@blamejs/pki 0.8.30 → 0.8.48

package/lib/merkle.js

@@ -42,34 +42,59 @@
  *   `verifyConsistency` over sync SHA-256, fail-closed, transport-free.
  */
 
-var nodeCrypto = require("node:crypto");
 var constants = require("./constants");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
+
+/** @internal The operations this module decides with, bound at load. A proof is assembled by
+ *  concatenation, so a replaced `Array.prototype.concat` chooses which nodes the proof carries and in
+ *  what order, and a replaced `Buffer.concat` chooses the bytes a node hash covers. Taking the captures
+ *  also puts this file in the live-read gate's scope, which is how it stays converted. */
+var _concat = intrinsic.concat;
+var _bufferConcat = intrinsic.bufferConcat;
+var _bufferFrom = intrinsic.bufferFrom;
+var _bufferAlloc = intrinsic.bufferAlloc;
+var _isArray = intrinsic.isArray;
+var _assign = intrinsic.assign;
+var _create = intrinsic.create;
+var _BigInt = intrinsic.BigInt;
 
 var MerkleError = frameworkError.MerkleError;
 
 function _merkleErr(c, m) { return new MerkleError(c, m); }
 
 var SHA256_BYTES = 32;
-var LEAF_PREFIX = Buffer.from([0x00]);
-var NODE_PREFIX = Buffer.from([0x01]);
-var EMPTY = Buffer.alloc(0);
+var LEAF_PREFIX = _bufferFrom([0x00]);
+var NODE_PREFIX = _bufferFrom([0x01]);
+var EMPTY = _bufferAlloc(0);
 
 function _sha256(buf) {
-  return nodeCrypto.createHash("sha256").update(buf).digest();
+  return guard.crypto.digest("sha256", buf);
 }
 
+/** @internal A COPY, not a view. Reading each slot once is not enough when what is read shares the
+ *  caller's store: a getter handing out one scratch buffer per leaf satisfies the read-once rule and still
+ *  leaves every collected leaf pointing at the same bytes, so collecting the second overwrote the first
+ *  and the root of [A, B] came out as the root of [B, B] with nothing reporting it. Each value is 32 bytes
+ *  by the check above, so copying costs nothing worth measuring, and every byte this module folds, hashes
+ *  or compares is then its own. */
 function _toBuffer(v, field) {
-  return guard.bytes.view(v, MerkleError, "merkle/bad-input", field);
+  return guard.bytes.snapshot(v, MerkleError, "merkle/bad-input", field);
 }
 
+/** @internal The width is read on a VIEW, before the copy. A node is exactly 32 bytes, and the check
+ *  enforcing that ran on the copy, so a value handed where a hash belongs was duplicated in full and
+ *  only then refused: measured, `root([Buffer.alloc(64 * 1024 * 1024)])` allocated another 64 MiB to
+ *  reject one leaf. Viewing allocates nothing, and the size comes off the view rather than off the
+ *  caller's own `length`, which can be shadowed independently of the bytes. */
 function _node32(v, field) {
-  var buf = _toBuffer(v, field);
-  if (buf.length !== SHA256_BYTES) {
-    throw new MerkleError("merkle/bad-hash-length", field + " must be exactly 32 bytes, got " + buf.length);
+  var viewed = guard.bytes.source(v, MerkleError, "merkle/bad-input", field);
+  var size = guard.bytes.lengthOf(viewed);
+  if (size !== SHA256_BYTES) {
+    throw new MerkleError("merkle/bad-hash-length", field + " must be exactly 32 bytes, got " + size);
   }
-  return buf;
+  return guard.bytes.snapshot(viewed, MerkleError, "merkle/bad-input", field);
 }
 
 function _coerceCoord(v, field) {
@@ -77,19 +102,86 @@ function _coerceCoord(v, field) {
 }
 
