@blamejs/pki 0.8.10 → 0.8.11

package/lib/schema-crl.js

@@ -36,11 +36,6 @@ var PemError = frameworkError.PemError;
 var TAGS = asn1.TAGS;
 
 
-var CRL_REASONS = pkix.CRL_REASON_NAMES;
-
-var OID_CRL_NUMBER = oid.byName("cRLNumber");
-var OID_REASON_CODE = oid.byName("reasonCode");
-var OID_INVALIDITY_DATE = oid.byName("invalidityDate");
 
 var NS = pkix.makeNS("crl", CrlError, oid);
 
@@ -51,29 +46,23 @@ var TIME = pkix.time(NS);
 
 var CRL_VERSION = pkix.versionReader(NS, { "1": 2 });
 
+/** @internal The decoders are the shared scope registry's, so which extensions a CRL profiles at
+ * which scope is stated once rather than in an if/else chain here. What stays here is this
+ * module's own wrapping: every fault becomes `crl/bad-extension-value` naming the extension, and
+ * an OID no scope profiles keeps its raw value. The signature and the `undefined`-means-both
+ * reading are unchanged, because `lib/lint.js` calls this with one argument. */
+var CRL_EXT_DECODERS = pkix.crlExtensionDecoders(NS);
+
 function decodeExt(ext, scope, ctx) {
   var value = ext.value;
-  var atCrl = scope !== "entry";
-  var atEntry = scope !== "crl";
-  try {
-    if (ext.oid === OID_CRL_NUMBER && atCrl) {
-      value = asn1.read.integer(pkix.decodeNested(ext.value, ctx, "a cRLNumber extension value"));
-      if (value < 0n) throw new Error("cRLNumber must be non-negative (INTEGER 0..MAX)");
-    } else if (ext.oid === OID_REASON_CODE && atEntry) {
-      var reason = asn1.read.enumerated(pkix.decodeNested(ext.value, ctx, "a reasonCode extension value"));
-      if (!_hasOwn(CRL_REASONS, reason.toString())) throw new Error("undefined CRLReason " + reason.toString());
-      value = Number(reason);
-    } else if (ext.oid === OID_INVALIDITY_DATE && atEntry) {
-      var n = pkix.decodeNested(ext.value, ctx, "an invalidityDate extension value");
-      if (n.tagClass !== "universal" || n.tagNumber !== TAGS.GENERALIZED_TIME) {
-        throw new Error("invalidityDate must be a GeneralizedTime");
-      }
-      value = asn1.read.time(n);
+  var decoder = CRL_EXT_DECODERS.at(ext.oid, scope);
+  if (decoder !== null) {
+    try { value = decoder(ext.value, ctx); }
+    catch (e) {
+      throw NS.E("crl/bad-extension-value", "malformed " + (ext.name || ext.oid) + " extension value: " + ((e && e.message) || String(e)), e);
     }
-  } catch (e) {
-    throw NS.E("crl/bad-extension-value", "malformed " + (ext.name || ext.oid) + " extension value: " + ((e && e.message) || String(e)), e);
   }
-  return { oid: ext.oid, name: ext.name, critical: ext.critical, value: value };
+  return { oid: ext.oid, name: ext.name, critical: ext.critical, value: value, valueBytes: ext.value };
 }
 
 var REVOKED_ENTRY = schema.seq([
@@ -169,6 +158,10 @@ var CERTIFICATE_LIST = pkix.signedEnvelope(NS, TBS_CERTLIST, {
  * validated on the way in; a malformed CertificateList / TBSCertList throws a
  * typed `CrlError` (`crl/*`) and a leaf-level codec fault surfaces as `asn1/*`.
  *
+ * Each extension record is `{ oid, name, critical, value, valueBytes }`. `valueBytes` is the raw
+ * `extnValue` octets and `value` is the decoded form for the three extensions this parse decodes in
+ * place, `cRLNumber`, `reasonCode` and `invalidityDate`, and the same octets for every other.
+ *
  * @example
  *   var pair = await pki.key.generate("Ed25519");
  *   var key = await pki.key.export(pair.privateKey);
@@ -245,19 +238,11 @@ function matches(root) {
   return schema.isUniversalOneOf(pos, [TAGS.UTC_TIME, TAGS.GENERALIZED_TIME]);
 }
 
