@blamejs/pki 0.6.48 → 0.6.50

package/lib/schema-cmc.js

@@ -42,6 +42,8 @@ var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
 var oid = require("./oid");
 var cms = require("./schema-cms");
+var csr = require("./schema-csr");
+var crmf = require("./schema-crmf");
 var guard = require("./guard-all");
 var frameworkError = require("./framework-error");
 
@@ -55,6 +57,8 @@ function O(name) { return oid.byName(name); }
 
 var OID_PKI_DATA = O("id-cct-PKIData");
 var OID_PKI_RESPONSE = O("id-cct-PKIResponse");
+var OID_ENCRYPTED_POP = O("id-cmc-encryptedPOP");
+var OID_DECRYPTED_POP = O("id-cmc-decryptedPOP");
 var OID_STATUS_INFO = O("id-cmc-statusInfo");
 var OID_STATUS_INFO_V2 = O("id-cmc-statusInfoV2");
 var OID_RESPONSE_BODY = O("id-cmc-responseBody");
@@ -79,6 +83,11 @@ var CMC_CARRIERS = Object.assign(Object.create(null), { signedData: 1, authData:
 var CONTROL_PLACEMENT = Object.create(null);
 CONTROL_PLACEMENT[OID_RESPONSE_BODY] = "pkiResponse";
 CONTROL_PLACEMENT[OID_RA_IDENTITY_WITNESS] = "pkiData";
+/** @internal The two halves of the challenge-response exchange travel in opposite directions: the
+ * authority sends the challenge in its response, and the client answers in its next request (RFC 5272
+ * sec. 6.7). A message carrying the other one is not the message that section describes. */
+CONTROL_PLACEMENT[OID_ENCRYPTED_POP] = "pkiResponse";
+CONTROL_PLACEMENT[OID_DECRYPTED_POP] = "pkiData";
 
 
 function readBodyPartId(node, label) {
@@ -429,6 +438,181 @@ var PKI_RESPONSE = schema.seq([
   },
 });
 
