@blamejs/pki 0.7.35 → 0.7.37

package/lib/cms-sign.js

@@ -84,8 +84,11 @@ function _buildSignedAttrs(pairs) {
   return { setOf: setOf, wire: wire };
 }
 
+var KNOWN_ATTRIBUTE_KEYS = intrinsic.assign(intrinsic.create(null), { type: 1, values: 1 });
 function _resolveAttrPairs(list, what) {
   return intrinsic.map(list || [], function (a) {
+    if (!a || typeof a !== "object") throw _err("cms/bad-input", "an attribute must be { type, values }");
+    guard.identifier.assertKnownKeys(a, KNOWN_ATTRIBUTE_KEYS, _err, "cms/bad-input", "unknown attribute field (an attribute is { type, values }): ");
     var vals = intrinsic.map(a.values || [], function (v) { return _toBuf(v, what); });
     if (!vals.length) throw _err("cms/bad-input", "a signed attribute must carry at least one value (RFC 5652 -- Attribute values is SET SIZE (1..MAX))");
     return { type: oid.isDottedDecimal(a.type) ? a.type : O(a.type), values: vals };

package/lib/crl-sign.js

@@ -72,8 +72,6 @@ function _assertExtensionValueDecodes(node, extnId, what) {
   }
 }
 
-var OID_SKI = O("subjectKeyIdentifier");
-
 var CRL_REASON = constants.NAMES.CRL_REASON;
 var REASON_BY_NAME = intrinsic.create(null);
 Object.keys(CRL_REASON).forEach(function (v) { REASON_BY_NAME[CRL_REASON[v]] = Number(v); });
@@ -146,14 +144,8 @@ function _resolveReason(reason, isDelta) {
   return codeNum;
 }
 
-function _issuerSkiOf(ctx) {
-  if (!ctx.issuerCert) return null;
-  var ski = (ctx.issuerCert.extensions || []).filter(function (e) { return e.oid === OID_SKI; })[0];
-  if (ski) { try { return asn1.read.octetString(asn1.decode(ski.value)); } catch (_e) { } }   // allow:swallow-unverified -- a malformed issuer SKI is read as absent; the authorityKeyIdentifier keyIdentifier is then derived from the issuer public key
-  return null;
-}
 function _akiKeyId(val, ctx) {
-  var issuerSki = _issuerSkiOf(ctx);
+  var issuerSki = ctx.issuerCert ? _b.skiValueOf(ctx.issuerCert) : null;
   if (guard.bytes.isByteSource(val)) {
     var given = guard.bytes.snapshotSource(val, CrlError, "crl/bad-input", "the authorityKeyIdentifier keyIdentifier");
     /** @internal Sec. 5.2.1 names the CRL signer certificate's subject key identifier as the value,

package/lib/csr-sign.js

@@ -34,6 +34,7 @@ var KNOWN_SPEC_KEYS = Object.assign(Object.create(null), { subject: 1, subjectPu
  * them was accepted and dropped, so asking for PEM and misspelling the option returned DER and
  * reported nothing. */
 var KNOWN_SIGN_OPTS = Object.assign(Object.create(null), { digestAlgorithm: 1, pem: 1, pss: 1 });
+var KNOWN_KEY_WRAPPER_KEYS = Object.assign(Object.create(null), { key: 1 });
 var b = asn1.build;
 function _err(code, message, cause) { return new CsrError(code, message, cause); }
 function _signE(kind, message, cause) { return new CsrError("csr/" + kind, message, cause); }
@@ -109,7 +110,9 @@ function _sign(spec, key, opts) {
   if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("csr/bad-input", "the certification-request spec must be an object");
   guard.identifier.assertKnownKeys(spec, KNOWN_SPEC_KEYS, _err, "csr/bad-input", "unknown spec field ");
   guard.identifier.assertKnownKeys(opts, KNOWN_SIGN_OPTS, _err, "csr/bad-input", "pki.csr.sign has an unknown option ");
-  var signingKey = (key && typeof key === "object" && !Buffer.isBuffer(key) && !(key instanceof Uint8Array) && key.type == null && "key" in key) ? key.key : key;
+  var wrapped = key && typeof key === "object" && !Buffer.isBuffer(key) && !(key instanceof Uint8Array) && key.type == null && "key" in key;
+  if (wrapped) guard.identifier.assertKnownKeys(key, KNOWN_KEY_WRAPPER_KEYS, _err, "csr/bad-input", "unknown field in the { key } wrapper (a signing option belongs in the third argument): ");
+  var signingKey = wrapped ? key.key : key;
   if (signingKey == null) throw _err("csr/bad-input", "a signing key (the subject's private key) is required");
 
   var subjectSpki = _b.reqDer(spec.subjectPublicKey, "spec.subjectPublicKey (the SPKI DER of the requested key)");