-/** @internal The criticality RFC 5280 sec. 5.3 fixes for each CRL entry extension, keyed by dotted
- *  OID through the registry the caller passes: the CRL signer, the OCSP signer (sec. 4.4.5 carries
- *  the same extensions into a SingleResponse) and the linter all read this one table. */
-var ENTRY_EXTENSION_CRITICALITY_ROWS = [
-  ["reasonCode", false, "RFC 5280 sec. 5.3.1"], ["invalidityDate", false, "RFC 5280 sec. 5.3.2"],
-  ["certificateIssuer", true, "RFC 5280 sec. 5.3.3"],
-];
+/** @internal The criticality RFC 5280 sec. 5.3 fixes for each CRL entry extension, from the shared
+ *  scope registry: the CRL signer, the OCSP signer (sec. 4.4.5 carries the same extensions into a
+ *  SingleResponse) and the linter all read this one table. */
 function entryExtensionCriticality(oidRegistry) {
-  var table = intrinsic.create(null);
-  intrinsic.forEach(ENTRY_EXTENSION_CRITICALITY_ROWS, function (r) {
-    table[oidRegistry.byName(r[0])] = { critical: r[1], citation: r[2] };
-  });
-  return table;
+  return pkix.crlEntryFixedCriticality(oidRegistry);
 }
 /** @internal Reads a CRL entry extension's value the way this parser reads it, for a consumer that
  *  meets one outside a CRL (an OCSP SingleResponse, RFC 6960 sec. 4.4.5): reasonCode and
@@ -272,19 +257,132 @@ function readEntryExtension(ext, ctx) {
   catch (e) {
     throw NS.E("crl/bad-extension-value", "malformed certificateIssuer extension value: " + ((e && e.message) || intrinsic.String(e)), e);
   }
-  return { oid: ext.oid, name: ext.name, critical: ext.critical, value: names };
+  return { oid: ext.oid, name: ext.name, critical: ext.critical, value: names, valueBytes: ext.value };
+}
+
+/** @internal The three scopes a CRL reader meets, as the shared door reads them. `ocsp-single`
+ *  carries the entry tables under its own key because RFC 6960 sec. 4.4.5 puts a CRL entry
+ *  extension in an OCSP SingleResponse, where the row should say where it was read rather than
+ *  claim it came off a CRL entry. */
+function crlDoorTable(arm) {
+  return function (ctx) { return pkix.crlExtensionDecoders(ctx).doorScope[arm]; };
 }
+var CRL_SCOPES = intrinsic.assign(intrinsic.create(null), {
+  "crl": { decoders: crlDoorTable("crl"), criticality: pkix.crlFixedCriticality(oid) },
+  "crl-entry": { decoders: crlDoorTable("entry"), criticality: pkix.crlEntryFixedCriticality(oid) },
+  "ocsp-single": { decoders: crlDoorTable("entry"), criticality: pkix.crlEntryFixedCriticality(oid) },
+});
+
+/** @internal The parse decodes cRLNumber, reasonCode and invalidityDate in place, so its records
+ *  carry the decoded value. The door reads the raw octets the record kept beside it, and decodes
+ *  them itself under this call's caps and this call's scope. */
+function rawRecords(list) {
+  return intrinsic.map(list || [], function (e) {
+    return { oid: e.oid, name: e.name, critical: e.critical, value: e.valueBytes };
+  });
+}
+
+var DOOR = pkix.extensionDoor({
+  ns: NS, ErrorClass: CrlError, key: "crl", kind: "crl", what: "the CRL",
+  parse: parse, scopes: CRL_SCOPES,
+  segments: function (crl) {
+    var out = [{ list: rawRecords(crl.crlExtensions), scope: "crl" }];
+    var revoked = crl.revokedCertificates || [];
+    for (var i = 0; i < revoked.length; i++) {
+      intrinsic.push(out, { list: rawRecords(revoked[i].crlEntryExtensions), scope: "crl-entry", containerIndex: i });
+    }
+    return out;
+  },
+});
+
+/**
+ * @primitive  pki.schema.crl.decodeExtensions
+ * @signature  pki.schema.crl.decodeExtensions(crlOrBytes, opts?) -> rows
+ * @since      0.8.11
+ * @status     stable
+ * @spec       RFC 5280 sec. 5.2, RFC 5280 sec. 5.3
+ * @related    pki.schema.crl.parse, pki.schema.x509.decodeExtensions, pki.lint.crl
+ *
+ * Read a CRL's extensions as decoded records: the CRL's own extensions first, then each revoked
+ * entry's. The argument is the object `parse` returned or the bytes `parse` takes.
