@blamejs/pki 0.7.45 → 0.8.0

package/CHANGELOG.md

@@ -4,6 +4,36 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.0 — 2026-09-19
+
+Verification is held to the rules signing already applied.
+
+### Added
+
+- `pki.C.LIMITS.OID_MAX_SUBIDENTIFIERS` (128) bounds how many sub-identifiers an OBJECT IDENTIFIER may carry, alongside the existing per-sub-identifier octet bound.
+- `pki.C.LIMITS.RSA_MIN_MODULUS_BITS` (2048) and `pki.path.validate` option `minRsaModulusBits`, which may only raise the floor.
+- `allowWeakDigests` on `pki.cms.verify`, `pki.smime.verify` and `pki.tsp.verify`, for verifying an archived signature made under a digest that is no longer collision resistant.
+
+### Changed
+
+- `pki.cms.verify` reports a SignerInfo whose message digest is SHA-1 as `cms/weak-digest` instead of verifying it, and does the same for a countersignature at any nesting depth. `pki.smime.verify` and `pki.tsp.verify` inherit this through the same signature check. Pass `allowWeakDigests: true` to verify an archived signature under it. A message digest of MD5, MD4 or MD2 is reported `cms/unsupported-algorithm` and the opt-in does not apply, there being no verification path for those digests. The RFC 3161 message imprint is unaffected: that digest is the requester's choice and an archived timestamp under SHA-1 remains readable.
+- `pki.path.validate` refuses an RSA issuer key below 2048 bits with `path/weak-key`. Raise the floor with `minRsaModulusBits`; it cannot be lowered.
+- A key the crypto engine cannot import now reports `path/unsupported-algorithm` instead of `path/bad-signature`, so a certificate on a curve the engine does not carry no longer reads as forged.
+- `pki.webcrypto.subtle.importKey("spki", ...)` refuses an ECDSA or ECDH key whose parameters are explicit domain parameters or the implicitlyCA form, as RFC 5480 section 2.1.1 requires a namedCurve. Certificate parsing still accepts such a key so it can be inspected and linted.
+- `lint/rfc5280/ski-missing` and `lint/rfc5280/aki-missing` are graded `error` rather than `notice`, matching the RFC 5280 section 4.2.1.1 and 4.2.1.2 MUST clauses and the grade the CRL profile already gives the same absence. `lint/rfc5280/ski-missing-ee` is graded `warn`, its clause being a SHOULD. A pipeline gating on `--severity error` will see findings it did not see before.
+- A `PkiError` whose reason is `timeout` carries `permanent: false`, so a caller can decide to retry from the error itself rather than from a code list of its own. The reason is read without its domain, so a timeout raised by a protocol client under its own prefix (`acme/timeout`, `est/timeout`) carries the flag too. Every other code stays `permanent: true`, including a proxy that refuses CONNECT with a definite status.
+
+### Fixed
+
+- Reading an OBJECT IDENTIFIER with more than 128 sub-identifiers throws `oid/too-many-subidentifiers` rather than expanding it. Each sub-identifier costs a bignum and a decimal string, so a 400 KB certificate carrying one such OID cost 55 MB of memory to parse and the ceiling scaled with the 16 MiB input bound. Every format parser reads OIDs through the bounded reader. Encoding is held to the same count, so a value the reader refuses cannot be produced. The generic `pki.asn1.decode` still returns such a value as an opaque primitive node, which allocates nothing beyond the input.
+- `pki.cms.sign` and `pki.cms.countersign` over more than 16 MiB of buffered content threw an untyped `RangeError` instead of a `PkiError`.
+- A CRL extension is decoded only in the scope RFC 5280 defines it for: `cRLNumber` at CRL scope (section 5.2.3), `reasonCode` and `invalidityDate` in a revoked-certificate entry (sections 5.3.1 and 5.3.2). An extension carried in the other scope is left with its raw value, as an unrecognized non-critical extension should be, instead of failing the whole CRL when its value does not parse as that type.
+- The `pki.cms.verify` reference example built a signature with `detached` in the signer descriptor, where it is ignored; the example produced an attached SignedData while describing a detached one.
+
+### Documentation
+
+- SECURITY.md states that the toolkit matches no reference identity: name constraints reach the name forms a certificate carries plus the `emailAddress` synthesis RFC 5280 section 4.2.1.10 requires, and a `dNSName` constraint does not reach a subject `commonName`. RFC 9525 section 1.3 retires `commonName` as a source of hostname identity.
+
 ## v0.7.45 — 2026-09-13
 
 A signature-protected CMP message fills an omitted sender with the signer's subject.

