@blamejs/pki 0.6.50 → 0.6.52

package/lib/cmp-verify.js

@@ -32,6 +32,10 @@ var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var cmpBuild = require("./cmp-build");
 var cmp = require("./schema-cmp");
+var cms = require("./schema-cms");
+var cmsVerify = require("./cms-verify");
+var cmsDecrypt = require("./cms-decrypt");
+var pkcs8 = require("./schema-pkcs8");
 var pkix = require("./schema-pkix");
 var pbes2 = require("./pbes2");
 var x509 = require("./schema-x509");
@@ -52,6 +56,7 @@ var _certExtDecoders = pkix.certExtensionDecoders(NS).byOid;
 var KNOWN_VERIFY_OPTS = intrinsic.assign(intrinsic.create(null), {
   sharedSecret: 1, signerCert: 1, trustAnchors: 1, intermediates: 1, time: 1,
   transactionID: 1, expectRecipNonce: 1, revocationChecker: 1, maxIterations: 1, kem: 1,
+  messageTimeTolerance: 1,
 });
 var KNOWN_KEM_VERIFY_KEYS = intrinsic.assign(intrinsic.create(null),
   { sharedSecret: 1, transactionID: 1 });
@@ -146,6 +151,30 @@ function _sanGeneralNames(parsed) {
   return [];
 }
 
+/** @internal An anonymous sender: the NULL-DN a requester uses when it knows nothing about its own
+ * name (RFC 9810 sec. 5.1.1), encoded as a directoryName with no relative names. */
+function _isNullDnSender(sender) {
+  return !!sender && sender.tagClass === "context" && sender.tagNumber === 4 &&
+    !!sender.value && _isArray(sender.value.rdns) && sender.value.rdns.length === 0;
+}
+
+/** @internal The commonName of a sender given as a directoryName, which is the name a MAC-protected
+ * message identifies its shared secret by (RFC 9483 sec. 4.1.5). A sender in any other GeneralName
+ * form, or one carrying no commonName, names nothing a senderKID could equal. */
+function _senderCommonName(sender) {
+  if (!sender || sender.tagClass !== "context" || sender.tagNumber !== 4) return null;
+  var rdns = sender.value && sender.value.rdns;
+  if (!_isArray(rdns)) return null;
+  var cnOid = oid.byName("commonName");
+  for (var i = 0; i < rdns.length; i++) {
+    var rdn = rdns[i];
+    for (var j = 0; j < rdn.length; j++) {
+      if (rdn[j].type === cnOid && typeof rdn[j].value === "string") return rdn[j].value;
+    }
+  }
+  return null;
+}
+
 function _senderBoundToCert(sender, parsed) {
   if (!sender || !sender.bytes) return false;
   var subjectRdns = parsed.subject.rdns;
@@ -311,6 +340,15 @@ function _uriEqual(a, b) {
   return na === nb;
 }
 
+/** @internal Whether a declared key identifier names this certificate. Absent means the rule does not
+ * apply; present with no subjectKeyIdentifier to compare means it cannot be satisfied, so the message
+ * is refused rather than admitted for want of a value. */
+function _senderKidMatchesCert(senderKID, parsed) {
+  if (senderKID == null) return true;
+  var ski = _certSki(parsed);
+  return ski != null && guard.crypto.constantTimeEqual(ski, senderKID);
+}
+
 function _resolveSignerCert(m, opts, extra) {
   var senderKID = m.header.senderKID;
   function _signerObj(der, p) { return { der: der, spki: p.subjectPublicKeyInfo.bytes, subject: _subjectDn(p), parsed: p }; }
@@ -318,10 +356,7 @@ function _resolveSignerCert(m, opts, extra) {
     var p;
     try { p = x509.parse(der); }
     catch (_e) { return null; }
-    if (senderKID != null) {
-      var ski = _certSki(p);
-      if (ski == null || !guard.crypto.constantTimeEqual(ski, senderKID)) return null;
-    }
+    if (!_senderKidMatchesCert(senderKID, p)) return null;
     return _signerObj(der, p);
   }
   if (opts.signerCert != null) {
@@ -361,6 +396,22 @@ function _headerChecks(m, opts) {
   if (opts.expectRecipNonce != null && !_bufEq(m.header.recipNonce, opts.expectRecipNonce)) {
     return { code: "cmp/bad-recip-nonce", reason: "header.recipNonce does not echo the expected sender nonce" };
   }
+  /** @internal A stated window is checked in both directions: a clock runs fast as readily as slow, and
+   * a message dated ahead of the receiver is as much a replay signal as one dated behind it. */
+  if (opts.messageTimeTolerance != null && m.header.messageTime != null) {
+    var at = guard.time.instantOf(opts.time != null ? opts.time : new _Date());
+    var sent = guard.time.instantOf(m.header.messageTime);
+    if (!intrinsic.isFinite(at) || !intrinsic.isFinite(sent)) {
+      return { code: "cmp/bad-message-time", reason: "the header messageTime could not be read as an instant to compare against the verification time (RFC 9483 sec. 3.5)" };
+    }
+    // allow:nan-date-comparison-unguarded -- both instants are finite by the check above
+    var skew = (at > sent ? at - sent : sent - at) / 1000;
+    if (skew > opts.messageTimeTolerance) {
+      return { code: "cmp/bad-message-time", reason: "the header messageTime is " + intrinsic.floor(skew) +
