@blamejs/pki 0.7.40 → 0.7.41

package/CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.7.41 — 2026-09-12
+
+A delivered or archived private key is proven the private half of its certificate with the key itself.
+
+### Fixed
+
+- pki.est.serverkeygen proves a cleartext server-generated private key is the private half of the returned certificate it binds it to (a signature, an agreement, or an encapsulation the key completes), and refuses with est/key-cert-mismatch a key whose stated public half matches the certificate while its private material cannot use it. The selection of the certificate by public-key match and the ambiguity refusal are unchanged, and a finite-field Diffie-Hellman key, whose private structure carries the exponent alone, is still bound by the value it derives, at any width the runtime reads.
+- pki.crmf.build proves the key enclosed in an encryptedKey proof of possession is the private half of certTemplate.publicKey with the key itself, and refuses with crmf/bad-popo an RSA, EC, EdDSA, ML-DSA, ML-KEM or composite key that only states the template's public components; a key the toolkit cannot read stays crmf/bad-input. A finite-field Diffie-Hellman key, whose private structure carries the exponent alone, keeps the derived comparison at any width, so the archival path still accepts a key wider than any group the toolkit agrees over.
+
 ## v0.7.40 — 2026-09-12
 
 A PKCS#12 store links a certificate only to its own key.

package/lib/crmf-sign.js

@@ -836,7 +836,38 @@ function _buildEncryptedKeyPop(pop, outerTag, template) {
   }
 }
 
+async function _assertEnclosedKeyCorresponds(privateKeyDer, templateSpki) {
+  var pair;
+  try {
+    pair = await key.correspondsTo(privateKeyDer, templateSpki);
+  } catch (e) {
+    if (e instanceof CrmfError) throw e;
+    /** @internal A key the key module cannot read at all is bad input; one it reads and cannot
+     * exercise together with the template's key proves possession of nothing, which is the proof
+     * failing, not the input. */
+    if (e && e.isPkiError === true && e.code === "key/bad-input") {
+      throw _err("crmf/bad-input", "pop.privateKey could not be read as a private key to check against " +
+        "certTemplate.publicKey: " + (e.message || e), e);
+    }
+    throw _err("crmf/bad-popo", "the private key enclosed in the encryptedKey proof of possession could not be " +
+      "exercised with certTemplate.publicKey, so it cannot be shown to be that key's private half (RFC 4211 sec. 4.2)", e);
+  }
+  if (pair !== true) {
+    throw _err("crmf/bad-popo", "the private key enclosed in the encryptedKey proof of possession is not the " +
+      "private half of certTemplate.publicKey, so it proves possession of a key this request does not ask to " +
+      "have certified (RFC 4211 sec. 4.2)");
+  }
+}
+
 function _assertEnclosedKeyMatches(privateKeyDer, templateSpki) {
+  /** @internal Which proof the enclosed key takes depends on what its structure can carry. A
+   * finite-field PrivateKeyInfo carries the exponent alone, so the public value derived from it IS
+   * the proof, and this arm keeps that derivation at any width, with the cheap tests below. Every
+   * other family's private structure carries public components of its own (RFC 5958 sec. 2,
+   * RFC 5915, PKCS #1), which a caller could set to the template's beside private material that
+   * cannot use it, so those are proven by USING the key against the template. */
+  var enclosedAlg = key.algorithmOidAt(privateKeyDer, 1);
+  if (enclosedAlg !== null && !key.isDhOid(enclosedAlg)) return _assertEnclosedKeyCorresponds(privateKeyDer, templateSpki);
   return Promise.resolve()
     .then(function () { return key.publicFromPrivate(privateKeyDer); })
     .then(function (derivedSpki) {
@@ -991,7 +1022,9 @@ function _buildProofOfPossession(pop, certReqDer, template, signingKey, opts) {
  *   intended, so it takes `pop.archive: true`; `pop.privateKey` is the PKCS#8 DER, `pop.recipients` the CMS
  *   recipients to envelope it to, and `pop.identifier` (a string or GeneralName) is required, because
  *   sec. 4.2.1 makes it mandatory whenever the purpose is proving possession: without it a decrypting
- *   agent cannot tell whose key it holds. `pop.contentEncryptionAlgorithm` defaults to `aes-256-cbc`; an
+ *   agent cannot tell whose key it holds. The enclosed key is proven the private half of
+ *   `certTemplate.publicKey` with the key itself (`crmf/bad-popo` when it is not), not by the public
+ *   components its structure states. `pop.contentEncryptionAlgorithm` defaults to `aes-256-cbc`; an
  *   AEAD algorithm is refused, since it would produce an `AuthEnvelopedData` this field cannot carry.
  * - `agreeMAC`, which agrees a secret with the authority and MACs the request under a key derived from it,
  *   so nothing is signed (RFC 4211 sec. 4.3, RFC 2875 sec. 3). `pop.key` is the requester's finite-field