+ *
+ * One array spans both scopes rather than two, because RFC 5280 sec. 5.3 makes an unreadable
+ * critical ENTRY extension a verdict about the whole CRL, and a caller handed two lists can read
+ * one and not the other. Each row names where it was read: `scope` is `"crl"` or `"crl-entry"`, and
+ * `containerIndex` is the position of the revoked entry an entry row came from, or `null` for the
+ * CRL's own.
+ *
+ * Each row is `{ oid, name, critical, value, scope, index, containerIndex, state, decoded, code,
+ * profile }`. `state` is the discriminator: `"decoded"`, `"unrecognized"` for an OID no decoder is
+ * registered for AT THAT SCOPE, and `"undecodable"`. A `cRLNumber` on a revoked entry and a
+ * `reasonCode` on the CRL are each unrecognized rather than undecodable, because neither scope
+ * profiles the other's extension.
+ *
+ * @opts
+ *   - `strict` (boolean) -- throw the decoder's own typed error instead of reporting an
+ *     undecodable value. It does not turn an unrecognized OID into a throw.
+ *   - `maxBytes` / `maxDepth` / `maxItems` (integer) -- decode caps for this call. Each may only
+ *     tighten the built-in ceiling, and each bounds the decoding this call performs.
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey);
+ *   var caCert = await pki.x509.sign({ subject: "Issuing CA", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z"),
+ *     extensions: { basicConstraints: { cA: true }, keyUsage: ["keyCertSign", "cRLSign"] } }, { key: key });
+ *   var crlDer = await pki.crl.sign({ thisUpdate: new Date("2026-01-01T00:00:00Z"), crlNumber: 7n,
+ *     revoked: [{ serialNumber: 0x0a3fn, revocationDate: new Date("2026-01-15T00:00:00Z"), reason: "keyCompromise" }] },
+ *     { cert: caCert, key: key });
+ *   var rows = pki.schema.crl.decodeExtensions(crlDer);
+ *   rows.filter(function (r) { return r.scope === "crl-entry" && r.name === "reasonCode"; })[0].decoded;  // -> 1
+ */
+var decodeExtensions = DOOR.decodeExtensions;
+
+/**
+ * @primitive  pki.schema.crl.decodeExtension
+ * @signature  pki.schema.crl.decodeExtension(ext, opts) -> row
+ * @since      0.8.11
+ * @status     stable
+ * @spec       RFC 5280 sec. 5.2, RFC 5280 sec. 5.3, RFC 6960 sec. 4.4.5
+ * @related    pki.schema.crl.decodeExtensions
+ *
+ * Read one CRL extension record as a decoded row. `opts.scope` is required and says which table to
+ * read it against, because the same identifier means different things at the three scopes a CRL
+ * reader meets. The argument is `{ oid, name, critical, value }`, with `value` the raw `extnValue`
+ * octets, which a `parse` result carries as `valueBytes`.
+ *
+ * @opts
+ *   - `scope` (string, required) -- `"crl"` for a CRL's own extension, `"crl-entry"` for a revoked
+ *     entry's, `"ocsp-single"` for one carried in an OCSP `SingleResponse` (RFC 6960 sec. 4.4.5).
+ *   - `strict` (boolean) -- throw the decoder's own typed error instead of reporting an
+ *     undecodable value.
+ *   - `maxBytes` / `maxDepth` / `maxItems` (integer) -- decode caps for this call.
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey);
+ *   var caCert = await pki.x509.sign({ subject: "Issuing CA", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z"),
+ *     extensions: { basicConstraints: { cA: true }, keyUsage: ["keyCertSign", "cRLSign"] } }, { key: key });
+ *   var crlDer = await pki.crl.sign({ thisUpdate: new Date("2026-01-01T00:00:00Z"), crlNumber: 7n,
+ *     revoked: [{ serialNumber: 0x0a3fn, revocationDate: new Date("2026-01-15T00:00:00Z"), reason: "keyCompromise" }] },
+ *     { cert: caCert, key: key });
+ *   var e = pki.schema.crl.parse(crlDer).revokedCertificates[0].crlEntryExtensions[0];
+ *   pki.schema.crl.decodeExtension({ oid: e.oid, name: e.name, critical: e.critical, value: e.valueBytes },
+ *     { scope: "crl-entry" }).decoded;  // -> 1
+ */
+var decodeExtension = DOOR.decodeExtension;
 
