@blamejs/pki 0.7.1 → 0.7.3

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.7.3 — 2026-09-10
+
+A timestamp verification takes its options once, so every pass reads the same answer.
+
+### Changed
+
+- pki.tsp.verify reads each option once. A token is examined in more than one pass, and opts.certs was consulted again by each of them, so an option reached through an accessor could hand one set of certificates to the signature check and another to the chain the signer is traced through. No route was found that turns this into a wrong verdict, and a caller passing options as plain values was never affected; the change makes the verdict describe one set of inputs rather than relying on a caller object to answer consistently. It follows the same read-once shape applied to the PKCS#12 verbs in 0.7.2.
+
+## v0.7.2 — 2026-09-10
+
+A PKCS#12 iteration cap is read once, so it cannot be answered with a value that is not a number.
+
+### Security
+
+- pki.pkcs12.open and pki.pkcs12.verifyMac hold a store to opts.maxIterations however that option is supplied. The option is the caller's own bound on key-derivation work, and it was read once for each part of its shape check and again by every later pass that applies it: the message authentication code, and then each bag the store carries. An option reached through an accessor answers each read separately, so one that returned a valid integer to the shape check and a non-numeric value to a later comparison left the cap as NaN. No count is above NaN, so the comparison stopped refusing anything and a store demanding far more work than the caller allowed was accepted and its keys derived. A store carrying no message authentication code reaches this through its bags alone, so opening one with opts.allowUnauthenticated was affected even though the authenticated path was not consulted. Both verbs now take the whole options object once, at entry, and every pass reads that one copy, which closes the same door for every option either verb accepts rather than for this one alone. A caller passing options as plain values was never affected. The same read-once shape is applied to the PBES2 and CMP iteration caps, where no route was found that reaches them this way.
+
 ## v0.7.1 — 2026-09-10
 
 A wildcard name in a certificate is held to an excluded name constraint it can reach.

package/lib/cmp-verify.js

@@ -535,11 +535,15 @@ async function _verifyMac(m, protectedPart, protectionAlg, protection, opts) {
 
 function _capWork(iterationCount, salt, keyLength, prfHash, opts) {
   var cap = PBMAC1_MAX_ITER;
-  if (opts.maxIterations != null) {
-    if (typeof opts.maxIterations !== "number" || !_isFinite(opts.maxIterations) || opts.maxIterations < 1 || _floor(opts.maxIterations) !== opts.maxIterations) {
+  /** @internal Read once: the shape check and the comparison must read the same answer, or an
+   * option reached through an accessor passes as a number and then answers the comparison with
+   * something that is not one, leaving the cap NaN and bounding nothing. */
+  var wantedIter = opts.maxIterations;
+  if (wantedIter != null) {
+    if (typeof wantedIter !== "number" || !_isFinite(wantedIter) || wantedIter < 1 || _floor(wantedIter) !== wantedIter) {
       throw _err("cmp/bad-input", "opts.maxIterations must be a positive integer");
     }
-    cap = _min(opts.maxIterations, cap);
+    cap = _min(wantedIter, cap);
   }
   if (iterationCount < PBMAC1_MIN_ITER) throw _err("cmp/bad-input", "the PBMAC1 iterationCount " + iterationCount + " is below the floor " + PBMAC1_MIN_ITER + " (RFC 8018 sec. 4.2)");
   if (iterationCount > cap) throw _err("cmp/bad-input", "the PBMAC1 iterationCount " + iterationCount + " exceeds the cap " + cap);