package/lib/est.js

@@ -1742,6 +1742,18 @@ async function _serverkeygenResult(res, opts, derived) {
     var bound = findIssuedCert(out.certificates, spki);
     if (!bound) throw E("est/key-cert-mismatch", "the cleartext server-generated private key matches no returned certificate's public key (RFC 7030 sec. 4.4.2)");
     if (findIssuedCert(out.certificates.filter(function (c) { return c !== bound; }), spki)) throw E("est/ambiguous-issued-cert", "more than one returned certificate carries the server-generated key; the issued certificate is ambiguous (RFC 7030 sec. 4.4.2)");
+    /** @internal The public half the key states selected the certificate; the pair is then proven
+     * with the PRIVATE half, since a private structure states public components of its own that a
+     * server could set to the certificate's beside private material that cannot use it. A
+     * finite-field Diffie-Hellman PrivateKeyInfo carries the exponent alone, so the value derived
+     * from it above IS the proof, at any width the runtime reads. */
+    var keyAlg = key.algorithmOidAt(out.privateKeyDer, 1);
+    if (keyAlg === null || !key.isDhOid(keyAlg)) {
+      var pair;
+      try { pair = await key.correspondsTo(out.privateKeyDer, spki); }
+      catch (e2) { throw E("est/key-cert-mismatch", "the cleartext server-generated private key could not be exercised with the returned certificate's public key, so the two cannot be shown to be a pair (RFC 7030 sec. 4.4.2)", e2); }
+      if (pair !== true) throw E("est/key-cert-mismatch", "the cleartext server-generated private key is not the private half of the returned certificate's public key (RFC 7030 sec. 4.4.2)");
+    }
     delete out.privateKeyDer;
   }
   return out;
@@ -1765,7 +1777,9 @@ async function _serverkeygenResult(res, opts, derived) {
  * the key so the issued certificate's public key is the generated one, not the throwaway CSR key. A cleartext
  * key is bound to its certificate before it resolves: the delivered private key's public half MUST match
  * exactly one returned certificate (`est/key-cert-mismatch` on none, `est/ambiguous-issued-cert` on more than
- * one), so a mis-associated key is refused, never handed back unusable.
+ * one), and the key is then proven the private half of that certificate's public key with the key itself
+ * (`est/key-cert-mismatch` when it is not; a finite-field DH key, whose structure carries the exponent alone,
+ * is proven by the value it derives), so a mis-associated or unusable key is refused, never handed back.
  * The encryption requirement + expected recipient are derived from the CSR's own DecryptKeyIdentifier /
  * AsymmetricDecryptKeyIdentifier attribute; an `opts` value that contradicts the CSR is `est/bad-input`
  * (a cleartext-key downgrade cannot slip past). The delivered key's channel is asserted confidentiality-