package/lib/ct.js

@@ -255,12 +255,19 @@ function _u24Bytes(n) {
  *   var preimage = pki.ct.reconstructSignedData({ entryType: 0, leafCert: der }, sct);
  *   // hash `preimage` + verify against the log's public key at the verify layer
  */
+/** @internal The two log-entry arms read different fields, and a field belonging to the other arm
+ *  is refused the same way a misspelled one is: a value the arm never reads cannot be in the entry. */
+var _X509_ENTRY_KEYS = intrinsic.assign(intrinsic.create(null), { entryType: 1, leafCert: 1 });
+var _PRECERT_ENTRY_KEYS = intrinsic.assign(intrinsic.create(null), { entryType: 1, tbsCertificate: 1, issuerKeyHash: 1 });
 function reconstructSignedData(entry, sct) {
   entry = entry || {};
+  if (typeof entry !== "object") throw new CtError("ct/bad-input", "the log entry must be an object { entryType, ... } (RFC 6962 sec. 3.1)");
   var entryType = entry.entryType;
   if (entryType !== 0 && entryType !== 1) {
     throw new CtError("ct/bad-entry-type", "entryType must be x509_entry(0) or precert_entry(1), got " + guard.text.showValue(entryType) + " (RFC 6962 sec. 3.1)");
   }
+  guard.identifier.assertKnownKeys(entry, entryType === 0 ? _X509_ENTRY_KEYS : _PRECERT_ENTRY_KEYS, _ctErr, "ct/bad-input",
+    entryType === 0 ? "unknown x509_entry field (accepted: entryType, leafCert): " : "unknown precert_entry field (accepted: entryType, tbsCertificate, issuerKeyHash): ");
   if (!sct || typeof sct.timestamp !== "bigint" || sct.version !== 0) {
     throw new CtError("ct/bad-input", "reconstructSignedData expects a decoded v1 SCT from parseSctList().scts[]");
   }
@@ -522,8 +529,10 @@ function _logKeyMaterial(logKey) {
  *   var sct = await pki.ct.signSct({ entryType: 0, leafCert: der }, signerKeyPkcs8);
  *   var ext = pki.ct.encodeSctList([sct]);
  */
+var _SIGN_SCT_OPTS = intrinsic.assign(intrinsic.create(null), { timestamp: 1, extensions: 1, logId: 1 });
 async function signSct(entry, logKey, opts) {
-  opts = opts || {};
+  opts = guard.identifier.optionsObject(opts, _ctErr, "ct/bad-input", "pki.ct.signSct options");
+  guard.identifier.assertKnownKeys(opts, _SIGN_SCT_OPTS, _ctErr, "ct/bad-input", "unknown pki.ct.signSct option (accepted: timestamp, extensions, logId): ");
   var mat = _logKeyMaterial(logKey);
   var alg = _spkiAlg(mat.spki);
   var hashAlg = 4, sigAlg, imp, sign, ecdsaDer = false, coordLen;

package/lib/guard-name.js

@@ -218,6 +218,15 @@ function _allCharsIn(s, table) {
 
 function stripTrailingDot(s) { return _charAt(s, s.length - 1) === "." ? _strSlice(s, 0, -1) : s; }
 
+/** @internal Whether `s` opens with `scheme` followed by a colon, the scheme compared without
+ * regard to ASCII case (RFC 3986 sec. 3.1). `scheme` is given in lower case. */
+// @enforced-by behavioral -- a scheme comparison has no rename-proof code shape; the vectors refusing a location under the wrong scheme are the guard
+function uriSchemeIs(s, scheme) {
+  if (typeof s !== "string" || s.length <= scheme.length) return false;
+  if (_charCodeAt(s, scheme.length) !== 0x3a) return false;
+  return lowerAscii(_strSlice(s, 0, scheme.length)) === scheme;
+}
+
 /** @internal A host name of two or more labels that is not an address, which is the form a URI
  * name constraint is compared by (RFC 5280 sec. 4.2.1.10). */
 function isFqdnHost(host) {
@@ -527,7 +536,7 @@ module.exports = intrinsic.freeze({
   assertNoControlBytes: assertNoControlBytes, assertPrintableIa5: assertPrintableIa5,
   dnEqual: dnEqual, rdnEqual: rdnEqual, emailEqual: emailEqual, dpnCorresponds: dpnCorresponds,
   escapeControlBytes: escapeControlBytes, escapeDnValue: escapeDnValue,
-  lowerAscii: lowerAscii,
+  lowerAscii: lowerAscii, uriSchemeIs: uriSchemeIs,
   stripTrailingDot: stripTrailingDot, isFqdnHost: isFqdnHost, splitMailbox: splitMailbox,
   constraintBaseRefusal: constraintBaseRefusal,
   constraintBaseUnreadable: constraintBaseUnreadable,

package/lib/lint.js

@@ -749,18 +749,6 @@ function _crlDecodedExtension(crl, name) {
   }
 }
 
-/** @internal Whether a string opens with the given URI scheme followed by a colon, compared
- * without regard to case by scanning character codes. */
-function _uriSchemeIs(s, scheme) {
-  if (typeof s !== "string" || s.length <= scheme.length) return false;
-  for (var i = 0; i < scheme.length; i++) {
-    var c = s.charCodeAt(i);
-    if (c >= 65 && c <= 90) c += 32;
-    if (c !== scheme.charCodeAt(i)) return false;
-  }
-  return s.charCodeAt(scheme.length) === 58;
-}
-
 /** @internal The schemes that satisfy the section 5.2.7 recommendation. The secured forms count:
  * warning about an https or ldaps location would report the more protected spelling of the two the
  * clause names. */
@@ -1201,7 +1189,7 @@ var RFC5280_CRL_RULES = [
       var reachable = descs.some(function (d) {
         var loc = d.accessLocation;
         if (!loc || loc.tag !== 6) return false;
-        return AIA_RECOMMENDED_SCHEMES.some(function (s) { return _uriSchemeIs(loc.value, s); });
+        return AIA_RECOMMENDED_SCHEMES.some(function (s) { return guard.name.uriSchemeIs(loc.value, s); });
       });
       return reachable ? null : true;
     },

