@blamejs/pki 0.6.48 → 0.6.50

package/lib/cmp-build.js

@@ -13,12 +13,13 @@
  *   PKCS#10 via `pki.csr.sign`, a `certConf` / `pollReq` / `genm` / `rr`, or a `nested` wrapper of other
  *   PKIMessages an RA forwards), and an optional
  *   `PKIProtection` computed over the message. Protection is a signature under the sender key (any
- *   registry algorithm) or a PBMAC1 shared-secret MAC. The emitted message round-trips through
+ *   registry algorithm), a PBMAC1 shared-secret MAC, or a KEM-based MAC keyed by a secret the peer
+ *   encapsulated to the sender's ML-KEM key. The emitted message round-trips through
  *   `pki.schema.cmp.parse` and its protection verifies. `pki.cmp.transfer` carries a message to a CMP
  *   endpoint (RFC 9811), `pki.cmp.verify` checks an incoming message's protection, and `pki.cmp.session`
  *   drives a full enrollment transaction end to end over these. Parsing lives at `pki.schema.cmp.parse`.
  * @spec RFC 9810
- * @card Build a CMP PKIMessage with signature or PBMAC1 protection.
+ * @card Build a CMP PKIMessage with signature, PBMAC1 or KEM-based protection.
  */
 
 var asn1 = require("./asn1-der");
@@ -52,6 +53,7 @@ var signScheme = require("./sign-scheme");
 var pkix = require("./schema-pkix");
 var pkiBuild = require("./pki-build");
 var webcrypto = require("./webcrypto");
+var subtle = webcrypto.webcrypto.subtle;
 var pbes2 = require("./pbes2");
 var constants = require("./constants");
 var guard = require("./guard-all");
@@ -87,9 +89,10 @@ var BODY_TAG = intrinsic.assign(intrinsic.create(null), {
 });
 var CRMF_BODY = intrinsic.assign(intrinsic.create(null), { ir: 1, cr: 1, kur: 1, krr: 1, ccr: 1 });
 var CERT_REP_ARM = intrinsic.assign(intrinsic.create(null), { ip: 1, cp: 1, kup: 1, ccp: 1 });
-var KNOWN_OPTS_KEYS = intrinsic.assign(intrinsic.create(null), { key: 1, cert: 1, mac: 1, extraCerts: 1, pem: 1, pss: 1, digestAlgorithm: 1 });
+var KNOWN_OPTS_KEYS = intrinsic.assign(intrinsic.create(null), { key: 1, cert: 1, mac: 1, kem: 1, extraCerts: 1, pem: 1, pss: 1, digestAlgorithm: 1 });
 var KNOWN_OPTS_SIG_KEYS = intrinsic.assign(intrinsic.create(null), { key: 1, cert: 1, extraCerts: 1, pem: 1, pss: 1, digestAlgorithm: 1 });
 var KNOWN_OPTS_MAC_KEYS = intrinsic.assign(intrinsic.create(null), { mac: 1, extraCerts: 1, pem: 1 });
+var KNOWN_OPTS_KEM_KEYS = intrinsic.assign(intrinsic.create(null), { kem: 1, extraCerts: 1, pem: 1 });
 var KNOWN_MESSAGE_KEYS = intrinsic.assign(intrinsic.create(null), { header: 1, body: 1 });
 var KNOWN_MAC_KEYS = intrinsic.assign(intrinsic.create(null), { secret: 1, salt: 1, iterationCount: 1, prf: 1, keyLength: 1, algorithm: 1 });
 
@@ -545,11 +548,164 @@ async function _p10crBody(csrDer, parsedCsr, tag, state) {
 
 
 
