@blamejs/pki 0.8.30 → 0.8.48

package/lib/jose.js

@@ -39,6 +39,10 @@
 var constants = require("./constants");
 var wcEngine = require("./webcrypto");
 var webcrypto = wcEngine.webcrypto;
+/** @internal The verify operation, captured at load. The object was held and its METHOD fetched per
+ * call, which leaves it replaceable: one answering true accepts a JWS whose signer never signed it,
+ * including on the embedded-key route this module pins against its thumbprint. */
+var _subtleVerify = require("./guard-intrinsic").uncurry(webcrypto.subtle.verify);
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
 var edwardsPoint = require("./edwards-point");
@@ -121,11 +125,11 @@ function b64uDecode(text) {
  *   pki.jose.parseJson('{"a":1}');   // -> { a: 1 }
  */
 function parseJson(input) {
-  return guard.json.parse(input, E, {
+  return guard.verdict.shield(guard.json.parse(input, E, {
     maxBytes: LIMITS.JSON_MAX_BYTES, maxDepth: LIMITS.JSON_MAX_DEPTH,
     badJson: "jose/bad-json", tooDeep: "jose/too-deep", duplicateMember: "jose/duplicate-member",
     tooLarge: "jose/too-large", badInput: "jose/bad-input", label: "the JSON document",
-  });
+  }));
 }
 
 
@@ -329,9 +333,18 @@ async function verify(jws, opts) {
   if (!jws || typeof jws !== "object" || _isArray(jws)) throw E("jose/bad-jws", "a flattened JWS object is required");
   if (_hasOwn(jws, "signatures")) throw E("jose/bad-jws", "the multi-signature signatures member is forbidden");
   if (_hasOwn(jws, "header")) throw E("jose/bad-jws", "the unprotected header member is forbidden");
-  if (typeof jws.protected !== "string" || typeof jws.signature !== "string") throw E("jose/bad-jws", "protected and signature must be base64url strings");
-  if (typeof jws.payload !== "string") throw E("jose/bad-jws", "payload must be a base64url string (never detached)");
-  var header = parseJson(b64uDecode(jws.protected));
+  /** @internal The three members are taken ONCE, for the reason `opts` is above: the JWS is the caller's
+   *  object, and a member reached through an accessor answers every read separately. `protected` decides
+   *  both the header the profile rules are applied to and the signing input the signature is checked over,
+   *  and the thumbprint comparison awaits between those two uses, so reading it twice would let the rules
+   *  be applied to one message and the signature checked over another. Everything below reads these
+   *  locals. */
+  var protectedB64 = jws.protected;
+  var signatureB64 = jws.signature;
+  var payloadB64 = jws.payload;
+  if (typeof protectedB64 !== "string" || typeof signatureB64 !== "string") throw E("jose/bad-jws", "protected and signature must be base64url strings");
+  if (typeof payloadB64 !== "string") throw E("jose/bad-jws", "payload must be a base64url string (never detached)");
+  var header = parseJson(b64uDecode(protectedB64));
   var profileName = opts.profile || "acme-outer";
   var checked = _checkHeader(header, profileName);
   /** @internal The embedded jwk is the signer's PUBLIC key (RFC 7515 sec. 4.1.3). One carrying
@@ -342,14 +355,32 @@ async function verify(jws, opts) {
   if (opts.key !== undefined && (typeof opts.key !== "object" || opts.key === null || _isArray(opts.key))) {
     throw E("jose/bad-key", "opts.key was supplied but is not a JWK object, so the key this message must be signed under cannot be established");
   }
-  var jwk = header.jwk || opts.key;
+  /** @internal The caller's key is COPIED here, before ANY member of it is read, and everything below
+   *  reads the copy: the thumbprint comparison against the embedded jwk, the key-type check, the Edwards
+   *  low-order point gate, the signature-width calculation, the import parameters and the algorithm
+   *  selector. Its members were read many times over, `crv` eight times and `kty` nine on one successful
+   *  verify, and an accessor answers each read separately.
+   *
+   *  The FIRST read is the one that decides which curve the point gate validates against
+   *  (`jwk.crv === "Ed25519" ? 6 : 7`), so a `crv` answering `Ed448` once and `Ed25519` afterwards had the
+   *  point gated under the wrong curve's parameters while an Ed25519 key was imported and verified. That
+   *  gate is the whole defense against a low-order key verifying a FORGED signature. Copying before the
+   *  thumbprint comparison rather than after it matters for the same reason: otherwise a key could
+   *  thumbprint as the embedded one and be copied as a different one.