package/lib/ocsp.js

@@ -84,11 +84,15 @@ function _toDer(input, what) {
 }
 function _keyValue(spkiDer) { return ocspVerify.ocspKeyValue(spkiDer); }
 function _nonceExt(nonceBytes) { return b.sequence([b.oid(OID_OCSP_NONCE), b.octetString(b.octetString(nonceBytes))]); }
-function _assertNonce(nonceBytes) {
-  if (!Buffer.isBuffer(nonceBytes) || nonceBytes.length < 1 || nonceBytes.length > 128) {
-    throw _err("ocsp/bad-input", "a nonce must be a Buffer of 1..128 octets (RFC 9654 sec. 2.1)");
+/** @internal RFC 9654 sec. 2.1 bounds a nonce at 1..128 octets, and adds for the requester: "An OCSP
+ *  requester that implements the extension in this document MUST use a minimum length of 32
+ *  octets". A responder echoes what it was sent, so its floor stays at the section's 1. */
+function _assertNonce(nonceBytes, floor) {
+  if (!Buffer.isBuffer(nonceBytes) || nonceBytes.length < floor || nonceBytes.length > 128) {
+    throw _err("ocsp/bad-input", "a nonce must be a Buffer of " + floor + "..128 octets (RFC 9654 sec. 2.1)");
   }
 }
+var REQUESTER_NONCE_FLOOR = 32, RESPONDER_NONCE_FLOOR = 1;
 function _buildCertID(cert, issuer, hashName) {
   var wc = HASH_WC[guard.text.keyOf(hashName)];
   if (!wc) throw _err("ocsp/bad-input", "unsupported CertID hashAlgorithm " + guard.text.showValue(hashName) + " (sha1 / sha256 / sha384 / sha512)");
@@ -122,9 +126,12 @@ function _buildCertID(cert, issuer, hashName) {
  *
  * @opts
  *   hashAlgorithm  `"sha1"` (default) / `"sha256"` / `"sha384"` / `"sha512"`; the CertID identity hash.
- *   nonce          `true` for a fresh 32-octet CSPRNG nonce (RFC 9654), or a caller Buffer (1..128 octets).
- *   requestorName  a Name (RDN array) placed in the [1] requestorName as a directoryName.
- *   signer         `{ cert, key }` to sign the request (requires requestorName).
+ *   nonce          `true` for a fresh 32-octet CSPRNG nonce (RFC 9654), or a caller Buffer of 32..128
+ *                  octets (RFC 9654 sec. 2.1: a requester MUST use at least 32).
+ *   requestorName  a Name (DER `BufferSource`, or a parsed Name) placed in the [1] requestorName as a
+ *                  directoryName. With `signer`, the signer certificate's subject is taken when none
+ *                  is stated (RFC 6960 sec. 4.1.2: a requestor that signs SHALL specify its name).
+ *   signer         `{ cert, key }` to sign the request.
  *   profile        `"lightweight"`: one Request, SHA-1 CertID, nonce-only extensions (RFC 5019).
  *   pem            emit a PEM `OCSP REQUEST` string instead of DER.
  * @example
@@ -148,6 +155,8 @@ function buildRequest(query, opts) {
 var _BUILD_REQUEST_OPTS = Object.assign(Object.create(null), {
   hashAlgorithm: 1, nonce: 1, pem: 1, profile: 1, requestorName: 1, signer: 1
 });
+var _QUERY_KEYS = Object.assign(Object.create(null), { cert: 1, issuer: 1, singleRequestExtensions: 1 });
+var _REQUEST_SIGNER_KEYS = Object.assign(Object.create(null), { cert: 1, key: 1 });
 
 function _buildRequest(query, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "ocsp/bad-input", "pki.ocsp.buildRequest options");
@@ -159,10 +168,27 @@ function _buildRequest(query, opts) {
   var queries = Array.isArray(query) ? pkiBuild.reqDenseArray(query, "queries", _err, "ocsp/bad-input") : [query];
   if (!queries.length) throw _err("ocsp/bad-input", "buildRequest needs at least one { cert, issuer } query");
   if (lightweight && queries.length !== 1) throw _err("ocsp/bad-input", "the lightweight profile permits exactly one Request (RFC 5019 sec. 2.1.1)");
-  if (opts.signer && !opts.requestorName) throw _err("ocsp/bad-input", "a signed OCSP request MUST carry requestorName (RFC 6960 sec. 4.1.2)");
+  var signerCertDer = null, signerCert = null;
+  if (opts.signer) {
+    guard.identifier.assertKnownKeys(opts.signer, _REQUEST_SIGNER_KEYS, _err, "ocsp/bad-input", "unknown request signer field (the signer is { cert, key }): ");
+    signerCertDer = _normCertDer(opts.signer.cert, "the request signer certificate");
+    signerCert = _certOf(signerCertDer, "the request signer certificate");
+  }
+  /** @internal Sec. 4.1.2: "If the request is signed, the requestor SHALL specify its name in the
+   *  requestorName field." The signer certificate names the requestor, so its subject is the name
+   *  when none is stated. A certificate with an empty subject names its holder in a critical
+   *  subjectAltName (RFC 5280 sec. 4.1.2.6); an empty Name names nobody, so it is not derived. */
+  var requestorNameDer = null;
+  if (opts.requestorName != null) requestorNameDer = _nameDer(opts.requestorName);
+  else if (signerCert !== null) {
+    if (!signerCert.subject.rdns.length) throw _err("ocsp/bad-input", "the request signer certificate has an empty subject, so no requestorName can be taken from it; state requestorName (RFC 6960 sec. 4.1.2)");
+    requestorNameDer = signerCert.subject.bytes;
+  }
 