-function _resolveProtection(opts) {
+/** @internal A byte field of the KEM protection spec, taken through the toolkit's byte door so a
+ * caller object cannot answer differently on a second read. */
+function _kemBytes(v, what) {
+  if (v == null) throw _err("cmp/bad-input", what + " is required for KEM-based protection");
+  if (!guard.bytes.isByteSource(v)) throw _err("cmp/bad-input", what + " must be DER bytes");
+  return guard.bytes.snapshotSource(v, CmpError, "cmp/bad-input", what);
+}
+
+var KEM_STATIC_STRING = "CMP-KEM";
+var KNOWN_KEM_KEYS = intrinsic.assign(intrinsic.create(null),
+  { key: 1, ciphertext: 1, kemAlgorithm: 1, kemContext: 1, transactionID: 1, len: 1 });
+/** @internal The KEM algorithms a ciphertext can be decapsulated under, and the MAC the derived key
+ * drives. RFC 9810 sec. 5.1.3.4 leaves both to the profile and points at RFC 9481; the shipped set is
+ * the ML-KEM parameter sets this toolkit already establishes secrets with, under HMAC-SHA256. */
+/** @internal Keyed by the DOTTED OID, not by a display name: `pki.oid.register` can re-point a name,
+ * and an algorithm this client supports must not become unsupported because a caller renamed it. */
+var KEM_DECAPSULATE = intrinsic.create(null);
+KEM_DECAPSULATE[O("id-ml-kem-512")] = "ML-KEM-512";
+KEM_DECAPSULATE[O("id-ml-kem-768")] = "ML-KEM-768";
+KEM_DECAPSULATE[O("id-ml-kem-1024")] = "ML-KEM-1024";
+var KEM_MAC_KEY_BYTES = 32;
+
+/** @internal The context a KEM-derived protection key is bound to (RFC 9810 sec. 5.1.3.4). Written
+ * ONCE and read by both the protecting and the verifying half, because two copies of one derivation
+ * drift: the static string, the transaction identifier and any kemContext all feed the KDF, so a
+ * single byte of disagreement yields a key the peer cannot reproduce. The CMP module is EXPLICIT TAGS,
+ * so `[0]` wraps the OCTET STRING. */
+function kemOtherInfo(transactionID, kemContext) {
+  var kids = [b.sequence([b.utf8(KEM_STATIC_STRING)]), b.octetString(transactionID)];
+  if (kemContext != null) guard.list.append(kids, b.explicit(0, b.octetString(kemContext)));
+  return b.sequence(kids);
+}
+
+/** @internal The shared secret key: HKDF over the KEM shared secret, with the DER KemOtherInfo as
+ * info and `len` as the output size the MAC algorithm needs. */
+async function kemSharedKey(sharedSecret, len, transactionID, kemContext) {
+  var info = kemOtherInfo(transactionID, kemContext);
+  var ikm = await subtle.importKey("raw", sharedSecret, { name: "HKDF" }, false, ["deriveBits"]);
+  var bits = await subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt: intrinsic.bufferAlloc(0), info: info }, ikm, len * 8);
+  return intrinsic.bufferFrom(bits);
+}
+
+/** @internal The protecting half of RFC 9810 sec. 5.1.3.4: the holder of the KEM private key
+ * decapsulates the ciphertext the peer sent, derives the shared secret key, and MACs the message with
+ * it. Decapsulation failure terminates the operation with the failInfo the section names, rather than
+ * falling through to another flavor. */
+/** @internal The decapsulation key, from the shapes every other key option in this module accepts: a
+ * WebCrypto CryptoKey is adopted as it is, which is what `pki.key.generate` hands back, and an encoded
+ * key is decoded and imported. Any copy the decode makes is collected for the caller to wipe. */
+async function _kemPrivateKey(rawKey, wcName, ownedKeyCopies) {
+  if (rawKey && typeof rawKey === "object" && !guard.bytes.isByteSource(rawKey) &&
+      typeof rawKey.type === "string" && rawKey.algorithm != null) {
+    if (rawKey.type !== "private") {
+      throw _err("cmp/bad-input", "opts.kem.key is a CryptoKey of type " + guard.text.showValue(rawKey.type) +
+        "; decapsulation needs the private key (type \"private\")");
+    }
+    return webcrypto.adoptKey(rawKey, { name: wcName }, ["decapsulateBits"], _signE, "bad-input");
+  }
+  var keyDer = signScheme.normalizePkcs8(rawKey, "opts.kem.key", _signE, ownedKeyCopies);
+  return subtle.importKey("pkcs8", keyDer, { name: wcName }, false, ["decapsulateBits"]);
+}
+
+/** @internal The KemBMParameter fields in the order sec. 5.1.3.4 gives them, with the optional
+ * kemContext between the KDF and the length. */
+function _kemBmParameterKids(len, kemContext) {
+  var kids = [b.sequence([b.oid(oid.byName("hkdfWithSha256"))])];
+  if (kemContext != null) guard.list.append(kids, b.explicit(0, b.octetString(kemContext)));
+  guard.list.append(kids, b.integer(_bigInt(len)));
+  guard.list.append(kids, b.sequence([b.oid(oid.byName("hmacWithSHA256"))]));
+  return kids;
+}
+
+/** @internal The MAC the derived key drives, computed the same way on both halves. */
+async function kemMac(sharedKey, protectedPartDer) {
+  var k = await subtle.importKey("raw", sharedKey, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  return intrinsic.bufferFrom(await subtle.sign({ name: "HMAC" }, k, protectedPartDer));
+}
+
+function _resolveKemProtection(kemSpec, message) {
+  if (!kemSpec || typeof kemSpec !== "object" || _isBuffer(kemSpec)) {
+    throw _err("cmp/bad-input", "opts.kem must be an object { key, ciphertext, kemAlgorithm, kemContext?, transactionID?, len? }");
+  }
+  guard.identifier.assertKnownKeys(kemSpec, KNOWN_KEM_KEYS, _err, "cmp/bad-input", "unknown opts.kem field ");
+  if (kemSpec.key == null) throw _err("cmp/bad-input", "opts.kem.key is the KEM private key the ciphertext was encapsulated to");
+  /** @internal Taken once, and decoded LATER: normalizing a PEM or a Uint8Array allocates a buffer
+   * holding the private key, and anything that throws between here and the MAC would leave it behind.
+   * The copy is therefore made inside the protected region below, where its cleanup runs on every
+   * exit; a caller-owned Buffer is only viewed and is never wiped. */
+  var rawKey = kemSpec.key;
+  var ct = _kemBytes(kemSpec.ciphertext, "opts.kem.ciphertext (the KEM ciphertext the peer sent)");
+  var algName = kemSpec.kemAlgorithm;
+  if (typeof algName !== "string") throw _err("cmp/bad-input", "opts.kem.kemAlgorithm names the KEM the ciphertext was produced under");
+  var algOid = oid.isDottedDecimal(algName) ? algName : oid.byName(algName);
+  var wcName = KEM_DECAPSULATE[guard.text.keyOf(algOid)];
+  if (!wcName) {
+    throw _err("cmp/unsupported-algorithm",
+      "unsupported KEM " + algName + " for KEM-based message protection (ML-KEM-512/768/1024)");
+  }
+  /** @internal The ASN.1 admits len 1, and a one-byte key is one an observer of a single message can
+   * search exhaustively, so the floor is the one this module already applies to a MAC key rather than
+   * the syntax's. */
+  var len = kemSpec.len == null ? KEM_MAC_KEY_BYTES : kemSpec.len;
+  if (typeof len !== "number" || !Number.isInteger(len) ||
+      len < constants.LIMITS.CMP_KEM_MIN_KEY_BYTES || len > constants.LIMITS.CMP_KEM_MAX_KEY_BYTES) {
+    throw _err("cmp/bad-input", "opts.kem.len is the derived key size in bytes, " +
+      constants.LIMITS.CMP_KEM_MIN_KEY_BYTES + ".." + constants.LIMITS.CMP_KEM_MAX_KEY_BYTES +
+      " (a shorter key would not carry the strength the MAC is meant to have)");
+  }
+  var kemContext = kemSpec.kemContext == null ? null
+    : _kemBytes(kemSpec.kemContext, "opts.kem.kemContext");
+  /** @internal "transactionID MUST be the value from the message containing the ciphertext", which is
+   * this message's own id in the ordinary flow and the peer's when it sent the ciphertext first, so
+   * the caller can name it. */
+  var txid = kemSpec.transactionID != null
+    ? _kemBytes(kemSpec.transactionID, "opts.kem.transactionID")
+    /** @internal `_build` has already refused a spec with no header, so this reads the header it
+     * verified rather than re-testing for one. */
+    : _kemBytes(message.header.transactionID,
+      "message.header.transactionID (a KEM-derived key is bound to it)");
+  return {
+    protectionAlgDer: b.sequence([b.oid(oid.byName("kemBasedMac")), b.sequence(_kemBmParameterKids(len, kemContext))]),
+    certDer: null,
+    computeBits: async function (protectedPartDer) {
+      var ss = null, ssk = null, ownedKeyCopies = [];
+      try {
+        try {
+          var priv = await _kemPrivateKey(rawKey, wcName, ownedKeyCopies);
+          ss = intrinsic.bufferFrom(await subtle.decapsulateBits({ name: wcName }, priv, ct));
+        } catch (e) {
+          if (e instanceof CmpError) throw e;
+          throw _err("cmp/bad-message-check",
+            "the KEM ciphertext did not decapsulate under opts.kem.key, so no protection key can be " +
+            "derived and the operation is terminated (RFC 9810 sec. 5.1.3.4 step 2)", e);
+        }
+        ssk = await kemSharedKey(ss, len, txid, kemContext);
+        return b.bitString(await kemMac(ssk, protectedPartDer), 0);
+      } finally {
+        var owned = [];
+        if (ss) guard.list.append(owned, ss);
+        if (ssk) guard.list.append(owned, ssk);
+        for (var ci = 0; ci < ownedKeyCopies.length; ci++) guard.list.append(owned, ownedKeyCopies[ci]);
+        ownedKeyCopies.length = 0;
+        if (owned.length) guard.secret.zeroizeAll(owned, CmpError, "cmp/bad-input", "the KEM shared secret");
+      }
+    },
+  };
+}
+
+function _resolveProtection(opts, message) {
   var hasSig = opts.key != null || opts.cert != null;
   var hasMac = opts.mac != null;
-  if (hasSig && hasMac) throw _err("cmp/bad-input", "supply exactly one of { key, cert } (signature) or { mac } (PBMAC1), not both");
-  if (!hasSig && !hasMac) throw _err("cmp/bad-input", "a PKIMessage requires protection: supply { key, cert } for a signature or { mac } for PBMAC1");
+  var hasKem = opts.kem != null;
+  if ((hasSig ? 1 : 0) + (hasMac ? 1 : 0) + (hasKem ? 1 : 0) > 1) {
+    throw _err("cmp/bad-input", "supply exactly one of { key, cert } (signature), { mac } (PBMAC1) or { kem } (KEM-based MAC), not more than one");
+  }
+  if (hasKem) return _resolveKemProtection(opts.kem, message);
+  if (!hasSig && !hasMac) throw _err("cmp/bad-input", "a PKIMessage requires protection: supply { key, cert } for a signature, { mac } for PBMAC1, or { kem } for a KEM-based MAC");
 
