@blamejs/pki 0.8.0 → 0.8.2

package/lib/cms-digest.js

@@ -0,0 +1,191 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * @module     pki.cms
+ * @nav        Messaging
+ * @title      CMS DigestedData
+ * @order      95
+ * @slug       cms-digest
+ *
+ * @intro
+ *   RFC 5652 sec. 7 DigestedData, the integrity-only CMS content type. It carries the
+ *   content, the digest algorithm, and the digest over the content octets. There is no
+ *   signer and no key, so it establishes that content matches a digest and nothing about
+ *   who produced either: its worth is the worth of the channel the message and the digest
+ *   traveled over. `pki.cms.sign` establishes origin, `pki.cms.authenticate` establishes
+ *   origin under a shared key.
+ *
+ *   The version follows the encapsulated type, 0 for `id-data` and 2 for anything else.
+ *   The verifying half recomputes the digest and compares it in constant time, and its
+ *   verdict carries no signer and no trust field, so it cannot be read as a signature.
+ *
+ * @spec RFC 5652 sec. 7
+ * @card
+ *   Build and verify RFC 5652 DigestedData: SHA-256/384/512 over the content octets,
+ *   attached or detached, constant-time comparison, fail-closed.
+ */
+
+var nodeCrypto = require("node:crypto");
+var oid = require("./oid");
+var schemaCms = require("./schema-cms");
+var frameworkError = require("./framework-error");
+var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
+var asn1 = require("./asn1-der");
+var b = asn1.build;
+
+var CmsError = frameworkError.CmsError;
+function _err(code, message, cause) { return new CmsError(code, message, cause); }
+function O(name) { return oid.byName(name); }
+
+var OID_DATA = O("data");
+var OID_DIGESTED_DATA = O("digestedData");
+
+var NODE_DIGEST = intrinsic.assign(intrinsic.create(null), {
+  sha256: "sha256", sha384: "sha384", sha512: "sha512",
+});
+
+var _DIGEST_OPTS = intrinsic.assign(intrinsic.create(null), {
+  digestAlgorithm: 1, contentType: 1, detached: 1, pem: 1,
+});
+var _VERIFY_DIGEST_OPTS = intrinsic.assign(intrinsic.create(null), { content: 1 });
+
+function _digestName(opts) {
+  var name = opts.digestAlgorithm === undefined ? "sha256" : opts.digestAlgorithm;
+  var key = guard.text.keyOf(name);
+  if (!NODE_DIGEST[key]) {
+    throw _err("cms/unsupported-algorithm", "unsupported digest algorithm " + guard.text.showValue(name) +
+      " (sha256 / sha384 / sha512)");
+  }
+  return key;
+}
+
+/**
+ * @primitive  pki.cms.digest
+ * @signature  pki.cms.digest(content, opts?) -> Promise<Buffer|string>
+ * @since      0.8.1
+ * @status     stable
+ * @spec       RFC 5652 sec. 7
+ * @related    pki.cms.verifyDigest, pki.cms.sign, pki.cms.authenticate
+ *
+ * Build an RFC 5652 `DigestedData`: the content, the digest algorithm, and the digest over
+ * the content octets. It carries no signer and no key, so it establishes that content
+ * matches a digest and nothing about who produced either. Use `pki.cms.sign` for origin,
+ * or `pki.cms.authenticate` for origin under a shared key.
+ *
+ * The version follows the encapsulated type, 0 for `id-data` and 2 for anything else.
+ *
+ * @opts
+ *   - `digestAlgorithm` (string) -- `sha256` (default), `sha384` or `sha512`.
+ *   - `contentType` (string) -- the encapsulated content type by OID name, default `data`.
+ *   - `detached` (boolean) -- omit the content, leaving the digest to travel alone.
+ *   - `pem` (boolean) -- return a PEM `CMS` block instead of DER.
+ * @example
+ *   var der = await pki.cms.digest(Buffer.from("hello"));
+ *   (await pki.cms.verifyDigest(der)).valid;   // -> true
+ */
+function digest(content, opts) {
+  return guard.bytes.fixedCall(CmsError, "cms/bad-input", [
+    [content, "content"], [opts, "pki.cms.digest options"],
+  ], _digest);
+}
+
+async function _digest(content, opts) {
+  opts = guard.identifier.optionsObject(opts, _err, "cms/bad-input", "pki.cms.digest options");
+  guard.identifier.assertKnownKeys(opts, _DIGEST_OPTS, _err, "cms/bad-input",
+    "pki.cms.digest has an unknown option ");
+  var raw = guard.bytes.source(content, CmsError, "cms/bad-input", "content");
+  var alg = _digestName(opts);
+  var ctName = opts.contentType === undefined ? "data" : opts.contentType;
+  var ctOid = O(ctName);