+        " seconds from the verification time, outside the " + opts.messageTimeTolerance +
+        "-second window this caller accepts (RFC 9483 sec. 3.5)" };
+    }
+  }
   return null;
 }
 
@@ -460,6 +511,23 @@ async function _verifyMac(m, protectedPart, protectionAlg, protection, opts) {
   if (!guard.crypto.constantTimeEqual(computed, protection.bytes)) {
     return _fail(m, "mac", protectionAlg, "cmp/protection-failed", "the PBMAC1 MAC does not verify (a wrong shared secret or a tampered ProtectedPart)");
   }
+  /** @internal Under MAC protection the sender names the shared secret, and sec. 4.1.5 requires the
+   * senderKID to carry that same name: the identifier and the name the message is attributed to are
+   * one value, so a message pointing them at different entities is refused. */
+  /** @internal The name rule governs a sender that HAS a name. An anonymous NULL-DN sender carries a
+   * reference number instead (RFC 9810 sec. 5.1.1), which names no commonName to equal, so it is
+   * required to be present above and left uncompared here rather than refused for failing a match the
+   * base protocol does not ask of it. */
+  if (m.header.senderKID != null && !_isNullDnSender(m.header.sender)) {
+    var cn = _senderCommonName(m.header.sender);
+    if (cn === null || !guard.crypto.constantTimeEqual(_bufferFrom(cn, "utf8"), m.header.senderKID)) {
+      return _fail(m, "mac", protectionAlg, "cmp/bad-sender-kid",
+        "the header senderKID must carry the same name as the commonName of the sender field, which " +
+        "is how a MAC-protected message identifies the shared secret it was protected with " +
+        "(RFC 9483 sec. 4.1.5)");
+    }
+  }
+
   var hc = _headerChecks(m, opts);
   if (hc) return _fail(m, "mac", protectionAlg, hc.code, hc.reason);
   return _ok(m, "mac", protectionAlg, true, null);
@@ -485,7 +553,17 @@ function _capWork(iterationCount, salt, keyLength, prfHash, opts) {
 async function _verifySignature(m, protectedPart, protectionAlg, protection, opts) {
   var extra = _boundExtraCerts(m.extraCerts);
   var signer = _resolveSignerCert(m, opts, extra);
-  if (!signer) return _fail(m, "signature", protectionAlg, "cmp/signer-cert-not-found", "no signer certificate resolved (opts.signerCert, senderKID, or extraCerts)");
+  if (!signer) {
+    /** @internal Selecting from `extraCerts` narrows by the declared key identifier, so "nothing
+     * matched" and "nothing was offered" are different failures. Reporting them apart keeps one
+     * defect from carrying two codes depending on how the certificate would have arrived. */
+    if (m.header.senderKID != null && extra.length) {
+      return _fail(m, "signature", protectionAlg, "cmp/bad-sender-kid",
+        "no certificate in extraCerts carries the subjectKeyIdentifier the header senderKID declares, " +
+        "so nothing offered identifies the key that would verify the protection (RFC 9483 sec. 3.5)");
+    }
+    return _fail(m, "signature", protectionAlg, "cmp/signer-cert-not-found", "no signer certificate resolved (opts.signerCert, senderKID, or extraCerts)");
+  }
 
   var ok = await _engine.verifyWithSpki(protectionAlg, protection.bytes, signer.spki, protectedPart);
   if (ok !== true) return _fail(m, "signature", protectionAlg, "cmp/protection-failed", "the protection signature does not verify over the ProtectedPart under the declared protectionAlg", signer);
@@ -493,6 +571,16 @@ async function _verifySignature(m, protectedPart, protectionAlg, protection, opt
   if (!_senderBoundToCert(m.header.sender, signer.parsed)) {
     return _fail(m, "signature", protectionAlg, "cmp/sender-mismatch", "the header sender field does not match the signer certificate subject, or (for an empty subject) a subjectAltName entry (RFC 9483 sec. 3.1, RFC 5280 sec. 7.1)", signer);
   }
+  /** @internal The declared key identifier is checked against the certificate whose key ACTUALLY
+   * verified, on every route that certificate arrives by. Selecting from `extraCerts` already matches
+   * it while choosing, and a caller-supplied certificate reaches the same rule here, so a message
+   * naming one key and signed by another is refused however the verifier came by the certificate
+   * (RFC 9483 sec. 3.5). */
+  if (!_senderKidMatchesCert(m.header.senderKID, signer.parsed)) {
+    return _fail(m, "signature", protectionAlg, "cmp/bad-sender-kid",
+      "the header senderKID does not identify the certificate whose key verified the protection: it " +
+      "must equal that certificate's subjectKeyIdentifier (RFC 9483 sec. 3.5)", signer);
+  }
 
   var hc = _headerChecks(m, opts);