 module.exports = {
   parse: parse,
   pemDecode: pemDecode,
   pemEncode: pemEncode,
   matches: matches,
+  decodeExtensions: decodeExtensions,
+  decodeExtension: decodeExtension,
   /** @internal The reader this parser applies to a CRL entry extension (reasonCode, invalidityDate),
    *  for a consumer that meets the same extension elsewhere: RFC 6960 sec. 4.4.5 carries every CRL
    *  entry extension into an OCSP SingleResponse, and the linter reads it with this rather than a
    *  second one. Not on the curated `pki.schema.crl` surface. */
-  decodeExtension: decodeExt,
+  decodeExt: decodeExt,
   entryExtensionCriticality: entryExtensionCriticality,
   readEntryExtension: readEntryExtension,
 };

package/lib/schema-crmf.js

@@ -40,6 +40,7 @@ var pkix = require("./schema-pkix");
 var cms = require("./schema-cms");
 var oid = require("./oid");
 var frameworkError = require("./framework-error");
+var intrinsic = require("./guard-intrinsic");
 
 var CrmfError = frameworkError.CrmfError;
 var PemError = frameworkError.PemError;
@@ -140,7 +141,7 @@ var POPO_SIGNING_KEY = schema.seq([
   },
 });
 
-var POPOPRIVKEY_METHODS = Object.assign(Object.create(null), { 0: "thisMessage", 1: "subsequentMessage", 2: "dhMAC", 3: "agreeMAC", 4: "encryptedKey" });
+var POPOPRIVKEY_METHODS = intrinsic.assign(intrinsic.create(null), { 0: "thisMessage", 1: "subsequentMessage", 2: "dhMAC", 3: "agreeMAC", 4: "encryptedKey" });
 function popoPrivKey(type) {
   return schema.decode(function (n, ctx) {
     if (!n.children || n.children.length !== 1) {
@@ -203,7 +204,7 @@ var CONTROL = schema.seq([
     return { type: t, name: ctx.oid.name(t) || null, value: m.fields.value.node.bytes };
   },
 });
-function mapControls(m) { return m.items.map(function (it) { return it.value.result; }); }
+function mapControls(m) { return intrinsic.map(m.items, function (it) { return it.value.result; }); }
 var CONTROLS = schema.seqOf(CONTROL, { assert: "sequence", min: 1, code: "crmf/bad-controls", what: "Controls", build: mapControls });
 var REG_INFO = schema.seqOf(CONTROL, { assert: "sequence", min: 1, code: "crmf/bad-reg-info", what: "regInfo", build: mapControls });
 