 function _proofNodes(proof) {
-  if (!Array.isArray(proof)) throw new MerkleError("merkle/bad-proof", "proof must be an array");
-  if (proof.length > constants.LIMITS.MERKLE_MAX_PROOF_NODES) {
-    throw new MerkleError("merkle/proof-too-large", "proof has " + proof.length + " nodes, exceeds " + constants.LIMITS.MERKLE_MAX_PROOF_NODES);
-  }
-  var out = [];
-  for (var i = 0; i < proof.length; i++) out.push(_node32(proof[i], "proof[" + i + "]"));
-  return out;
+  if (!_isArray(proof)) throw new MerkleError("merkle/bad-proof", "proof must be an array");
+  /** @internal Through the same guard as the leaf array, for the same reason: the node cap reads the
+   *  length and a hand-rolled walk reads it again. The verifiers were not exposed the way the producers
+   *  were, because a proof the walk collected short folds to a root that does not match the one supplied,
+   *  so the comparison refuses it. That is fail-closed by consequence rather than by rule, and the rule is
+   *  cheaper to keep here than to re-derive at each verifier. */
+  return guard.list.copyMap(proof, function (slot, i) { return _node32(slot, "proof[" + i + "]"); },
+    function (n) {
+      if (n > constants.LIMITS.MERKLE_MAX_PROOF_NODES) {
+        throw new MerkleError("merkle/proof-too-large",
+          "proof has " + n + " nodes, exceeds " + constants.LIMITS.MERKLE_MAX_PROOF_NODES);
+      }
+    });
 }
 
 function _ctEq(a, b) {
   return guard.crypto.constantTimeEqual(a, b);
 }
 
+var NO_CONSISTENCY_CLAIM =
+  "an empty older tree (oldSize 0) makes no consistency claim about a non-empty newer tree: " +
+  "RFC 6962 sec. 2.1.2 defines the proof for 0 < oldSize < newSize, and nothing here binds " +
+  "newRoot. Verify an inclusion proof against the new tree, or start from a signed tree head " +
+  "you already trust";
+
+/** @internal Each slot is read once, into the buffer the length check and every later fold both
+ *  use, so an array whose accessor answers differently on a second read cannot put one value past
+ *  the check and a different one into the tree. The COUNT is read once as well, by
+ *  `guard.list.copyMap`, which is the point of going through it: a hand-rolled
+ *  `for (i = 0; i < v.length; i++)` re-reads the length after every slot access, so a getter on one slot
+ *  that shortened the array left the cap approving four leaves and the walk collecting one, and the root
+ *  committed to a tree the caller never supplied. A slot past a length that shrank reads as undefined and
+ *  `_node32` refuses it, so the array is refused rather than folded short. */
+function _leafArray(v, field) {
+  if (!_isArray(v)) {
+    throw new MerkleError("merkle/bad-input", field + " must be an array of 32-byte leaf hashes");
+  }
+  return guard.list.copyMap(v, function (slot, i) { return _node32(slot, field + "[" + i + "]"); },
+    function (n) {
+      if (n > constants.LIMITS.MERKLE_MAX_LEAVES) {
+        throw new MerkleError("merkle/too-many-leaves",
+          field + " holds " + n + " leaves, exceeds " + constants.LIMITS.MERKLE_MAX_LEAVES);
+      }
+    });
+}
+
+/** @internal RFC 6962 sec. 2.1's "largest power of two smaller than n", for n >= 2. Doubled from
+ *  1 rather than derived through a logarithm: the leaf count is bounded well inside the exact
+ *  integer range, and a float log would round at the boundary sizes this splits on. */
+function _splitPoint(n) {
+  var k = 1;
+  while (k * 2 < n) k *= 2;
+  return k;
+}
+
+/** @internal MTH(D[lo:hi]) for hi > lo. The empty tree is answered by the caller. */
+function _mth(leaves, lo, hi) {
+  if (hi - lo === 1) return leaves[lo];
+  var k = _splitPoint(hi - lo);
+  return nodeHash(_mth(leaves, lo, lo + k), _mth(leaves, lo + k, hi));
+}
+
+/** @internal PATH(m, D[lo:hi]) of RFC 6962 sec. 2.1.1, with m relative to lo. */
+function _path(leaves, lo, hi, m) {
+  if (hi - lo === 1) return [];
+  var k = _splitPoint(hi - lo);
+  if (m < k) return _concat(_path(leaves, lo, lo + k, m), [_mth(leaves, lo + k, hi)]);
+  return _concat(_path(leaves, lo + k, hi, m - k), [_mth(leaves, lo, lo + k)]);
+}
+
+/** @internal SUBPROOF(m, D[lo:hi], b) of RFC 6962 sec. 2.1.2, with m relative to lo. The split
+ *  compares m <= k here where PATH compares m < k, which is what puts the old tree's own root in
+ *  the proof exactly when the caller did not already hold it. */
+function _subproof(leaves, lo, hi, m, b) {
+  if (m === hi - lo) return b ? [] : [_mth(leaves, lo, hi)];
+  var k = _splitPoint(hi - lo);
+  if (m <= k) return _concat(_subproof(leaves, lo, lo + k, m, b), [_mth(leaves, lo + k, hi)]);
+  return _concat(_subproof(leaves, lo + k, hi, m - k, false), [_mth(leaves, lo, lo + k)]);
+}
+
 /**
  * @primitive  pki.merkle.leafHash
  * @signature  pki.merkle.leafHash(entry) -> Buffer
@@ -107,7 +199,7 @@ function _ctEq(a, b) {
  */
 function leafHash(entry) {
   var e = _toBuffer(entry, "entry");
-  return _sha256(Buffer.concat([LEAF_PREFIX, e]));
+  return _sha256(_bufferConcat([LEAF_PREFIX, e]));
 }
 