+/** @internal The challenge-response proof of possession a server sends when the key being certified
+ * cannot sign for itself (RFC 5272 sec. 6.7). The `cms` field is surfaced as the bytes it arrived as,
+ * because it is an EnvelopedData a caller decrypts with its own key material rather than something
+ * this parser opens. */
+/** @internal The request a challenge quotes is one the client answers for, so it is held to the
+ * definition of the arm it uses rather than to its outer tag alone: a proof computed over a request
+ * that is not one could never be checked against anything. This is asked of a CHALLENGED request only.
+ * A request body carries what its sender sent, and judging it is the enrollment's business, not the
+ * decoder's. */
+function _assertAnswerableRequest(request) {
+  if (request.arm !== "tcr" && request.arm !== "crm") return;
+  /** @internal A CertReqMessages of one, which is the shape the CRMF parser takes; built outside the
+   * catch below so only the parse it wraps can be what fails. */
+  var payload = request.arm === "tcr" ? request.certificationRequestBytes
+    : asn1.build.sequence([asn1.build.raw(request.certReqMsgBytes)]);
+  try {
+    if (request.arm === "tcr") { csr.parse(payload); } else { crmf.parse(payload); }
+  } catch (e) {
+    throw E("cmc/bad-pop-challenge",
+      "the request an EncryptedPOP quotes is not a " +
+      (request.arm === "tcr" ? "PKCS#10 CertificationRequest" : "CRMF CertReqMsg") +
+      ", so a proof over it could not be checked: " + ((e && e.message) || "malformed") +
+      " (RFC 5272 sec. 6.7)", e);
+  }
+}
+
+function parseEncryptedPop(node) {
+  if (node.tagClass !== "universal" || node.tagNumber !== TAGS.SEQUENCE || !node.constructed ||
+      node.children.length !== 5) {
+    throw E("cmc/bad-pop-challenge",
+      "an EncryptedPOP is SEQUENCE { request, cms, thePOPAlgID, witnessAlgID, witness } (RFC 5272 sec. 6.7)");
+  }
+  var envelope = _assertEnvelopedChallenge(node.children[1]);
+  var request;
+  try { request = parseTaggedRequest(node.children[0]); }
+  catch (e) {
+    throw E("cmc/bad-pop-challenge",
+      "an EncryptedPOP quotes the request it challenges as a TaggedRequest: " +
+      ((e && e.message) || "malformed") + " (RFC 5272 sec. 6.7)", e);
+  }
+  _assertAnswerableRequest(request);
+  return {
+    request: request,
+    /** @internal The TaggedRequest exactly as it arrived. A proof of possession is a MAC over these
+     * bytes, and the challenge carries them so neither side has to re-encode the request to agree on
+     * what was covered (RFC 5272 sec. 6.7). */
+    requestBytes: node.children[0].bytes,
+    cms: envelope.bytes,
+    cmsRecipientCount: envelope.recipientCount,
+    thePOPAlgID: _popAlgorithm(node.children[2], "thePOPAlgID"),
+    witnessAlgID: _popAlgorithm(node.children[3], "witnessAlgID"),
+    witness: _popOctetString(node.children[4], "witness"),
+  };
+}
+
+/** @internal A leaf of one of the POP controls. A malformed one is a malformed challenge, so it carries
+ * this control's code rather than the codec's. */
+function _popOctetString(node, what) {
+  try { return asn1.read.octetString(node); }
+  catch (e) {
+    throw E("cmc/bad-pop-challenge", "a POP " + what + " is an OCTET STRING (RFC 5272 sec. 6.7)", e);
+  }
+}
+
+function parseDecryptedPop(node) {
+  if (node.tagClass !== "universal" || node.tagNumber !== TAGS.SEQUENCE || !node.constructed ||
+      node.children.length !== 3) {
+    throw E("cmc/bad-pop-challenge",
+      "a DecryptedPOP is SEQUENCE { bodyPartID, thePOPAlgID, thePOP } (RFC 5272 sec. 6.7)");
+  }
+  var bodyPartID;
+  try { bodyPartID = readBodyPartIdentity(node.children[0]); }
+  catch (e) {
+    throw E("cmc/bad-pop-challenge",
+      "a DecryptedPOP names the certification request it proves with a BodyPartID: " +
+      ((e && e.message) || "malformed") + " (RFC 5272 sec. 6.7)", e);
+  }
+  return {
+    bodyPartID: bodyPartID,
+    thePOPAlgID: _popAlgorithm(node.children[1], "thePOPAlgID"),
+    thePOP: _popOctetString(node.children[2], "thePOP"),
+  };
+}
+
+/** @internal The proof value travels in an EnvelopedData (RFC 5272 sec. 6.7), and the bytes are handed
+ * on unopened because opening them needs key material this parser does not hold. Unopened is not
+ * unchecked: a field that is not a ContentInfo carrying an EnvelopedData cannot be a challenge, and
+ * saying so here is what keeps a control that could never be answered from reading as one. */
+function _assertEnvelopedChallenge(node) {
+  var kids = pkix.rootSequenceChildren(node, 2, 2);
+  if (!kids) {
+    throw E("cmc/bad-pop-challenge",
+      "an EncryptedPOP carries the proof value in a CMS ContentInfo, which is a SEQUENCE of a content " +
+      "type and its content (RFC 5272 sec. 6.7)");
+  }
+  var contentType;
+  try { contentType = asn1.read.oid(kids[0]); }
+  catch (e) {
+    throw E("cmc/bad-pop-challenge",
+      "an EncryptedPOP's ContentInfo names its content type with an OBJECT IDENTIFIER (RFC 5272 sec. 6.7)", e);
+  }
+  if (contentType !== O("envelopedData")) {
+    throw E("cmc/bad-pop-challenge",
+      "an EncryptedPOP carries the proof value in an EnvelopedData, got " +
+      (oid.name(contentType) || contentType) + " (RFC 5272 sec. 6.7)");
+  }
+  var content = kids[1];
+  if (content.tagClass !== "context" || content.tagNumber !== 0 || !content.constructed ||
+      content.children.length !== 1) {
+    throw E("cmc/bad-pop-challenge",
+      "an EncryptedPOP's ContentInfo carries its content in [0] EXPLICIT (RFC 5652 sec. 3)");
+  }
+  /** @internal Validated by the CMS EnvelopedData schema itself rather than by a shape check written
+   * here, so every field is held to one definition and the count reported below is the count of
+   * recipients that same definition accepted. Sec. 6.7 also allows a recipient identified by an
+   * issuerAndSerialNumber whose issuer is encoded as NULL, which is not the Name that schema requires;
+   * a challenge addressed only that way is refused here, and `pki.cms.decrypt` could not open it
+   * either, so it is refused where the reason can be named rather than after a failed answer. */
+  var enveloped;
+  try { enveloped = cms.walkEnvelopedData(content.children[0]); }
+  catch (e) {
+    throw E("cmc/bad-pop-challenge",
+      "an EncryptedPOP's ContentInfo does not carry an EnvelopedData a recipient could open: " +
+      ((e && e.message) || "malformed") + " (RFC 5652 sec. 6.1)", e);
+  }
+  var recipients = (enveloped.recipientInfos || []).length;
+  if (recipients < 1) {
+    throw E("cmc/bad-pop-challenge",
+      "an EnvelopedData names at least one recipient in its recipientInfos SET (RFC 5652 sec. 6.1)");
+  }
+  return { bytes: node.bytes, recipientCount: recipients };
+}
+
+/** @internal Both fields are AlgorithmIdentifiers, and both are read the same way: the OID names the
+ * algorithm and the parameters travel with it, so a caller answering a challenge copies what it was
+ * sent rather than reconstructing it. */
+function _popAlgorithm(node, what) {
+  if (node.tagClass !== "universal" || node.tagNumber !== TAGS.SEQUENCE || !node.constructed ||
+      node.children.length < 1 || node.children.length > 2) {
+    throw E("cmc/bad-pop-challenge", "a POP " + what + " is an AlgorithmIdentifier (RFC 5272 sec. 6.7)");
+  }
+  var algOid;
+  try { algOid = asn1.read.oid(node.children[0]); }
+  catch (e) {
+    throw E("cmc/bad-pop-challenge",
+      "a POP " + what + " names its algorithm with an OBJECT IDENTIFIER (RFC 5272 sec. 6.7)", e);
+  }
+  return {
+    oid: algOid,
+    name: oid.name(algOid) || null,
+    parameters: node.children.length === 2 ? node.children[1].bytes : null,
+    bytes: node.bytes,
+  };
+}
+
+/** @internal One AttributeValue, which is what a control carrying a single structure holds. */
+function _onlyValue(c, what) {
+  if (c.values.length !== 1) {
+    throw E("cmc/bad-pop-challenge",
+      "a " + what + " control carries exactly one AttributeValue, got " + c.values.length);
+  }
+  return asn1.decode(c.values[0]);
+}
+
+function _decodePopChallenges(controls) {
+  for (var i = 0; i < controls.length; i++) {
+    var c = controls[i];
+    if (c.attrType === OID_ENCRYPTED_POP) {
+      c.encryptedPOP = parseEncryptedPop(_onlyValue(c, "an Encrypted POP"));
+    } else if (c.attrType === OID_DECRYPTED_POP) {
+      c.decryptedPOP = parseDecryptedPop(_onlyValue(c, "a Decrypted POP"));
+    }
+  }
+}
+
 function _collectStatuses(controls) {
   var out = [];
   for (var i = 0; i < controls.length; i++) {
@@ -445,6 +629,7 @@ function _collectStatuses(controls) {
 