package/lib/pbes2.js

@@ -74,9 +74,13 @@ function parsePbkdf2Params(paramsDer, opts, E, prefix, strictPrf) {
   if (salt.length > C.LIMITS.PBKDF2_MAX_SALT) throw E(prefix + "/bad-input", "PBKDF2 salt exceeds the " + C.LIMITS.PBKDF2_MAX_SALT + "-octet cap");
   var iterations = guard.range.positiveInt31(asn1.read.integer(kids[1]), E, prefix + "/bad-input", "PBKDF2 iterationCount");
   var cap = C.LIMITS.PBKDF2_MAX_ITERATIONS;
-  if (opts && opts.maxIterations != null) {
-    if (typeof opts.maxIterations !== "number" || !isFinite(opts.maxIterations) || opts.maxIterations < 1 || Math.floor(opts.maxIterations) !== opts.maxIterations) throw E(prefix + "/bad-input", "maxIterations must be a positive integer");
-    cap = Math.min(opts.maxIterations, cap);
+  /** @internal Read once: the shape check and the comparison must read the same answer, or an
+   * option reached through an accessor passes as a number and then answers the comparison with
+   * something that is not one, leaving the cap NaN and bounding nothing. */
+  var wantedIter = opts ? opts.maxIterations : null;
+  if (wantedIter != null) {
+    if (typeof wantedIter !== "number" || !isFinite(wantedIter) || wantedIter < 1 || Math.floor(wantedIter) !== wantedIter) throw E(prefix + "/bad-input", "maxIterations must be a positive integer");
+    cap = Math.min(wantedIter, cap);
   }
   if (iterations > cap) throw E(prefix + "/iteration-limit", "PBKDF2 iterationCount " + iterations + " exceeds the cap " + cap);
   var prfNode = "sha1";

package/lib/pkcs12-build.js

@@ -552,6 +552,8 @@ async function _build(spec, opts) {
 async function verifyMac(pfx, password, opts) {
   if (opts != null && typeof opts === "object" && !Buffer.isBuffer(opts)) {
     guard.identifier.assertKnownKeys(opts, _VERIFY_MAC_OPTS, _err, "pkcs12/bad-input", "pki.pkcs12.verifyMac has an unknown option ");
+    /** @internal Taken once here, for the reason the same call in `open` states. */
+    opts = guard.identifier.snapshotOptions(opts, _VERIFY_MAC_OPTS);
   }
   var m = _storeFromBytes(pfx);
   var valid = await _verifyMacOfStore(m, password, opts);
@@ -593,11 +595,16 @@ async function _verifyMacOfStore(m, password, opts) {
   return computed.length === expected.length && guard.crypto.constantTimeEqual(computed, expected);
 }
 