   if (hc) return _fail(m, "signature", protectionAlg, hc.code, hc.reason, signer);
@@ -640,6 +728,18 @@ function _fixSecret(v, made, label) {
   return v;
 }
 
+/** @internal The freshness window, in seconds. RFC 9483 sec. 3.5 leaves the threshold to the use case
+ * and lists the check under local policy, so it is stated by the caller rather than defaulted: a
+ * window this library invented would refuse conforming messages from a peer whose clock is merely
+ * further off than that number. */
+function _fixTolerance(v) {
+  if (v == null) return null;
+  if (typeof v !== "number" || !intrinsic.isFinite(v) || v < 0) {
+    throw _err("cmp/bad-input", "opts.messageTimeTolerance is the accepted messageTime skew in seconds, a non-negative number");
+  }
+  return v;
+}
+
 /** @internal The KEM verification material, taken once at the door like every other caller value: the
  * shared secret is copied and registered for wiping, and the transaction identifier is snapshot, so
  * neither can answer differently when the derivation reads it. */
@@ -675,8 +775,13 @@ function _fixCertList(v, label) {
   for (var i = 0; i < n; i++) _append(out, _fixByteish(v[i], label + "[" + i + "]"));
   return out;
 }
+/** @internal The verification instant, copied so a caller cannot move it after the fact. A value that
+ * is not a Date is refused here rather than carried into a comparison that would throw from whichever
+ * check happened to read it first. */
 function _fixTime(v) {
-  return guard.time.isDate(v) ? new _Date(guard.time.instantOf(v)) : v;
+  if (v == null) return v;
+  if (!guard.time.isDate(v)) throw _err("cmp/bad-input", "opts.time must be a Date");
+  return new _Date(guard.time.instantOf(v));
 }
 function _fixVerifyOptions(opts, made) {
   if (opts == null) opts = {};
@@ -693,6 +798,7 @@ function _fixVerifyOptions(opts, made) {
     revocationChecker: opts.revocationChecker,
     maxIterations: opts.maxIterations,
     kem: _fixKem(opts.kem, made),
+    messageTimeTolerance: _fixTolerance(opts.messageTimeTolerance),
   };
 
   _assertEchoBytes(f.transactionID, "transactionID");
@@ -738,6 +844,315 @@ async function _verify(message, opts) {
   return _verifySignature(m, protectedPart, protectionAlg, protection, opts);
 }
 
+var KNOWN_OPEN_KEY_PACKAGE_OPTS = intrinsic.assign(intrinsic.create(null), {
+  key: 1, cert: 1, password: 1, trustAnchors: 1, intermediates: 1, time: 1,
+  authorizedBySharedSecret: 1,
+});
+var OID_A_KEY_PACKAGE = oid.byName("aKeyPackage");
+var OID_SIGNED_DATA = oid.byName("signedData");
+var OID_ENVELOPED_DATA = oid.byName("envelopedData");
+var OID_CM_KGA = oid.byName("cmKGA");
+
+function _keyPackageErr(reason, cause) { return _err("cmp/bad-key-package", reason, cause); }
+
+/** @internal The three shapes sec. 4.1.6 profiles out of an EnvelopedData, read from the parsed
+ * container before anything is decrypted: the structure is an EnvelopedData, exactly one party can
+ * open it, and what it holds is a SignedData. */
+function _assertKeyPackageContainer(parsed) {
+  if (parsed.contentTypeName !== "envelopedData") {
+    throw _keyPackageErr("a delivered key package is carried in a CMS EnvelopedData, and this container is a " +
+      parsed.contentTypeName + " (RFC 9483 sec. 4.1.6)");
+  }
+  var ris = parsed.recipientInfos;
+  if (!_isArray(ris) || ris.length !== 1) {
+    throw _keyPackageErr("a delivered key package names exactly one RecipientInfo, and this container names " +
+      guard.text.showValue(ris && ris.length) +
+      "; a second recipient is a second party able to open a key generated for this entity (RFC 9483 sec. 4.1.6)");
+  }
+  /** @internal A `KeyAgreeRecipientInfo` wraps the content-encryption key once per entry in its
+   * `recipientEncryptedKeys` (RFC 5652 sec. 6.2.2), each for a different recipient under one
+   * originator, so counting RecipientInfos alone would admit a second party under one of them. */
+  var reks = ris[0].recipientEncryptedKeys;
+  if (_isArray(reks) && reks.length !== 1) {
+    throw _keyPackageErr("the key agreement RecipientInfo of a delivered key package wraps the content-encryption key once, and this one wraps it " +
+      reks.length + " times; each is a party able to open a key generated for this entity (RFC 9483 sec. 4.1.6, RFC 5652 sec. 6.2.2)");
+  }
+  var eci = parsed.encryptedContentInfo;
+  if (!eci || eci.contentType !== OID_SIGNED_DATA) {
+    throw _keyPackageErr("the encrypted content of a delivered key package is declared id-signedData, and this container declares " +
+      guard.text.showValue(eci && eci.contentType) + " (RFC 9483 sec. 4.1.6)");
+  }
+}
+
+/** @internal RFC 5958 sec. 2: AsymmetricKeyPackage ::= SEQUENCE SIZE (1..MAX) OF OneAsymmetricKey.