   if (hasSig) {
     if (opts.key == null || opts.cert == null) throw _err("cmp/bad-input", "signature protection requires both opts.key (the private key) and opts.cert (the signer certificate)");
@@ -621,8 +777,11 @@ async function _build(message, opts) {
     return "unknown message field " + JSON.stringify(k) + " (a message carries only header + body)";
   });
   var sigForm = opts.key != null || opts.cert != null, macForm = opts.mac != null;
+  var kemForm = opts.kem != null;
+  var formCount = (sigForm ? 1 : 0) + (macForm ? 1 : 0) + (kemForm ? 1 : 0);
   guard.identifier.assertKnownKeys(opts,
-    sigForm === macForm ? KNOWN_OPTS_KEYS : sigForm ? KNOWN_OPTS_SIG_KEYS : KNOWN_OPTS_MAC_KEYS,
+    formCount !== 1 ? KNOWN_OPTS_KEYS
+      : sigForm ? KNOWN_OPTS_SIG_KEYS : macForm ? KNOWN_OPTS_MAC_KEYS : KNOWN_OPTS_KEM_KEYS,
     _err, "cmp/bad-input", function (k) {
       return "unknown opts field " + JSON.stringify(k) +
         (macForm && (k === "pss" || k === "digestAlgorithm")
@@ -632,7 +791,7 @@ async function _build(message, opts) {
   if (message.header == null) throw _err("cmp/bad-input", "message.header is required");
   if (message.body == null) throw _err("cmp/bad-input", "message.body is required");
 