+  if (!ctOid) throw _err("cms/bad-input", "opts.contentType is not a known OID name: " + guard.text.showValue(ctName));
+
+  var value = nodeCrypto.createHash(NODE_DIGEST[alg]).update(raw).digest();
+  var eciChildren = opts.detached === true
+    ? [b.oid(ctOid)]
+    : [b.oid(ctOid), b.explicit(0, b.octetString(raw))];
+  var dd = b.sequence([
+    b.integer(ctOid === OID_DATA ? 0 : 2),
+    b.sequence([b.oid(O(alg))]),
+    b.sequence(eciChildren),
+    b.octetString(value),
+  ]);
+  var ci = b.sequence([b.oid(OID_DIGESTED_DATA), b.explicit(0, dd)]);
+  return opts.pem === true ? schemaCms.pemEncode(ci, "CMS") : ci;
+}
+
+/**
+ * @primitive  pki.cms.verifyDigest
+ * @signature  pki.cms.verifyDigest(input, opts?) -> Promise<verdict>
+ * @since      0.8.1
+ * @status     stable
+ * @spec       RFC 5652 sec. 7
+ * @related    pki.cms.digest, pki.cms.verify
+ *
+ * Recompute the digest of a `DigestedData`'s content and compare it with the digest the
+ * message carries, in constant time. Returns `{ valid, digestAlgorithm, content, contentType }`,
+ * with `code` set to `cms/digest-mismatch` when the content does not match.
+ *
+ * A DigestedData proves neither origin nor authority. A caller that needs either verifies a
+ * `SignedData` instead; this verdict carries no signer and no trust field, so it cannot be
+ * mistaken for one.
+ *
+ * @opts
+ *   - `content` (BufferSource) -- the detached content the digest covers. Required when the
+ *     message omits its own content, refused as redundant when it carries it.
+ * @example
+ *   var der = await pki.cms.digest(Buffer.from("hello"));
+ *   var v = await pki.cms.verifyDigest(der);
+ *   v.valid;             // -> true
+ *   v.digestAlgorithm;   // -> "sha256"
+ */
+function verifyDigest(input, opts) {
+  return guard.bytes.fixedCall(CmsError, "cms/bad-input", [
+    [input, "the CMS message"], [opts, "pki.cms.verifyDigest options"],
+  ], _verifyDigest);
+}
+
+async function _verifyDigest(input, opts) {
+  opts = guard.identifier.optionsObject(opts, _err, "cms/bad-input", "pki.cms.verifyDigest options");
+  guard.identifier.assertKnownKeys(opts, _VERIFY_DIGEST_OPTS, _err, "cms/bad-input",
+    "pki.cms.verifyDigest has an unknown option ");
+  var parsed = guard.parsed.acceptDerived(input, "cms", function (bytes) {
+    return schemaCms.parse(bytes);
+  }, _err, "cms/bad-input", "the DigestedData");
+  if (parsed.contentType !== OID_DIGESTED_DATA) {
+    throw _err("cms/not-a-digested-data", "pki.cms.verifyDigest reads a DigestedData (RFC 5652 sec. 7) and this is " +
+      (oid.name(parsed.contentType) || parsed.contentType));
+  }
+  var alg = guard.text.keyOf(parsed.digestAlgorithm.name || "");
+  if (!NODE_DIGEST[alg]) {
+    throw _err("cms/unsupported-algorithm", "unsupported digest algorithm " +
+      guard.text.showValue(parsed.digestAlgorithm.name || parsed.digestAlgorithm.oid));
+  }
+  guard.der.assertParams(parsed.digestAlgorithm.parameters, "absentOrNull", _err,
+    "cms/unsupported-algorithm", parsed.digestAlgorithm.name + " digest algorithm (RFC 5754 sec. 2)");
+  var embedded = parsed.encapContentInfo.eContent;
+  var supplied = opts.content === undefined ? null
+    : guard.bytes.snapshotSource(opts.content, CmsError, "cms/bad-input", "opts.content");
+  if (embedded != null && supplied != null) {
+    throw _err("cms/bad-input", "the DigestedData carries its own content, so opts.content is redundant");
+  }
+  if (embedded == null && supplied == null) {
+    throw _err("cms/bad-input", "the DigestedData is detached, so opts.content must supply the content it covers");
+  }
+  var covered = embedded != null
+    ? guard.bytes.snapshotSource(embedded, CmsError, "cms/bad-input", "the encapsulated content")
+    : supplied;
+  var recomputed = nodeCrypto.createHash(NODE_DIGEST[alg]).update(covered).digest();
+  var matched = guard.crypto.constantTimeEqual(recomputed, parsed.digest);
+  return guard.verdict.of({
+    valid: matched,
+    code: matched ? undefined : "cms/digest-mismatch",
+    digestAlgorithm: alg,
+    contentType: parsed.encapContentInfo.eContentType,
+    contentTypeName: oid.name(parsed.encapContentInfo.eContentType) || null,
+    content: covered,
+  });
+}
+
+module.exports = { digest: digest, verifyDigest: verifyDigest };