package/lib/asn1-der.js

@@ -483,6 +483,10 @@ function decodeOidContent(buf) {
         "OID sub-identifier exceeds " + constants.LIMITS.OID_MAX_SUBIDENTIFIER_BYTES + " octets");
     }
     if ((b & 0x80) === 0) {
+      if (arcs.length >= constants.LIMITS.OID_MAX_SUBIDENTIFIERS) {
+        throw new OidError("oid/too-many-subidentifiers",
+          "OBJECT IDENTIFIER carries more than " + constants.LIMITS.OID_MAX_SUBIDENTIFIERS + " sub-identifiers");
+      }
       var value = 0n;
       for (var k = arcStart; k <= i; k++) value = value * 128n + BigInt(buf[k] & 0x7f);
       arcs.push(value);
@@ -777,7 +781,7 @@ function intToDer(v) {
 }
 
 function encodeOidContent(dotted) {
-  guard.identifier.assertCanonicalOid(dotted, _oidErr, "oid/bad-input", "OID", "oid/bad-arc");
+  guard.identifier.assertCanonicalOid(dotted, _oidErr, "oid/bad-input", "OID", "oid/bad-arc", "oid/too-many-subidentifiers");
   var arcs = dotted.split(".").map(function (p) { return BigInt(p); });
   var a1 = arcs[0], a2 = arcs[1];
   var subids = [a1 * 40n + a2].concat(arcs.slice(2));

package/lib/cms-verify.js

@@ -69,6 +69,17 @@ var DIGEST_HASH = intrinsic.assign(intrinsic.create(null), {
   shake128: "SHAKE128", shake256: "SHAKE256",
 });
 var SIG_HASH = intrinsic.assign(intrinsic.create(null), { sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" });
+function _digestOidTable(named) {
+  var t = intrinsic.create(null);
+  intrinsic.forEach(named, function (pair) {
+    var dotted = oid.byName(pair[0]);
+    if (dotted) t[dotted] = pair[1];
+  });
+  return t;
+}
+var WEAK_DIGEST_OIDS = _digestOidTable([["sha1", "SHA-1"]]);
+var UNVERIFIABLE_DIGEST_OIDS = _digestOidTable([["md5", "MD5"], ["md4", "MD4"], ["md2", "MD2"]]);
+var WEAK_SIGNATURE_HASHES = intrinsic.assign(intrinsic.create(null), { "SHA-1": 1 });
 function _supportedDigest(name) { return intrinsic.hasOwn(DIGEST_HASH, name) && !!DIGEST_HASH[name]; }
 async function _computeDigest(name, content) {
   return intrinsic.bufferFrom(await subtle.digest(DIGEST_HASH[name], content));
@@ -247,11 +258,21 @@ function _decodeSignedAttrs(setOfBytes) {
   });
 }
 
-async function _verifyOne(si, content, eContentType, parsedCerts, csTarget, digestByName) {
+async function _verifyOne(si, content, eContentType, parsedCerts, csTarget, digestByName, allowWeakDigests) {
   var composite = compositeSig.COMPOSITE_ALGS[si.signatureAlgorithm.oid];
   if (composite) return _verifyComposite(si, composite, content, eContentType, parsedCerts, csTarget, digestByName);
   var scheme = SIG_SCHEME[si.signatureAlgorithm.name];
   if (!scheme) return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "unsupported signature algorithm " + JSON.stringify(si.signatureAlgorithm.name) });
+  var unverifiableDigest = UNVERIFIABLE_DIGEST_OIDS[si.digestAlgorithm.oid];
+  if (unverifiableDigest) {
+    return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid,
+      message: "the " + unverifiableDigest + " message digest is broken and this toolkit does not verify a signature under it" });
+  }
+  var weakDigest = WEAK_DIGEST_OIDS[si.digestAlgorithm.oid];
+  if (!allowWeakDigests && weakDigest) {
+    return _pResolve({ ok: false, code: "cms/weak-digest", sid: si.sid,
+      message: "the " + weakDigest + " message digest is not collision resistant; pass allowWeakDigests to verify an archived signature under it" });
+  }
   var digestHash = SIG_HASH[si.digestAlgorithm.name];
   var pss = scheme.kind === "rsapss" ? _resolvePss(si.signatureAlgorithm.parameters) : null;
   if (scheme.kind === "rsapss" && !pss) return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "unsupported or non-conformant RSASSA-PSS parameters (RFC 4055)" });
@@ -261,6 +282,10 @@ async function _verifyOne(si, content, eContentType, parsedCerts, csTarget, dige
   if (!mldsaNoAttrs && dp !== null && dp !== undefined && !_isDerNull(dp)) return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the " + si.digestAlgorithm.name + " digest algorithm parameters must be absent or DER NULL (RFC 5754 sec. 2)" });
   if ((scheme.kind === "mldsa" || scheme.kind === "slhdsa") && si.signedAttrsBytes && (si.digestAlgorithm.name === "shake128" || si.digestAlgorithm.name === "shake256") && dp !== null && dp !== undefined) return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "a SHAKE digestAlgorithm carries no parameters (RFC 8702 sec. 3.1)" });
   var sigHash = pss ? pss.hash : (scheme.hash || digestHash);
+  if (!allowWeakDigests && WEAK_SIGNATURE_HASHES[sigHash]) {
+    return _pResolve({ ok: false, code: "cms/weak-digest", sid: si.sid,
+      message: "the signature algorithm selects the " + sigHash + " digest, which is not collision resistant; pass allowWeakDigests to verify an archived signature under it" });
+  }
   if ((scheme.kind !== "eddsa" && scheme.kind !== "mldsa" && scheme.kind !== "slhdsa" && !sigHash) || (si.signedAttrsBytes && !_supportedDigest(si.digestAlgorithm.name))) return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "unsupported digest algorithm " + JSON.stringify(si.digestAlgorithm.name) });
   if (scheme.kind === "mldsa" && si.signedAttrsBytes && !_mldsaDigestSuitable(scheme.name, si.digestAlgorithm.name)) return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the " + si.digestAlgorithm.name + " message digest is below the security strength of " + scheme.name + " (RFC 9882 sec. 3.3)" });
   if (scheme.kind === "slhdsa" && si.signedAttrsBytes && si.digestAlgorithm.name !== scheme.digest) return _pResolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "SLH-DSA " + scheme.name + " requires the " + scheme.digest + " message digest (RFC 9814 sec. 4)" });
@@ -386,7 +411,7 @@ function _surfaceSignedAttrs(si) {
   });
 }
 