@@ -261,7 +262,7 @@ var CERT_REQUEST = schema.seq([
     }
     return {
       certReqId:     m.fields.certReqId.value,
-      certReqIdHex:  m.fields.certReqId.node.content.toString("hex"),
+      certReqIdHex:  intrinsic.bufToString(m.fields.certReqId.node.content, "hex"),
       certTemplate:  tpl,
       controls:      m.fields.controls.present ? m.fields.controls.value.result : null,
       certReqBytes:  m.node.bytes,
@@ -287,7 +288,7 @@ var CERT_REQ_MSG = schema.seq([
         throw ctx.E("crmf/bad-popo", "poposkInput MUST be present when the CertTemplate lacks subject or publicKey (RFC 4211 sec. 4.1)");
       }
       if (popo.poposkInput !== null && certReq.certTemplate.publicKey !== null &&
-          !popo.poposkInput.publicKey.equals(certReq.certTemplate.publicKey.bytes)) {
+          !intrinsic.bufferEquals(popo.poposkInput.publicKey, certReq.certTemplate.publicKey.bytes)) {
         throw ctx.E("crmf/bad-popo", "POPOSigningKeyInput publicKey MUST equal the CertTemplate publicKey (RFC 4211 sec. 4.1)");
       }
     }
@@ -305,7 +306,7 @@ var CERT_REQ_MSG = schema.seq([
 
 var CERT_REQ_MESSAGES = schema.seqOf(CERT_REQ_MSG, {
   assert: "sequence", min: 1, code: "crmf/bad-cert-req-messages", what: "CertReqMessages",
-  build: function (m) { return { messages: m.items.map(function (it) { return it.value.result; }) }; },
+  build: function (m) { return { messages: intrinsic.map(m.items, function (it) { return it.value.result; }) }; },
 });
 
 
@@ -422,7 +423,7 @@ function matches(root) {
 function walkCertReqMessages(node, opts, outer) {
   var ctx = schema.withResources(NS, outer);
   if (opts && (opts.allowSigningAlg || opts.allowV1Version)) {
-    ctx = Object.assign({}, ctx);
+    ctx = intrinsic.assign({}, ctx);
     if (opts.allowSigningAlg) ctx.allowSigningAlg = true;
     if (opts.allowV1Version) ctx.allowV1Version = true;
   }
@@ -432,11 +433,95 @@ function walkCertTemplate(node, outer) {
   return schema.walk(CERT_TEMPLATE, node, schema.withResources(NS, outer)).result;
 }
 