package/lib/cms-verify.js

@@ -38,6 +38,7 @@ var cmsSign = require("./cms-sign");
 var cmsEncrypt = require("./cms-encrypt");
 var cmsDecrypt = require("./cms-decrypt");
 var cmsCompress = require("./cms-compress");
+var cmsDigest = require("./cms-digest");
 var signScheme = require("./sign-scheme");
 var _mldsaDigestSuitable = signScheme.mldsaDigestSuitable;
 var SLHDSA_BY_OID = signScheme.SLHDSA_BY_OID;
@@ -105,7 +106,7 @@ var SIG_SCHEME = intrinsic.assign(intrinsic.create(null), {
 ["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
  "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
 ].forEach(function (s) { SIG_SCHEME["id-slh-dsa-" + s] = { kind: "slhdsa", name: "SLH-DSA-" + s.toUpperCase(), params: "absent", sameKeyOid: true, digest: SLHDSA_BY_OID[oid.byName("id-slh-dsa-" + s)].digest }; });
-function _isDerNull(p) { return Buffer.isBuffer(p) && p.length === 2 && p[0] === 0x05 && p[1] === 0x00; }
+function _isDerNull(p) { return guard.der.isNull(p); }
 function _algParamsOk(shape, p) { return shape === "null" ? _isDerNull(p) : (p === null || p === undefined); }
 var EC_CURVE = intrinsic.create(null);
 EC_CURVE[oid.byName("prime256v1")] = { curve: "P-256", coordLen: 32 };
@@ -1120,4 +1121,4 @@ function isCertsOnly(input) {
 }
 
 // @internal
-module.exports = { verify: verify, sign: sign, countersign: countersign, encrypt: encrypt, authenticate: authenticate, decrypt: decrypt, compress: compress, decompress: decompress, certsOnly: certsOnly, parseCertsOnly: parseCertsOnly, isCertsOnly: isCertsOnly, setEngine: setEngine };
+module.exports = { verify: verify, sign: sign, countersign: countersign, encrypt: encrypt, authenticate: authenticate, decrypt: decrypt, compress: compress, decompress: decompress, digest: cmsDigest.digest, verifyDigest: cmsDigest.verifyDigest, certsOnly: certsOnly, parseCertsOnly: parseCertsOnly, isCertsOnly: isCertsOnly, setEngine: setEngine };

package/lib/guard-der.js

@@ -7,6 +7,7 @@ var _freeze = require("./guard-intrinsic").freeze;
 var _forEach = require("./guard-intrinsic").forEach;
 var _sizeOf = require("./guard-intrinsic").sizeOf;
 var _create = require("./guard-intrinsic").create;
+var _isBuffer = require("./guard-intrinsic").isBuffer;
 
 var asn1 = null;
 function _asn1() { if (asn1 === null) asn1 = require("./asn1-der"); return asn1; }
@@ -84,4 +85,28 @@ function tlv(content, E, code, label) {
   return content;
 }
 
-module.exports = _freeze({ element: element, tlv: tlv });
+// @enforced-by guard-shape-reinlined
+// @guard-shape \[0\] === 0x05
+function isNull(params) {
+  return _isBuffer(params) && _sizeOf(params) === 2 && params[0] === 0x05 && params[1] === 0x00;
+}
+
+// @enforced-by behavioral -- absence has no rename-proof shape; the RED vector per verb is the guard
+function paramsAbsentOrNull(params) {
+  return params === null || params === undefined || isNull(params);
+}
+
+// @enforced-by behavioral -- see paramsAbsentOrNull.
+function assertParams(params, shape, E, code, label) {
+  var ok = shape === "null" ? isNull(params) : (shape === "absent"
+    ? (params === null || params === undefined)
+    : paramsAbsentOrNull(params));
+  if (ok) return params;
+  throw E(code, "the " + label + " parameters must be " + (shape === "null"
+    ? "DER NULL" : (shape === "absent" ? "absent" : "absent or DER NULL")));
+}
+
+module.exports = _freeze({
+  element: element, tlv: tlv,
+  isNull: isNull, paramsAbsentOrNull: paramsAbsentOrNull, assertParams: assertParams,
+});

package/lib/guard-name.js

@@ -21,6 +21,10 @@ var _numToString = intrinsic.uncurry(Number.prototype.toString);
 var _create = intrinsic.create;
 var _hasOwn = intrinsic.hasOwn;
 var _fromCharCode = String.fromCharCode;
+var _bufferFrom = intrinsic.bufferFrom;
+var _TextDecoderCtor = TextDecoder;
+var _utf8Fatal = new _TextDecoderCtor("utf-8", { fatal: true, ignoreBOM: true });
+var _decodeUtf8 = intrinsic.uncurry(_TextDecoderCtor.prototype.decode);
 var _String = String;
 var _isArray = Array.isArray;
 var _isBuffer = intrinsic.isBuffer;
@@ -159,6 +163,124 @@ function escapeControlBytes(str) {
 }
 