 /**
@@ -131,7 +223,7 @@ function leafHash(entry) {
 function nodeHash(left, right) {
   var l = _node32(left, "left");
   var r = _node32(right, "right");
-  return _sha256(Buffer.concat([NODE_PREFIX, l, r]));
+  return _sha256(_bufferConcat([NODE_PREFIX, l, r]));
 }
 
 /**
@@ -180,7 +272,7 @@ function emptyRootHash() {
  *   var lh = pki.merkle.leafHash(Buffer.from([0]));
  *   pki.merkle.verifyInclusion({ leafIndex: 0, treeSize: 1, leafHash: lh, proof: [], rootHash: lh }); // -> true
  */
-var _INCLUSION_KEYS = Object.assign(Object.create(null), { leafIndex: 1, treeSize: 1, leafHash: 1, rootHash: 1, proof: 1 });
+var _INCLUSION_KEYS = _assign(_create(null), { leafIndex: 1, treeSize: 1, leafHash: 1, rootHash: 1, proof: 1 });
 function verifyInclusion(opts) {
   opts = opts || {};
   guard.identifier.assertKnownKeys(opts, _INCLUSION_KEYS, function (c, m) { return new MerkleError(c, m); },
@@ -252,7 +344,7 @@ function verifyInclusion(opts) {
  *   var r = pki.merkle.leafHash(Buffer.from([0]));
  *   pki.merkle.verifyConsistency({ oldSize: 1, newSize: 1, oldRoot: r, newRoot: r, proof: [] }); // -> true
  */
-var _CONSISTENCY_KEYS = Object.assign(Object.create(null), { oldSize: 1, newSize: 1, oldRoot: 1, newRoot: 1, proof: 1 });
+var _CONSISTENCY_KEYS = _assign(_create(null), { oldSize: 1, newSize: 1, oldRoot: 1, newRoot: 1, proof: 1 });
 function verifyConsistency(opts) {
   opts = opts || {};
   guard.identifier.assertKnownKeys(opts, _CONSISTENCY_KEYS, function (c, m) { return new MerkleError(c, m); },
@@ -271,11 +363,7 @@ function verifyConsistency(opts) {
       // allow:constant-time-compare-short-circuited -- oldRoot, newRoot, and er are public Merkle tree roots, not secrets, so short-circuiting the second compare leaks nothing confidential
       return _ctEq(oldRoot, er) && _ctEq(newRoot, er);
     }
-    throw new MerkleError("merkle/no-consistency-claim",
-      "an empty older tree (oldSize 0) makes no consistency claim about a non-empty newer tree: " +
-      "RFC 6962 sec. 2.1.2 defines the proof for 0 < oldSize < newSize, and nothing here binds " +
-      "newRoot. Verify an inclusion proof against the new tree, or start from a signed tree head " +
-      "you already trust");
+    throw new MerkleError("merkle/no-consistency-claim", NO_CONSISTENCY_CLAIM);
   }
   if (oldSize === newSize) {
     if (proof.length !== 0) throw new MerkleError("merkle/sizes-equal-nonempty-proof", "equal tree sizes require an empty consistency proof");
@@ -285,7 +373,7 @@ function verifyConsistency(opts) {
 
