@blamejs/pki 0.6.50 → 0.6.51

package/CHANGELOG.md

@@ -4,6 +4,25 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.51 — 2026-09-07
+
+A CMP message that names one key and is protected by another no longer verifies.
+
+### Added
+
+- pki.cmp.verify checks the senderKID of a MAC-protected message against the commonName of its sender field, which is how such a message names the shared secret it was protected with (RFC 9483 section 4.1.5). A senderKID naming another entity, or a sender carrying no commonName to match, is refused with cmp/bad-sender-kid. An anonymous sender is the exception the base protocol names: where the sender is the NULL-DN a requester uses before it knows its own name, the senderKID is a reference number rather than a name (RFC 9810 section 5.1.1), so it is carried and not compared. A KEM-protected message's senderKID is likewise carried and not compared, since no specification says what it names there.
+- pki.cmp.verify refuses an opts.time that is not a Date with cmp/bad-input, at the door, rather than letting whichever check reads it first throw a bare TypeError.
+- pki.cmp.verify takes opts.messageTimeTolerance, the accepted messageTime skew in seconds. RFC 9483 section 3.5 requires a present messageTime to be close to the receiver's current time but leaves the threshold to the use case, so stating a window turns the check on and a message outside it in either direction is a cmp/bad-message-time verdict. A clock runs fast as readily as slow, so a message dated ahead of the receiver is judged the same as one dated behind it. Without the option the messageTime is not judged, and a message carrying none is unaffected.
+
+### Changed
+
+- A caller that passes opts.signerCert for a message whose senderKID does not match that certificate now receives a cmp/bad-sender-kid verdict where the message previously verified. A sender that sets senderKID to its certificate's subjectKeyIdentifier, which is what the field is for, is unaffected.
+
+### Fixed
+
+- pki.cmp.verify holds a declared senderKID to the key that actually verified the protection, on every path (RFC 9483 section 3.5). A certificate passed as opts.signerCert is now checked against the header's senderKID exactly as one selected from extraCerts already was, so a message naming one key identifier and signed under another is refused with cmp/bad-sender-kid instead of verifying. A signer certificate carrying no subjectKeyIdentifier offers nothing for a declared identifier to name and cannot satisfy one; a message declaring no senderKID is unaffected, since the rule is conditioned on the field being present.
+- A message whose extraCerts carry no certificate matching the declared senderKID reports cmp/bad-sender-kid rather than cmp/signer-cert-not-found. The two failures are different: nothing was offered, versus nothing offered carries the identifier the message declares. Reporting them apart keeps one defect from carrying two codes depending on how the certificate would have arrived. pki.cmp.session treats the new code the same way it treated the old one, so a transaction whose response declares a signer the response did not carry still falls back to the certificate the session already holds, and that certificate is put through the same identifier check.
+
 ## v0.6.50 — 2026-09-07
 
 A client whose key can only establish secrets can now authenticate its CMP messages with that key.

package/lib/cmp-session.js

@@ -201,8 +201,14 @@ var CAPUBS_MAX = 2 * MAX_EXTRA_CERTS;
 var SESSION_MAX_INTERMEDIATES = constants.LIMITS.PATH_BUILD_MAX_CANDIDATES - CAPUBS_MAX - MAX_EXTRA_CERTS;
 var SESSION_MAX_INTERMEDIATES_MAC = constants.LIMITS.PATH_BUILD_MAX_CANDIDATES - CAPUBS_MAX;
 function _isRecoverableVerify(code) {
+  /** @internal `cmp/bad-sender-kid` belongs here for the same reason `cmp/signer-cert-not-found` does:
+   * a response whose extraCerts carry no certificate matching the declared key identifier is one this
+   * session may already hold the signer for. Retrying is safe because the fallback certificate is put
+   * through the same identifier check, so the retry can only succeed on a certificate the message
+   * actually names. */
   return code === "cmp/signer-cert-not-found" || code === "cmp/protection-failed" ||
-    code === "cmp/sender-mismatch" || code === "cmp/untrusted-signer";
+    code === "cmp/sender-mismatch" || code === "cmp/untrusted-signer" ||
+    code === "cmp/bad-sender-kid";
 }
 function _responseExtraCerts(responseBytes) {
   var extra = schemaCmp.parse(responseBytes).extraCerts;

package/lib/cmp-verify.js

@@ -52,6 +52,7 @@ var _certExtDecoders = pkix.certExtensionDecoders(NS).byOid;
 var KNOWN_VERIFY_OPTS = intrinsic.assign(intrinsic.create(null), {
   sharedSecret: 1, signerCert: 1, trustAnchors: 1, intermediates: 1, time: 1,
   transactionID: 1, expectRecipNonce: 1, revocationChecker: 1, maxIterations: 1, kem: 1,
+  messageTimeTolerance: 1,
 });
 var KNOWN_KEM_VERIFY_KEYS = intrinsic.assign(intrinsic.create(null),
   { sharedSecret: 1, transactionID: 1 });
@@ -146,6 +147,30 @@ function _sanGeneralNames(parsed) {
   return [];
 }
 