-  var prot = _resolveProtection(opts);
+  var prot = _resolveProtection(opts, message);
   var senderKey = opts.key;
 
   var bodyResult = await _encodeBody(message.body, senderKey, opts);
@@ -712,6 +871,13 @@ function _collectExtraCerts(opts, protCertDer) {
  *   - `key` (Buffer|CryptoKey) + `cert` (Buffer): signature protection under the sender key; `cert` is
  *     the signer certificate (its SPKI resolves the algorithm) and is placed in `extraCerts`.
  *   - `mac` ({ secret, salt?, iterationCount?, prf?, keyLength? }): PBMAC1 protection from a shared secret.
+ *   - `kem` ({ key, ciphertext, kemAlgorithm, kemContext?, transactionID?, len? }): KEM-based MAC
+ *     protection (RFC 9810 sec. 5.1.3.4), for a sender whose key establishes secrets rather than
+ *     signing. `key` is the KEM private key as a CryptoKey (what `pki.key.generate` returns), a
+ *     PKCS#8 DER Buffer / Uint8Array, or a PEM string. `ciphertext` is what the peer encapsulated to
+ *     it, `kemAlgorithm` names the ML-KEM
+ *     parameter set it was produced under, and the derived key is bound to `transactionID` (this
+ *     message's, unless the ciphertext arrived under another) and any `kemContext`.
  *   - `extraCerts` (array of Buffer): additional certificates to carry in `extraCerts [1]`.
  *   - `pem` (boolean|string): return a PEM `CMP` block instead of DER.
  *   - `pss` (boolean) / `digestAlgorithm` (string): signature-protection algorithm options.
@@ -875,9 +1041,12 @@ function wellKnownUrl(base, opts) {
   var rawBasePath = _beforeQueryOrFragment(_stripSchemeAuthority(String(base)));
   if (rawBasePath !== "" && rawBasePath !== "/") throw _err("cmp/bad-url", "an RFC 8615 well-known URI is authority-rooted; the CMP base URL must have no path component (pass a full operation URL to transfer instead): " + JSON.stringify(String(base)));
   var segs = [".well-known", "cmp"];
-  if (opts.label != null) { segs.push("p"); segs.push(_wellKnownSeg(opts.label, "label")); }
-  if (opts.operation != null) segs.push(_wellKnownSeg(opts.operation, "operation"));
-  return u.origin + "/" + segs.join("/");
+  if (opts.label != null) {
+    guard.list.append(segs, "p");
+    guard.list.append(segs, _wellKnownSeg(opts.label, "label"));
+  }
+  if (opts.operation != null) guard.list.append(segs, _wellKnownSeg(opts.operation, "operation"));
+  return u.origin + "/" + intrinsic.join(segs, "/");
 }
 
 /**
@@ -962,4 +1131,8 @@ module.exports = {
   },
   // @internal
   decodeIdpDistributionPoint: decodeIdpDistributionPoint,
+  /** @internal The KEM protection derivation, read by pki.cmp.verify so the two halves of one
+   * key agreement cannot drift apart. */
+  kemSharedKey: kemSharedKey,
+  kemMac: kemMac,
 };

package/lib/cmp-session.js

@@ -77,6 +77,14 @@ var INFO_OPS = Object.assign(Object.create(null), {
   rootCaCert: { name: "rootCaCert", requestOid: "rootCaCert", responseOid: "rootCaKeyUpdate", value: "cert", read: "readRootCaKeyUpdate" },
   certReqTemplate: { name: "certReqTemplate", requestOid: "certReqTemplate", responseOid: "certReqTemplate", value: false, read: "readCertReqTemplate" },
   crlUpdate: { name: "crlUpdate", requestOid: "crlStatusList", responseOid: "crls", value: "crlStatus", read: "readCrls" },
+  /** @internal The KEM ciphertext a peer encapsulated to this client's KEM public key, which the
+   * client then decapsulates to protect its own messages (RFC 9810 sec. 5.3.19.18 / 5.1.3.4). The
+   * request carries no value; the answer carries the algorithm and the ciphertext. */
+  kemCiphertext: { name: "kemCiphertext", requestOid: "kemCiphertextInfo", responseOid: "kemCiphertextInfo", value: false, read: "readKemCiphertextInfo" },
+});
+var KEM_CIPHERTEXT_ALGORITHMS = Object.assign(Object.create(null));
+["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function (n) {
+  KEM_CIPHERTEXT_ALGORITHMS[oid.byName(n)] = n;
 });
 var KNOWN_REVOKE_KEYS = Object.assign(Object.create(null), { certificate: 1, certDetails: 1, reason: 1 });
 var RSA_ARCS = ["rsaEncryption", "rsaSignatureWithripemd160", "id-TA-RSA-v1-5-SHA-256",
@@ -1341,6 +1349,25 @@ function session(opts) {
   }
 