+/** @internal A CertTemplate asks for certificate extensions, so the certificate table reads them.
+ *  As with a PKCS#10 request, criticality is part of what is asked for and RFC 4211 sec. 5 leaves
+ *  the decision to the CA; the criticality RFC 5280 fixes is reported all the same. */
+var CRMF_SCOPES = intrinsic.assign(intrinsic.create(null), {
+  "crmf-template": {
+    decoders: function (ctx) { return pkix.certExtensionDecoders(ctx).byOid; },
+    criticality: pkix.certFixedCriticality(oid),
+  },
+});
+
+var DOOR = pkix.extensionDoor({
+  ns: NS, ErrorClass: CrmfError, key: "crmf", kind: "crmf", what: "the certificate request messages",
+  parse: parse, scopes: CRMF_SCOPES, defaultScope: "crmf-template",
+  segments: function (parsed) {
+    var messages = parsed.messages || [];
+    var out = [];
+    for (var i = 0; i < messages.length; i++) {
+      var template = messages[i].certReq && messages[i].certReq.certTemplate;
+      intrinsic.push(out, { list: (template && template.extensions) || [], scope: "crmf-template", containerIndex: i });
+    }
+    return out;
+  },
+});
+
+/**
+ * @primitive  pki.schema.crmf.decodeExtensions
+ * @signature  pki.schema.crmf.decodeExtensions(messagesOrBytes, opts?) -> rows
+ * @since      0.8.11
+ * @status     stable
+ * @spec       RFC 4211 sec. 5, RFC 5280 sec. 4.2
+ * @related    pki.schema.crmf.parse, pki.schema.csr.decodeExtensions
+ *
+ * Read the extensions the certificate templates in a `CertReqMessages` ask for, as decoded records.
+ * The argument is the object `parse` returned or the bytes `parse` takes, and the rows of every
+ * message are returned in one array, each naming the message it came from in `containerIndex`.
+ *
+ * Each row is `{ oid, name, critical, value, scope, index, containerIndex, state, decoded, code,
+ * profile }`, with `scope` `"crmf-template"`. Criticality here is part of the request: RFC 4211
+ * sec. 5 leaves which requested extensions to honor to the CA, and `profile` reports what RFC 5280
+ * would fix for the certificate the request would produce.
+ *
+ * @opts
+ *   - `strict` (boolean) -- throw the decoder's own typed error instead of reporting an
+ *     undecodable value. It does not turn an unrecognized OID into a throw.
+ *   - `maxBytes` / `maxDepth` / `maxItems` (integer) -- decode caps for this call.
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var der = await pki.crmf.build(
+ *     { certReqId: 0, certTemplate: { subject: "req.example", publicKey: await pki.key.export(pair.publicKey),
+ *       extensions: { subjectAltName: [{ dNSName: "req.example" }] } } },
+ *     { key: await pki.key.export(pair.privateKey) });
+ *   var rows = pki.schema.crmf.decodeExtensions(der);
+ *   rows[0].scope + " " + rows[0].name;  // -> "crmf-template subjectAltName"
+ */
+var decodeExtensions = DOOR.decodeExtensions;
+
+/**
+ * @primitive  pki.schema.crmf.decodeExtension
+ * @signature  pki.schema.crmf.decodeExtension(ext, opts?) -> row
+ * @since      0.8.11
+ * @status     stable
+ * @spec       RFC 4211 sec. 5
+ * @related    pki.schema.crmf.decodeExtensions
+ *
+ * Read one requested extension record as a decoded row, at scope `"crmf-template"`. The argument is
+ * one element of a `certTemplate`'s `extensions`, as `{ oid, name, critical, value }`.
+ *
+ * @opts
+ *   - `strict` (boolean) -- throw the decoder's own typed error instead of reporting an
+ *     undecodable value.
+ *   - `maxBytes` / `maxDepth` / `maxItems` (integer) -- decode caps for this call.
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var der = await pki.crmf.build(
+ *     { certReqId: 0, certTemplate: { subject: "req.example", publicKey: await pki.key.export(pair.publicKey),
+ *       extensions: { subjectAltName: [{ dNSName: "req.example" }] } } },
+ *     { key: await pki.key.export(pair.privateKey) });
+ *   var msgs = pki.schema.crmf.parse(der);
+ *   pki.schema.crmf.decodeExtension(msgs.messages[0].certReq.certTemplate.extensions[0]).name;  // -> "subjectAltName"
+ */
+var decodeExtension = DOOR.decodeExtension;
+
 module.exports = {
   parse: parse,
   pemDecode: pemDecode,
   pemEncode: pemEncode,
   matches: matches,
+  decodeExtensions: decodeExtensions,
+  decodeExtension: decodeExtension,
   walkCertReqMessages: walkCertReqMessages,
   walkCertTemplate: walkCertTemplate,
   certReqMessagesSchema: CERT_REQ_MESSAGES,

package/lib/schema-csr.js

@@ -34,6 +34,7 @@ var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
 var oid = require("./oid");
 var frameworkError = require("./framework-error");
+var intrinsic = require("./guard-intrinsic");
 