package/lib/key.js

@@ -680,7 +680,22 @@ function _dhAsPkcs3(der, at, what) {
   if (!algNode.children || algNode.children.length !== 2) {
     throw _err("key/bad-input", what + " X9.42 AlgorithmIdentifier does not carry DomainParameters");
   }
-  var dom = x942Domain(algNode.children[1], KeyError, "key/bad-input", what);
+  /** @internal A field the codec refuses to read as the type the structure states is a malformed
+   * key, reported as one rather than as the codec's own complaint. */
+  var dom, y = null;
+  try {
+    dom = x942Domain(algNode.children[1], KeyError, "key/bad-input", what);
+    if (at === 0) {
+      var pub = asn1.read.bitString(node.children[1]);
+      if (!guard.crypto.isOctetAligned(pub)) {
+        throw _err("key/bad-input", what + " Diffie-Hellman public key BIT STRING must be octet-aligned (0 unused bits)");
+      }
+      y = asn1.read.integer(asn1.decode(pub.bytes));
+    }
+  } catch (e) {
+    if (e instanceof KeyError) throw e;
+    throw _err("key/bad-input", what + " X9.42 Diffie-Hellman key could not be read", e);
+  }
   assertDhOperandsWithin([dom.p, dom.g, dom.q, dom.j], KeyError, "key/bad-input", what);
   assertDhDomainCoherent(dom.p, dom.g, dom.q, dom.j, KeyError, "key/bad-input", what);
   assertDhGeneratorOrder(dom.p, dom.g, dom.q, KeyError, "key/bad-input", what);
@@ -689,11 +704,6 @@ function _dhAsPkcs3(der, at, what) {
   /** @internal The one field the X9.42 form states that the PKCS #3 form cannot be held to is the
    * subgroup, so a public value is held to it here, where q is still known. */
   if (at === 0) {
-    var pub = asn1.read.bitString(node.children[1]);
-    if (!guard.crypto.isOctetAligned(pub)) {
-      throw _err("key/bad-input", what + " Diffie-Hellman public key BIT STRING must be octet-aligned (0 unused bits)");
-    }
-    var y = asn1.read.integer(asn1.decode(pub.bytes));
     if (y <= 1n || y >= dom.p - 1n) {
       throw _err("key/bad-input", what + " Diffie-Hellman public value is outside the group (RFC 2875 sec. 3)");
     }
@@ -711,19 +721,45 @@ function _dhAsPkcs3(der, at, what) {
  * algorithm; every secret the probe makes is wiped on every way out. A public key of another
  * algorithm, composite or not, is another family and not a pair. */
 async function _compositeCorrespondsTo(privDer, spkiDer, privateOid) {
+  /** @internal The private half is read first, as on the classical route: a composite key the KEM
+   * cannot read is bad input whatever the public half names, decided before the family shortcut
+   * answers that the two are not a pair. The derivation's result is not what is compared; the
+   * read is what it answers for. */
+  try { await compositeKem.publicFromPrivate(privDer); }
+  catch (e0) {
+    if (_isKemStructureFault(e0)) throw _err("key/bad-input", "the private key could not be read", e0);
+    throw _err("key/unsupported-algorithm", "the key pair could not be exercised to decide whether its two halves correspond", e0);
+  }
   if (_algorithmOidAt(spkiDer, 0) !== privateOid) return false;
   var sealed = null, opened = null;
   try {
-    sealed = await compositeKem.encapsulate(spkiDer);
-    opened = await compositeKem.decapsulate(privDer, sealed.ciphertext);
+    /** @internal A structure the KEM cannot read is bad input, the verdict an unreadable classical
+     * key gets from the runtime import above; a decapsulation that runs and fails is the pair not
+     * deciding. The KEM tells the two apart by its own codes, and so does this. */
+    try { sealed = await compositeKem.encapsulate(spkiDer); }
+    catch (e) {
+      if (_isKemStructureFault(e)) throw _err("key/bad-input", "the public key could not be read", e);
+      throw _err("key/unsupported-algorithm", "the key pair could not be exercised to decide whether its two halves correspond", e);
+    }
+    try { opened = await compositeKem.decapsulate(privDer, sealed.ciphertext); }
+    catch (e2) {
+      if (_isKemStructureFault(e2)) throw _err("key/bad-input", "the private key could not be read", e2);
+      throw _err("key/unsupported-algorithm", "the key pair could not be exercised to decide whether its two halves correspond", e2);
+    }
     return guard.crypto.constantTimeEqual(opened, sealed.sharedSecret);
-  } catch (e) {
-    throw _err("key/unsupported-algorithm", "the key pair could not be exercised to decide whether its two halves correspond", e);
   } finally {
     guard.secret.zeroizeAll([sealed && sealed.sharedSecret, opened], KeyError, "key/bad-input", "the correspondence probe secrets");
   }
 }
 