-async function _verifyCountersignatures(si, parsedCerts) {
+async function _verifyCountersignatures(si, parsedCerts, allowWeakDigests) {
   var targetSig = _toBuf(si.signature, "the countersigned signature");
   var values = [];
   intrinsic.forEach(si.unsignedAttrs || [], function (a) {
@@ -394,16 +419,16 @@ async function _verifyCountersignatures(si, parsedCerts) {
     intrinsic.forEach(a.values, function (v) { guard.list.append(values, v && v.bytes ? v.bytes : v); });
   });
   var out = [];
-  for (var _cp = 0; _cp < values.length; _cp++) guard.list.append(out, await _verifyOneCountersig(values[_cp], targetSig, parsedCerts));
+  for (var _cp = 0; _cp < values.length; _cp++) guard.list.append(out, await _verifyOneCountersig(values[_cp], targetSig, parsedCerts, allowWeakDigests));
   return out;
 }
 
-async function _verifyOneCountersig(vDer, targetSig, parsedCerts) {
+async function _verifyOneCountersig(vDer, targetSig, parsedCerts, allowWeakDigests) {
   var csSi;
   try { csSi = cms.walkCountersignature(asn1.decode(intrinsic.isBuffer(vDer) ? vDer : intrinsic.bufferFrom(vDer))); }
   catch (e) { return _row({ ok: false, code: (e instanceof CmsError ? e.code : "cms/bad-countersignature"), message: e && e.message }); }
-  var verdict = await _verifyOne(csSi, targetSig, null, parsedCerts, targetSig);
-  var nested = await _verifyCountersignatures(csSi, parsedCerts);
+  var verdict = await _verifyOne(csSi, targetSig, null, parsedCerts, targetSig, undefined, allowWeakDigests);
+  var nested = await _verifyCountersignatures(csSi, parsedCerts, allowWeakDigests);
   var head = { ok: verdict.ok, sid: verdict.sid, cert: verdict.cert, digestAlgorithm: csSi.digestAlgorithm.name };
   return guard.verdict.of(
     verdict.code ? guard.verdict.of(head, { code: verdict.code }) : head,
@@ -478,7 +503,7 @@ async function _verifyOneCountersig(vDer, targetSig, parsedCerts) {
  *   var cert = await pki.x509.sign({ subject: "Signer", subjectPublicKey: await pki.key.export(pair.publicKey),
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
  *   var detachedBytes = Buffer.from("hello");
- *   var p7sDer = await pki.cms.sign(detachedBytes, { cert: cert, key: key, detached: true });
+ *   var p7sDer = await pki.cms.sign(detachedBytes, { cert: cert, key: key }, { detached: true });
  *   var res = await pki.cms.verify(p7sDer, { content: detachedBytes });
  *   res.valid;                         // boolean
  *   res.signers[0].ok;                 // per-signer verdict
@@ -509,7 +534,7 @@ async function _resolveContentDigests(parsed, streamSource) {
   return byName;
 }
 
-var _VERIFY_OPTS = intrinsic.assign(intrinsic.create(null), { certs: 1, content: 1, trustAnchors: 1, time: 1, requiredEku: 1, checkPurpose: 1 });
+var _VERIFY_OPTS = intrinsic.assign(intrinsic.create(null), { certs: 1, content: 1, trustAnchors: 1, time: 1, requiredEku: 1, checkPurpose: 1, allowWeakDigests: 1 });
 
 function verify(input, opts) {
   return guard.async.deferred(function () { return _verify(input, opts); });
@@ -523,6 +548,7 @@ async function _verify(input, opts) {
   }, _err, "cms/bad-input", "the SignedData");
   if (!Array.isArray(parsed.signerInfos)) throw _err("cms/bad-input", "input is not a CMS SignedData");
   var trustCfg = _snapshotTrust(opts);
+  var allowWeakDigests = opts.allowWeakDigests === true;
   var parsedCerts = [];
   (parsed.certificates || []).forEach(function (c) { _addCert(parsedCerts, c && c.bytes ? c.bytes : c); });
   (opts.certs || []).forEach(function (c) { _addCert(parsedCerts, c); });
@@ -544,8 +570,8 @@ async function _verify(input, opts) {
   var signers = [];
   for (var _sp = 0; _sp < parsed.signerInfos.length; _sp++) {
     var siOne = parsed.signerInfos[_sp];
-    var verdict = await _verifyOne(siOne, content, eContentType, parsedCerts, null, digestByName);
-    var counters = await _verifyCountersignatures(siOne, parsedCerts);
+    var verdict = await _verifyOne(siOne, content, eContentType, parsedCerts, null, digestByName, allowWeakDigests);
+    var counters = await _verifyCountersignatures(siOne, parsedCerts, allowWeakDigests);
     guard.list.append(signers, guard.verdict.of(verdict, {
       countersignatures: counters,
       unsignedAttrs: _surfaceUnsignedAttrs(siOne),