+   *
+   *  `snapshotDeep` refuses an accessor-backed member rather than reading it once, which is the stronger
+   *  answer for a value that selects an algorithm. The embedded jwk comes from the parsed header and is
+   *  this module's own object, so it needs no copy. */
+  var suppliedKey = opts.key === undefined ? undefined
+    : guard.bytes.snapshotDeep(opts.key, JoseError, "jose/bad-key", "opts.key");
+  var jwk = header.jwk || suppliedKey;
   if (!jwk) throw E("jose/bad-key", "a verification key is required (opts.key) when the profile does not embed a jwk");
   var keySource = "embedded-jwk";
-  if (opts.key) {
+  if (suppliedKey) {
     keySource = "opts.key";
     if (header.jwk) {
       var embeddedTp, suppliedTp;
-      try { embeddedTp = await thumbprint(header.jwk); suppliedTp = await thumbprint(opts.key); }
+      try { embeddedTp = await thumbprint(header.jwk); suppliedTp = await thumbprint(suppliedKey); }
       catch (e) { throw E("jose/bad-key", "the embedded jwk and opts.key could not be compared as RFC 7638 thumbprints", e); }
       if (embeddedTp !== suppliedTp) {
         throw E("jose/key-mismatch",
@@ -358,19 +389,19 @@ async function verify(jws, opts) {
           ", supplied " + suppliedTp + ")");
       }
     }
-    jwk = opts.key;
+    jwk = suppliedKey;
   }
   _assertKeyType(checked.algRow, jwk);
-  var sig = b64uDecode(jws.signature);
+  var sig = b64uDecode(signatureB64);
   var want = _expectedSigBytes(checked.algRow, jwk);
   if (want != null && sig.length !== want) throw E("jose/bad-signature", "the signature length " + sig.length + " is not the " + want + " bytes " + checked.alg + " requires");
-  var signingInput = _bufferFrom(jws.protected + "." + jws.payload, "ascii");
+  var signingInput = _bufferFrom(protectedB64 + "." + payloadB64, "ascii");
   var key;
   try { key = await webcrypto.subtle.importKey("jwk", jwk, _importParams(checked.algRow, jwk), false, ["verify"]); }
   catch (e) { throw E("jose/bad-key", "the JWK could not be imported for verification", e); }
-  var ok = await webcrypto.subtle.verify(_cryptoAlg(checked.algRow, jwk), key, sig, signingInput);
+  var ok = await _subtleVerify(webcrypto.subtle, _cryptoAlg(checked.algRow, jwk), key, sig, signingInput);
   if (!ok) throw E("jose/verify-failed", "the JWS signature did not verify");
-  return { header: header, payload: b64uDecode(jws.payload), keySource: keySource };
+  return { header: header, payload: b64uDecode(payloadB64), keySource: keySource };
 }
 
 
@@ -409,9 +440,23 @@ async function verify(jws, opts) {
  */
 var _SIGN_KEYS = intrinsic.assign(intrinsic.create(null), { protected: 1, payload: 1, key: 1, jwk: 1, profile: 1 });
 var _SIGN_KEYS_EMBEDDED_JWK = intrinsic.assign(intrinsic.create(null), { protected: 1, payload: 1, key: 1, profile: 1 });
+
+/** @internal The payload, copied, taken before anything else on the caller's object is read. Every later
+ *  read of that object is caller code when the field is an accessor, and the protected header is read
+ *  FIRST and SERIALIZED, which reaches the header object, each of its fields and any `toJSON` on it. Over
+ *  a view of the payload any of those would replace what gets signed, after the verb had accepted the
+ *  payload it was handed, so the copy comes before all of them rather than before whichever one is in
+ *  view. A payload that is not a Buffer is carried through untouched and refused where it always was, so
+ *  no diagnostic moves ahead of the header's own. */
+function _fixedPayload(supplied) {
+  if (!_isBuffer(supplied)) return supplied;
+  return guard.bytes.snapshot(supplied, JoseError, "jose/bad-input", "payload");
+}
+
 async function sign(opts) {
   opts = opts || {};
   guard.identifier.assertKnownKeys(opts, _SIGN_KEYS, E, "jose/bad-input", "unknown pki.jose.sign option ");
+  var fixedPayload = _fixedPayload(opts.payload);
   var headerJson;
   try { headerJson = _stringify(opts.protected); }
   catch (e) { throw E("jose/bad-header", "the protected header must be JSON-serializable", e); }
@@ -424,13 +469,25 @@ async function sign(opts) {
         (k === "jwk" ? "; the protected header already embeds the public JWK" : "");
     });
   }
-  var payload = opts.payload;
+  var payload = fixedPayload;
   if (!_isBuffer(payload)) throw E("jose/bad-input", "payload must be a Buffer (empty Buffer for POST-as-GET)");
-  payload = guard.bytes.view(payload, JoseError, "jose/bad-input", "payload");
-  if (!wcEngine.isCryptoKeyLike(opts.key)) throw E("jose/bad-input", "a private or secret CryptoKey (opts.key) is required");
+  /** @internal ONE read of the caller's signing key, taken before anything inspects it, and every use
+   *  below reads this binding. It was read four times: the key-like test, twice by the hash-to-algorithm
+   *  check, and once more to sign with. An accessor answers each read separately, so the check could
+   *  approve a SHA-256 key while the signature was produced by a SHA-512 one, and the JWS emitted then
+   *  DECLARES an algorithm its signature was not made under, which is the algorithm confusion the header
+   *  registry exists to close before any crypto call.