   function _checkInfoValue(op, value, requestValue) {
+    /** @internal A ciphertext is only useful if the client can decapsulate it, so the answer is held
+     * to a KEM this toolkit establishes secrets under and to a non-empty ciphertext; anything else
+     * could not be turned into a protection key (RFC 9810 sec. 5.3.19.18 / 5.1.3.4). */
+    if (op.name === "kemCiphertext") {
+      if (!KEM_CIPHERTEXT_ALGORITHMS[value.kem.oid]) {
+        throw _err("cmp/bad-info-value", "a KEM ciphertext answer names " +
+          (value.kem.name || value.kem.oid) + ", which this client cannot decapsulate under (ML-KEM-512/768/1024)");
+      }
+      /** @internal An ML-KEM ciphertext is a fixed size, so one of any other length could not be
+       * decapsulated under the algorithm the answer names. Refusing it here reports the authority's
+       * answer as malformed rather than handing back material that cannot be used. */
+      var want = oid.kemParams(value.kem.oid);
+      if (!value.ct || value.ct.length !== want.ct) {
+        throw _err("cmp/bad-info-value", "a KEM ciphertext answer for " +
+          (value.kem.name || value.kem.oid) + " carries " + (value.ct ? value.ct.length : 0) +
+          " bytes, and that algorithm's ciphertext is " + want.ct);
+      }
+      return value;
+    }
     if (op.name === "rootCaCert") {
       if (value.newWithOld == null) throw _err("cmp/bad-info-value", "a rootCaKeyUpdate response must carry newWithOld -- the certificate that lets an entity trusting the OLD root gain trust in the new one (RFC 9483 sec. 4.3.2)");
       return _checkRootCaKeyUpdate(value, requestValue);

package/lib/cmp-verify.js

@@ -51,8 +51,10 @@ var _certExtDecoders = pkix.certExtensionDecoders(NS).byOid;
 
 var KNOWN_VERIFY_OPTS = intrinsic.assign(intrinsic.create(null), {
   sharedSecret: 1, signerCert: 1, trustAnchors: 1, intermediates: 1, time: 1,
-  transactionID: 1, expectRecipNonce: 1, revocationChecker: 1, maxIterations: 1,
+  transactionID: 1, expectRecipNonce: 1, revocationChecker: 1, maxIterations: 1, kem: 1,
 });
+var KNOWN_KEM_VERIFY_KEYS = intrinsic.assign(intrinsic.create(null),
+  { sharedSecret: 1, transactionID: 1 });
 
 var PRF_HASH = _create(null);
 PRF_HASH[oid.byName("hmacWithSHA256")] = "SHA-256";
@@ -68,7 +70,7 @@ var PBMAC1_KEYLEN_MAX = 1024;
 var PRF_HLEN = intrinsic.assign(intrinsic.create(null), { "SHA-256": 32, "SHA-384": 48, "SHA-512": 64 });
 
 var UNSUPPORTED_MAC_OIDS = _create(null);
-["passwordBasedMac", "dhBasedMac", "kemBasedMac"].forEach(function (n) {
+["passwordBasedMac", "dhBasedMac"].forEach(function (n) {
   var o = oid.byName(n);
   if (o) UNSUPPORTED_MAC_OIDS[o] = n;
 });
@@ -375,6 +377,66 @@ function _keyUsageAllowsSigning(parsed) {
   return true;
 }
 