 var CsrError = frameworkError.CsrError;
 var PemError = frameworkError.PemError;
@@ -52,16 +53,16 @@ var DIRECTORY_STRING_TAGS = [
   asn1.TAGS.UTF8_STRING, asn1.TAGS.PRINTABLE_STRING, asn1.TAGS.TELETEX_STRING,
   asn1.TAGS.UNIVERSAL_STRING, asn1.TAGS.BMP_STRING,
 ];
-var RECOGNIZED_ATTRIBUTE_VALUE = Object.create(null);
+var RECOGNIZED_ATTRIBUTE_VALUE = intrinsic.create(null);
 RECOGNIZED_ATTRIBUTE_VALUE[oid.byName("extensionRequest")] = function (node, ctx) {
   try { return { extensions: schema.walk(EXTENSIONS, node, ctx).result }; }
   catch (e) {
     throw ctx.E("csr/bad-attribute-value",
-      "extensionRequest value must be a well-formed Extensions SEQUENCE (RFC 2985 sec. 5.4.2): " + ((e && e.message) || String(e)), e);
+      "extensionRequest value must be a well-formed Extensions SEQUENCE (RFC 2985 sec. 5.4.2): " + ((e && e.message) || intrinsic.String(e)), e);
   }
 };
 RECOGNIZED_ATTRIBUTE_VALUE[oid.byName("challengePassword")] = function (node, ctx) {
-  if (node.tagClass !== "universal" || DIRECTORY_STRING_TAGS.indexOf(node.tagNumber) === -1) {
+  if (node.tagClass !== "universal" || intrinsic.indexOf(DIRECTORY_STRING_TAGS, node.tagNumber) === -1) {
     throw ctx.E("csr/bad-attribute-value", "challengePassword must be a DirectoryString (RFC 2985 sec. 5.4.1)");
   }
   var s;
@@ -80,7 +81,7 @@ var CERTIFICATION_REQUEST_INFO = schema.seq([
 ], {
   assert: "sequence", code: "csr/bad-cri", what: "certificationRequestInfo",
   build: function (m, ctx) {
-    var attributes = m.fields.attributes.value.items.map(function (it) {
+    var attributes = intrinsic.map(m.fields.attributes.value.items, function (it) {
       var a = it.value.result;
       var checkValue = RECOGNIZED_ATTRIBUTE_VALUE[a.type];
       if (checkValue) {
@@ -89,7 +90,7 @@ var CERTIFICATION_REQUEST_INFO = schema.seq([
           throw ctx.E("csr/bad-attribute-value", (a.name || a.type) + " is a SINGLE VALUE attribute (RFC 2985 sec. 5.4)");
         }
         var enriched = checkValue(valueItems[0].node, ctx);
-        if (enriched) { Object.keys(enriched).forEach(function (k) { a[k] = enriched[k]; }); }
+        if (enriched) { intrinsic.forEach(intrinsic.keys(enriched), function (k) { a[k] = enriched[k]; }); }
       }
       return a;
     });
@@ -205,10 +206,120 @@ function matches(root) {
     schema.isContext(k[3], 0);
 }
 