+   *
+   *  The RSA arms are where it showed: the registry's fixed signature widths catch the HMAC and EC arms,
+   *  and two 2048-bit RSA keys produce the same 256-byte signature, so the width pin below cannot see a
+   *  substitution between them. */
+  var suppliedKey = opts.key;
+  if (!wcEngine.isCryptoKeyLike(suppliedKey)) throw E("jose/bad-input", "a private or secret CryptoKey (opts.key) is required");
   var checked = _checkHeader(header, opts.profile || "acme-outer");
+  var suppliedAlg = suppliedKey.algorithm;
+  var suppliedHash = suppliedAlg && suppliedAlg.hash;
   if ((checked.algRow.kty === "RSA" || checked.algRow.kty === "oct") &&
-      (!opts.key.algorithm.hash || opts.key.algorithm.hash.name !== checked.algRow.hash)) {
+      (!suppliedHash || suppliedHash.name !== checked.algRow.hash)) {
     throw E("jose/bad-key", "the signing key's hash does not match the algorithm " + checked.alg);
   }
   if (header.jwk) { _assertKeyType(checked.algRow, header.jwk); assertPublicJwk(header.jwk); }
@@ -438,15 +495,18 @@ async function sign(opts) {
   var payloadB64 = payload.length === 0 ? "" : b64uEncode(payload);
   var signingInput = _bufferFrom(protectedB64 + "." + payloadB64, "ascii");
   var jwk = header.jwk || opts.jwk || {};
-  var signKey = await wcEngine.adoptKey(opts.key, null, ["sign"], E, "jose/bad-input");
+  /** @internal `suppliedKey` is the reading taken at the top, so the key adopted for signing, the key the
+   *  hash-to-algorithm check approved and the key the expected signature width is computed from are all
+   *  one key. */
+  var signKey = await wcEngine.adoptKey(suppliedKey, null, ["sign"], E, "jose/bad-input");
   var sigBuf = _bufferFrom(await webcrypto.subtle.sign(_cryptoAlg(checked.algRow, jwk, signKey), signKey, signingInput));
-  var want = _expectedSigBytes(checked.algRow, jwk, opts.key);
+  var want = _expectedSigBytes(checked.algRow, jwk, suppliedKey);
   if (want != null && sigBuf.length !== want) throw E("jose/bad-key", "the signing key produced a " + sigBuf.length + "-byte signature but " + checked.alg + " requires " + want + " (the key does not match the algorithm)");
   if (header.jwk) {
     var pubKey;
     try { pubKey = await webcrypto.subtle.importKey("jwk", header.jwk, _importParams(checked.algRow, header.jwk), false, ["verify"]); }
     catch (e) { throw E("jose/bad-key", "the embedded jwk could not be imported to confirm it matches the signing key", e); }
-    if (!(await webcrypto.subtle.verify(_cryptoAlg(checked.algRow, header.jwk), pubKey, sigBuf, signingInput))) {
+    if (!(await _subtleVerify(webcrypto.subtle, _cryptoAlg(checked.algRow, header.jwk), pubKey, sigBuf, signingInput))) {
       throw E("jose/bad-key", "the embedded jwk does not match the signing key (it cannot verify the produced signature)");
     }
   }
@@ -485,14 +545,22 @@ var THUMBPRINT_MEMBERS = intrinsic.assign(intrinsic.create(null), {
  *   await pki.jose.thumbprint(accountJwk);   // -> "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
  */
 async function thumbprint(jwk) {
-  if (!jwk || typeof jwk !== "object" || typeof jwk.kty !== "string") throw E("jose/bad-key", "a JWK object with a kty is required");
-  var members = THUMBPRINT_MEMBERS[jwk.kty];
-  if (!members) throw E("jose/bad-key", "unsupported JWK key type " + _stringify(jwk.kty));
+  if (!jwk || typeof jwk !== "object") throw E("jose/bad-key", "a JWK object with a kty is required");
+  /** @internal COPIED before any member is read, because what this returns is an IDENTITY. Each member
+   *  was read twice, the type check and then the value put into the hash, and `kty` four times; an
+   *  accessor answers each read separately, so a member could be checked as one value and HASHED as
+   *  another. The thumbprint is what RFC 7638 identifies a key by: `pki.jose.verify` compares an embedded
+   *  jwk against `opts.key` with it, and ACME uses it as the account identity in a key authorization. A