package/lib/constants.js

@@ -112,14 +112,17 @@ var LIMITS = Object.assign(Object.create(null), {
   DER_MAX_BYTES: BYTES.mib(16),
   DER_MAX_DEPTH: 64,
   DER_MAX_ITEMS: 4000000,
+  NAMED_SCAN_MAX_ELEMENTS: 16777216,
   MAX_DECODE_DEPTH_CEILING: 256,
   PEM_MAX_BYTES: BYTES.mib(16),
   DER_MAX_INTEGER_BYTES: BYTES.kib(16),
   DH_MAX_MODULUS_BYTES: 512,
   DH_MIN_SUBGROUP_BYTES: 20,
   DH_MIN_MODULUS_BYTES: 256,
+  RSA_MIN_MODULUS_BITS: 2048,
   DH_PRIME_MEMO_ENTRIES: 64,
   OID_MAX_SUBIDENTIFIER_BYTES: 32,
+  OID_MAX_SUBIDENTIFIERS: 128,
   HTTP_MAX_RESPONSE_BYTES: BYTES.mib(24),
   HTTP_AUTH_HEADER_MAX_BYTES: BYTES.kib(8),
   CBOR_MAX_BYTES: BYTES.mib(16),

package/lib/framework-error.js

@@ -18,10 +18,14 @@
  *
  *   `code` is a stable, greppable `domain/reason` string
  *   (`asn1/indefinite-length`, `x509/not-a-certificate`): safe to switch
- *   on and safe to log. Because every failure here is a deterministic
- *   verdict on the bytes in hand (a malformed length, an unknown OID
- *   shape, a truncated certificate), errors are `permanent: true`. The
- *   same input will never parse on retry.
+ *   on and safe to log. A failure that is a deterministic verdict on the
+ *   bytes in hand (a malformed length, an unknown OID shape, a truncated
+ *   certificate) is `permanent: true`: the same input will never parse on
+ *   retry. A failure whose reason is `timeout` is `permanent: false`, so a
+ *   caller can retry on the error rather than on a code list of its own.
+ *   The reason is read without its domain, so the protocol clients that
+ *   raise the same failure under their own prefix (`acme/timeout`,
+ *   `est/timeout`) carry the flag too.
  *
  * @card
  *   `PkiError` base class + `defineClass` factory + the per-domain error
@@ -30,9 +34,17 @@
 
 var intrinsic = require("./guard-intrinsic");
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
+var _strSlice = intrinsic.uncurry(String.prototype.slice);
 var _String = intrinsic.String;
 var _defineProperty = intrinsic.defineProperty;
 
+var _TRANSIENT_REASONS = intrinsic.assign(intrinsic.create(null), { timeout: 1 });
+
+function _reasonOf(c) {
+  for (var i = 0; i < c.length; i++) if (_charCodeAt(c, i) === 47) return _strSlice(c, i + 1);
+  return c;
+}
+
 function _isCodeShape(c) {
   var n = c.length, i, ch, slash = -1;
   if (n < 3) return false;
@@ -79,7 +91,7 @@ class PkiError extends Error {
     }
     this.code = c;
     this.isPkiError = true;
-    this.permanent = true;
+    this.permanent = !_TRANSIENT_REASONS[_reasonOf(c)];
   }
 }
 

package/lib/guard-bytes.js

@@ -6,6 +6,7 @@ var async = require("./guard-async");
 var identifier = require("./guard-identifier");
 var time = require("./guard-time");
 var intrinsic = require("./guard-intrinsic");
+var _NAMED_SCAN_MAX_ELEMENTS = require("./constants").LIMITS.NAMED_SCAN_MAX_ELEMENTS;
 var util = intrinsic.assign(intrinsic.create(null), { types: intrinsic.types });
 var _isArray = intrinsic.isArray;
 var _bufferFrom = intrinsic.bufferFrom;
@@ -358,7 +359,9 @@ function _deep(v, ErrorClass, code, label, cap, depth, collect) {
   }
   if (_isBuffer(v) || _isView(v) || _isArrayBuffer(v)) {
     var bytesCopy = _copyBytesSameKind(v, ErrorClass, code, label, collect);
-    _copyNamed(v, bytesCopy, ErrorClass, code, label, cap, depth, collect);
+    if (bytesCopy.byteLength <= _NAMED_SCAN_MAX_ELEMENTS) {
+      _copyNamed(v, bytesCopy, ErrorClass, code, label, cap, depth, collect);
+    }
     return bytesCopy;
   }
   if (require("./guard-parsed").isRecordedAsProduced(v)) return v;   // allow:inline-require -- circular load: guard-parsed requires this module

package/lib/guard-identifier.js

@@ -2,6 +2,7 @@
 // Copyright (c) blamejs contributors
 "use strict";
 var intrinsic = require("./guard-intrinsic");
+var constants = require("./constants");
 var util = intrinsic.assign(intrinsic.create(null), { types: intrinsic.types });
 // @internal
 