 function _finishBody(body, where) {
   for (var i = 0; i < body.controls.length; i++) assertControlPlacement(body.controls[i], where);
+  _decodePopChallenges(body.controls);
   body.statuses = _collectStatuses(body.controls);
   body.unhandled = body.controls.filter(function (c) {
     return c.attrType !== OID_STATUS_INFO && c.attrType !== OID_STATUS_INFO_V2 && c.attrName === null;
@@ -541,9 +726,20 @@ function parsePkiResponse(input) {
  *   pki.schema.cmc.parse(der).kind;   // "pkiData"
  */
 function parse(input) {
-  var parsedCms = (input && typeof input === "object" && !ArrayBuffer.isView(input) &&
-    !guard.bytes.isByteSource(input) && input.encapContentInfo != null)
-    ? input : cms.parse(input);
+  var alreadyParsed = input && typeof input === "object" && !ArrayBuffer.isView(input) &&
+    !guard.bytes.isByteSource(input) && input.encapContentInfo != null;
+  var parsedCms;
+  if (alreadyParsed) { parsedCms = input; }
+  else {
+    /** @internal Bytes that are not a CMS message at all are a CMC message this cannot read, and every
+     * other format parser answers for its own input in its own domain. */
+    try { parsedCms = cms.parse(input); }
+    catch (e) {
+      throw E("cmc/bad-der",
+        "a CMC message is carried in a CMS SignedData or AuthenticatedData, and these bytes are not " +
+        "one: " + ((e && e.message) || "malformed") + " (RFC 5272 sec. 3.2 / 4.2)", e);
+    }
+  }
   if (CMC_CARRIERS[parsedCms.contentTypeName] !== 1) {
     throw E("cmc/not-cmc",
       "a Full PKI Request / Response is carried in a CMS SignedData or AuthenticatedData, got " +
@@ -568,6 +764,8 @@ function parse(input) {
 }
 