 var DN_SPECIAL = intrinsic.assign(intrinsic.create(null), { 0x2c: 1, 0x2b: 1, 0x22: 1, 0x5c: 1, 0x3c: 1, 0x3e: 1, 0x3b: 1 });
+
+function _hexNibble(c) {
+  if (c >= 0x30 && c <= 0x39) return c - 0x30;
+  if (c >= 0x41 && c <= 0x46) return c - 0x41 + 10;
+  if (c >= 0x61 && c <= 0x66) return c - 0x61 + 10;
+  return -1;
+}
+function _isAttrTypeStart(c) { return (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a); }
+function _isAttrTypeChar(c) { return _isAttrTypeStart(c) || (c >= 0x30 && c <= 0x39) || c === 0x2d; }
+function _isDigit(c) { return c >= 0x30 && c <= 0x39; }
+
+// @enforced-by behavioral -- the descriptor grammar has no rename-proof shape distinct
+function isAttributeDescriptor(name) {
+  if (typeof name !== "string" || name.length === 0) return false;
+  if (!_isAttrTypeStart(_charCodeAt(name, 0))) return false;
+  for (var i = 1; i < name.length; i++) {
+    if (!_isAttrTypeChar(_charCodeAt(name, i))) return false;
+  }
+  return true;
+}
+
+// @enforced-by behavioral -- the inverse of escapeDnValue has no rename-proof shape distinct
+function parseDnString(str, E, code, label) {
+  if (typeof str !== "string") throw E(code, label + " must be a string");
+  var rdns = [], atvs = [], i = 0, n = str.length;
+  if (n === 0) return rdns;
+  for (;;) {
+    var typeStart = i;
+    var first = _charCodeAt(str, i);
+    if (_isDigit(first)) {
+      while (i < n && (_isDigit(_charCodeAt(str, i)) || _charCodeAt(str, i) === 0x2e)) i++;
+    } else if (_isAttrTypeStart(first)) {
+      while (i < n && _isAttrTypeChar(_charCodeAt(str, i))) i++;
+    }
+    if (i === typeStart) throw E(code, label + " has a component with no attribute type");
+    var type = _strSlice(str, typeStart, i);
+    if (i >= n || _charCodeAt(str, i) !== 0x3d) throw E(code, label + " component " + type + " has no '=' after its attribute type");
+    i++;
+
+    var value = "", hex = null, pending = [];
+    function flushPending() {
+      if (pending.length === 0) return;
+      var decoded;
+      try { decoded = _decodeUtf8(_utf8Fatal, _bufferFrom(pending)); }
+      catch (e) { throw E(code, label + " has a run of '\\' hex escapes that is not valid UTF-8 (RFC 4514 sec. 3)", e); }
+      value += decoded;
+      pending = [];
+    }
+    if (i < n && _charCodeAt(str, i) === 0x23) {
+      i++;
+      var hexStart = i;
+      while (i < n && _hexNibble(_charCodeAt(str, i)) >= 0) i++;
+      var span = i - hexStart;
+      if (span === 0 || (span & 1) === 1) throw E(code, label + " has a '#' value that is not an even number of hex digits");
+      hex = _strSlice(str, hexStart, i);
+    } else {
+      var valueStart = i, lastWasBareSpace = false;
+      for (; i < n; i++) {
+        var c = _charCodeAt(str, i);
+        if (c === 0x2c || c === 0x2b) break;
+        if (c !== 0x5c) {
+          if (c === 0x00 || c === 0x22 || c === 0x3b || c === 0x3c || c === 0x3e) {
+            throw E(code, label + " has an unescaped character RFC 4514 sec. 3 requires to be escaped");
+          }
+          if (c === 0x20 && i === valueStart) {
+            throw E(code, label + " has an unescaped leading space, which RFC 4514 sec. 3 requires to be escaped");
+          }
+          lastWasBareSpace = c === 0x20;
+        } else {
+          lastWasBareSpace = false;
+        }
+        if (c === 0x5c) {
+          i++;
+          if (i >= n) throw E(code, label + " ends with a trailing '\\' that escapes nothing");
+          var e1 = _charCodeAt(str, i);
+          var h1 = _hexNibble(e1);
+          if (h1 >= 0) {
+            if (i + 1 >= n) throw E(code, label + " has a '\\' hex escape with only one digit");
+            var h2 = _hexNibble(_charCodeAt(str, i + 1));
+            if (h2 < 0) throw E(code, label + " has a '\\' hex escape whose second digit is not hex");
+            _append(pending, h1 * 16 + h2);
+            i++;
+            continue;
+          }
+          if (e1 !== 0x20 && e1 !== 0x23 && e1 !== 0x3d && DN_SPECIAL[e1] !== 1) {
+            throw E(code, label + " escapes a character RFC 4514 sec. 2.4 does not give a meaning to");
+          }
+          flushPending();
+          value += _charAt(str, i);
+          continue;
+        }
+        flushPending();
+        value += _charAt(str, i);
+      }
+      flushPending();
+      if (lastWasBareSpace) {
+        throw E(code, label + " has an unescaped trailing space, which RFC 4514 sec. 3 requires to be escaped");
+      }
+    }
+    _append(atvs, { type: type, value: hex === null ? value : null, hex: hex });
+
+    if (i >= n) { _append(rdns, atvs); return rdns; }
+    var sep = _charCodeAt(str, i);
+    if (sep !== 0x2c && sep !== 0x2b) {
+      throw E(code, label + " has a component followed by a character that is not a separator");
+    }
+    i++;
+    if (sep === 0x2b) {
+      if (i >= n) throw E(code, label + " ends with a '+' that joins nothing");
+    } else {
+      _append(rdns, atvs);
+      atvs = [];
+      if (i >= n) throw E(code, label + " ends with a separator that joins nothing");
+      while (i < n && _charCodeAt(str, i) === 0x20) i++;
+      if (i >= n) throw E(code, label + " ends with a separator that joins nothing");
+    }
+  }
+}
 // @enforced-by behavioral -- the escaping has no rename-proof code shape distinct
 function escapeDnValue(v) {
   var s = _String(v), out = "";
@@ -535,7 +657,8 @@ module.exports = intrinsic.freeze({
   capturedRdns: capturedRdns, copyDnRdns: copyDnRdns,
   assertNoControlBytes: assertNoControlBytes, assertPrintableIa5: assertPrintableIa5,
   dnEqual: dnEqual, rdnEqual: rdnEqual, emailEqual: emailEqual, dpnCorresponds: dpnCorresponds,
-  escapeControlBytes: escapeControlBytes, escapeDnValue: escapeDnValue,
+  escapeControlBytes: escapeControlBytes, escapeDnValue: escapeDnValue, parseDnString: parseDnString,
+  isAttributeDescriptor: isAttributeDescriptor,
   lowerAscii: lowerAscii, uriSchemeIs: uriSchemeIs,
   stripTrailingDot: stripTrailingDot, isFqdnHost: isFqdnHost, splitMailbox: splitMailbox,
   constraintBaseRefusal: constraintBaseRefusal,