@@ -60,7 +61,7 @@ function _isDottedDecimal(str) {
 }
 
 // @enforced-by behavioral -- string-form OID canonicalization has no rename-proof
-function assertCanonicalOid(str, E, code, label, boundsCode) {
+function assertCanonicalOid(str, E, code, label, boundsCode, countCode) {
   var who = label || "OID";
   if (typeof str !== "string" || !_isDottedDecimal(str)) {
     throw E(code, who + " must be a canonical dotted-decimal OID string of two or more arcs with no leading-zero component");
@@ -68,6 +69,9 @@ function assertCanonicalOid(str, E, code, label, boundsCode) {
   if (boundsCode === null) return str;
   var bcode = boundsCode === undefined ? code : boundsCode;
   var parts = _strSplit(str, ".");
+  if (parts.length - 1 > constants.LIMITS.OID_MAX_SUBIDENTIFIERS) {
+    throw E(countCode || bcode, who + " carries more than " + constants.LIMITS.OID_MAX_SUBIDENTIFIERS + " sub-identifiers");
+  }
   var root = _BigInt(parts[0]);
   var second = _BigInt(parts[1]);
   if (root > 2n) throw E(bcode, who + " root arc must be 0, 1, or 2 (X.660)");

package/lib/lint.js

@@ -46,6 +46,12 @@ var MS_PER_DAY = C.TIME.days(1);
 var LintError = frameworkError.LintError;
 function _cfg(code, message, cause) { return new LintError(code, message, cause); }
 
+function _sameName(a, b) {
+  if (!a || !b || !a.rdns || !b.rdns) return false;
+  try { return guard.name.dnEqual(a.rdns, b.rdns, _cfg, "lint/bad-input", "distinguished name") === true; }
+  catch (_e) { return a.dn === b.dn; }
+}
+
 var NS = pkix.makeNS("lint", LintError, oid);
 var EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
 
@@ -368,15 +374,15 @@ var RFC5280_RULES = [
     },
   },
   {
-    id: "lint/rfc5280/ski-missing", severity: "notice", source: "rfc5280", citation: "RFC 5280 4.2.1.2",
-    message: "a CA certificate should carry a subjectKeyIdentifier extension",
+    id: "lint/rfc5280/ski-missing", severity: "error", source: "rfc5280", citation: "RFC 5280 4.2.1.2",
+    message: "a CA certificate must carry a subjectKeyIdentifier extension",
     appliesTo: function (cert, ctx) { var bc = ctx.decode("basicConstraints"); return !!(bc && bc.value && bc.value.cA === true); },
     check: function (cert, ctx) { return ctx.raw("subjectKeyIdentifier") ? null : true; },
   },
   {
-    id: "lint/rfc5280/aki-missing", severity: "notice", source: "rfc5280", citation: "RFC 5280 4.2.1.1",
-    message: "a non-self-issued certificate should carry an authorityKeyIdentifier extension",
-    appliesTo: function (cert) { return !!(cert.issuer && cert.subject && cert.issuer.dn !== cert.subject.dn); },
+    id: "lint/rfc5280/aki-missing", severity: "error", source: "rfc5280", citation: "RFC 5280 4.2.1.1",
+    message: "a non-self-issued certificate must carry an authorityKeyIdentifier extension",
+    appliesTo: function (cert) { return !!(cert.issuer && cert.subject) && !_sameName(cert.issuer, cert.subject); },
     check: function (cert, ctx) { return ctx.raw("authorityKeyIdentifier") ? null : true; },
   },
   {
@@ -466,7 +472,7 @@ var RFC5280_RULES = [
     },
   },
   {
-    id: "lint/rfc5280/ski-missing-ee", severity: "notice", source: "rfc5280", citation: "RFC 5280 4.2.1.2",
+    id: "lint/rfc5280/ski-missing-ee", severity: "warn", source: "rfc5280", citation: "RFC 5280 4.2.1.2",
     message: "an end-entity certificate should carry a subjectKeyIdentifier extension",
     appliesTo: function (cert, ctx) { var bc = ctx.decode("basicConstraints"); return !(bc && bc.value && bc.value.cA === true); },
     check: function (cert, ctx) { return ctx.raw("subjectKeyIdentifier") ? null : true; },

package/lib/oid.js

@@ -208,6 +208,7 @@ var FAMILIES = Object.assign(Object.create(null), {
     "pbeWithSHAAnd128BitRC2-CBC": 5, "pbeWithSHAAnd40BitRC2-CBC": 6 } },
 
   rsadsiDigest: { base: [1, 2, 840, 113549, 2], of: {
+    md2: 2, md4: 4, md5: 5,
     hmacWithSHA1: 7, hmacWithSHA224: 8, hmacWithSHA256: 9,
     hmacWithSHA384: 10, hmacWithSHA512: 11 } },
 