+ * Each element is surfaced as its own DER buffer, which is what a PKCS#8 `PrivateKeyInfo` is
+ * (`PrivateKeyInfo ::= OneAsymmetricKey`), so a caller imports it without re-encoding. Copied off the
+ * decrypted content rather than sliced from it, so holding one key does not hold the package. */
+var ASYMMETRIC_KEY_PACKAGE = schema.seqOf(
+  schema.decode(function (n, ctx) {
+    if (!(n.tagClass === "universal" && n.tagNumber === asn1.TAGS.SEQUENCE && n.children && n.children.length >= 1)) {
+      throw ctx.E("cmp/bad-key-package", "an AsymmetricKeyPackage element must be a OneAsymmetricKey SEQUENCE (RFC 5958 sec. 2)");
+    }
+    /** @internal OneAsymmetricKey and a PKCS#8 PrivateKeyInfo are the same structure (RFC 5958
+     * sec. 2), so the shipped strict parser decides whether an element is one; a SEQUENCE that merely
+     * looks like a container is not a delivered key. */
+    try { pkcs8.parse(n.bytes); }
+    catch (e) { throw ctx.E("cmp/bad-key-package", "an AsymmetricKeyPackage element is not a OneAsymmetricKey (RFC 5958 sec. 2)", e); }
+    return _bufferFrom(n.bytes);
+  }),
+  { assert: "sequence", min: 1, code: "cmp/bad-key-package", what: "AsymmetricKeyPackage",
+    build: function (m) { return _map(m.items, function (it) { return it.value; }); } });
+
+function _readKeyPackage(der) {
+  var node;
+  try { node = asn1.decode(der); }
+  catch (e) { throw _keyPackageErr("the signed content is not DER", e); }
+  return schema.walk(ASYMMETRIC_KEY_PACKAGE, node, NS).result;
+}
+
+function _fixOpenKeyPackageOptions(opts, made) {
+  opts = guard.identifier.optionsObject(opts, _err, "cmp/bad-input", "pki.cmp.openKeyPackage options");
+  guard.identifier.assertKnownKeys(opts, KNOWN_OPEN_KEY_PACKAGE_OPTS, _err, "cmp/bad-input", "unknown opts field ");
+  var f = {
+    key: opts.key,
+    cert: _fixByteish(opts.cert, "cert"),
+    password: _fixSecret(opts.password, made, "password"),
+    trustAnchors: _fixCertList(opts.trustAnchors, "trustAnchors"),
+    intermediates: _fixPoolCerts(opts.intermediates, "intermediates"),
+    time: _fixTime(opts.time),
+    exempt: opts.authorizedBySharedSecret === true,
+  };
+  if (opts.authorizedBySharedSecret != null && typeof opts.authorizedBySharedSecret !== "boolean") {
+    throw _err("cmp/bad-input", "opts.authorizedBySharedSecret is a boolean stating that this entity protected its request with the shared secret");
+  }
+  if (f.key == null && f.password == null) {
+    throw _err("cmp/bad-input", "opening a delivered key package needs the key material the content-encryption key was protected to: opts.key (with opts.cert) for the key transport and key agreement techniques, or opts.password for the password technique (RFC 9483 sec. 4.1.6.1 to 4.1.6.3)");
+  }
+  if (f.key != null && f.password != null) {
+    throw _err("cmp/bad-input", "a delivered key package is opened by one key management technique: pass opts.key or opts.password, not both");
+  }
+  /** @internal sec. 4.1.6 offers the shared-secret exemption only to an entity that protected its
+   * request with a MAC, which is the entity opening this container with that secret. Stating it
+   * alongside a private key claims the exemption for a signature-protected exchange, where the
+   * section's requirement to validate the signer stands. */
+  if (f.exempt && f.password == null) {
+    throw _err("cmp/bad-input", "opts.authorizedBySharedSecret authorizes the key generation authority by the secret that protected the request, so it applies only to a container opened with opts.password (RFC 9483 sec. 4.1.6)");
+  }
+  if (f.exempt && f.trustAnchors != null) {
+    throw _err("cmp/bad-input", "opts.authorizedBySharedSecret and opts.trustAnchors state two different rules for authorizing the key generation authority; supply one");
+  }
+  if (!f.exempt && f.trustAnchors == null) {
+    throw _err("cmp/bad-input", "authorizing the key generation authority needs opts.trustAnchors, or opts.authorizedBySharedSecret when this entity protected its request with the shared secret (RFC 9483 sec. 4.1.6)");
+  }
+  return f;
+}
+
+async function _openKeyPackage(container, opts) {
+  var bytes = _asContentInfo(
+    guard.bytes.snapshotSource(_coerceKeyPackageBytes(container), CmpError, "cmp/bad-input", "the delivered key package container"),
+    OID_ENVELOPED_DATA, "the delivered key package container");
+  var parsed;
+  try { parsed = cms.parse(bytes); }
+  catch (e) { throw _keyPackageErr("the delivered key package container is not a CMS ContentInfo", e); }
+  _assertKeyPackageContainer(parsed);
+
+  /** @internal The profile fixes the recipient count at one, so the arm to open is named instead of
+   * matched: a caller holding only the private key need not supply the certificate as well. */
+  /** @internal Every way the container fails to open reports the one code, so the verdict carries no
+   * more than "it did not open": `pki.cms.decrypt` already collapses each secret-dependent failure to
+   * a single uniform result, and splitting that back out here would rebuild the oracle it removes. */
+  var opened;
+  try {
+    opened = await cmsDecrypt.decrypt(bytes, opts.password != null ? { password: opts.password } : { key: opts.key, cert: opts.cert },
+      { recipientIndex: 0 });
+  } catch (e) {
+    throw _keyPackageErr("the delivered key package could not be opened under the supplied key material", e);
+  }
+
+  var verdict;
+  var signedData = _asContentInfo(opened.content, OID_SIGNED_DATA, "the encrypted content");
+  try { verdict = await cmsVerify.verify(signedData, _signedDataVerifyOpts(opts)); }
+  catch (e) { throw _keyPackageErr("the SignedData wrapping the key package could not be verified", e); }