+/** @internal An anonymous sender: the NULL-DN a requester uses when it knows nothing about its own
+ * name (RFC 9810 sec. 5.1.1), encoded as a directoryName with no relative names. */
+function _isNullDnSender(sender) {
+  return !!sender && sender.tagClass === "context" && sender.tagNumber === 4 &&
+    !!sender.value && _isArray(sender.value.rdns) && sender.value.rdns.length === 0;
+}
+
+/** @internal The commonName of a sender given as a directoryName, which is the name a MAC-protected
+ * message identifies its shared secret by (RFC 9483 sec. 4.1.5). A sender in any other GeneralName
+ * form, or one carrying no commonName, names nothing a senderKID could equal. */
+function _senderCommonName(sender) {
+  if (!sender || sender.tagClass !== "context" || sender.tagNumber !== 4) return null;
+  var rdns = sender.value && sender.value.rdns;
+  if (!_isArray(rdns)) return null;
+  var cnOid = oid.byName("commonName");
+  for (var i = 0; i < rdns.length; i++) {
+    var rdn = rdns[i];
+    for (var j = 0; j < rdn.length; j++) {
+      if (rdn[j].type === cnOid && typeof rdn[j].value === "string") return rdn[j].value;
+    }
+  }
+  return null;
+}
+
 function _senderBoundToCert(sender, parsed) {
   if (!sender || !sender.bytes) return false;
   var subjectRdns = parsed.subject.rdns;
@@ -311,6 +336,15 @@ function _uriEqual(a, b) {
   return na === nb;
 }
 
+/** @internal Whether a declared key identifier names this certificate. Absent means the rule does not
+ * apply; present with no subjectKeyIdentifier to compare means it cannot be satisfied, so the message
+ * is refused rather than admitted for want of a value. */
+function _senderKidMatchesCert(senderKID, parsed) {
+  if (senderKID == null) return true;
+  var ski = _certSki(parsed);
+  return ski != null && guard.crypto.constantTimeEqual(ski, senderKID);
+}
+
 function _resolveSignerCert(m, opts, extra) {
   var senderKID = m.header.senderKID;
   function _signerObj(der, p) { return { der: der, spki: p.subjectPublicKeyInfo.bytes, subject: _subjectDn(p), parsed: p }; }
@@ -318,10 +352,7 @@ function _resolveSignerCert(m, opts, extra) {
     var p;
     try { p = x509.parse(der); }
     catch (_e) { return null; }
-    if (senderKID != null) {
-      var ski = _certSki(p);
-      if (ski == null || !guard.crypto.constantTimeEqual(ski, senderKID)) return null;
-    }
+    if (!_senderKidMatchesCert(senderKID, p)) return null;
     return _signerObj(der, p);
   }
   if (opts.signerCert != null) {
@@ -361,6 +392,22 @@ function _headerChecks(m, opts) {
   if (opts.expectRecipNonce != null && !_bufEq(m.header.recipNonce, opts.expectRecipNonce)) {
     return { code: "cmp/bad-recip-nonce", reason: "header.recipNonce does not echo the expected sender nonce" };
   }
+  /** @internal A stated window is checked in both directions: a clock runs fast as readily as slow, and
+   * a message dated ahead of the receiver is as much a replay signal as one dated behind it. */
+  if (opts.messageTimeTolerance != null && m.header.messageTime != null) {
+    var at = guard.time.instantOf(opts.time != null ? opts.time : new _Date());
+    var sent = guard.time.instantOf(m.header.messageTime);
+    if (!intrinsic.isFinite(at) || !intrinsic.isFinite(sent)) {
+      return { code: "cmp/bad-message-time", reason: "the header messageTime could not be read as an instant to compare against the verification time (RFC 9483 sec. 3.5)" };
+    }
+    // allow:nan-date-comparison-unguarded -- both instants are finite by the check above
+    var skew = (at > sent ? at - sent : sent - at) / 1000;
+    if (skew > opts.messageTimeTolerance) {
+      return { code: "cmp/bad-message-time", reason: "the header messageTime is " + intrinsic.floor(skew) +
+        " seconds from the verification time, outside the " + opts.messageTimeTolerance +
+        "-second window this caller accepts (RFC 9483 sec. 3.5)" };
+    }
+  }
   return null;
 }
 