+   *  thumbprint over a value the checks never approved names a key that was never the one validated. */
+  var copied = guard.bytes.snapshotDeep(jwk, JoseError, "jose/bad-key", "the JWK");
+  if (typeof copied.kty !== "string") throw E("jose/bad-key", "a JWK object with a kty is required");
+  var members = THUMBPRINT_MEMBERS[copied.kty];
+  if (!members) throw E("jose/bad-key", "unsupported JWK key type " + _stringify(copied.kty));
   var parts = [];
   for (var i = 0; i < members.length; i++) {
     var m = members[i];
-    if (typeof jwk[m] !== "string") throw E("jose/bad-key", "the JWK is missing the required member " + _stringify(m));
-    _push(parts, _stringify(m) + ":" + _stringify(jwk[m]));
+    if (typeof copied[m] !== "string") throw E("jose/bad-key", "the JWK is missing the required member " + _stringify(m));
+    _push(parts, _stringify(m) + ":" + _stringify(copied[m]));
   }
   var canonical = "{" + _join(parts, ",") + "}";
   var digest = _bufferFrom(await webcrypto.subtle.digest("SHA-256", _bufferFrom(canonical, "utf8")));

package/lib/key.js

@@ -30,6 +30,11 @@ var schemaSec1 = require("./schema-sec1");
 var pkix = require("./schema-pkix");
 var schema = require("./schema-engine");
 var webcrypto = require("./webcrypto");
+/** @internal The key-material exporter, captured at load. The signature probe that decides whether two
+ *  halves are a pair imports and signs with what this returns, so a replacement exporting a different
+ *  private key makes a mismatched pair report as corresponding: the probe then signs and verifies with
+ *  a pair that does correspond, and neither half is the one the caller supplied. */
+var _exportAnyKey = webcrypto.exportAnyKey;
 var compositeKem = require("./composite-kem");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
@@ -123,7 +128,7 @@ function _sec1ToPkcs8(der, curveOid) {
 async function _toPrivateKeyDer(input) {
   if (_isCryptoKey(input)) {
     if (input.type !== "private") throw _err("key/bad-input", "a private CryptoKey is required (got a " + input.type + " key)");
-    return webcrypto.exportAnyKey(input, _err, "key/bad-input");
+    return _exportAnyKey(input, _err, "key/bad-input");
   }
   return pkix.coerceToDer(input, { pemLabel: "PRIVATE KEY", PemError: PemError, ErrorClass: KeyError, prefix: "key" });
 }
@@ -295,13 +300,13 @@ async function export_(key, opts) {
   var fmt = opts.format || "der";
   if (fmt === "jwk") {
     try {
-      return await webcrypto.exportAnyKey(key, _err, "key/bad-input", "jwk");
+      return await _exportAnyKey(key, _err, "key/bad-input", "jwk");
     } catch (e) {
       if (e && e.isPkiError) throw e;
       throw _err("key/bad-input", "exporting the key as a JWK failed", e);
     }
   }
-  var der = await webcrypto.exportAnyKey(key, _err, "key/bad-input");
+  var der = await _exportAnyKey(key, _err, "key/bad-input");
   if (fmt === "der") return der;
   if (fmt === "pem") return pkix.pemEncode(der, opts.label || defaultLabel, PemError);
   if (fmt === "pkcs1") return _toPkcs1(der, key);
@@ -870,8 +875,8 @@ async function publicFromPrivate(privateKey, opts) {
     return opts.pem ? pkix.pemEncode(spki, "PUBLIC KEY", PemError) : spki;
   }
   try {
-    var priv = nodeCrypto.createPrivateKey({ key: der, format: "der", type: "pkcs8" });
-    spki = nodeCrypto.createPublicKey(priv).export({ format: "der", type: "spki" });
+    var priv = guard.crypto.privateKey({ key: der, format: "der", type: "pkcs8" });
+    spki = guard.crypto.exportKey(guard.crypto.publicKey(priv), { format: "der", type: "spki" });
   } catch (e) { throw _err("key/bad-input", "could not derive the public key from the private key", e); }
   return opts.pem ? pkix.pemEncode(spki, "PUBLIC KEY", PemError) : spki;
 }
@@ -946,7 +951,7 @@ function _pairSignOptions(priv, pub) {
   /** @internal Null-prototype, because the engine READS this object by name. A plain object would
    * let an inherited `saltLength` reach the signature as a restriction neither half stated. */
   var options = _create(null);