   return Promise.all(queries.map(function (q) {
-    if (!q || q.cert == null || q.issuer == null) throw _err("ocsp/bad-input", "each query must be { cert, issuer }");
+    if (!q || typeof q !== "object") throw _err("ocsp/bad-input", "each query must be { cert, issuer }");
+    guard.identifier.assertKnownKeys(q, _QUERY_KEYS, _err, "ocsp/bad-input", "unknown query field (a query is { cert, issuer, singleRequestExtensions? }): ");
+    if (q.cert == null || q.issuer == null) throw _err("ocsp/bad-input", "each query must be { cert, issuer }");
     var cert = _certOf(q.cert, "the query certificate");
     var issuer = _certOf(q.issuer, "the issuer certificate");
     return _buildCertID(cert, issuer, hashName).then(function (certID) {
@@ -175,22 +201,17 @@ function _buildRequest(query, opts) {
     });
   })).then(function (requests) {
     var tbsChildren = [];
-    if (opts.requestorName) {
-      var nameDer = _nameDer(opts.requestorName);
-      tbsChildren.push(b.explicit(1, b.contextConstructed(4, nameDer)));
-    }
+    if (requestorNameDer !== null) tbsChildren.push(b.explicit(1, b.contextConstructed(4, requestorNameDer)));
     tbsChildren.push(b.sequence(requests));
     var reqExts = [];
     if (opts.nonce) {
       var nonceBytes = opts.nonce === true ? nodeCrypto.randomBytes(32) : opts.nonce;
-      _assertNonce(nonceBytes);
+      _assertNonce(nonceBytes, REQUESTER_NONCE_FLOOR);
       reqExts.push(_nonceExt(nonceBytes));
     }
     if (reqExts.length) tbsChildren.push(b.explicit(2, b.sequence(reqExts)));
     var tbsRequest = b.sequence(tbsChildren);
-    if (!opts.signer) return _emitReq(b.sequence([tbsRequest]), opts);
-    var signerCertDer = _normCertDer(opts.signer.cert, "the request signer certificate");
-    var signerCert = _certOf(signerCertDer, "the request signer certificate");
+    if (signerCert === null) return _emitReq(b.sequence([tbsRequest]), opts);
     var scheme = signScheme.resolveSignScheme(signerCert, { combinedRsaSig: true }, true, _signE);
     return signScheme.signOverTbs(scheme, opts.signer.key, tbsRequest, _signE).then(function (sig) {
       var optionalSignature = b.sequence([scheme.sigAlgId, b.bitString(sig, 0), b.explicit(0, b.sequence([b.raw(signerCertDer)]))]);
@@ -275,13 +296,21 @@ function sign(responseData, responder, opts) {
 }
 
 var _SIGN_OPTS = Object.assign(Object.create(null), { embedCert: 1, extendedRevoke: 1, nonce: 1, pem: 1 });
+var _RESPONSE_DATA_KEYS = Object.assign(Object.create(null), { responderID: 1, responses: 1, producedAt: 1 });
+var _SINGLE_RESPONSE_KEYS = Object.assign(Object.create(null), { cert: 1, issuer: 1, certID: 1, hashAlgorithm: 1, status: 1, thisUpdate: 1, nextUpdate: 1, singleExtensions: 1 });
+var _RESPONDER_KEYS = Object.assign(Object.create(null), { cert: 1, key: 1 });
+var _STATUS_KEYS = Object.assign(Object.create(null), { revoked: 1, revocationReason: 1 });
 