+  if (!verdict.valid) {
+    throw _keyPackageErr("the signature over the delivered key package does not verify; the SignedData reports [" +
+      intrinsic.join(_map(verdict.signers, function (s) { return s.code || "a signature mismatch"; }), ", ") + "]");
+  }
+  if (verdict.eContentType !== OID_A_KEY_PACKAGE) {
+    throw _keyPackageErr("the signed content type is " + verdict.eContentType + ", not id-ct-KP-aKeyPackage; the signature must bind what it covers to a key package (RFC 9483 sec. 4.1.6, RFC 5958 sec. 2)");
+  }
+  var signerCert = verdict.signers[0] && verdict.signers[0].cert;
+  if (!signerCert) throw _keyPackageErr("the SignedData names no signer certificate to authorize as the key generation authority");
+  _authorizeKga(verdict, signerCert, opts);
+  if (verdict.eContent == null) throw _keyPackageErr("the SignedData carries no encapsulated content, so no key package was delivered");
+  return { keys: _readKeyPackage(verdict.eContent), kga: _bufferFrom(signerCert), trusted: opts.exempt ? false : true };
+}
+
+/** @internal sec. 4.1.6: the entity "MUST use a certificate containing the additional extended key
+ * usage extension id-kp-cmKGA in order to be accepted by the EE as a legitimate key generation
+ * authority", and the EE "MUST validate the signer certificate". `pki.path.validate`'s `requiredEku`
+ * answers the RFC 5280 sec. 4.2.1.12 question (does this certificate PERMIT the purpose), which an
+ * absent extension satisfies, so the assertion is checked here as well as the chain. */
+function _authorizeKga(verdict, signerCert, opts) {
+  if (opts.exempt) return;
+  if (!verdict.trusted) {
+    throw _err("cmp/unauthorized-kga", "the certificate that signed the delivered key package does not chain to an accepted trust anchor (RFC 9483 sec. 4.1.6)");
+  }
+  var parsedSigner;
+  try { parsedSigner = x509.parse(signerCert); }
+  catch (e) { throw _err("cmp/unauthorized-kga", "the certificate that signed the delivered key package could not be read", e); }
+  if (!pkix.assertsPurpose(NS, parsedSigner, OID_CM_KGA)) {
+    throw _err("cmp/unauthorized-kga", "the certificate that signed the delivered key package does not assert the id-kp-cmKGA extended key usage, which is what a key generation authority uses to show it is one (RFC 9483 sec. 4.1.6, RFC 9480 sec. 2.2)");
+  }
+}
+
+function _signedDataVerifyOpts(opts) {
+  if (opts.exempt) return {};
+  var v = { trustAnchors: opts.trustAnchors, requiredEku: [OID_CM_KGA] };
+  if (opts.intermediates != null) v.certs = opts.intermediates;
+  if (opts.time != null) v.time = opts.time;
+  return v;
+}
+
+/** @internal The certificate options here take one certificate or a list of them, as DER or PEM, which
+ * is the shape `pki.cmp.verify` takes. `pki.cms.verify` takes `certs` as a list of DER, so the pool is
+ * normalized at the door: a single certificate forwarded unwrapped would be walked as a sequence of
+ * its own bytes and contribute nothing, and a PEM string would not be read at all. */
+function _fixPoolCerts(v, label) {
+  if (v == null) return v;
+  var list = _fixCertList(_isArray(v) ? v : [v], label);
+  return _map(list, function (c, i) {
+    if (typeof c !== "string") return c;
+    try { return x509.pemDecode(c); }
+    catch (e) { throw _err("cmp/bad-input", "opts." + label + "[" + i + "] PEM could not be decoded", e); }
+  });
+}
+
+/** @internal Both CMS layers arrive in either of two forms, and the two are structurally exclusive so
+ * neither is guessed at. A ContentInfo opens with an OBJECT IDENTIFIER naming its content type; the
+ * bare structure opens with its own `CMSVersion` INTEGER. Both forms are seen in practice. A CMP
+ * `EncryptedKey` carries the `EnvelopedData` itself (RFC 9810 sec. 5.2.2), and RFC 5652 sec. 6.1
+ * encrypts the CONTENT rather than a ContentInfo around it, so the plaintext under an `id-signedData`
+ * `encryptedContentInfo` is a `SignedData`. Each is wrapped so one code path reads both. Anything
+ * else is left alone for the ContentInfo parse to refuse by name. */
+function _asContentInfo(der, contentTypeOid, what) {
+  var node;
+  try { node = asn1.decode(der); }
+  catch (e) { throw _keyPackageErr(what + " is not DER", e); }
+  var first = node.constructed && node.children ? node.children[0] : null;
+  if (!first || first.tagClass !== "universal" || first.tagNumber !== asn1.TAGS.INTEGER) return der;
+  return b.sequence([b.oid(contentTypeOid), b.explicit(0, b.raw(der))]);
+}
+
+function _coerceKeyPackageBytes(container) {
+  if (typeof container === "string") {
+    try { return cms.pemDecode(container); }
+    catch (e) { throw _err("cmp/bad-input", "the delivered key package container PEM could not be decoded", e); }
+  }
+  return container;
+}
+
+/**
+ * @primitive pki.cmp.openKeyPackage
+ * @signature pki.cmp.openKeyPackage(container, opts) -> Promise<{ keys, kga, trusted }>
+ * @since 0.6.52
+ * @status stable
+ * @spec RFC 9483 sec. 4.1.6, RFC 5958, RFC 5652, RFC 9480 sec. 2.2
+ * @defends unauthorized-key-generation-authority (CWE-863)
+ * @related pki.cmp.session, pki.cms.decrypt, pki.cms.verify
+ *
+ * Open a centrally generated private key delivered in a CMP response (RFC 9483 sec. 4.1.6). A CA that
+ * generates the key pair on the end entity's behalf puts it in the `privateKey` field of the granted
+ * `CertifiedKeyPair`: an RFC 5958 `AsymmetricKeyPackage`, signed by the Key Generation Authority in a
+ * CMS `SignedData`, sealed to this entity in a CMS `EnvelopedData`. `container` is those
+ * `EnvelopedData` bytes (DER `Buffer` or PEM), which `pki.cmp.session` surfaces as
+ * `deliveredKey` when the session is told to accept one.