-  options.padding = nodeCrypto.constants.RSA_PKCS1_PSS_PADDING;
+  options.padding = guard.crypto.padding.RSA_PKCS1_PSS;
   if (salt != null) options.saltLength = salt;
   return { digest: digest, options: options };
 }
@@ -1006,7 +1011,7 @@ async function correspondsTo(privateKey, spkiDer) {
   var privAsPkcs3 = _dhAsPkcs3(privDer, 1, "the private key's");
   try {
     _assertDhWithin(privAsPkcs3, 1, "the private key's");
-    try { priv = nodeCrypto.createPrivateKey({ key: privAsPkcs3, format: "der", type: "pkcs8" }); }
+    try { priv = guard.crypto.privateKey({ key: privAsPkcs3, format: "der", type: "pkcs8" }); }
     catch (e) { throw _err("key/bad-input", "the private key could not be read", e); }
   } finally { if (privAsPkcs3 !== privDer) guard.secret.zeroize(privAsPkcs3, KeyError, "key/bad-input", "the rewritten private key"); }
   var publicOid = _algorithmOidAt(spki, 0);
@@ -1014,7 +1019,7 @@ async function correspondsTo(privateKey, spkiDer) {
   if (_isDhOid(_algorithmOidAt(privDer, 1)) !== _isDhOid(publicOid)) return false;
   var pubAsPkcs3 = _dhAsPkcs3(spki, 0, "the public key's");
   _assertDhWithin(pubAsPkcs3, 0, "the public key's");
-  try { pub = nodeCrypto.createPublicKey({ key: pubAsPkcs3, format: "der", type: "spki" }); }
+  try { pub = guard.crypto.publicKey({ key: pubAsPkcs3, format: "der", type: "spki" }); }
   catch (e) { throw _err("key/bad-input", "the public key could not be read", e); }
   if (!_sameKeyFamily(priv, pub)) return false;
   var kind = guard.text.keyOf(priv.asymmetricKeyType);
@@ -1029,7 +1034,7 @@ async function correspondsTo(privateKey, spkiDer) {
       /** @internal Compared as KEYS rather than as encodings: a PKCS #3 DHParameter may carry the
        * optional privateValueLength beside the same p and g, and two encodings of one public value
        * are one key. The runtime's equality compares the group and the value. */
-      return _keyEquals(nodeCrypto.createPublicKey(priv), pub) === true;
+      return _keyEquals(guard.crypto.publicKey(priv), pub) === true;
     }
     if (_PAIR_KEM[kind]) {
       var sealed = nodeCrypto.encapsulate(pub);
@@ -1053,8 +1058,8 @@ async function correspondsTo(privateKey, spkiDer) {
        * structure for an attacker to plant, so what the scalar generates IS the canonical answer and
        * comparing against it adds a bound the agreement alone does not give. */
       return guard.crypto.constantTimeEqual(
-        nodeCrypto.createPublicKey(priv).export({ format: "der", type: "spki" }),
-        pub.export({ format: "der", type: "spki" }));
+        guard.crypto.exportKey(guard.crypto.publicKey(priv), { format: "der", type: "spki" }),
+        guard.crypto.exportKey(pub, { format: "der", type: "spki" }));
     }
     var how = _pairSignOptions(priv, pub);
     if (how === null) {
@@ -1062,8 +1067,8 @@ async function correspondsTo(privateKey, spkiDer) {
     }
     var signKey = how.options ? _assign(_create(null), { key: priv }, how.options) : priv;
     var verifyKey = how.options ? _assign(_create(null), { key: pub }, how.options) : pub;
-    return nodeCrypto.verify(how.digest, _PAIR_PROBE, verifyKey,
-      nodeCrypto.sign(how.digest, _PAIR_PROBE, signKey)) === true;
+    return guard.crypto.verify(how.digest, _PAIR_PROBE, verifyKey,
+      guard.crypto.sign(how.digest, _PAIR_PROBE, signKey)) === true;
   } catch (e) {
     /** @internal The incompatible-parameters verdict is decided rather than caught, so it is passed
      * through with the reason it was raised for. Rewrapping it would tell an operator the pair could

package/lib/lint.js

@@ -3972,6 +3972,89 @@ var RFC9881_RULES = [
 var RFC9909_RULES = [
   _pqcSigKeyUsageRule("lint/rfc9909/slhdsa-key-usage", "rfc9909", "RFC 9909 6", "SLH-DSA", _isSlhDsa),
 ];
+/** @internal Section 4.1 states the criticality at SHOULD NOT ("This extension SHOULD NOT be marked
+ * critical", the section adding that marking it "would severely impact interoperability"), so it is