package/lib/path-validate.js

@@ -70,7 +70,10 @@ var edwardsPoint = require("./edwards-point");
 var PathError = errors.PathError;
 function E(code, message, cause) { return new PathError(code, message, cause); }
 function pathCode(e, fallback) {
-  return (e && typeof e.code === "string" && e.code.indexOf("path/") === 0) ? e.code : fallback;
+  if (!e || typeof e.code !== "string") return fallback;
+  if (e.code.indexOf("path/") === 0) return e.code;
+  if (e.code === "webcrypto/not-supported" || e.code === "webcrypto/data") return "path/unsupported-algorithm";
+  return fallback;
 }
 
 var contains = guard.list.contains;
@@ -151,6 +154,7 @@ _sig("id-ml-dsa-87", { name: "ML-DSA-87" }, { name: "ML-DSA-87" }, "absent", fal
 _sig("id-alg-hss-lms-hashsig", { name: "HSS-LMS" }, null, "absent", false, true).shbs = true;
 
 var OID_RSA_PSS = oid.byName("rsassaPss");
+var OID_RSA_ENCRYPTION = oid.byName("rsaEncryption");
 var OID_MGF1 = oid.byName("mgf1");
 var HASH_BY_OID = intrinsic.create(null);
 HASH_BY_OID[oid.byName("sha256")] = "SHA-256";
@@ -344,6 +348,49 @@ function _shbsVerify(spkiBytes, sigBytes, message) {
   } catch (e) { return guard.verdict.of({ ok: false, code: pathCode(e, "path/bad-signature"), error: e }); }
 }
 
+function _weakIssuerKey(state) {
+  var spkiBytes = state.workingPublicKey;
+  var isRsa;
+  try { isRsa = _issuerKeyIsRsa(spkiBytes); }
+  catch (_e) { return null; }
+  if (!isRsa) return null;
+  var bits;
+  try { bits = _rsaModulusBits(spkiBytes); }
+  catch (_e) { bits = null; }
+  if (bits === null) {
+    return E("path/weak-key",
+      "the issuer's key names an RSA algorithm and its modulus cannot be read, so its strength cannot be established");
+  }
+  var floor = state.minRsaModulusBits || constants.LIMITS.RSA_MIN_MODULUS_BITS;
+  if (bits >= floor) return null;
+  return E("path/weak-key", "the issuer's RSA modulus is " + bits + " bits, below the " + floor + "-bit minimum");
+}
+
+function _issuerKeyIsRsa(spkiBytes) {
+  if (!spkiBytes || !spkiBytes.length) return false;
+  var kids = pkix.rootSequenceChildren(asn1.decode(spkiBytes), 2, 2);
+  if (!kids) return false;
+  var algKids = pkix.rootSequenceChildren(kids[0], 1);
+  if (!algKids) return false;
+  var keyAlg = asn1.read.oid(algKids[0]);
+  return keyAlg === OID_RSA_ENCRYPTION || keyAlg === OID_RSA_PSS;
+}
+
+function _rsaModulusBits(spkiBytes) {
+  var spki = asn1.decode(spkiBytes);
+  var keyBits = asn1.read.bitString(spki.children[1]);
+  var innerKids = pkix.rootSequenceChildren(asn1.decode(keyBits.bytes), 1);
+  if (!innerKids) return null;
+  var modulus = innerKids[0].content;
+  if (!modulus || !modulus.length) return null;
+  var i = 0;
+  while (i < modulus.length && modulus[i] === 0) i += 1;
+  if (i >= modulus.length) return 0;
+  var top = modulus[i], topBits = 0;
+  while (top > 0) { topBits += 1; top >>= 1; }
+  return (modulus.length - i - 1) * 8 + topBits;
+}
+
 function builtinVerify(state, cert) {
   var d;
   try {
@@ -702,6 +749,7 @@ function initialize(certs, params, seeds, anchor) {
     validPolicyTree: rootNode(),
     policyNodeCount: 1,
     maxPolicyNodes: params.maxPolicyNodes !== undefined ? params.maxPolicyNodes : constants.LIMITS.PATH_MAX_POLICY_NODES,
+    minRsaModulusBits: params.minRsaModulusBits !== undefined ? params.minRsaModulusBits : constants.LIMITS.RSA_MIN_MODULUS_BITS,
     permittedGenerations: intrinsic.filter(seeds.permittedGenerations, function (g) { return g.length > 0; }),
     excludedSubtrees: seeds.excluded,
     explicitPolicy: params.initialExplicitPolicy ? 0 : n + 1,
@@ -1054,7 +1102,7 @@ function validateCriticalExtensionStructure(cert) {
 var _VALIDATE_OPTS = intrinsic.assign(intrinsic.create(null), {
   checkPurpose: 1, ctLogList: 1, ctPolicy: 1, historicalMode: 1, initialAnyPolicyInhibit: 1,
   initialExcludedSubtrees: 1, initialExplicitPolicy: 1, initialPermittedSubtrees: 1,
-  initialPolicyMappingInhibit: 1, maxPathCerts: 1, maxPolicyNodes: 1, requireRevocation: 1,
+  initialPolicyMappingInhibit: 1, maxPathCerts: 1, maxPolicyNodes: 1, minRsaModulusBits: 1, requireRevocation: 1,
   requiredEku: 1, revocationChecker: 1, softFail: 1, time: 1, trustAnchors: 1,
   userInitialPolicySet: 1, verifier: 1
 });
@@ -1100,6 +1148,14 @@ async function validate(path, opts) {
   if (!intrinsic.isArray(path)) throw E("path/bad-input", "validate: path must be an array of certificates");
   var maxCerts = guard.limits.cap(opts.maxPathCerts, "validate: opts.maxPathCerts", constants.LIMITS.PATH_MAX_CERTS, { E: E, code: "path/bad-input", min: 1 });
   if (path.length > maxCerts) throw E("path/bad-input", "validate: the certification path has " + path.length + " certificates, exceeding the maxPathCerts limit (" + maxCerts + ")");
+  if (opts.minRsaModulusBits != null) {
+    if (typeof opts.minRsaModulusBits !== "number" || !intrinsic.isInteger(opts.minRsaModulusBits)) {
+      throw E("path/bad-input", "validate: opts.minRsaModulusBits must be an integer");
+    }
+    if (opts.minRsaModulusBits < constants.LIMITS.RSA_MIN_MODULUS_BITS) {
+      throw E("path/bad-input", "validate: opts.minRsaModulusBits may only raise the " + constants.LIMITS.RSA_MIN_MODULUS_BITS + "-bit minimum, not lower it");
+    }
+  }
   var certs = path.map(function (c, ci) { return coerceCert(c, "validate: path[" + ci + "]"); });
   var n = certs.length;
   if (n < 1) throw E("path/empty-path", "validate: the certification path is empty");
@@ -1178,7 +1234,10 @@ async function validate(path, opts) {
     var checks = [];
 
