop,
+  parseTaggedRequest: parseTaggedRequest,
   parse: parse,
   parsePkiData: parsePkiData,
   parsePkiResponse: parsePkiResponse,

package/lib/schema-cms.js

@@ -555,7 +555,9 @@ var KEY_AGREE_RECIPIENT_INFO = schema.seq([
   schema.field("originator", schema.explicit(0, ORIGINATOR_IDENTIFIER_OR_KEY, { code: "cms/bad-kari" })),
   schema.optional("ukm", schema.octetString(), { tag: 1, explicit: true, emptyCode: "cms/bad-kari" }),
   schema.field("keyEncryptionAlgorithm", ALGORITHM_IDENTIFIER),
-  schema.field("recipientEncryptedKeys", schema.seqOf(RECIPIENT_ENCRYPTED_KEY, { code: "cms/bad-recipient-encrypted-keys", what: "recipientEncryptedKeys" })),
+  /** @internal At least one encrypted key: a key-agreement recipient info that names none names no
+   * recipient, so nothing could open the content it is attached to. */
+  schema.field("recipientEncryptedKeys", schema.seqOf(RECIPIENT_ENCRYPTED_KEY, { min: 1, code: "cms/bad-recipient-encrypted-keys", what: "recipientEncryptedKeys" })),
 ], {
   assert: "constructed", code: "cms/bad-kari", what: "KeyAgreeRecipientInfo",
   build: function (m) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.48",
+  "version": "0.6.49",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:2d1b2e87-6386-4481-940b-f4de0f1b9227",
+  "serialNumber": "urn:uuid:082f242e-4786-4518-b201-8797b47662eb",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-06T18:47:52.624Z",
+    "timestamp": "2026-09-07T02:07:15.421Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.48",
+      "bom-ref": "@blamejs/pki@0.6.49",
       "type": "application",
       "name": "pki",
-      "version": "0.6.48",
+      "version": "0.6.49",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.48",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.49",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.48",
+      "ref": "@blamejs/pki@0.6.49",
       "dependsOn": []
     }
   ]