+ * graded at warn here rather than held to a value by the shared criticality table, which carries only
+ * the MUSTs. The same reason keeps issuerAltName out of the CRL table. Placement is a MUST in the same
+ * section: "For certificate chains, this extension MUST only be included in the end-entity
+ * certificate", so the two clauses are two rows at two strengths. */
+var OID_SAPKI = oid.byName("subjectAltPublicKeyInfo");
+var OID_ALT_ALG = oid.byName("altSignatureAlgorithm");
+var OID_ALT_VAL = oid.byName("altSignatureValue");
+/** @internal ITU-T X.509 (2019) clause 9.8. Two clauses at two strengths, and the difference matters.
+ * Clause 9.8.3 states the pairing as a shall: "When the altSignatureAlgorithm extension is included in
+ * a particular value that is an instance of a data type that supports extensions, the altSignatureValue
+ * extension shall also be included." Clause 7.2.2 requires the full set in a certificate: one "shall
+ * contain alternative public key information in the subjectAltPublicKeyInfo extension ..., an
+ * alternative signature algorithm value in the altSignatureAlgorithm extension ... and an alternative
+ * signature value in the altSignatureValue extension". Criticality is stated only in NOTEs recommending
+ * non-critical, with the clauses saying the extensions "may be flagged as critical or as non-critical",
+ * so that row is a warning and never an error: grading a NOTE as an error would invent a requirement
+ * level the text does not state. */
+var X509_ALTSIG_RULES = [
+  {
+    id: "lint/x509-altsig/algorithm-without-value", severity: "error", source: "x509-altsig", citation: "ITU-T X.509 (2019) 9.8.3",
+    message: "a value carrying altSignatureAlgorithm must also carry altSignatureValue",
+    appliesTo: function (cert, ctx) { return !!ctx.raw("altSignatureAlgorithm"); },
+    check: function (cert, ctx) {
+      return ctx.raw("altSignatureValue") ? null : { context: { present: "altSignatureAlgorithm", missing: "altSignatureValue" } };
+    },
+  },
+  {
+    id: "lint/x509-altsig/value-without-algorithm", severity: "error", source: "x509-altsig", citation: "ITU-T X.509 (2019) 9.8.3",
+    message: "a value carrying altSignatureValue must also carry altSignatureAlgorithm, which states how to verify it",
+    appliesTo: function (cert, ctx) { return !!ctx.raw("altSignatureValue"); },
+    check: function (cert, ctx) {
+      return ctx.raw("altSignatureAlgorithm") ? null : { context: { present: "altSignatureValue", missing: "altSignatureAlgorithm" } };
+    },
+  },
+  {
+    id: "lint/x509-altsig/incomplete-set", severity: "error", source: "x509-altsig", citation: "ITU-T X.509 (2019) 7.2.2",
+    message: "a certificate carrying the alternative cryptographic algorithm extensions must carry all three",
+    appliesTo: function (cert, ctx) {
+      return !!(ctx.raw("subjectAltPublicKeyInfo") || ctx.raw("altSignatureAlgorithm") || ctx.raw("altSignatureValue"));
+    },
+    check: function (cert, ctx) {
+      var missing = ["subjectAltPublicKeyInfo", "altSignatureAlgorithm", "altSignatureValue"]
+        .filter(function (n) { return !ctx.raw(n); });
+      return missing.length ? { context: { missing: missing.join(", ") } } : null;
+    },
+  },
+  {
+    id: "lint/x509-altsig/critical", severity: "warn", source: "x509-altsig", citation: "ITU-T X.509 (2019) 9.8.2 / 9.8.3",
+    message: "the alternative cryptographic algorithm extensions are recommended non-critical",
+    check: function (cert) {
+      var rows = [];
+      (cert.extensions || []).forEach(function (e) {
+        if (e.critical !== true) return;
+        if (e.oid !== OID_SAPKI && e.oid !== OID_ALT_ALG && e.oid !== OID_ALT_VAL) return;
+        rows.push({ context: { extension: e.name || e.oid, recommended: "non-critical", was: "critical" } });
+      });
+      return rows.length ? rows : null;
+    },
+  },
+];
+
+var RFC9763_RULES = [
+  {
+    id: "lint/rfc9763/related-certificate-critical", severity: "warn", source: "rfc9763", citation: "RFC 9763 4.1",