package/lib/guard-text.js

@@ -24,7 +24,7 @@ function decode(input, maxBytes, ErrorClass, spec) {
     input = bytes.source(input, ErrorClass, spec.badInput, spec.label);
     if (bytes.lengthOf(input) > maxBytes) throw new ErrorClass(spec.tooLarge, spec.label + " exceeds the size cap");
     if (spec.fatal) {
-      try { return _decode(new _TextDecoder(charset, { fatal: true }), input); }
+      try { return _decode(new _TextDecoder(charset, { fatal: true, ignoreBOM: true }), input); }
       catch (e) { throw new ErrorClass(spec.badDecode, spec.label + " is not valid " + charset, e); }
     }
     return _toString(input, charset);

package/lib/oid.js

@@ -46,8 +46,13 @@ var FAMILIES = Object.assign(Object.create(null), {
   attributeType: { base: [2, 5, 4], of: {
     commonName: 3, surname: 4, serialNumber: 5, countryName: 6,
     localityName: 7, stateOrProvinceName: 8, streetAddress: 9,
-    organizationName: 10, organizationalUnitName: 11, title: 12, givenName: 42,
-    clearance: 55, role: 72 } },
+    organizationName: 10, organizationalUnitName: 11, title: 12,
+    businessCategory: 15, postalCode: 17, name: 41, givenName: 42,
+    initials: 43, generationQualifier: 44, distinguishedNameQualifier: 46,
+    clearance: 55, pseudonym: 65, role: 72, organizationIdentifier: 97 } },
+
+  cabfJurisdiction: { base: [1, 3, 6, 1, 4, 1, 311, 60, 2, 1], of: {
+    jurisdictionLocalityName: 1, jurisdictionStateOrProvinceName: 2, jurisdictionCountryName: 3 } },
 
   certExtension: { base: [2, 5, 29], of: {
     subjectDirectoryAttributes: 9,
@@ -265,12 +270,19 @@ var FAMILIES = Object.assign(Object.create(null), {
     asymmDecryptKeyID: 54, certificationRequestInfoTemplate: 61, extensionReqTemplate: 62 } },
 
   ansiX962: { base: [1, 2, 840, 10045], of: {
-    ecPublicKey: [2, 1], prime256v1: [3, 1, 7],
+    ecPublicKey: [2, 1], prime192v1: [3, 1, 1], prime256v1: [3, 1, 7],
     ecdsaWithSHA256: [4, 3, 2], ecdsaWithSHA384: [4, 3, 3], ecdsaWithSHA512: [4, 3, 4] } },
 