 module.exports = {
+  parseEncryptedPop: parseEncryptedPop,
+  parseTaggedRequest: parseTaggedRequest,
   parse: parse,
   parsePkiData: parsePkiData,
   parsePkiResponse: parsePkiResponse,

package/lib/schema-cmp.js

@@ -43,6 +43,7 @@ var cms = require("./schema-cms.js");
 var crmf = require("./schema-crmf.js");
 var frameworkError = require("./framework-error.js");
 var guard = require("./guard-all.js");
+var constants = require("./constants");
 
 var CmpError = frameworkError.CmpError;
 var PemError = frameworkError.PemError;
@@ -101,6 +102,40 @@ var GENERAL_NAME = pkix.generalName(NS, { decodeValue: true });
 var ALG_ID = pkix.algorithmIdentifier(NS);
 var EXTENSIONS = pkix.extensions(NS);
 
+/** @internal The parameters of a KEM-based MAC protectionAlg (RFC 9810 sec. 5.1.3.4). `len` is the
+ * size of the key the KDF produces, and it is the size the MAC algorithm needs, so the two travel
+ * together and a verifier derives exactly what the protector derived. */
+var KEM_BM_PARAMETER = schema.seq([
+  schema.field("kdf", ALG_ID),
+  /** @internal The CMP module is DEFINITIONS EXPLICIT TAGS, so `[0]` wraps the OCTET STRING rather
+   * than replacing its tag. */
+  schema.optional("kemContext", schema.octetString(), { tag: 0, explicit: true }),
+  schema.field("len", schema.integerLeaf()),
+  schema.field("mac", ALG_ID),
+], {
+  assert: "sequence", arity: { min: 3, max: 4 }, code: "cmp/bad-kem-data", what: "KemBMParameter",
+  build: function (m, ctx) {
+    var n = guard.range.int(m.fields.len.value, 1n, BigInt(constants.LIMITS.CMP_KEM_MAX_KEY_BYTES),
+      ctx.E, "cmp/bad-kem-data", "a KemBMParameter len");
+    return {
+      kdf: m.fields.kdf.value.result,
+      kemContext: m.fields.kemContext.present ? m.fields.kemContext.value : null,
+      len: n,
+      mac: m.fields.mac.value.result,
+    };
+  },
+});
+
+/** @internal The KEM ciphertext a peer sends so the holder of the KEM private key can derive the same
+ * secret (RFC 9810 sec. 5.3.19.18). */
+var KEM_CIPHERTEXT_INFO = schema.seq([
+  schema.field("kem", ALG_ID),
+  schema.field("ct", schema.octetString()),
+], {
+  assert: "sequence", arity: { exact: 2 }, code: "cmp/bad-kem-ciphertext", what: "KemCiphertextInfo",
+  build: function (m) { return { kem: m.fields.kem.value.result, ct: m.fields.ct.value }; },
+});
+
 
 var INFO_TYPE_AND_VALUE = schema.seq([
   schema.field("infoType", schema.oidLeaf()),
@@ -835,6 +870,14 @@ function matches(root) {
   return schema.isContextInRange(body, 0, 26) && !!body.children;
 }
 
+/** @internal One embedded KEM structure, read under this module's namespace so every field of it
+ * reports in the CMP domain rather than the codec's. */
+function _readKem(sch, der, code, what) {
+  return schema.embeddedDer(sch, der, NS, { code: code, what: what }).result;
+}
+function readKemBMParameter(p) { return _readKem(KEM_BM_PARAMETER, p, "cmp/bad-kem-data", "KemBMParameter"); }
+function readKemCiphertextInfo(d) { return _readKem(KEM_CIPHERTEXT_INFO, d, "cmp/bad-kem-ciphertext", "KemCiphertextInfo"); }
+
 module.exports = {
   parse: parse,
   pemDecode: pemDecode,
@@ -847,4 +890,6 @@ module.exports = {
   readCrls: readCrls,
   readAlgorithmIdentifier: readAlgorithmIdentifier,
   readName: readName,
+  readKemBMParameter: readKemBMParameter,
+  readKemCiphertextInfo: readKemCiphertextInfo,
 };