+/** @internal The caller's bound is read once and the shape check and the comparison both read that
+ * one answer. Read separately, an option reached through an accessor satisfies every check as a
+ * number and then answers the comparison with something that is not one, so `Math.min` yields NaN.
+ * Nothing compares above NaN, so the cap stopped bounding the work it exists to bound. */
 function _capWork(iterations, salt, opts, keyLength, hardCap) {
   var cap = hardCap;
-  if (opts.maxIterations != null) {
-    if (typeof opts.maxIterations !== "number" || !isFinite(opts.maxIterations) || opts.maxIterations < 1 || Math.floor(opts.maxIterations) !== opts.maxIterations) throw _err("pkcs12/bad-input", "maxIterations must be a positive integer");
-    cap = Math.min(opts.maxIterations, cap);
+  var wanted = opts.maxIterations;
+  if (wanted != null) {
+    if (typeof wanted !== "number" || !isFinite(wanted) || wanted < 1 || Math.floor(wanted) !== wanted) throw _err("pkcs12/bad-input", "maxIterations must be a positive integer");
+    cap = Math.min(wanted, cap);
   }
   if (iterations > cap) throw _err("pkcs12/iteration-limit", "the MAC iteration count " + iterations + " exceeds the cap " + cap);
   if (salt && salt.length > C.LIMITS.PBKDF2_MAX_SALT) throw _err("pkcs12/bad-input", "the MAC salt exceeds the " + C.LIMITS.PBKDF2_MAX_SALT + "-octet cap");
@@ -653,6 +660,12 @@ function _capWork(iterations, salt, opts, keyLength, hardCap) {
 async function open(pfx, password, opts) {
   opts = opts || {};
   guard.identifier.assertKnownKeys(opts, _OPEN_OPTS, _err, "pkcs12/bad-input", "pki.pkcs12.open has an unknown option ");
+  /** @internal Every option is taken once, here, and everything below reads the snapshot. A store
+   * is opened in many passes, the MAC and then each bag, so an option left on the caller's object is
+   * read again by every one of them. An option reached through an accessor answers each read
+   * separately: one that returned a valid integer to this check and something that is not a number
+   * to a later bag left the work cap as NaN, and no count is above NaN. */
+  opts = guard.identifier.snapshotOptions(opts, _OPEN_OPTS);
   if (opts.maxIterations != null &&(typeof opts.maxIterations !== "number" || !isFinite(opts.maxIterations) || opts.maxIterations < 1 || Math.floor(opts.maxIterations) !== opts.maxIterations)) {
     throw _err("pkcs12/bad-input", "maxIterations must be a positive integer");
   }
@@ -732,7 +745,8 @@ function _decryptLegacyPbe(ea, ct, password, opts, budget) {
     if (e && e.isPkcs12Error) throw e;
     throw _err("pkcs12/bad-algorithm-parameters", "malformed pkcs-12PbeParams (RFC 7292 App. C)", e);
   }
-  var cap = opts.maxIterations != null ? Math.min(opts.maxIterations, CLASSIC_MAC_MAX_ITERATIONS) : CLASSIC_MAC_MAX_ITERATIONS;
+  var wantedLegacy = opts.maxIterations;
+  var cap = wantedLegacy != null ? Math.min(wantedLegacy, CLASSIC_MAC_MAX_ITERATIONS) : CLASSIC_MAC_MAX_ITERATIONS;
   if (iterations > cap) throw _err("pkcs12/iteration-limit", "the legacy PBE iteration count " + iterations + " exceeds the cap " + cap);
   if (salt.length > C.LIMITS.PBKDF2_MAX_SALT) throw _err("pkcs12/bad-input", "the legacy PBE salt exceeds the " + C.LIMITS.PBKDF2_MAX_SALT + "-octet cap");
   var u = P12_KDF_UV[scheme.hash].u;

package/lib/tsp-sign.js

@@ -596,6 +596,12 @@ async function verify(token, data, opts) {
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("tsp/bad-input", "pki.tsp.verify options must be an object");
   guard.identifier.assertKnownKeys(opts, _VERIFY_OPTS, _err, "tsp/bad-input",
     "pki.tsp.verify has an unknown option (the anchor option is `trustAnchors`) ");
+  /** @internal Every option is taken once, here, and each pass below reads that copy. A token is
+   * examined in several passes: the signature over it, then the chain from the signer to the
+   * caller's anchors. An option left on the caller's object is read again by each, and an option
+   * reached through an accessor answers each read separately, so the certificates that verified the
+   * signature need not be the certificates the chain was built from. */
+  opts = guard.identifier.snapshotOptions(opts, _VERIFY_OPTS);
   if (opts.certs != null && (!Array.isArray(opts.certs) || !guard.list.allMatch(opts.certs, function (c) { return guard.bytes.isByteSource(c); }))) {
     throw _err("tsp/bad-input", "pki.tsp.verify opts.certs must be an array of DER certificate Buffers");
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.7.1",
+  "version": "0.7.3",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:f4cef9a3-338a-48f8-81a2-c156e38dfb4b",
+  "serialNumber": "urn:uuid:7729b1e4-672e-4d2e-ac81-8d11135b58a9",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-10T05:54:34.594Z",
+    "timestamp": "2026-09-10T08:34:35.597Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.7.1",
+      "bom-ref": "@blamejs/pki@0.7.3",
       "type": "application",
       "name": "pki",
-      "version": "0.7.1",
+      "version": "0.7.3",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.7.1",
+      "purl": "pkg:npm/%40blamejs/pki@0.7.3",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.7.1",
+      "ref": "@blamejs/pki@0.7.3",
       "dependsOn": []
     }
   ]