-  secg: { base: [1, 3, 132, 0], of: { secp384r1: 34, secp521r1: 35 } },
+  secg: { base: [1, 3, 132, 0], of: {
+    sect163k1: 1, sect163r1: 2, secp256k1: 10, sect163r2: 15, sect283k1: 16, sect283r1: 17,
+    sect233k1: 26, sect233r1: 27, secp192k1: 31, secp224k1: 32, secp224r1: 33,
+    secp384r1: 34, secp521r1: 35, sect409k1: 36, sect409r1: 37, sect571k1: 38, sect571r1: 39 } },
 
-  brainpool: { base: [1, 3, 36, 3, 3, 2, 8, 1, 1], of: { brainpoolP256r1: 7, brainpoolP384r1: 11 } },
+  brainpool: { base: [1, 3, 36, 3, 3, 2, 8, 1, 1], of: {
+    brainpoolP160r1: 1, brainpoolP160t1: 2, brainpoolP192r1: 3, brainpoolP192t1: 4,
+    brainpoolP224r1: 5, brainpoolP224t1: 6, brainpoolP256r1: 7, brainpoolP256t1: 8,
+    brainpoolP320r1: 9, brainpoolP320t1: 10, brainpoolP384r1: 11, brainpoolP384t1: 12,
+    brainpoolP512r1: 13, brainpoolP512t1: 14 } },
 
   edwards: { base: [1, 3, 101], of: { X25519: 110, X448: 111, Ed25519: 112, Ed448: 113 } },
 
@@ -332,7 +344,7 @@ var FAMILIES = Object.assign(Object.create(null), {
   nistKem: { base: [2, 16, 840, 1, 101, 3, 4, 4], of: {
     "id-ml-kem-512": 1, "id-ml-kem-768": 2, "id-ml-kem-1024": 3 } },
 
-  datatype: { base: [0, 9, 2342, 19200300, 100, 1], of: { domainComponent: 25 } },
+  datatype: { base: [0, 9, 2342, 19200300, 100, 1], of: { userId: 1, domainComponent: 25 } },
 
   fidoGenCe: { base: [1, 3, 6, 1, 4, 1, 45724, 1, 1], of: { idFidoGenCeAaguid: 4 } },
 

package/lib/path-validate.js

@@ -220,7 +220,7 @@ function resolveRsaPss(paramsBytes) {
   return { verify: { name: "RSA-PSS", saltLength: saltLength }, imp: { name: "RSA-PSS", hash: hash } };
 }
 
-function isDerNull(p) { return p && p.length === 2 && p[0] === 0x05 && p[1] === 0x00; }
+function isDerNull(p) { return guard.der.isNull(p); }
 
 function resolveDescriptor(sigAlg) {
   if (sigAlg.oid === OID_RSA_PSS) return resolveRsaPss(sigAlg.parameters);
@@ -827,7 +827,7 @@ function addChild(state, parent, validPolicy, qualifiers, expectedPolicySet, che
 }
 
 function isNullOrAbsentParams(p) {
-  return p === null || p === undefined || (p.length === 2 && p[0] === 0x05 && p[1] === 0x00);
+  return guard.der.paramsAbsentOrNull(p);
 }
 
 function spliceSpkiParameters(spki, algOid, paramsBytes) {
@@ -1017,8 +1017,13 @@ function validateCriticalExtensionStructure(cert) {
  * optional `requiredEku` (key purposes the target's extendedKeyUsage must
  * assert, given as registered OID names or dotted OID strings; an absent
  * extension is unrestricted, RFC 5280 4.2.1.12), and an optional
- * `revocationChecker`. The value-carrying options (`time`, `maxPathCerts`,
- * `maxPolicyNodes`, the subtree seeds, `userInitialPolicySet`, `requiredEku`)
+ * `revocationChecker`. An optional `verifier` replaces the built-in signature
+ * check with `verifier.verify({ cert, workingPublicKey, workingPublicKeyAlgorithm,
+ * workingPublicKeyParameters })`, which is how a chain on a curve the engine does
+ * not carry, such as a brainpool one, is validated. It replaces the signature step
+ * only: the key-strength floor and every other RFC 5280 check still apply.
+ * The value-carrying options (`time`, `maxPathCerts`,
+ * `maxPolicyNodes`, `minRsaModulusBits`, the subtree seeds, `userInitialPolicySet`, `requiredEku`)
  * are validated at the entry point. A mis-shaped value throws `path/bad-input`,
  * so it cannot silently go unapplied. Returns `{ valid, revocationChecked, anchorConstraints,
  * path, results, workingPublicKey, workingPublicKeyAlgorithm,

package/lib/pki-build.js

@@ -265,6 +265,27 @@ function _isDottedOid(s) {
 
 var b = asn1.build;
 