package/lib/schema-cms.js

@@ -555,7 +555,9 @@ var KEY_AGREE_RECIPIENT_INFO = schema.seq([
   schema.field("originator", schema.explicit(0, ORIGINATOR_IDENTIFIER_OR_KEY, { code: "cms/bad-kari" })),
   schema.optional("ukm", schema.octetString(), { tag: 1, explicit: true, emptyCode: "cms/bad-kari" }),
   schema.field("keyEncryptionAlgorithm", ALGORITHM_IDENTIFIER),
-  schema.field("recipientEncryptedKeys", schema.seqOf(RECIPIENT_ENCRYPTED_KEY, { code: "cms/bad-recipient-encrypted-keys", what: "recipientEncryptedKeys" })),
+  /** @internal At least one encrypted key: a key-agreement recipient info that names none names no
+   * recipient, so nothing could open the content it is attached to. */
+  schema.field("recipientEncryptedKeys", schema.seqOf(RECIPIENT_ENCRYPTED_KEY, { min: 1, code: "cms/bad-recipient-encrypted-keys", what: "recipientEncryptedKeys" })),
 ], {
   assert: "constructed", code: "cms/bad-kari", what: "KeyAgreeRecipientInfo",
   build: function (m) {

package/lib/sign-scheme.js

@@ -164,10 +164,23 @@ function _assertKeyMatchesScheme(key, imp, E) {
   if (imp.hash && (!ka.hash || ka.hash.name !== imp.hash)) throw E("bad-input", "the signer CryptoKey hash (" + (ka.hash && ka.hash.name) + ") does not match the signing digest (" + imp.hash + ")");
   if (imp.namedCurve && ka.namedCurve !== imp.namedCurve) throw E("bad-input", "the signer CryptoKey curve (" + ka.namedCurve + ") does not match the certificate curve (" + imp.namedCurve + ")");
 }
-function _normPkcs8(k, label, E) {
+/** @internal `owned`, when given, collects the copies this makes of the caller's key so the caller can
+ * wipe them: a Buffer is viewed and stays the caller's, while a Uint8Array or a PEM string produces a
+ * new buffer holding the private key. The branch is taken once here, so no caller has to re-derive
+ * which shape it passed. */
+function _normPkcs8(k, label, E, owned) {
   if (_isBuffer(k)) return guard.bytes.view(k, E, "bad-input", label);
-  if (_isU8(k)) return guard.bytes.snapshot(k, E, "bad-input", label);
-  if (typeof k === "string") { try { return pkcs8.pemDecode(k); } catch (e) { throw E("bad-input", label + " PEM could not be decoded", e); } }
+  if (_isU8(k)) {
+    var snap = guard.bytes.snapshot(k, E, "bad-input", label);
+    if (owned) guard.list.append(owned, snap);
+    return snap;
+  }
+  if (typeof k === "string") {
+    var der;
+    try { der = pkcs8.pemDecode(k); } catch (e) { throw E("bad-input", label + " PEM could not be decoded", e); }
+    if (owned) guard.list.append(owned, der);
+    return der;
+  }
   throw E("bad-input", label + " must be a PKCS#8 DER Buffer, Uint8Array, or PEM string");
 }
 function _normCompositeKeys(key, comp, E) {
@@ -220,6 +233,9 @@ function signOverTbs(scheme, key, signedBytes, E) {
 
 module.exports = {
   resolveSignScheme: resolveSignScheme,
+  /** @internal A PKCS#8 private key from the shapes every signer option accepts, so a verb that takes
+   * a private key for something other than signing reads it the same way. */
+  normalizePkcs8: _normPkcs8,
   pssSpkiPinnedHash: pssSpkiPinnedHash,
   signOverTbs: signOverTbs,
   MLDSA_SUITABLE_DIGEST: MLDSA_SUITABLE_DIGEST,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.48",
+  "version": "0.6.50",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:2d1b2e87-6386-4481-940b-f4de0f1b9227",
+  "serialNumber": "urn:uuid:e7a3f132-aaea-4bc5-ae0f-387a72dc5e4f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-06T18:47:52.624Z",
+    "timestamp": "2026-09-07T05:02:17.771Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.48",
+      "bom-ref": "@blamejs/pki@0.6.50",
       "type": "application",
       "name": "pki",
-      "version": "0.6.48",
+      "version": "0.6.50",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.48",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.50",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.48",
+      "ref": "@blamejs/pki@0.6.50",
       "dependsOn": []
     }
   ]