+ *
+ * The two layers are undone in order and the authority is authorized BEFORE any key material is
+ * returned. Which key management technique opens the container follows the protection of the request
+ * that asked for the key: `opts.key` (with `opts.cert`) for the key transport and key agreement
+ * techniques a signature-protected request selects (sec. 4.1.6.1, sec. 4.1.6.2), `opts.password` for
+ * the password technique a MAC-protected request selects (sec. 4.1.6.3).
+ *
+ * Authorization is the point of the verb. The section requires the signer's certificate to carry the
+ * `id-kp-cmKGA` extended key usage "in order to be accepted by the EE as a legitimate key generation
+ * authority", so a certificate that merely PERMITS the purpose by carrying no `extendedKeyUsage` at
+ * all does not authorize: the assertion must be present, and the certificate must chain to an anchor
+ * in `opts.trustAnchors`. The one exception is the section's own: an entity that protected its request
+ * with a shared secret "MAY omit the validation" and authorize the authority by that secret instead.
+ * That is stated with `opts.authorizedBySharedSecret`, it applies only to a container opened with
+ * `opts.password`, and the result then reports `trusted: false`.
+ *
+ * Returns `{ keys, kga, trusted }`. `keys` is every `OneAsymmetricKey` in the package, in order, each
+ * as its own DER `Buffer` that is a PKCS#8 `PrivateKeyInfo` ready for `pki.key.import`. `kga` is the
+ * signer certificate whose signature was checked. `trusted` says whether that certificate chained.
+ * Malformed input, an unopenable container, an unverifiable signature, or an unauthorized authority
+ * all throw a typed `CmpError`; no key material is returned on any of them.
+ *
+ * The container's shape is held to the profile where the shape decides who reads the key or what the
+ * signature covers: it must be an `EnvelopedData`, it must name exactly one `RecipientInfo`, its
+ * encrypted content type must be `id-signedData`, and the signed content type must be
+ * `id-ct-KP-aKeyPackage`. The profile's CMS version literals are not enforced, because RFC 5652
+ * sec. 5.1 and sec. 6.1 derive those from the signer and recipient forms in use and a conforming
+ * sender reaches different values. Its choice-of-form rules, the signer identifier form and the
+ * ordering of the certificates the SignedData carries, are not judged either. Both live inside the
+ * encrypted SignedData rather than in the `container` bytes, and the result carries only the signer
+ * certificate, so a caller holding a stricter profile cannot judge them from this verdict.
+ *
+ * `keys` is the whole RFC 5958 `AsymmetricKeyPackage`, which is `SIZE (1..MAX)`, so a package carrying
+ * several is opened and every key returned. RFC 9483 sec. 4.1.6 profiles that to a sequence of one,
+ * and where the count decides something it is held: a `pki.cmp.session` enrollment requires exactly
+ * one, since one grant certifies one key and every further key is one the issued certificate says
+ * nothing about. A caller using this verb on its own owns that binding.
+ *
+ * @opts
+ *   - `key` (Buffer|PEM|CryptoKey) -- this entity's private key, for a container opened by the key
+ *     transport or key agreement technique.
+ *   - `cert` (Buffer|PEM) -- the certificate for `key`. Optional: the profile fixes the recipient
+ *     count at one, so the arm is named rather than matched.
+ *   - `password` (string|Buffer) -- the shared secret, for a container opened by the password
+ *     technique. Copied at the door and wiped when the call returns.
+ *   - `trustAnchors` (Buffer|Buffer[]|PEM) -- the roots this entity accepts for the key generation
+ *     authority. REQUIRED unless `authorizedBySharedSecret` is set.
+ *   - `intermediates` (Buffer|Buffer[]|PEM) -- extra untrusted pool certificates for path building.
+ *   - `time` (Date) -- the validity instant for path validation. Defaults to the current time.
+ *   - `authorizedBySharedSecret` (boolean) -- authorize the authority by the secret that protected
+ *     the request rather than by a chain, which sec. 4.1.6 permits a MAC-protected exchange. Requires
+ *     `opts.password` and refuses `opts.trustAnchors`.