+    message: "the relatedCertificate extension should not be marked critical",
+    appliesTo: function (cert, ctx) { return !!ctx.raw("relatedCertificate"); },
+    check: function (cert, ctx) {
+      var e = ctx.raw("relatedCertificate");
+      return e.critical === true ? { context: { extension: "relatedCertificate", recommended: "non-critical", was: "critical" } } : null;
+    },
+  },
+  {
+    id: "lint/rfc9763/related-certificate-on-ca", severity: "error", source: "rfc9763", citation: "RFC 9763 4.1",
+    message: "the relatedCertificate extension must only be included in the end-entity certificate",
+    appliesTo: function (cert, ctx) { return !!ctx.raw("relatedCertificate"); },
+    check: function (cert, ctx) {
+      var bc = ctx.decode("basicConstraints");
+      return (bc && bc.value && bc.value.cA === true) ? { context: { extension: "relatedCertificate", cA: true } } : null;
+    },
+  },
+];
 
 /** @internal RFC 5280 sec. 5 states the criticality of each CRL extension it profiles, and sec. 5.3
  * does the same for the entry extensions. certificateIssuer is critical (sec. 5.3.3) because a
@@ -6329,6 +6412,8 @@ var PROFILES = Object.assign(Object.create(null), {
   "rfc9881": RFC9881_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
   "rfc9909": RFC9909_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
   "rfc9935": RFC9935_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  "rfc9763": RFC9763_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  "x509-altsig": X509_ALTSIG_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
   "cabf-tls": CABF_TLS_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
   "cabf-smime": CABF_SMIME_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
   "cabf-cs": CABF_CS_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
@@ -6351,6 +6436,7 @@ var PROFILES = Object.assign(Object.create(null), {
     .concat(RFC5280_EXTENSION_SYNTAX_RULES),
 });
 var ALL_RULES = RFC5280_RULES.concat(RFC9881_RULES).concat(RFC9909_RULES).concat(RFC9935_RULES)
+  .concat(RFC9763_RULES).concat(X509_ALTSIG_RULES)
   .concat(CABF_TLS_RULES).concat(CABF_SMIME_RULES).concat(CABF_CS_RULES).concat(ETSI_QC_RULES)
   /** @internal The root-program rows are in the registry so `rules()` enumerates them, and stay
    * inert under the default set because each one asks whether the caller named the profile. */
@@ -6363,11 +6449,89 @@ var CABF_TLS_CSR_RULES = CABF_TLS_RULES.filter(function (r) {
 /** @internal A requested extension whose value does not decode is the same fault in a request as
  *  in a certificate, so the request profiles take the same row the certificate profiles do. */
 var CSR_STRUCTURAL_RULES = RFC2986_CSR_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES);
+
+var OID_SOP_ATTR = oid.byName("statementOfPossession");
+var SOP_SIGNATURE_USAGES = ["digitalSignature", "nonRepudiation", "keyCertSign", "cRLSign"];
+/** @internal RFC 9883 sec. 6 states one prohibition outright: "The privateKeyPossessionStatement
+ * attribute MUST NOT be used to obtain a signature certificate." Sec. 4 states the same requirement as a
+ * property of the request: "the subjectPKInfo MUST contain the public key for the key establishment
+ * algorithm". The attribute exists so a key-establishment key, which cannot sign, can still be certified;
+ * a request carrying it while asking for a signature key usage, or naming a subject key that can only
+ * sign, is asking for the certificate those sentences forbid. The two name comparisons sec. 3 states are
+ * deliberately absent here: each ends in "the certificate policy MUST describe how the CA can determine
+ * that the two subject names identify the same entity", which is a question no linter can answer, and
+ * `pki.possession.verifyRequest` reports the comparison for a caller's policy to resolve. */
+function _csrHasPossessionStatement(csr) {
+  return (csr.attributes || []).some(function (a) { return a.type === OID_SOP_ATTR; });