+/** @internal The verifying half of RFC 9810 sec. 5.1.3.4. The peer that encapsulated holds the same
+ * shared secret, and derives the key from it through the derivation `pki.cmp.build` uses, so the two
+ * halves cannot disagree about the context. The transaction identifier the context binds to is the one
+ * from the message that carried the ciphertext, which the caller names when it is not this message's. */
+async function _verifyKem(m, protectedPart, protectionAlg, protection, opts) {
+  var kemOpts = opts.kem;
+  if (!kemOpts) {
+    throw _err("cmp/bad-input", "a KEM-protected message requires opts.kem { sharedSecret, transactionID? }");
+  }
+  if (!_nonEmptySecret(kemOpts.sharedSecret)) {
+    throw _err("cmp/bad-input", "opts.kem.sharedSecret is the KEM shared secret the peer encapsulated");
+  }
+  if (protectionAlg.parameters === null) {
+    return _fail(m, "kem", protectionAlg, "cmp/protection-failed", "the KEM protectionAlg carries no KemBMParameter (RFC 9810 sec. 5.1.3.4)");
+  }
+  var params;
+  try { params = cmp.readKemBMParameter(protectionAlg.parameters); }
+  catch (e) {
+    return _fail(m, "kem", protectionAlg, e instanceof CmpError ? e.code : "cmp/protection-failed",
+      "the KemBMParameter did not decode: " + ((e && e.message) || e));
+  }
+  if (params.kdf.oid !== oid.byName("hkdfWithSha256")) {
+    return _fail(m, "kem", protectionAlg, "cmp/unsupported-algorithm",
+      "unsupported KEM key-derivation " + _stringify(params.kdf.name || params.kdf.oid) + " (HKDF-SHA256 only)");
+  }
+  if (params.mac.oid !== oid.byName("hmacWithSHA256")) {
+    return _fail(m, "kem", protectionAlg, "cmp/unsupported-algorithm",
+      "unsupported KEM message-authentication algorithm " + _stringify(params.mac.name || params.mac.oid) + " (HMAC-SHA256 only)");
+  }
+  /** @internal The sender chooses `len`, so a peer could name a key short enough to search. The
+   * message is refused rather than verified under a key that carries no strength. */
+  if (params.len < constants.LIMITS.CMP_KEM_MIN_KEY_BYTES) {
+    return _fail(m, "kem", protectionAlg, "cmp/protection-failed",
+      "the KemBMParameter names a " + params.len + "-byte protection key, and a key shorter than " +
+      constants.LIMITS.CMP_KEM_MIN_KEY_BYTES + " bytes would not carry the strength the MAC is meant to have");
+  }
+  var txid = kemOpts.transactionID != null
+    ? guard.bytes.view(kemOpts.transactionID, CmpError, "cmp/bad-input", "opts.kem.transactionID")
+    : m.header.transactionID;
+  if (txid == null) {
+    return _fail(m, "kem", protectionAlg, "cmp/protection-failed",
+      "a KEM-derived key is bound to the transaction identifier of the message that carried the ciphertext, and neither this message nor opts.kem names one");
+  }
+  var secret = guard.bytes.view(kemOpts.sharedSecret, CmpError, "cmp/bad-input", "opts.kem.sharedSecret");
+  var ssk = null;
+  try {
+    ssk = await cmpBuild.kemSharedKey(secret, params.len, txid, params.kemContext);
+    var computed = await cmpBuild.kemMac(ssk, protectedPart);
+    if (!guard.crypto.constantTimeEqual(computed, protection.bytes)) {
+      return _fail(m, "kem", protectionAlg, "cmp/protection-failed",
+        "the KEM-based MAC does not verify (a different shared secret, a different derivation context, or a tampered ProtectedPart)");
+    }
+  } finally {
+    if (ssk) guard.secret.zeroize(ssk, CmpError, "cmp/bad-input", "the KEM-derived protection key");
+  }
+  var khc = _headerChecks(m, opts);
+  if (khc) return _fail(m, "kem", protectionAlg, khc.code, khc.reason);
+  return _ok(m, "kem", protectionAlg, true, null);
+}
+
 async function _verifyMac(m, protectedPart, protectionAlg, protection, opts) {
   if (protectionAlg.parameters === null) {
     return _fail(m, "mac", protectionAlg, "cmp/protection-failed", "the PBMAC1 protectionAlg carries no PBMAC1-params (RFC 9579 sec. 4)");
@@ -561,15 +623,36 @@ function _assertEchoBytes(v, name) {
   throw _err("cmp/bad-input", "opts." + name + " must be a Buffer / Uint8Array");
 }
 
-function _fixSecret(v, made) {
+/** @internal A shared secret, taken once and registered for wiping. Every byte-source shape is
+ * accepted, not only the ones a caller happens to have converted: a KEM encapsulation hands back an
+ * ArrayBuffer, and a secret read from a larger allocation arrives as a view over it. */
+function _fixSecret(v, made, label) {
   if (typeof v === "string") {
     var fromString = _bufferFrom(v, "utf8");
     _append(made, fromString);
     return fromString;
   }
-  var copy = _fixByteish(v, "sharedSecret");
-  if (util.types.isUint8Array(copy)) _append(made, copy);
-  return copy;
+  if (v != null && guard.bytes.isByteSource(v)) {
+    var snap = guard.bytes.snapshotSource(v, CmpError, "cmp/bad-input", "opts." + (label || "sharedSecret"));
+    _append(made, snap);
+    return snap;
+  }
+  return v;
+}
+
+/** @internal The KEM verification material, taken once at the door like every other caller value: the
+ * shared secret is copied and registered for wiping, and the transaction identifier is snapshot, so
+ * neither can answer differently when the derivation reads it. */
+function _fixKem(v, made) {
+  if (v == null) return null;
+  if (typeof v !== "object" || guard.bytes.isByteSource(v)) {
+    throw _err("cmp/bad-input", "opts.kem must be an object { sharedSecret, transactionID? }");
+  }
+  guard.identifier.assertKnownKeys(v, KNOWN_KEM_VERIFY_KEYS, _err, "cmp/bad-input", "unknown opts.kem field ");
+  return {
+    sharedSecret: _fixSecret(v.sharedSecret, made, "kem.sharedSecret"),
+    transactionID: _fixByteish(v.transactionID, "kem.transactionID"),
+  };
 }
 
 function _fixCertList(v, label) {
@@ -609,6 +692,7 @@ function _fixVerifyOptions(opts, made) {
     expectRecipNonce: _fixByteish(opts.expectRecipNonce, "expectRecipNonce"),
     revocationChecker: opts.revocationChecker,
     maxIterations: opts.maxIterations,
+    kem: _fixKem(opts.kem, made),
   };
 
   _assertEchoBytes(f.transactionID, "transactionID");
@@ -634,9 +718,17 @@ async function _verify(message, opts) {
   }
 
   var isMac = protectionAlg.oid === oid.byName("pbmac1");
+  var isKem = protectionAlg.oid === oid.byName("kemBasedMac");
   var hasSigCred = opts.signerCert != null || opts.trustAnchors != null;
   var hasSecret = opts.sharedSecret != null;
 