 function _sign(responseData, responder, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "ocsp/bad-input", "pki.ocsp.sign options");
   guard.identifier.assertKnownKeys(opts, _SIGN_OPTS, _err, "ocsp/bad-input",
     "pki.ocsp.sign has an unknown option (the nonce to echo back is `nonce`): ");
   responseData = responseData || {};
-  if (!responder || responder.cert == null || responder.key == null) throw _err("ocsp/bad-input", "a responder must be { cert, key }");
+  if (typeof responseData !== "object") throw _err("ocsp/bad-input", "the responseData must be an object { responderID, responses, producedAt? }");
+  guard.identifier.assertKnownKeys(responseData, _RESPONSE_DATA_KEYS, _err, "ocsp/bad-input", "unknown responseData field (accepted: responderID, responses, producedAt): ");
+  if (!responder || typeof responder !== "object") throw _err("ocsp/bad-input", "a responder must be { cert, key }");
+  guard.identifier.assertKnownKeys(responder, _RESPONDER_KEYS, _err, "ocsp/bad-input", "unknown responder field (the responder is { cert, key }; a signing option belongs in the third argument): ");
+  if (responder.cert == null || responder.key == null) throw _err("ocsp/bad-input", "a responder must be { cert, key }");
   var respCertDer = _normCertDer(responder.cert, "the responder certificate");
   var respCert = _certOf(respCertDer, "the responder certificate");
   var ownedKeyBytes = [];
@@ -314,7 +343,7 @@ function _signResponse(responseData, responder, respCert, respCertDer, responder
       }
       var rdChildren = [ridNode, b.generalizedTime(_asEncodableDate(responseData.producedAt, "producedAt") || new Date()), b.sequence(srNodes)];
       var respExts = [];
-      if (opts.nonce != null) { _assertNonce(opts.nonce); respExts.push(_nonceExt(opts.nonce)); }
+      if (opts.nonce != null) { _assertNonce(opts.nonce, RESPONDER_NONCE_FLOOR); respExts.push(_nonceExt(opts.nonce)); }
       if (opts.extendedRevoke || anyNonIssued) respExts.push(b.sequence([b.oid(OID_EXTENDED_REVOKE), b.octetString(b.nullValue())]));
       if (respExts.length) rdChildren.push(b.explicit(1, b.sequence(respExts)));
       var responseDataDer = b.sequence(rdChildren);
@@ -362,6 +391,9 @@ function _responderID(rid, respCert) {
 function _buildSingleResponse(r, opts) {
   r = r || {};
   var certIdP;
+  if (typeof r !== "object") return Promise.reject(_err("ocsp/bad-input", "each response entry must be an object"));
+  try { guard.identifier.assertKnownKeys(r, _SINGLE_RESPONSE_KEYS, _err, "ocsp/bad-input", "unknown response entry field (accepted: cert, issuer, certID, hashAlgorithm, status, thisUpdate, nextUpdate, singleExtensions): "); }
+  catch (e) { return Promise.reject(e); }
   if (r.certID != null) certIdP = Promise.resolve(b.raw(guard.bytes.view(r.certID, OcspError, "ocsp/bad-input", "a response entry's certID")));
   else if (r.cert != null && r.issuer != null) certIdP = _buildCertID(_certOf(r.cert, "a response certificate"), _certOf(r.issuer, "a response issuer"), r.hashAlgorithm || "sha1");
   else return Promise.reject(_err("ocsp/bad-input", "each response entry needs { certID } or { cert, issuer }"));
@@ -505,6 +537,7 @@ function _certStatusNode(status, opts) {
   if (status == null || status === "good") return b.contextPrimitive(0, Buffer.alloc(0));
   if (status === "unknown") return b.contextPrimitive(2, Buffer.alloc(0));
   if (typeof status === "object" && status.revoked != null) {
+    guard.identifier.assertKnownKeys(status, _STATUS_KEYS, _err, "ocsp/bad-input", "unknown revoked status field (a revoked status is { revoked, revocationReason? }): ");
     var ri = [b.generalizedTime(_asEncodableDate(status.revoked, "the revocation time"))];
     if (status.revocationReason != null) {
       var code = typeof status.revocationReason === "number" ? status.revocationReason : REASON_CODE[guard.text.keyOf(status.revocationReason)];
@@ -638,8 +671,8 @@ function _requestFromBytes(request) {
 }
 function _reqVerdict(parsed, extra) {
   return guard.verdict.of({
-    valid: extra.signed === true && extra.signatureValid === true,
-    signed: extra.signed, signatureValid: extra.signatureValid,
+    valid: extra.signed === true && extra.signatureValid === true && extra.requestorNamed === true,
+    signed: extra.signed, signatureValid: extra.signatureValid, requestorNamed: extra.requestorNamed === true,
     signerCert: extra.signerCert != null ? extra.signerCert : null,
     signerCerts: extra.signerCerts != null ? extra.signerCerts : [],
     certs: extra.certs != null ? extra.certs : [],
@@ -664,18 +697,44 @@ async function _findRequestSigners(candidates, strict, parsed, sig, sigBits) {
   }
   return { matches: matches, parseable: parseable };
 }
+/** @internal RFC 6960 sec. 4.1.2: "If the request is signed, the requestor SHALL specify its name
+ *  in the requestorName field." The requestor is whoever holds the key that signed, so the name is
+ *  held to the subject of a certificate that verified the signature, compared as a distinguished
+ *  name (RFC 5280 sec. 7.1). The parser refuses a signed request that names nobody
+ *  (ocsp/missing-requestor-name); one naming its requestor by a GeneralName form other than
+ *  directoryName leaves the check unperformed and never a pass. */
+function _requestorNamed(parsed, matches) {
+  var rn = parsed.requestorName;
+  if (rn.tagNumber !== 4) {
+    return { named: [], reason: "the signed OCSP request names its requestor by a GeneralName form [" + rn.tagNumber + "] this responder does not compare to a certificate subject; a directoryName is compared (RFC 6960 sec. 4.1.2)" };
+  }
+  if (!rn.value.rdns.length) return { named: [], reason: "the signed OCSP request's requestorName is an empty distinguished name, which names nobody (RFC 6960 sec. 4.1.2)" };
+  var named = [];
+  for (var i = 0; i < matches.length; i++) {
+    if (guard.name.dnEqual(matches[i].subject.rdns, rn.value.rdns, _err, "ocsp/bad-input", "the requestorName")) named.push(matches[i]);
+  }
+  if (named.length) return { named: named, reason: null };
+  return { named: [], reason: "the requestorName " + guard.text.showValue(rn.value.dn) + " is not the subject of a certificate that signed the request (RFC 6960 sec. 4.1.2)" };
+}
+/** @internal Several certificates can carry the signing key (a renewal beside the certificate it
+ *  replaced), and one of them may carry another subject. The signer the verdict names, and the set
+ *  the responder builds its trusted path from, are the certificates that both verified the signature
+ *  AND carry the name the request states; a same-key certificate under another name is not the
+ *  requestor, whatever order the request embeds them in. */
 function _signerVerdict(parsed, found, failReason) {
   if (!found.matches.length) return _reqVerdict(parsed, { signed: true, signatureValid: false, certs: found.parseable, reason: failReason });
+  var bound = _requestorNamed(parsed, found.matches);
+  var signers = bound.named.length ? bound.named : found.matches;
   return _reqVerdict(parsed, {
-    signed: true, signatureValid: true, signerCert: found.matches[0].der,
-    signerCerts: found.matches.map(function (m) { return m.der; }), certs: found.parseable,
-    signerSubject: { dn: found.matches[0].subject.dn, rdns: found.matches[0].subject.rdns }, reason: null,
+    signed: true, signatureValid: true, requestorNamed: bound.reason === null, signerCert: signers[0].der,
+    signerCerts: signers.map(function (m) { return m.der; }), certs: found.parseable,
+    signerSubject: { dn: signers[0].subject.dn, rdns: signers[0].subject.rdns }, reason: bound.reason,
   });
 }
 