+}
+/** @internal The same table `pki.possession.verifyRequest` reads, so the linter and the verifier grade one
+ *  request alike. Read off the requested key usages alone, this row passed a request that named no usage
+ *  while asking to certify a key that can only ever sign, which is the sec. 4 MUST on the subjectPKInfo and
+ *  the sec. 6 prohibition both, and which the verifier refuses; `pki.csr.sign` under this profile then
+ *  emitted it. */
+var _isSignatureOnlyKey = pkix.signatureOnlyKeyOid(NS);
+function _csrSubjectKeyOid(csr) {
+  return csr.subjectPublicKeyInfo && csr.subjectPublicKeyInfo.algorithm
+    ? csr.subjectPublicKeyInfo.algorithm.oid : null;
+}
+var RFC9883_CSR_RULES = [
+  {
+    id: "lint/rfc9883/signature-certificate-requested", severity: "error", source: "rfc9883", citation: "RFC 9883 4 and 6",
+    message: "a request carrying a possession statement must not ask for a signature certificate",
+    appliesTo: function (csr) { return _csrHasPossessionStatement(csr); },
+    check: function (csr, ctx) {
+      /** @internal The subject key decides on its own when it can only sign, so this is read whether or
+       *  not the request names a usage. A key that can do either says nothing here and is judged by the
+       *  usages the request asks for. */
+      var keyOid = _csrSubjectKeyOid(csr);
+      if (_isSignatureOnlyKey(keyOid)) {
+        return { context: { subjectKeyAlgorithm: oid.name(keyOid) || keyOid } };
+      }
+      var ku = ctx.decode("keyUsage");
+      var value = ku && ku.value;
+      if (!value) return null;
+      var asked = SOP_SIGNATURE_USAGES.filter(function (u) { return value[u] === true; });
+      return asked.length ? { context: { keyUsage: asked.join(", ") } } : null;
+    },
+  },
+  {
+    id: "lint/rfc9883/statement-value-undecodable", severity: "error", source: "rfc9883", citation: "RFC 9883 3",
+    message: "a statementOfPossession attribute value must be a well-formed PrivateKeyPossessionStatement",
+    appliesTo: function (csr) { return _csrHasPossessionStatement(csr); },
+    check: function (csr) {
+      var rows = [];
+      (csr.attributes || []).forEach(function (a) {
+        if (a.type !== OID_SOP_ATTR) return;
+        if (a.privateKeyPossessionStatement === undefined) {
+          rows.push({ context: { attribute: a.name || a.type } });
+        }
+      });
+      return rows.length ? rows : null;
+    },
+  },
+  /** @internal Sec. 3 states the attribute's syntax in the singular and nothing anywhere in RFC 9883 says
+   *  which of several a CA should honor, so a request carrying more than one leaves every check sec. 3 asks
+   *  for without a subject: the checks would be made against one statement while the CA certifies a request
+   *  that carries another naming a different certificate. `pki.possession.verifyRequest` refuses such a
+   *  request with `possession/bad-request`, and without this row the linter graded it conforming and
+   *  `pki.csr.sign` under this profile would emit it. */
+  {
+    id: "lint/rfc9883/statement-attribute-repeated", severity: "error", source: "rfc9883", citation: "RFC 9883 3",
+    message: "a request must carry one statementOfPossession attribute, not several",
+    appliesTo: function (csr) { return _csrHasPossessionStatement(csr); },
+    check: function (csr) {
+      var count = 0;
+      (csr.attributes || []).forEach(function (a) { if (a.type === OID_SOP_ATTR) count += 1; });
+      return count > 1 ? { context: { attributes: String(count) } } : null;
+    },
+  },
+];
 var CSR_PROFILES = Object.assign(Object.create(null), {
   "rfc2986": CSR_STRUCTURAL_RULES,
   "cabf-tls": CSR_STRUCTURAL_RULES.concat(CABF_TLS_CSR_RULES),
+  "rfc9883": RFC9883_CSR_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
 });
-var ALL_CSR_RULES = CSR_STRUCTURAL_RULES;
+var ALL_CSR_RULES = CSR_STRUCTURAL_RULES.concat(RFC9883_CSR_RULES);
 
 function _subjectIsNonEmpty(csr) {
   var rdns = csr.subject && csr.subject.rdns;