+ * @example
+ *   var nb = new Date("2026-01-01T00:00:00Z"), na = new Date("2036-01-01T00:00:00Z");
+ *   var kgaPair = await pki.key.generate("Ed25519");                       // the key generation authority
+ *   var kgaKey = await pki.key.export(kgaPair.privateKey);
+ *   var kgaCert = await pki.x509.sign({ subject: "Key Generation Authority",
+ *     subjectPublicKey: await pki.key.export(kgaPair.publicKey), notBefore: nb, notAfter: na,
+ *     extensions: { basicConstraints: { cA: true }, keyUsage: ["digitalSignature", "keyCertSign"],
+ *       extendedKeyUsage: ["cmKGA"], subjectKeyIdentifier: true } }, { key: kgaKey });
+ *   var rsa = { name: "RSA-OAEP", modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" };
+ *   var eePair = await pki.key.generate(rsa);                              // the enrolling end entity
+ *   var eeKey = await pki.key.export(eePair.privateKey);
+ *   var eeCert = await pki.x509.sign({ subject: "Enrolling client",
+ *     subjectPublicKey: await pki.key.export(eePair.publicKey), notBefore: nb, notAfter: na,
+ *     extensions: { keyUsage: ["keyEncipherment"] } }, { key: eeKey });
+ *   var generated = await pki.key.export((await pki.key.generate("Ed25519")).privateKey);
+ *   var signedPackage = await pki.cms.sign(pki.asn1.build.sequence([pki.asn1.build.raw(generated)]),
+ *     [{ key: kgaKey, cert: kgaCert }], { eContentType: "aKeyPackage", sid: "ski" });
+ *   var deliveredKeyDer = await pki.cms.encrypt(signedPackage, [{ cert: eeCert }],
+ *     { contentEncryptionAlgorithm: "aes-256-cbc", contentType: "signedData" });
+ *   var opened = await pki.cmp.openKeyPackage(deliveredKeyDer,
+ *     { key: eeKey, cert: eeCert, trustAnchors: [kgaCert] });
+ *   opened.keys.length;                                   // 1
+ *   var privateKey = await pki.key.import(opened.keys[0]);
+ */
+function openKeyPackage(container, opts) {
+  var made = [];
+  return guard.async.deferred(async function () {
+    try {
+      return await _openKeyPackage(container, _fixOpenKeyPackageOptions(opts, made));
+    } finally {
+      guard.secret.zeroizeAll(made, CmpError, "cmp/bad-input", "the copied key package shared secret");
+    }
+  });
+}
+
 /**
  * @primitive  pki.cmp.verify
  * @signature  pki.cmp.verify(message, opts?) -> Promise<verdict>
@@ -763,6 +1178,14 @@ async function _verify(message, opts) {
  * carry at least 128 bits; a violation is a `{ valid: false }` verdict carrying `cmp/unsupported-version`,
  * `cmp/bad-transaction-id`, or `cmp/bad-sender-nonce`.
  *
+ * A present `senderKID` must identify the key material that verified the protection (RFC 9483
+ * sec. 3.5), whichever way that key was resolved. Under signature protection it must equal the
+ * `subjectKeyIdentifier` of the certificate whose key verified, so a certificate supplied as
+ * `opts.signerCert` is held to the declared identifier exactly as one selected out of `extraCerts` is,
+ * and a certificate carrying no `subjectKeyIdentifier` cannot satisfy one. Under MAC protection it must
+ * carry the same name as the `commonName` of the sender field, which is how such a message names the
+ * shared secret it was protected with (sec. 4.1.5). A mismatch is a `cmp/bad-sender-kid` verdict.
+ *
  * Returns a verdict (never a bare boolean): `{ valid, trusted, protectionType, protectionAlg, signer,
  * transactionID, senderNonce, recipNonce, header, body, code?, reason? }`. `valid` is whether the
  * protection is cryptographically intact under the declared algorithm; `trusted` is whether a MAC secret
@@ -775,6 +1198,10 @@ async function _verify(message, opts) {
  *
  * @opts
  *   - `sharedSecret` (string|Buffer) -- the PBMAC1 secret; REQUIRED for a MAC-protected message (UTF-8).
+ *   - `messageTimeTolerance` (number) -- the accepted `messageTime` skew in seconds. RFC 9483
+ *     sec. 3.5 requires a present `messageTime` to be close to the receiver's current time but leaves
+ *     the threshold to the use case, so stating it turns the check on; a message outside the window in
+ *     either direction is a `cmp/bad-message-time` verdict. Absent, the `messageTime` is not judged.