 /**
  * @primitive  pki.ocsp.verifyRequest
- * @signature  pki.ocsp.verifyRequest(request, opts?) -> Promise<{ valid, signed, signatureValid, signerCert, signerCerts, certs, signerSubject, requestorName, requestList, requestExtensions, version, reason }>
+ * @signature  pki.ocsp.verifyRequest(request, opts?) -> Promise<{ valid, signed, signatureValid, requestorNamed, signerCert, signerCerts, certs, signerSubject, requestorName, requestList, requestExtensions, version, reason }>
  * @since      0.6.0
  * @status     stable
  * @spec       RFC 6960
@@ -692,18 +751,24 @@ function _signerVerdict(parsed, found, failReason) {
  *
  * `signatureValid` means only that a certificate's key made this signature over this request. It
  * says nothing about whether that certificate is trusted: `signerCerts` is every certificate the
- * request carries whose key verified the signature (RFC 6960 sec. 4.1.1 certs is unordered, and a
- * key may appear under an expired certificate beside its renewal), so the responder builds a trusted
- * path to one of them rather than depend on ordering. `signerCert` and the decoded `signerSubject`
- * are the first of those, the common single-signer case. `certs` is every parseable certificate the
+ * request carries whose key verified the signature AND whose subject is the `requestorName` the
+ * request states (RFC 6960 sec. 4.1.1 certs is unordered, and a key may appear under an expired
+ * certificate beside its renewal; a same-key certificate under another name is not the requestor),
+ * so the responder builds a trusted path to one of them rather than depend on ordering. `signerCert`
+ * and the decoded `signerSubject` are the first of those, the common single-signer case; when no
+ * verifying certificate carries the name, they fall back to the verifying ones and `valid` is
+ * false. `certs` is every parseable certificate the
  * request carried (or opts.certs supplied), including intermediates that do not sign and so are absent
  * from `signerCerts`: the responder passes it as the `opts.candidates` pool to `pki.path.build`, which
  * discovers and validates the ordered path from a `signerCerts` entry (leaf) up to a trust anchor.
  * The responder then confirms that certificate is authorized to sign the request: its `keyUsage`,
  * where present, must assert `digitalSignature` (RFC 5280 sec. 4.2.1.3, since the certificate signed
- * the request). It also compares the certificate's subject to the `requestorName` it expects. The decoded
- * `requestList`, `requestExtensions` and `version` are
- * returned so the CertIDs being asked about need no re-parse.
+ * the request). The `requestorName` a signed request carries (RFC 6960 sec. 4.1.2: a requestor that
+ * signs SHALL specify its name) is held to the subject of a certificate that verified the signature,
+ * compared as a distinguished name (RFC 5280 sec. 7.1): `requestorNamed` is true when it is, `valid`
+ * requires it, and a name given as a GeneralName form other than directoryName is not compared and
+ * never passes. The decoded `requestorName` (with its `value` for a directoryName), `requestList`,
+ * `requestExtensions` and `version` are returned so the CertIDs being asked about need no re-parse.
  *
  * @opts
  *   - `certs`  An array of certificates (DER `Buffer` / `Uint8Array` or PEM strings) supplying the

package/lib/pki-build.js

@@ -28,6 +28,7 @@ var _isBufferChk = intrinsic.isBuffer;
 var _stringify = intrinsic.stringify;
 var _mapIntrinsic = intrinsic.map;
 var _bufferConcatIntrinsic = intrinsic.bufferConcat;
+var OID_SKI = oid.byName("subjectKeyIdentifier");
 
 function _isAlphaCode(c) { return (c >= 65 && c <= 90) || (c >= 97 && c <= 122); }
 function _isDigitCode(c) { return c >= 48 && c <= 57; }
@@ -81,14 +82,14 @@ function _componentBytesOk(s, from, to, byteOk) {
   return true;
 }
 
-function _validUriHost(s, from, to) {
+function _validUriHost(s, from, to, singleLabel) {
   if (to <= from) return false;
   var host = _sliceStr(s, from, to), len = host.length;
   if (_looksLikeIPv4Shape(host)) return _packIpLiteral(host) !== null;
   var end = _charCodeAt(host, len - 1) === 46 ? len - 1 : len;
   if (end > 253) return false;
   var firstDot = _stringIndexOf(host, ".", 0);
-  if (firstDot === -1 || firstDot >= end) return false;
+  if (!singleLabel && (firstDot === -1 || firstDot >= end)) return false;
   return _labelsValid(host, 0, len, _isHostLabelRange, true);
 }
 
@@ -98,11 +99,11 @@ function _validUriIp6Host(s, from, to) {
   return packed !== null && intrinsic.sizeOf(packed) === 16;
 }
 
-function _validUriAuthority(s, from, to) {
+function _validUriAuthority(s, from, to, shape) {
   var i, c, at = -1;
   for (i = from; i < to; i += 1) {
     c = _charCodeAt(s, i);
-    if (c === 64) { if (at !== -1) return false; at = i; }
+    if (c === 64) { if (at !== -1 || !shape.userinfo) return false; at = i; }
   }
   var hostStart = at === -1 ? from : at + 1;
   if (at !== -1 && !_componentBytesOk(s, from, at, _isUserinfoByte)) return false;
@@ -120,14 +121,31 @@ function _validUriAuthority(s, from, to) {
   var colon = -1;
   for (i = hostStart; i < to; i += 1) { if (_charCodeAt(s, i) === 58) { colon = i; break; } }
   var hostEnd = colon === -1 ? to : colon;
-  if (!_validUriHost(s, hostStart, hostEnd)) return false;
+  var portAlone = hostEnd === hostStart && colon !== -1 && shape.emptyHost;
+  if (!portAlone && !_validUriHost(s, hostStart, hostEnd, shape.singleLabel)) return false;
   if (colon !== -1) {
     for (i = colon + 1; i < to; i += 1) { if (!_isDigitCode(_charCodeAt(s, i))) return false; }
   }
   return true;
 }
 