+/** @internal The distinguished-name attributes RFC 5280 App. A.1 types as something other than
+ *  DirectoryString, with the SIZE constraint the module states. Every other attribute is a
+ *  DirectoryString and takes UTF8String. A row here, not a branch, so a newly registered
+ *  attribute whose module entry names a type is a data addition. */
+var ATV_TYPE = intrinsic.assign(intrinsic.create(null), {
+  countryName: { encode: b.printable, tag: asn1.TAGS.PRINTABLE_STRING, size: [2, 2], what: "X520countryName, PrintableString SIZE(2)" },
+  jurisdictionCountryName: { encode: b.printable, tag: asn1.TAGS.PRINTABLE_STRING, size: [2, 2], what: "a jurisdiction country code, PrintableString SIZE(2)" },
+  distinguishedNameQualifier: { encode: b.printable, tag: asn1.TAGS.PRINTABLE_STRING, what: "X520dnQualifier, PrintableString" },
+  serialNumber: { encode: b.printable, tag: asn1.TAGS.PRINTABLE_STRING, size: [1, 64], what: "X520SerialNumber, PrintableString" },
+  emailAddress: { encode: b.ia5, tag: asn1.TAGS.IA5_STRING, size: [1, 255], what: "EmailAddress, IA5String" },
+  domainComponent: { encode: b.ia5, tag: asn1.TAGS.IA5_STRING, what: "DomainComponent, IA5String (RFC 4519 sec. 2.4)" },
+});
+
+/** @internal The DirectoryString CHOICE of RFC 5280 App. A.1. Every attribute the toolkit
+ *  publishes a short name for and does not give its own row above is valued as one, so a
+ *  pre-encoded value for one of them must be a member. An attribute with no published short
+ *  name has a syntax this toolkit does not claim to know, and its value stays opaque. */
+var DIRECTORY_STRING_TAGS = intrinsic.assign(intrinsic.create(null), {});
+[asn1.TAGS.TELETEX_STRING, asn1.TAGS.PRINTABLE_STRING, asn1.TAGS.UNIVERSAL_STRING,
+  asn1.TAGS.UTF8_STRING, asn1.TAGS.BMP_STRING].forEach(function (t) { DIRECTORY_STRING_TAGS[t] = 1; });
+
 var KU_BIT = intrinsic.assign(intrinsic.create(null), {
   digitalSignature: 0, nonRepudiation: 1, contentCommitment: 1, keyEncipherment: 2,
   dataEncipherment: 3, keyAgreement: 4, keyCertSign: 5, cRLSign: 6, encipherOnly: 7, decipherOnly: 8,
@@ -360,19 +381,55 @@ function makeBuilder(ctx) {
     return (y >= 1950 && y <= 2049) ? b.utcTime(date) : b.generalizedTime(date);
   }
 