  *   - `kem` ({ sharedSecret, transactionID? }) -- REQUIRED for a KEM-protected message (RFC 9810
  *     sec. 5.1.3.4). `sharedSecret` is what this side encapsulated to the sender's KEM public key, and
  *     `transactionID` names the message that carried the ciphertext when it was not this one. The
@@ -815,6 +1242,7 @@ module.exports = {
   transfer: cmpBuild.transfer,
   wellKnownUrl: cmpBuild.wellKnownUrl,
   verify: verify,
+  openKeyPackage: openKeyPackage,
   setEngine: setEngine,
   senderBoundToCert: _senderBoundToCert,
 };

package/lib/guard-name.js

@@ -332,6 +332,55 @@ function _hostConstraintBody(s) {
   return _charAt(h, 0) === "." ? _strSlice(h, 1) : h;
 }
 
+/** @internal A label with nothing in it, which is what makes a subtree base unmatchable. The
+ * comparisons in lib/path-validate.js compare a base against a name by suffix, so a base carrying an
+ * empty label asks for a name carrying one, and a name that carries one is not a name. */
+function _hasEmptyLabel(s) {
+  if (s.length === 0) return true;
+  if (_charAt(s, 0) === "." || _charAt(s, s.length - 1) === ".") return true;
+  return _indexOf(s, "..") !== -1;
+}
+
+/** @internal Whether the comparison can read a constraint base at all, which is a narrower question
+ * than whether a caller may state one. The door holds a caller to a well-formed host name; the
+ * comparison asks only whether an empty label leaves the base matching no name, and answers such a
+ * base with no verdict rather than with no match, since an excluded subtree that matches nothing
+ * excludes nothing. The two differ in both directions. A label carrying an underscore or edged with a
+ * hyphen is not a host name the door accepts, and the suffix comparison still applies it to exactly
+ * the names it names, so it stays enforced. The reduction here is the comparison's own, so the two
+ * cannot part company over a base like "..", whose body is empty only once a leading dot the
+ * comparison keeps has been taken off.
+ *
+ * The rule follows the comparison's own branches rather than the tag alone, since one tag can be
+ * compared two ways. An rfc822Name base carrying an at-sign is matched exactly and is read as a
+ * mailbox; one without an at-sign constrains the host and is read as a subtree, as a dNSName base is.
+ *
+ * A base that reduces to nothing is read by tag, because the comparisons do not agree on it. For
+ * dNSName it names the root of the namespace and `hostConstraintMatch` matches every name, so it is
+ * readable. For rfc822Name the same reduction leaves no domain to compare and `emailMatch` matches no
+ * mailbox, and for uniformResourceIdentifier `uriMatch` reads no host, so both are unreadable.
+ * @enforced-by behavioral -- the rule has no rename-proof code shape, and the RED vectors in
+ * path-validate.test.js driving a CA's own nameConstraints extension are the guard. */
+function constraintBaseUnreadable(tag, base) {
+  if (typeof base !== "string") return true;
+  /** @internal A base carrying an at-sign names one mailbox, and `emailMatch` compares it to a name
+   * exactly, local part and domain alike, rather than as a subtree. Each half is therefore read on
+   * its own terms: the local part by the RFC 5321 sec. 4.1.2 Dot-string or Quoted-string rule, which
+   * admits an underscore and refuses an empty atom, and the domain by the empty-label rule. A
+   * bracketed address literal carries no empty label in either accepted form, so the domain rule
+   * passes it through to the comparison, which reads it whole. */
+  if (tag === 1 && _lastIndexOf(base, "@") !== -1) {
+    var mb = splitMailbox(base);
+    if (mb === null || mb === "ambiguous") return true;
+    if (!_isMailboxLocal(mb[0])) return true;
+    return _hasEmptyLabel(stripTrailingDot(mb[1]));
+  }
+  var body = stripTrailingDot(base);
+  if (body === "") return tag !== 2;
+  if (_charAt(body, 0) === ".") body = _strSlice(body, 1);
+  return _hasEmptyLabel(body);
+}
+
 /** @internal Why a name-constraint base cannot be enforced, or null when it can. A base outside the
  * form its tag names is not a narrower namespace: an empty dNSName base matches every name, and a
  * base holding characters no host name can hold matches none, so the same value that reads as a
@@ -358,11 +407,19 @@ function constraintBaseRefusal(tag, base) {
     return _isHostName(_hostConstraintBody(base)) ? null
       : "must be a host name, optionally written as a subtree with a leading dot";
   }
+  /** @internal RFC 5280 sec. 4.2.1.10 says of a URI constraint: "The constraint MUST be specified as
+   * a fully qualified domain name and MAY specify a host or a domain. Examples would be
+   * host.example.com and .example.com." Its dNSName paragraph states no such requirement, so a single
+   * label is a valid dNSName base and is not a valid URI base. A caller meets this rule at the door,
+   * whether through `pki.trust.anchor` or through the validator's subtree seeds. A base a certificate
+   * carries in its own extension never reaches a door, and `uriMatch` is what holds it to the rule
+   * there, answering `path/name-constraint-unsupported` for a host it cannot read as fully qualified.
+   * `constraintBaseUnreadable` does not judge label count and does not stand in for that check. */
   if (tag === 6) {
     var h = _hostConstraintBody(_toLowerCase(base));
     var dotted = _isHostName(h) && _indexOf(h, ".") !== -1 && !_allCharsIn(h, _DIGDOT_TABLE);
     return dotted ? null
-      : "must be a dotted host name, which is the part of a URI a certificate is compared by";
+      : "must be a fully qualified domain name, which RFC 5280 sec. 4.2.1.10 requires of a URI constraint and not of a dNSName one";
   }
   return null;
 }
@@ -473,4 +530,5 @@ module.exports = intrinsic.freeze({
   lowerAscii: lowerAscii,
   stripTrailingDot: stripTrailingDot, isFqdnHost: isFqdnHost, splitMailbox: splitMailbox,
   constraintBaseRefusal: constraintBaseRefusal,
+  constraintBaseUnreadable: constraintBaseUnreadable,
 });