+  if (isKem) {
+    if (hasSigCred) throw _err("cmp/bad-input", "a KEM-protected message takes opts.kem, not signerCert/trustAnchors");
+    if (hasSecret) throw _err("cmp/bad-input", "a KEM-protected message takes opts.kem.sharedSecret, not opts.sharedSecret");
+    return _verifyKem(m, protectedPart, protectionAlg, protection, opts);
+  }
+  if (opts.kem != null) throw _err("cmp/bad-input", "opts.kem verifies a KEM-based MAC, and this message is protected another way");
+
   if (isMac) {
     if (hasSigCred) throw _err("cmp/bad-input", "a MAC-protected message takes opts.sharedSecret, not signerCert/trustAnchors");
     if (!_nonEmptySecret(opts.sharedSecret)) throw _err("cmp/bad-input", "a PBMAC1-protected message requires a non-empty opts.sharedSecret");
@@ -683,6 +775,10 @@ async function _verify(message, opts) {
  *
  * @opts
  *   - `sharedSecret` (string|Buffer) -- the PBMAC1 secret; REQUIRED for a MAC-protected message (UTF-8).
+ *   - `kem` ({ sharedSecret, transactionID? }) -- REQUIRED for a KEM-protected message (RFC 9810
+ *     sec. 5.1.3.4). `sharedSecret` is what this side encapsulated to the sender's KEM public key, and
+ *     `transactionID` names the message that carried the ciphertext when it was not this one. The
+ *     verdict's `protectionType` is `kem`.
  *   - `signerCert` (Buffer|PEM) -- the expected signature signer certificate (else resolved from
  *     `extraCerts` by `senderKID` or, per RFC 9483 sec. 3.3, `extraCerts[0]`).
  *   - `trustAnchors` (Buffer|Buffer[]|PEM) -- when present the signer certificate is FULLY path-validated

package/lib/cms-decrypt.js

@@ -160,7 +160,7 @@ function _kekIdMatches(ri, kekId) {
   return Buffer.compare(id, guard.bytes.view(kekId, CmsError, "cms/bad-input", "kekId")) === 0;
 }
 
-var _passThrough = intrinsic.assign(intrinsic.create(null), { "cms/unsupported-algorithm": 1, "cms/unsupported-recipient-type": 1, "cms/bad-input": 1, "cms/iteration-limit": 1, "cms/missing-key-derivation": 1, "cms/no-encrypted-content": 1 });
+var _passThrough = intrinsic.assign(intrinsic.create(null), { "cms/unsupported-algorithm": 1, "cms/unsupported-recipient-type": 1, "cms/bad-input": 1, "cms/iteration-limit": 1, "cms/missing-key-derivation": 1, "cms/no-encrypted-content": 1, "cms/too-many-recipient-keys": 1 });
 
 async function _acquireCek(ri, km, opts) {
   try {
@@ -198,6 +198,29 @@ async function _ktriCek(ri, km) {
   }
 }
 