+var _KEM_STRUCTURE_FAULTS = _assign(_create(null), { "kem/bad-key": 1, "kem/bad-input": 1, "kem/bad-algorithm": 1, "kem/bad-ciphertext": 1 });
+
+/** @internal Whether a KEM error says the key or ciphertext could not be READ, as opposed to a
+ * decapsulation that ran and failed. */
+function _isKemStructureFault(e) {
+  return !!(e && e.isPkiError === true && _KEM_STRUCTURE_FAULTS[guard.text.keyOf(e.code)] === 1);
+}
+
 async function publicFromPrivate(privateKey, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.publicFromPrivate options");
   guard.identifier.assertKnownKeys(opts, _PUBLIC_FROM_PRIVATE_OPTS, _err, "key/bad-input",
@@ -860,13 +896,15 @@ function _pssSalt(a, b) {
 
 async function correspondsTo(privateKey, spkiDer) {
   var privDer = await _toPrivateKeyDer(privateKey);
+  var spki = _bufferFrom(spkiDer);
   var compositeOid = _compositeKemOidOf(privDer);
-  if (compositeOid !== null) return _compositeCorrespondsTo(privDer, _bufferFrom(spkiDer), compositeOid);
-  /** @internal Whether the two halves are finite-field Diffie-Hellman is answered from their
-   * algorithm identifiers before either structure is validated: a DH structure's validation proves
-   * its modulus prime, and a half of another family is not a pair with it whatever it states, so
-   * that proof is never run to say so. */
-  if (_isDhOid(_algorithmOidAt(privDer, 1)) !== _isDhOid(_algorithmOidAt(_bufferFrom(spkiDer), 0))) return false;
+  if (compositeOid !== null) return _compositeCorrespondsTo(privDer, spki, compositeOid);
+  /** @internal The private half is read FIRST, whatever the public half names: a private key that
+   * cannot be read is bad input, and a caller tells that apart from a pair that is not one. Only
+   * then is the family question asked, from the two identifiers, before the public structure is
+   * validated: a composite or a finite-field half against a half of another family is not a pair
+   * whatever it states, so the runtime is never asked to read a structure it cannot, and a DH
+   * structure's validation, which proves its modulus prime, is never run to say so. */
   var priv, pub;
   /** @internal The PKCS #3 rewrite of an X9.42 private key is this function's own copy of the
    * exponent, wiped once the runtime holds the key. */
@@ -876,7 +914,10 @@ async function correspondsTo(privateKey, spkiDer) {
     try { priv = nodeCrypto.createPrivateKey({ key: privAsPkcs3, format: "der", type: "pkcs8" }); }
     catch (e) { throw _err("key/bad-input", "the private key could not be read", e); }
   } finally { if (privAsPkcs3 !== privDer) guard.secret.zeroize(privAsPkcs3, KeyError, "key/bad-input", "the rewritten private key"); }
-  var pubAsPkcs3 = _dhAsPkcs3(_bufferFrom(spkiDer), 0, "the public key's");
+  var publicOid = _algorithmOidAt(spki, 0);
+  if (publicOid !== null && compositeKem.isCompositeKem(publicOid)) return false;
+  if (_isDhOid(_algorithmOidAt(privDer, 1)) !== _isDhOid(publicOid)) return false;
+  var pubAsPkcs3 = _dhAsPkcs3(spki, 0, "the public key's");
   _assertDhWithin(pubAsPkcs3, 0, "the public key's");
   try { pub = nodeCrypto.createPublicKey({ key: pubAsPkcs3, format: "der", type: "spki" }); }
   catch (e) { throw _err("key/bad-input", "the public key could not be read", e); }
@@ -1000,6 +1041,7 @@ module.exports = {
   x942Domain: x942Domain,   // @internal
   pkcs3Params: pkcs3Params,   // @internal
   isDhOid: _isDhOid,   // @internal
+  algorithmOidAt: _algorithmOidAt,   // @internal
   assertDhOperandsWithin: assertDhOperandsWithin,   // @internal
   assertDhDomainCoherent: assertDhDomainCoherent,   // @internal
   assertDhGeneratorOrder: assertDhGeneratorOrder,   // @internal

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.7.40",
+  "version": "0.7.41",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:19ec3e74-60d4-4102-bfdf-50fadfa1aeaa",
+  "serialNumber": "urn:uuid:2f774cf6-ab61-4b1c-8dab-ee0085cfb2a5",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-12T19:13:54.735Z",
+    "timestamp": "2026-09-12T20:24:38.981Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.7.40",
+      "bom-ref": "@blamejs/pki@0.7.41",
       "type": "application",
       "name": "pki",
-      "version": "0.7.40",
+      "version": "0.7.41",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.7.40",
+      "purl": "pkg:npm/%40blamejs/pki@0.7.41",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.7.40",
+      "ref": "@blamejs/pki@0.7.41",
       "dependsOn": []
     }
   ]