     var sigRes;
-    if (verifier) {
+    var weak = _weakIssuerKey(state);
+    if (weak) {
+      sigRes = { ok: false, code: "path/weak-key", error: weak };
+    } else if (verifier) {
       var vv;
       try {
         vv = await verifier.verify({

package/lib/schema-crl.js

@@ -51,17 +51,19 @@ var TIME = pkix.time(NS);
 
 var CRL_VERSION = pkix.versionReader(NS, { "1": 2 });
 
-function decodeExt(ext) {
+function decodeExt(ext, scope) {
   var value = ext.value;
+  var atCrl = scope !== "entry";
+  var atEntry = scope !== "crl";
   try {
-    if (ext.oid === OID_CRL_NUMBER) {
+    if (ext.oid === OID_CRL_NUMBER && atCrl) {
       value = asn1.read.integer(asn1.decode(ext.value));
       if (value < 0n) throw new Error("cRLNumber must be non-negative (INTEGER 0..MAX)");
-    } else if (ext.oid === OID_REASON_CODE) {
+    } else if (ext.oid === OID_REASON_CODE && atEntry) {
       var reason = asn1.read.enumerated(asn1.decode(ext.value));
       if (!_hasOwn(CRL_REASONS, reason.toString())) throw new Error("undefined CRLReason " + reason.toString());
       value = Number(reason);
-    } else if (ext.oid === OID_INVALIDITY_DATE) {
+    } else if (ext.oid === OID_INVALIDITY_DATE && atEntry) {
       var n = asn1.decode(ext.value);
       if (n.tagClass !== "universal" || n.tagNumber !== TAGS.GENERALIZED_TIME) {
         throw new Error("invalidityDate must be a GeneralizedTime");
@@ -85,7 +87,9 @@ var REVOKED_ENTRY = schema.seq([
       serialNumber: m.fields.userCertificate.value,
       serialNumberHex: m.fields.userCertificate.node.content.toString("hex"),
       revocationDate: m.fields.revocationDate.value,
-      crlEntryExtensions: m.fields.crlEntryExtensions.present ? m.fields.crlEntryExtensions.value.result.map(decodeExt) : [],
+      crlEntryExtensions: m.fields.crlEntryExtensions.present
+        ? m.fields.crlEntryExtensions.value.result.map(function (e) { return decodeExt(e, "entry"); })
+        : [],
     };
   },
 });
@@ -114,7 +118,9 @@ var TBS_CERTLIST = schema.seq([
       thisUpdate: m.fields.thisUpdate.value,
       nextUpdate: m.fields.nextUpdate.present ? m.fields.nextUpdate.value : null,
       revokedCertificates: m.fields.revokedCertificates.present ? m.fields.revokedCertificates.value.result : [],
-      crlExtensions: m.fields.crlExtensions.present ? m.fields.crlExtensions.value.result.map(decodeExt) : [],
+      crlExtensions: m.fields.crlExtensions.present
+        ? m.fields.crlExtensions.value.result.map(function (e) { return decodeExt(e, "crl"); })
+        : [],
       crlExtensionsPresent: m.fields.crlExtensions.present,
     };
   },