-  function atvString(attrName, value) {
-    if (attrName === "countryName") {
-      if (String(value).length !== 2) throw E("bad-name", "countryName must be a two-letter ISO 3166 code (PrintableString SIZE(2))");
-      return b.printable(value);
+  function assertAtvValue(attrName, value) {
+    if (value == null || value === "") throw E("bad-name", "the " + attrName + " attribute value must be a non-empty string");
+    var row = ATV_TYPE[attrName];
+    if (!row || !row.size) return;
+    var len = _String(value).length;
+    if (len < row.size[0] || len > row.size[1]) {
+      throw E("bad-name", attrName + " must be " + (row.size[0] === row.size[1]
+        ? "exactly " + row.size[0] + " characters" : row.size[0] + " to " + row.size[1] + " characters") +
+        " (" + row.what + ", RFC 5280 App. A.1)");
     }
-    if (attrName === "emailAddress") return b.ia5(value);
-    return b.utf8(value);
+  }
+  function atvString(attrName, value) {
+    assertAtvValue(attrName, value);
+    var row = ATV_TYPE[attrName];
+    if (!row) return b.utf8(value);
+    return row.encode(value);
   }
   function encodeAtv(attrName, value) {
     if (value == null || value === "") throw E("bad-name", "the " + attrName + " attribute value must be a non-empty string");
     var typeOid = O(attrName);
     if (typeOid == null) throw E("bad-name", "unknown distinguished-name attribute " + guard.text.showValue(attrName));
     var valueTlv;
+    if (typeof value === "string" && _charCodeAt(value, 0) === 0x23) {
+      var raw = guard.encoding.hex(_sliceStr(value, 1), null, rawErr, ctx.prefix + "/bad-name", "a #hex attribute value");
+      guard.der.tlv(raw, rawErr, ctx.prefix + "/bad-name", "a #hex attribute value");
+      var rawNode = asn1.decode(raw);
+      var typeRow = ATV_TYPE[attrName];
+      var universalPrimitive = rawNode.tagClass === "universal" && !rawNode.constructed;
+      if (typeRow && (!universalPrimitive || rawNode.tagNumber !== typeRow.tag)) {
+        throw E("bad-name", "the " + attrName + " #hex value must be encoded as " + typeRow.what);
+      }
+      if (!typeRow && intrinsic.hasOwn(C.NAMES.DN_SHORT, attrName) &&
+          (!universalPrimitive || !DIRECTORY_STRING_TAGS[rawNode.tagNumber])) {
+        throw E("bad-name", "the " + attrName + " #hex value must be a DirectoryString: a TeletexString, PrintableString, UniversalString, UTF8String or BMPString (RFC 5280 App. A.1)");
+      }
+      var rawText;
+      try {
+        rawText = asn1.read.string(rawNode);
+      } catch (_e) {
+        rawText = null;
+      }
+      if (rawText !== null) {
+        try { atvString(attrName, rawText); }
+        catch (e) { if (e instanceof ErrorClass) throw e; throw E("bad-name", "the " + attrName + " #hex value carries characters invalid for that attribute's string type", e); }
+      }
+      return b.sequence([b.oid(typeOid), raw]);
+    }
+    if (typeof value === "string" && _charCodeAt(value, 0) === 0x5c) value = _sliceStr(value, 1);
+    if (value === "") throw E("bad-name", "the " + attrName + " attribute value must be a non-empty string");
     try { valueTlv = atvString(attrName, value); }
     catch (e) { if (e instanceof ErrorClass) throw e; throw E("bad-name", "the " + attrName + " value has characters invalid for its string type", e); }
     return b.sequence([b.oid(typeOid), valueTlv]);

package/lib/schema-cms.js

@@ -100,8 +100,8 @@ var AEAD_ALGS = Object.create(null);
 
 var DEFERRED = new Set([
   oid.byName("data"), oid.byName("signedAndEnvelopedData"),
-  oid.byName("digestedData"),
 ]);
+var OID_DIGESTED_DATA = oid.byName("digestedData");
 var OID_CONTENT_TYPE = oid.byName("contentType");
 var OID_MESSAGE_DIGEST = oid.byName("messageDigest");
 var OID_SIGNING_TIME = oid.byName("signingTime");
@@ -878,6 +878,32 @@ var COMPRESSED_DATA = schema.seq([
   },
 });
 
+var DIGESTED_DATA_VERSION = pkix.versionReader(NS, { "0": 0, "2": 2 });
+
+var DIGESTED_DATA = schema.seq([
+  schema.field("version", DIGESTED_DATA_VERSION),
+  schema.field("digestAlgorithm", ALGORITHM_IDENTIFIER),
+  schema.field("encapContentInfo", ENCAP_CONTENT_INFO),
+  schema.field("digest", schema.octetString()),
+], {
+  assert: "sequence", arity: { exact: 4 }, code: "cms/bad-digested-data", what: "DigestedData",
+  build: function (m, ctx) {
+    var version = m.fields.version.value;
+    var eci = m.fields.encapContentInfo.value.result;
+    var expected = eci.eContentType === OID_DATA ? 0 : 2;
+    if (version !== expected) {
+      throw ctx.E("cms/bad-version", "a DigestedData over " + (ctx.oid.name(eci.eContentType) || eci.eContentType) +
+        " is version " + expected + " (RFC 5652 sec. 7)");
+    }
+    return {
+      version: version,
+      digestAlgorithm: m.fields.digestAlgorithm.value.result,
+      encapContentInfo: eci,
+      digest: m.fields.digest.value,
+    };
+  },
+});
+
 var CONTENT_INFO = schema.seq([
   schema.field("contentType", schema.oidLeaf()),
   schema.field("content", schema.explicit(0, schema.any(), { code: "cms/not-a-content-info" })),
@@ -892,6 +918,7 @@ var CONTENT_INFO = schema.seq([
     else if (ct === OID_AUTH_DATA) inner = AUTHENTICATED_DATA;
     else if (ct === OID_AUTH_ENVELOPED_DATA) inner = AUTH_ENVELOPED_DATA;
     else if (ct === OID_COMPRESSED_DATA) inner = COMPRESSED_DATA;
+    else if (ct === OID_DIGESTED_DATA) inner = DIGESTED_DATA;
     if (inner === null) {
       if (DEFERRED.has(ct)) {
         throw NS.E("cms/unsupported-content-type", (ctx.oid.name(ct) || ct) + " is recognized but not parsed by this build");