+/** @internal A request asks for certificate extensions, so the certificate table reads them. What
+ *  the scope changes is the verdict a caller draws: RFC 2985 sec. 5.4.2 makes criticality part of
+ *  the REQUEST, and which requested extensions to honor, critical or not, is the CA's decision. The
+ *  criticality profile is reported all the same, because a CA honoring a request against it would
+ *  issue a non-conforming certificate. */
+var CSR_SCOPES = intrinsic.assign(intrinsic.create(null), {
+  "csr-requested": {
+    decoders: function (ctx) { return pkix.certExtensionDecoders(ctx).byOid; },
+    criticality: pkix.certFixedCriticality(oid),
+  },
+});
+var OID_EXTENSION_REQUEST = oid.byName("extensionRequest");
+
+function _err(code, message, cause) { return new CsrError(code, message, cause); }
+
+var DOOR = pkix.extensionDoor({
+  ns: NS, ErrorClass: CsrError, key: "csr", kind: "csr", what: "the certification request",
+  parse: parse, scopes: CSR_SCOPES, defaultScope: "csr-requested", groups: true,
+  segments: function (csr, read) {
+    var attrs = csr.attributes || [];
+    var out = [];
+    for (var i = 0; i < attrs.length; i++) {
+      if (attrs[i].type !== OID_EXTENSION_REQUEST) continue;
+      intrinsic.push(out, { list: attrs[i].extensions || [], scope: "csr-requested", containerIndex: i });
+    }
+    if (!read.groups && out.length > 1) {
+      throw _err("csr/ambiguous-extension-request", "this request carries " + out.length +
+        " extensionRequest attributes, and which of them a CA should honor is not stated anywhere; " +
+        "pass { groups: true } to read each one separately");
+    }
+    return out;
+  },
+  group: function (rows, segments) {
+    var out = [], byIndex = intrinsic.create(null);
+    for (var s = 0; s < segments.length; s++) {
+      var g = { attributeIndex: segments[s].containerIndex, extensions: [] };
+      byIndex[segments[s].containerIndex] = g;
+      intrinsic.push(out, g);
+    }
+    for (var r = 0; r < rows.length; r++) intrinsic.push(byIndex[rows[r].containerIndex].extensions, rows[r]);
+    return out;
+  },
+});
+
+/**
+ * @primitive  pki.schema.csr.decodeExtensions
+ * @signature  pki.schema.csr.decodeExtensions(csrOrBytes, opts?) -> rows
+ * @since      0.8.11
+ * @status     stable
+ * @spec       RFC 2985 sec. 5.4.2, RFC 5280 sec. 4.2
+ * @related    pki.schema.csr.parse, pki.schema.x509.decodeExtensions
+ *
+ * Read the extensions a certification request asks for, as decoded records. This is the verb a CA
+ * calls to see what a request wants before deciding what to issue. The argument is the object
+ * `parse` returned or the bytes `parse` takes.
+ *
+ * The rows come from the request's one `extensionRequest` attribute. A request carrying more than
+ * one is refused with `csr/ambiguous-extension-request`, because nothing says which of them a CA
+ * should honor; pass `groups: true` to read each attribute separately instead.
+ *
+ * Each row is `{ oid, name, critical, value, scope, index, containerIndex, state, decoded, code,
+ * profile }`, with `scope` `"csr-requested"` and `containerIndex` the position of the attribute the
+ * row came from. Criticality here is part of the request, not a verdict: RFC 2985 sec. 5.4.2 leaves
+ * which requested extensions to honor to the CA, and `profile` reports what RFC 5280 would fix for
+ * the certificate that request would produce.
+ *
+ * @opts
+ *   - `groups` (boolean) -- return `[{ attributeIndex, extensions }]`, one entry per
+ *     `extensionRequest` attribute, instead of one flat table. This is how a non-conforming request
+ *     carrying several is read.
+ *   - `strict` (boolean) -- throw the decoder's own typed error instead of reporting an
+ *     undecodable value. It does not turn an unrecognized OID into a throw.
+ *   - `maxBytes` / `maxDepth` / `maxItems` (integer) -- decode caps for this call.
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var csrDer = await pki.csr.sign({ subject: "req.example", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     extensionRequest: { subjectAltName: [{ dNSName: "req.example" }] } },
+ *     { key: await pki.key.export(pair.privateKey) });
+ *   var rows = pki.schema.csr.decodeExtensions(csrDer);
+ *   rows.filter(function (r) { return r.name === "subjectAltName"; })[0].state;  // -> "decoded"
+ */
+var decodeExtensions = DOOR.decodeExtensions;
+
+/**
+ * @primitive  pki.schema.csr.decodeExtension
+ * @signature  pki.schema.csr.decodeExtension(ext, opts?) -> row
+ * @since      0.8.11
+ * @status     stable
+ * @spec       RFC 2985 sec. 5.4.2
+ * @related    pki.schema.csr.decodeExtensions
+ *
+ * Read one requested extension record as a decoded row, at scope `"csr-requested"`. The argument is
+ * one element of an `extensionRequest` attribute's `extensions`, as `{ oid, name, critical, value }`.
+ *
+ * @opts
+ *   - `strict` (boolean) -- throw the decoder's own typed error instead of reporting an
+ *     undecodable value.
+ *   - `maxBytes` / `maxDepth` / `maxItems` (integer) -- decode caps for this call.
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var csrDer = await pki.csr.sign({ subject: "req.example", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     extensionRequest: { subjectAltName: [{ dNSName: "req.example" }] } },
+ *     { key: await pki.key.export(pair.privateKey) });
+ *   var csr = pki.schema.csr.parse(csrDer);
+ *   pki.schema.csr.decodeExtension(csr.attributes[0].extensions[0]).state;  // -> "decoded"
+ */
+var decodeExtension = DOOR.decodeExtension;
+
 module.exports = {
   parse: parse,
   pemDecode: pemDecode,
   pemEncode: pemEncode,
   matches: matches,
+  decodeExtensions: decodeExtensions,
+  decodeExtension: decodeExtension,
   certificationRequestSchema: CERTIFICATION_REQUEST,
 };