package/lib/smime.js

@@ -56,7 +56,7 @@ var SIGN_OPTS = Object.assign(Object.create(null), {
 });
 var VERIFY_OPTS = Object.assign(Object.create(null), {
   certs: 1, trustAnchors: 1, time: 1, requiredEku: 1, checkPurpose: 1, strictMicalg: 1,
-  legacyHeaderProtection: 1, expectedSender: 1,
+  legacyHeaderProtection: 1, expectedSender: 1, allowWeakDigests: 1,
 });
 var ENCRYPT_OPTS = Object.assign(Object.create(null), {
   entity: 1, contentType: 1, protectHeaders: 1, headers: 1, hcp: 1,
@@ -758,6 +758,7 @@ async function verify(message, opts) {
     vOpts.checkPurpose = opts.checkPurpose != null ? opts.checkPurpose : "emailProtection";
   }
   if (opts.time !== undefined) vOpts.time = opts.time;
+  if (opts.allowWeakDigests === true) vOpts.allowWeakDigests = true;
   if (_isPkcs7(ct.type, "mime")) {
     if (ct.params["smime-type"] && ct.params["smime-type"] !== "signed-data") throw _err("smime/unsupported-type", "unsupported smime-type " + JSON.stringify(ct.params["smime-type"]) + " (only signed-data)");
     var p7m = _decodeCms(ent);

package/lib/tsp-sign.js

@@ -603,7 +603,7 @@ function _buildTsaChains(leaf, pool) {
  *   res.valid;     // boolean; pass opts.trustAnchors to also chain the TSA cert to a root
  *   res.genTime;   // Date, read from the verified eContent
  */
-var _VERIFY_OPTS = intrinsic.assign(intrinsic.create(null), { certs: 1, trustAnchors: 1, nonce: 1, reqPolicy: 1, revocationChecker: 1 });
+var _VERIFY_OPTS = intrinsic.assign(intrinsic.create(null), { certs: 1, trustAnchors: 1, nonce: 1, reqPolicy: 1, revocationChecker: 1, allowWeakDigests: 1 });
 
 function _anyCritical(extensions) {
   return guard.list.anyMatches(extensions, function (e) { return !!e && !!e.critical; });
@@ -631,7 +631,7 @@ async function verify(token, data, opts) {
   function fail(code, reason) {
     return guard.verdict.of({ valid: false, trusted: false, revocationChecked: revocationChecked, anchorConstraints: anchorConstraints, code: code, reason: reason || null, genTime: tst.genTime, accuracy: tst.accuracy, serialNumber: tst.serialNumber, serialNumberHex: tst.serialNumberHex, policy: tst.policy, policyName: tst.policyName, nonce: tst.nonce, tsa: tst.tsa, tstInfo: tst, signer: null });
   }
-  var cmsRes = await cmsVerify.verify(tokenDer, { certs: opts.certs });
+  var cmsRes = await cmsVerify.verify(tokenDer, { certs: opts.certs, allowWeakDigests: opts.allowWeakDigests === true });
   var signer = cmsRes.signers[0];
   if (!cmsRes.valid) return fail("tsp/bad-signature", signer && (signer.code || signer.message));
   var tsaCertDer = signer && signer.cert;

package/lib/webcrypto.js

@@ -907,6 +907,19 @@ function _preValidatePkcs8(p8, name) {
   validate(innerBytes);
 }
 
+function _preValidateSpki(spki, name) {
+  if (name !== "ECDSA" && name !== "ECDH") return;
+  var params;
+  try {
+    var alg = asn1.decode(spki).children[0];
+    params = alg.children.length > 1 ? alg.children[1] : null;
+  } catch (e) { throw new WebCryptoError("webcrypto/data", "importKey spki: the SubjectPublicKeyInfo is not well-formed", e); }
+  if (params && params.tagClass === "universal" && !params.constructed && params.tagNumber === asn1.TAGS.OBJECT_IDENTIFIER) return;
+  throw new WebCryptoError("webcrypto/data",
+    "importKey spki: an " + name + " key must name its curve as a namedCurve OBJECT IDENTIFIER, " +
+    "and this SubjectPublicKeyInfo carries " + (params ? "explicit domain parameters" : "none") + " (RFC 5480 sec. 2.1.1)");
+}
+
 SubtleCrypto.prototype.importKey = async function importKey(format, keyData, algorithm, extractable, keyUsages) {
   var alg = _normalizeAlg(algorithm, "importKey");
   var usages = keyUsages || [];
@@ -929,6 +942,7 @@ SubtleCrypto.prototype.importKey = async function importKey(format, keyData, alg
 
   if (format === "spki") {
     var spkiBuf = _toBuf(keyData, "importKey spki");
+    _preValidateSpki(spkiBuf, name);
     var pub = _nodeKey(function () { return nodeCrypto.createPublicKey({ key: spkiBuf, format: "der", type: "spki" }); }, "importKey spki");
     return new CryptoKey("public", true, _algFromImport(name, alg, pub), usages, pub);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.7.45",
+  "version": "0.8.0",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:c95b91b1-2249-469b-b641-900d56a9cf3d",
+  "serialNumber": "urn:uuid:3474a203-558f-4bf4-8d04-ca4aec66e1f7",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-13T00:41:14.691Z",
+    "timestamp": "2026-09-19T19:43:19.653Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.7.45",
+      "bom-ref": "@blamejs/pki@0.8.0",
       "type": "application",
       "name": "pki",
-      "version": "0.7.45",
+      "version": "0.8.0",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.7.45",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.0",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.7.45",
+      "ref": "@blamejs/pki@0.8.0",
       "dependsOn": []
     }
   ]