-function _looksLikeUri(s) {
+/** @internal The shape a bare string must have to be read as a URI GeneralName without being told:
+ *  a scheme, "//", an authority naming a multi-label host (a single label reads as a dNSName), and
+ *  a well-formed remainder, a fragment included. */
+var _URI_SHAPE = intrinsic.assign(intrinsic.create(null), { singleLabel: false, userinfo: true, emptyAuthority: false, emptyHost: false, queryNeedsPath: false, fragment: true });
+/** @internal An HTTP URL (RFC 2616 sec. 3.2.2: "http:" "//" host [ ":" port ] [ abs_path [ "?" query ]]):
+ *  no userinfo, a host of one label or many, a query only after an absolute path, no fragment. */
+var _HTTP_URL_SHAPE = intrinsic.assign(intrinsic.create(null), { singleLabel: true, userinfo: false, emptyAuthority: false, emptyHost: false, queryNeedsPath: true, fragment: false });
+/** @internal An LDAP URL (RFC 4516 sec. 2: scheme "://" [host [":" port]] ["/" dn ...]): no
+ *  userinfo, a host of any label count that may be left out, with or without a port, and no
+ *  fragment. The dn, attributes, scope and filter after the "/" are not parsed. */
+var _LDAP_URL_SHAPE = intrinsic.assign(intrinsic.create(null), { singleLabel: true, userinfo: false, emptyAuthority: true, emptyHost: true, queryNeedsPath: false, fragment: false });
+
+function _looksLikeUri(s) { return _uriShape(s, _URI_SHAPE); }
+function isHttpUrl(s) { return typeof s === "string" && guard.name.uriSchemeIs(s, "http") && _uriShape(s, _HTTP_URL_SHAPE); }
+function isLdapUrl(s) { return typeof s === "string" && guard.name.uriSchemeIs(s, "ldap") && _uriShape(s, _LDAP_URL_SHAPE); }
+
+function _uriShape(s, shape) {
   var n = s.length, i, c;
   if (n === 0 || !_isAlphaCode(_charCodeAt(s, 0))) return false;
   i = 1;
@@ -140,8 +158,9 @@ function _looksLikeUri(s) {
   i += 3;
   var authStart = i, authEnd = n;
   for (; i < n; i += 1) { c = _charCodeAt(s, i); if (c === 47 || c === 63 || c === 35) { authEnd = i; break; } }
-  if (authEnd === authStart) return false;
-  if (!_validUriAuthority(s, authStart, authEnd)) return false;
+  if (authEnd === authStart) { if (!shape.emptyAuthority) return false; }
+  else if (!_validUriAuthority(s, authStart, authEnd, shape)) return false;
+  if (authEnd < n && shape.queryNeedsPath && _charCodeAt(s, authEnd) === 63) return false;
   var sawHash = false;
   i = authEnd;
   while (i < n) {
@@ -151,7 +170,7 @@ function _looksLikeUri(s) {
       i += 3;
       continue;
     }
-    if (c === 35) { if (sawHash) return false; sawHash = true; }
+    if (c === 35) { if (sawHash || !shape.fragment) return false; sawHash = true; }
     if (!_isUriByte(c)) return false;
     i += 1;
   }
@@ -1268,7 +1287,7 @@ function makeBuilder(ctx) {
     extSubjectInfoAccess: extSubjectInfoAccess, extSubjectDirectoryAttributes: extSubjectDirectoryAttributes,
     extMsCertificateTemplate: extMsCertificateTemplate, extMsCaVersion: extMsCaVersion,
     extMsPreviousCertHash: extMsPreviousCertHash, extMsEnrollCertType: extMsEnrollCertType,
-    spkiKeyId: spkiKeyId, skiKeyId: skiKeyId,
+    spkiKeyId: spkiKeyId, skiKeyId: skiKeyId, skiValueOf: skiValueOf,
     reqDer: reqDer, reqDenseArray: reqDenseArray, reqDerSequence: reqDerSequence, assertValidSpki: assertValidSpki, assertValidExtension: assertValidExtension,
     assertExtnValueIsDer: assertExtnValueIsDer,
     assertCertCriticality: assertCertCriticality,
@@ -1289,4 +1308,15 @@ function tbsSerialNumber(cert) {
   return asn1.read.integer(tbs.children[hasVersion ? 1 : 0]);
 }
 
-module.exports = intrinsic.freeze({ makeBuilder: makeBuilder, reqDenseArray: reqDenseArrayImpl, KU_BIT: KU_BIT, tbsNameField: tbsNameField, tbsSerialNumber: tbsSerialNumber, randomSerial: randomSerial });
+/** @internal The subjectKeyIdentifier a parsed certificate carries, or null without one. RFC 5280
+ *  sec. 4.2.1.1 names it as the authorityKeyIdentifier keyIdentifier of everything issued under
+ *  that certificate, so a signer reads it here before deriving one from the key, and a verifier
+ *  matches a signer by it. */
+function skiValueOf(parsedCert) {
+  var exts = intrinsic.filter(parsedCert.extensions, function (e) { return e.oid === OID_SKI; });
+  if (!exts.length) return null;
+  try { return asn1.read.octetString(asn1.decode(exts[0].value)); }
+  catch (_e) { return null; }   // allow:swallow-unverified -- a malformed SKI is read as absent; a signer then derives the authorityKeyIdentifier keyIdentifier from the public key, and a verifier matches on nothing
+}
+
+module.exports = intrinsic.freeze({ makeBuilder: makeBuilder, reqDenseArray: reqDenseArrayImpl, KU_BIT: KU_BIT, tbsNameField: tbsNameField, tbsSerialNumber: tbsSerialNumber, randomSerial: randomSerial, skiValueOf: skiValueOf, isHttpUrl: isHttpUrl, isLdapUrl: isLdapUrl });