@@ -460,6 +507,23 @@ async function _verifyMac(m, protectedPart, protectionAlg, protection, opts) {
   if (!guard.crypto.constantTimeEqual(computed, protection.bytes)) {
     return _fail(m, "mac", protectionAlg, "cmp/protection-failed", "the PBMAC1 MAC does not verify (a wrong shared secret or a tampered ProtectedPart)");
   }
+  /** @internal Under MAC protection the sender names the shared secret, and sec. 4.1.5 requires the
+   * senderKID to carry that same name: the identifier and the name the message is attributed to are
+   * one value, so a message pointing them at different entities is refused. */
+  /** @internal The name rule governs a sender that HAS a name. An anonymous NULL-DN sender carries a
+   * reference number instead (RFC 9810 sec. 5.1.1), which names no commonName to equal, so it is
+   * required to be present above and left uncompared here rather than refused for failing a match the
+   * base protocol does not ask of it. */
+  if (m.header.senderKID != null && !_isNullDnSender(m.header.sender)) {
+    var cn = _senderCommonName(m.header.sender);
+    if (cn === null || !guard.crypto.constantTimeEqual(_bufferFrom(cn, "utf8"), m.header.senderKID)) {
+      return _fail(m, "mac", protectionAlg, "cmp/bad-sender-kid",
+        "the header senderKID must carry the same name as the commonName of the sender field, which " +
+        "is how a MAC-protected message identifies the shared secret it was protected with " +
+        "(RFC 9483 sec. 4.1.5)");
+    }
+  }
+
   var hc = _headerChecks(m, opts);
   if (hc) return _fail(m, "mac", protectionAlg, hc.code, hc.reason);
   return _ok(m, "mac", protectionAlg, true, null);
@@ -485,7 +549,17 @@ function _capWork(iterationCount, salt, keyLength, prfHash, opts) {
 async function _verifySignature(m, protectedPart, protectionAlg, protection, opts) {
   var extra = _boundExtraCerts(m.extraCerts);
   var signer = _resolveSignerCert(m, opts, extra);
-  if (!signer) return _fail(m, "signature", protectionAlg, "cmp/signer-cert-not-found", "no signer certificate resolved (opts.signerCert, senderKID, or extraCerts)");
+  if (!signer) {
+    /** @internal Selecting from `extraCerts` narrows by the declared key identifier, so "nothing
+     * matched" and "nothing was offered" are different failures. Reporting them apart keeps one
+     * defect from carrying two codes depending on how the certificate would have arrived. */
+    if (m.header.senderKID != null && extra.length) {
+      return _fail(m, "signature", protectionAlg, "cmp/bad-sender-kid",
+        "no certificate in extraCerts carries the subjectKeyIdentifier the header senderKID declares, " +
+        "so nothing offered identifies the key that would verify the protection (RFC 9483 sec. 3.5)");
+    }
+    return _fail(m, "signature", protectionAlg, "cmp/signer-cert-not-found", "no signer certificate resolved (opts.signerCert, senderKID, or extraCerts)");
+  }
 
   var ok = await _engine.verifyWithSpki(protectionAlg, protection.bytes, signer.spki, protectedPart);
   if (ok !== true) return _fail(m, "signature", protectionAlg, "cmp/protection-failed", "the protection signature does not verify over the ProtectedPart under the declared protectionAlg", signer);
@@ -493,6 +567,16 @@ async function _verifySignature(m, protectedPart, protectionAlg, protection, opt
   if (!_senderBoundToCert(m.header.sender, signer.parsed)) {
     return _fail(m, "signature", protectionAlg, "cmp/sender-mismatch", "the header sender field does not match the signer certificate subject, or (for an empty subject) a subjectAltName entry (RFC 9483 sec. 3.1, RFC 5280 sec. 7.1)", signer);
   }
+  /** @internal The declared key identifier is checked against the certificate whose key ACTUALLY
+   * verified, on every route that certificate arrives by. Selecting from `extraCerts` already matches
+   * it while choosing, and a caller-supplied certificate reaches the same rule here, so a message
+   * naming one key and signed by another is refused however the verifier came by the certificate
+   * (RFC 9483 sec. 3.5). */
+  if (!_senderKidMatchesCert(m.header.senderKID, signer.parsed)) {
+    return _fail(m, "signature", protectionAlg, "cmp/bad-sender-kid",
+      "the header senderKID does not identify the certificate whose key verified the protection: it " +
+      "must equal that certificate's subjectKeyIdentifier (RFC 9483 sec. 3.5)", signer);
+  }
 
   var hc = _headerChecks(m, opts);
   if (hc) return _fail(m, "signature", protectionAlg, hc.code, hc.reason, signer);
@@ -640,6 +724,18 @@ function _fixSecret(v, made, label) {
   return v;
 }
 