+/** @internal One KeyAgreeRecipientInfo can carry an encrypted key for several recipients under one
+ * originator and one key-derivation, and a caller decrypting with a private key alone has no identifier
+ * to select its own entry by. The key-encryption key is derived once and every entry is offered to it;
+ * AES key wrap's integrity check settles which entry belongs to this key, so an entry that opens is one
+ * this key was addressed by. The attempt count is bounded because the list is attacker-supplied. */
+async function _kariUnwrapAny(kek, reks) {
+  var list = reks || [];
+  /** @internal The list arrives with the message, so the number of unwraps it can demand is bounded.
+   * The bound caps the attempts rather than refusing the list, so an entry within it still opens the
+   * message it always opened. */
+  var tried = list.length < C.LIMITS.CMS_MAX_KARI_ENCRYPTED_KEYS
+    ? list.length : C.LIMITS.CMS_MAX_KARI_ENCRYPTED_KEYS;
+  for (var i = 0; i < tried; i++) {
+    try { return await _aesKwUnwrap(kek, list[i].encryptedKey); }
+    catch (_e) { continue; } // allow:swallow-unverified this entry is not addressed to this key; a later one may be
+  }
+  if (list.length > tried) {
+    throw _err("cms/too-many-recipient-keys", "a KeyAgreeRecipientInfo names " + list.length +
+      " encrypted keys and none of the first " + tried + " opened; at most " + tried + " are tried");
+  }
+  throw _fail();
+}
+
 async function _kariCek(ri, km) {
   var k = _normKeyDer(km.key);
   var kek, z, mz;
@@ -207,7 +230,7 @@ async function _kariCek(ri, km) {
     var wrapAlg = _kariWrap(kea);
     var scheme = kea.oid;
     var origSpki = _originatorSpki(ri.originator);
-    var rek = (km.cert != null && _kariRekFor(ri, x509.parse(_normCertDer(km.cert)))) || ri.recipientEncryptedKeys[0];
+    var rek = (km.cert != null && _kariRekFor(ri, x509.parse(_normCertDer(km.cert)))) || null;
     var kekBytes = WRAP_KEK_LENGTHS[wrapAlg.oid];
     if (!kekBytes) throw _err("cms/unsupported-algorithm", "unsupported kari key-wrap");
     var ukm = ri.ukm || null;
@@ -222,7 +245,8 @@ async function _kariCek(ri, km) {
     } else {
       var origAlg = asn1.decode(origSpki).children[0];
       var origHasParams = origAlg.children.length > 1;
-      var curveOid = (km.cert != null && _ecCurveFromCert(km.cert)) || (origHasParams ? asn1.read.oid(origAlg.children[1]) : null);
+      var curveOid = (km.cert != null && _ecCurveFromCert(km.cert)) ||
+        (origHasParams ? asn1.read.oid(origAlg.children[1]) : _ecCurveFromPrivateKey(keyDer));
       var curve = curveOid ? CURVE[curveOid] : null;
       if (!curve) throw _err("cms/unsupported-algorithm", "unsupported or missing originator EC curve");
       var origSpkiFull = origHasParams ? origSpki : _withEcCurveParams(origSpki, curveOid);
@@ -232,7 +256,15 @@ async function _kariCek(ri, km) {
       var zKey = await subtle.importKey("raw", z, { name: "X963KDF" }, false, ["deriveBits"]);
       kek = Buffer.from(await subtle.deriveBits({ name: "X963KDF", hash: _x963Hash(scheme), info: _eccSharedInfo(wrapAlg.name, ukm, kekBytes) }, zKey, kekBytes * 8));
     }
-    return await _aesKwUnwrap(kek, rek.encryptedKey);
+    /** @internal A caller that supplied a certificate selects its entry by recipient identifier, which
+     * is what that certificate is for. Offering every entry is for the caller that has only a key, and
+     * so has no identifier to select by. */
+    if (km.cert != null) {
+      var chosen = rek || ri.recipientEncryptedKeys[0];
+      if (!chosen) throw _fail();
+      return await _aesKwUnwrap(kek, chosen.encryptedKey);
+    }
+    return await _kariUnwrapAny(kek, ri.recipientEncryptedKeys);
   } finally {
     guard.secret.zeroizeAll([z, mz, kek], CmsError, "cms/bad-input", "the key-agreement shared secret");
     _releaseKeyDer(k);
@@ -507,6 +539,19 @@ function _ecCurveFromCert(cert) {
   if (spki.algorithm.oid !== O("ecPublicKey") || spki.algorithm.parameters == null) return null;
   return asn1.read.oid(asn1.decode(spki.algorithm.parameters));
 }
+/** @internal The curve of the recipient's own private key. RFC 5753 sec. 7.1 lets an originator omit its
+ * curve parameters because the recipient already knows the curve; a recipient decrypting with a key and
+ * no certificate has that knowledge in the key itself, and nowhere else. */
+function _ecCurveFromPrivateKey(keyDer) {
+  var spki;
+  try {
+    spki = nodeCrypto.createPublicKey({ key: keyDer, format: "der", type: "pkcs8" })
+      .export({ format: "der", type: "spki" });
+  } catch (_e) { return null; } // allow:swallow-unverified a key this runtime cannot read names no curve
+  var alg = asn1.decode(spki).children[0];
+  if (asn1.read.oid(alg.children[0]) !== O("ecPublicKey") || alg.children.length < 2) return null;
+  return asn1.read.oid(alg.children[1]);
+}
 function _withEcCurveParams(spki, curveOid) {
   var node = asn1.decode(spki);
   var alg = node.children[0];

package/lib/constants.js

@@ -124,6 +124,9 @@ var LIMITS = Object.assign(Object.create(null), {
   CBOR_MAX_ITEMS: 1000000,
   SCT_MAX_BYTES: BYTES.kib(64) + 1,
   SCT_MAX_COUNT: 256,
+  CMS_MAX_KARI_ENCRYPTED_KEYS: 64,
+  CMP_KEM_MAX_KEY_BYTES: 1024,
+  CMP_KEM_MIN_KEY_BYTES: 20,
   MERKLE_MAX_PROOF_NODES: 65,
   PROXY_MAX_TLS_ANCHORS: 256,
   PATH_MAX_CERTS: 100,

package/lib/guard-intrinsic.js

@@ -4,6 +4,7 @@
 // @internal
 
 var _utilTypes = require("util").types;
+var _nodeCrypto = require("node:crypto");
 
 var _call = Function.prototype.call;
 var _bind = Function.prototype.bind;
@@ -19,6 +20,10 @@ var _bufferByteLength = Buffer.byteLength;
 var _bufferCompare = Buffer.compare;
 var _bufferEquals = uncurry(Buffer.prototype.equals);
 var _bufferToString = uncurry(Buffer.prototype.toString);
+/** @internal Key identity, taken off the KeyObject prototype at load. A caller that replaced this
+ * method could make two different keys answer as one, which is the question a proof of possession
+ * turns on. */
+var _keyEquals = uncurry(_nodeCrypto.KeyObject.prototype.equals);
 
 var _isView = ArrayBuffer.isView;
 var _isInteger = Number.isInteger;
@@ -146,6 +151,7 @@ module.exports = Object.freeze({
   byteLength: _bufferByteLength,
   compare: _bufferCompare,
   bufferEquals: _bufferEquals,
+  keyEquals: _keyEquals,
   isView: _isView,
   isInteger: _isInteger,
   isSafeInteger: _isSafeInteger,