package/lib/schema-attrcert.js

@@ -577,6 +577,13 @@ _AC_EXT_DECODERS[_Oav("targetInformation")] = _targetInformation;
 _AC_EXT_DECODERS[_Oav("noRevAvail")] = _noRevAvail;
 _AC_EXT_DECODERS[_Oav("aaControls")] = _aaControls;
 _AC_EXT_DECODERS[_Oav("acProxying")] = _acProxying;
+/** @internal The three RFC 5280 extensions RFC 5755 sec. 4.3.3 to 4.3.5 profile for an AC are read
+ *  through the certificate decoders, so a relying party running the sec. 6 "pointer in AC" scheme
+ *  reads the distribution point and the OCSP location off the parse rather than off raw bytes. */
+var _CERT_EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
+_AC_EXT_DECODERS[_Oav("authorityKeyIdentifier")] = _CERT_EXT_DECODERS[_Oav("authorityKeyIdentifier")];
+_AC_EXT_DECODERS[_Oav("authorityInfoAccess")] = _CERT_EXT_DECODERS[_Oav("authorityInfoAccess")];
+_AC_EXT_DECODERS[_Oav("cRLDistributionPoints")] = _CERT_EXT_DECODERS[_Oav("cRLDistributionPoints")];
 
 // @internal
 function validateAttributeValue(type, valueDer) {

package/lib/schema-ocsp.js

@@ -85,7 +85,9 @@ function certificateBytes() {
   return pkix.rawNonEmptySequence(NS, { code: "ocsp/bad-certs", message: "each certs element must be a non-empty Certificate SEQUENCE (RFC 6960 sec. 4.1.1/sec. 4.2.1)" });
 }
 
-var GENERAL_NAME_RAW = pkix.generalName(NS, { code: "ocsp/bad-requestor-name" });
+/** @internal The requestorName is read with its value decoded, so a responder compares a
+ *  directoryName to the signer certificate's subject (RFC 6960 sec. 4.1.2) off the parse. */
+var GENERAL_NAME_RAW = pkix.generalName(NS, { code: "ocsp/bad-requestor-name", decodeValue: true });
 
 function _rawSignature(field) {
   var sig = field.value;
@@ -388,7 +390,7 @@ var TBS_REQUEST = schema.seq([
     var rn = m.fields.requestorName;
     return {
       version: m.fields.version.value,
-      requestorName: rn.present ? { bytes: rn.value.bytes, tagClass: rn.value.tagClass, tagNumber: rn.value.tagNumber } : null,
+      requestorName: rn.present ? { bytes: rn.value.bytes, tagClass: rn.value.tagClass, tagNumber: rn.value.tagNumber, value: rn.value.value } : null,
       requestList: m.fields.requestList.value.items.map(function (it) { return it.value.result; }),
       requestExtensions: m.fields.requestExtensions.present ? _validateOcspExtensions(m.fields.requestExtensions.value.result) : null,
     };

package/lib/x509-sign.js

@@ -39,8 +39,6 @@ function _err(code, message, cause) { return new CertificateError(code, message,
 function _signE(kind, message, cause) { return new CertificateError("x509/" + kind, message, cause); }
 function O(n) { return oid.byName(n); }
 
-var OID_SKI = O("subjectKeyIdentifier");
-
 var KNOWN_SPEC_KEYS = intrinsic.assign(intrinsic.create(null), {
   subject: 1, subjectPublicKey: 1, notBefore: 1, notAfter: 1, serialNumber: 1, extensions: 1,
 });
@@ -77,13 +75,8 @@ var _encodeName = _b.encodeName, _isEmptyName = _b.isEmptyName, _reqDer = _b.req
   _skiKeyId = _b.skiKeyId, _spkiKeyId = _b.spkiKeyId, _serialInteger = _b.serialInteger;
 
 
-function _skiValueOf(caCert) {
-  var ext = (caCert.extensions || []).filter(function (e) { return e.oid === OID_SKI; })[0];
-  if (ext) { try { return asn1.read.octetString(asn1.decode(ext.value)); } catch (_e) { } }   // allow:swallow-unverified -- a malformed CA SKI is read as absent; _akiKeyId then derives the authorityKeyIdentifier keyIdentifier from the issuer public key
-  return null;
-}
 function _akiKeyId(val, ctx) {
-  var issuerSki = ctx.issuerCert ? _skiValueOf(ctx.issuerCert) : null;
+  var issuerSki = ctx.issuerCert ? _b.skiValueOf(ctx.issuerCert) : null;
   if (guard.bytes.isByteSource(val)) {
     var given = guard.bytes.snapshotSource(val, CertificateError, "x509/bad-input", "the authorityKeyIdentifier keyIdentifier");
     /** @internal Sec. 4.2.1.2: the issuer certificate's subjectKeyIdentifier MUST be the value

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.7.35",
+  "version": "0.7.37",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:ad5ed621-8770-42d9-80be-736cc92092a0",
+  "serialNumber": "urn:uuid:6602edcd-778a-4204-8e53-1bc40ccb396c",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-12T11:00:49.561Z",
+    "timestamp": "2026-09-12T13:27:30.472Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.7.35",
+      "bom-ref": "@blamejs/pki@0.7.37",
       "type": "application",
       "name": "pki",
-      "version": "0.7.35",
+      "version": "0.7.37",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.7.35",
+      "purl": "pkg:npm/%40blamejs/pki@0.7.37",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.7.35",
+      "ref": "@blamejs/pki@0.7.37",
       "dependsOn": []
     }
   ]