+/** @internal The freshness window, in seconds. RFC 9483 sec. 3.5 leaves the threshold to the use case
+ * and lists the check under local policy, so it is stated by the caller rather than defaulted: a
+ * window this library invented would refuse conforming messages from a peer whose clock is merely
+ * further off than that number. */
+function _fixTolerance(v) {
+  if (v == null) return null;
+  if (typeof v !== "number" || !intrinsic.isFinite(v) || v < 0) {
+    throw _err("cmp/bad-input", "opts.messageTimeTolerance is the accepted messageTime skew in seconds, a non-negative number");
+  }
+  return v;
+}
+
 /** @internal The KEM verification material, taken once at the door like every other caller value: the
  * shared secret is copied and registered for wiping, and the transaction identifier is snapshot, so
  * neither can answer differently when the derivation reads it. */
@@ -675,8 +771,13 @@ function _fixCertList(v, label) {
   for (var i = 0; i < n; i++) _append(out, _fixByteish(v[i], label + "[" + i + "]"));
   return out;
 }
+/** @internal The verification instant, copied so a caller cannot move it after the fact. A value that
+ * is not a Date is refused here rather than carried into a comparison that would throw from whichever
+ * check happened to read it first. */
 function _fixTime(v) {
-  return guard.time.isDate(v) ? new _Date(guard.time.instantOf(v)) : v;
+  if (v == null) return v;
+  if (!guard.time.isDate(v)) throw _err("cmp/bad-input", "opts.time must be a Date");
+  return new _Date(guard.time.instantOf(v));
 }
 function _fixVerifyOptions(opts, made) {
   if (opts == null) opts = {};
@@ -693,6 +794,7 @@ function _fixVerifyOptions(opts, made) {
     revocationChecker: opts.revocationChecker,
     maxIterations: opts.maxIterations,
     kem: _fixKem(opts.kem, made),
+    messageTimeTolerance: _fixTolerance(opts.messageTimeTolerance),
   };
 
   _assertEchoBytes(f.transactionID, "transactionID");
@@ -763,6 +865,14 @@ async function _verify(message, opts) {
  * carry at least 128 bits; a violation is a `{ valid: false }` verdict carrying `cmp/unsupported-version`,
  * `cmp/bad-transaction-id`, or `cmp/bad-sender-nonce`.
  *
+ * A present `senderKID` must identify the key material that verified the protection (RFC 9483
+ * sec. 3.5), whichever way that key was resolved. Under signature protection it must equal the
+ * `subjectKeyIdentifier` of the certificate whose key verified, so a certificate supplied as
+ * `opts.signerCert` is held to the declared identifier exactly as one selected out of `extraCerts` is,
+ * and a certificate carrying no `subjectKeyIdentifier` cannot satisfy one. Under MAC protection it must
+ * carry the same name as the `commonName` of the sender field, which is how such a message names the
+ * shared secret it was protected with (sec. 4.1.5). A mismatch is a `cmp/bad-sender-kid` verdict.
+ *
  * Returns a verdict (never a bare boolean): `{ valid, trusted, protectionType, protectionAlg, signer,
  * transactionID, senderNonce, recipNonce, header, body, code?, reason? }`. `valid` is whether the
  * protection is cryptographically intact under the declared algorithm; `trusted` is whether a MAC secret
@@ -775,6 +885,10 @@ async function _verify(message, opts) {
  *
  * @opts
  *   - `sharedSecret` (string|Buffer) -- the PBMAC1 secret; REQUIRED for a MAC-protected message (UTF-8).
+ *   - `messageTimeTolerance` (number) -- the accepted `messageTime` skew in seconds. RFC 9483
+ *     sec. 3.5 requires a present `messageTime` to be close to the receiver's current time but leaves
+ *     the threshold to the use case, so stating it turns the check on; a message outside the window in
+ *     either direction is a `cmp/bad-message-time` verdict. Absent, the `messageTime` is not judged.
  *   - `kem` ({ sharedSecret, transactionID? }) -- REQUIRED for a KEM-protected message (RFC 9810
  *     sec. 5.1.3.4). `sharedSecret` is what this side encapsulated to the sender's KEM public key, and
  *     `transactionID` names the message that carried the ciphertext when it was not this one. The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.50",
+  "version": "0.6.51",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:e7a3f132-aaea-4bc5-ae0f-387a72dc5e4f",
+  "serialNumber": "urn:uuid:d9015ac6-f8a1-409f-9e1f-5ae1fc7491a1",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-07T05:02:17.771Z",
+    "timestamp": "2026-09-07T06:27:34.397Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.50",
+      "bom-ref": "@blamejs/pki@0.6.51",
       "type": "application",
       "name": "pki",
-      "version": "0.6.50",
+      "version": "0.6.51",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.50",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.51",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.50",
+      "ref": "@blamejs/pki@0.6.51",
       "dependsOn": []
     }
   ]