@blamejs/pki 0.6.53 → 0.6.54

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.54 — 2026-09-07
+
+A holder of a composite ML-KEM key can enroll for it, proving possession by opening the challenge addressed to it.
+
+### Fixed
+
+- pki.cmc.build completes an unsigned enrollment for a composite ML-KEM key (RFC 5272 App. C.1). The rule is unchanged: the challenge must be addressed to the key the request asks for, and a challenge opened by any other key licenses nothing. What changed is how the two are compared. A key the runtime engine cannot read has no key object to compare, so the composite SubjectPublicKeyInfo answers instead, which is sound because that encoding is canonical: fixed component widths under a single OID, with no compressed-point spelling for two forms of one key to differ over. That ambiguity is the reason the classical comparison uses key objects, and it does not arise here. Every other key type is compared exactly as before.
+
 ## v0.6.53 — 2026-09-07
 
 A composite ML-KEM private key states its public half, so a holder can name the recipient it is.

package/lib/cmc-build.js

@@ -17,6 +17,7 @@ var oid = require("./oid");
 var cmsSign = require("./cms-sign");
 var cmsEncrypt = require("./cms-encrypt");
 var cmsDecrypt = require("./cms-decrypt");
+var compositeKem = require("./composite-kem");
 var key = require("./key");
 var _createPublicKey = nodeCrypto.createPublicKey;
 var guard = require("./guard-all");
@@ -518,19 +519,40 @@ function _requestIdentity(parsed) {
 
 /** @internal Whether the key that opened the challenge is the key the request asks to have certified.
  * Only a tcr is answered this way: a crm request carries its own proof-of-possession field. */
-function _provesRequestKey(openingKey, outgoing) {
-  if (!openingKey || !outgoing || !outgoing.certificationRequestBytes) return false;
-  var requested;
+function _provesRequestKey(opening, outgoing) {
+  if (!opening || !outgoing || !outgoing.certificationRequestBytes) return false;
+  var requestedSpki;
+  try {
+    requestedSpki = csr.parse(outgoing.certificationRequestBytes).subjectPublicKeyInfo.bytes;
+  } catch (_e) { return false; } // allow:swallow-unverified a request this runtime cannot read proves nothing here
   /** @internal Compared as keys rather than as encodings: an elliptic-curve point written in compressed
    * form and the same point written uncompressed are different bytes and the same key, and it is the key
    * the section is about. */
+  if (opening.key !== null) {
+    var requested;
+    try {
+      requested = _createPublicKey({ key: requestedSpki, format: "der", type: "spki" });
+    } catch (_e) { return false; } // allow:swallow-unverified a key this runtime cannot read proves nothing here
+    return intrinsic.keyEquals(requested, opening.key);
+  }
+  /** @internal A key the runtime engine cannot read has no KeyObject to compare, and a composite
+   * ML-KEM key is one. Its encoding answers instead, which is sound because that encoding is
+   * canonical: fixed component widths under a single OID, with no compressed-point spelling for two
+   * forms of one key to differ over, which is the ambiguity the comparison above exists to absorb. */
+  if (!_isCompositeSpki(requestedSpki)) return false;
+  return intrinsic.bufferEquals(requestedSpki, opening.spki);
+}
+
+/** @internal Whether a SubjectPublicKeyInfo names a composite ML-KEM algorithm, read from its
+ * AlgorithmIdentifier alone. Anything this cannot read is not one. */
+function _isCompositeSpki(spki) {
   try {
-    requested = _createPublicKey({
-      key: csr.parse(outgoing.certificationRequestBytes).subjectPublicKeyInfo.bytes,
-      format: "der", type: "spki",
-    });
-  } catch (_e) { return false; } // allow:swallow-unverified a key this runtime cannot read proves nothing here
-  return intrinsic.keyEquals(requested, openingKey);
+    var node = asn1.decode(spki);
+    if (!node.children || node.children.length !== 2) return false;
+    var alg = node.children[0];
+    if (!alg.children || alg.children.length < 1) return false;
+    return compositeKem.isCompositeKem(asn1.read.oid(alg.children[0]));
+  } catch (_e) { return false; } // allow:swallow-unverified an unreadable algorithm is not a composite one
 }
 
 /** @internal The public half of the key that OPENED the challenge. The recipient kind comes from the
@@ -539,11 +561,18 @@ function _provesRequestKey(openingKey, outgoing) {
  * yields null, and the request is then refused rather than accepted on an unproven key. */
 async function _openingPublicKey(recipient, recipientType) {
   if (!ASYMMETRIC_RECIPIENT[recipientType]) return null;
+  var spki;
   try {
-    return _createPublicKey({
-      key: await key.publicFromPrivate(recipient.key), format: "der", type: "spki",
-    });
+    spki = await key.publicFromPrivate(recipient.key);
   } catch (_e) { return null; } // allow:swallow-unverified a key whose public half cannot be derived proves nothing here
+  /** @internal Both spellings of the answer: the KeyObject the comparison prefers, and the encoding a
+   * key the runtime engine cannot read has instead of one. A null `key` is not a failure; it says the
+   * engine does not know this algorithm, and the comparison below decides what that permits. */
+  var asKey;
+  try {
+    asKey = _createPublicKey({ key: spki, format: "der", type: "spki" });
+  } catch (_e) { asKey = null; } // allow:swallow-unverified a composite key the runtime cannot read is compared by its canonical bytes
+  return { spki: spki, key: asKey };
 }
 
 async function _recoverProofValue(decoded, recipient, witnessHash) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.53",
+  "version": "0.6.54",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:258eb315-4dba-4e0f-8600-313c47a1a144",
+  "serialNumber": "urn:uuid:3fcb367d-0079-41f4-bd25-0141050006d7",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-07T16:58:48.291Z",
+    "timestamp": "2026-09-07T18:01:28.536Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.53",
+      "bom-ref": "@blamejs/pki@0.6.54",
       "type": "application",
       "name": "pki",
-      "version": "0.6.53",
+      "version": "0.6.54",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.53",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.54",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.53",
+      "ref": "@blamejs/pki@0.6.54",
       "dependsOn": []
     }
   ]