   var path = proof;
   if ((oldSize & (oldSize - 1n)) === 0n) {
-    path = [oldRoot].concat(proof);
+    path = _concat([oldRoot], proof);
   }
   var fn = oldSize - 1n;
   var sn = newSize - 1n;
@@ -313,10 +401,128 @@ function verifyConsistency(opts) {
   return okOld && okNew;
 }
 
+/**
+ * @primitive  pki.merkle.root
+ * @signature  pki.merkle.root(leafHashes) -> Buffer
+ * @since      0.8.34
+ * @status     stable
+ * @spec       RFC 6962, RFC 9162
+ * @related    pki.merkle.leafHash, pki.merkle.inclusionProof, pki.merkle.verifyInclusion
+ *
+ * The RFC 6962 Merkle Tree Hash `MTH(D[n])` over a whole tree, returned as a
+ * 32-byte root ready to pass to `verifyInclusion` as `rootHash`. Takes leaf
+ * HASHES, the same form `verifyInclusion` takes as `leafHash`; map entries
+ * through `pki.merkle.leafHash` first. An empty array is the empty tree and
+ * returns `emptyRootHash()`.
+ *
+ * Throws `merkle/bad-input` if `leafHashes` is not an array or a leaf is not a
+ * Buffer / Uint8Array, `merkle/bad-hash-length` if a leaf is not exactly 32
+ * bytes, and `merkle/too-many-leaves` above `C.LIMITS.MERKLE_MAX_LEAVES`.
+ *
+ * @example
+ *   var leaves = [Buffer.from([0]), Buffer.from([1])].map(pki.merkle.leafHash);
+ *   pki.merkle.root(leaves); // -> <Buffer 32-byte tree head>
+ */
+function root(leafHashes) {
+  var leaves = _leafArray(leafHashes, "leafHashes");
+  if (leaves.length === 0) return emptyRootHash();
+  return _mth(leaves, 0, leaves.length);
+}
+
+/**
+ * @primitive  pki.merkle.inclusionProof
+ * @signature  pki.merkle.inclusionProof(opts) -> Buffer[]
+ * @since      0.8.34
+ * @status     stable
+ * @spec       RFC 6962, RFC 9162
+ * @related    pki.merkle.verifyInclusion, pki.merkle.root
+ *
+ * Produce the RFC 6962 sec. 2.1.1 audit path `PATH(leafIndex, D[n])` for one
+ * leaf of a tree held in memory. The returned array is the `proof` that
+ * `verifyInclusion` folds against `root(leafHashes)`.
+ *
+ * The tree size is the length of `leafHashes` and is not a separate option, so
+ * a size and a leaf array cannot disagree. Throws `merkle/empty-tree` on an
+ * empty tree, `merkle/index-out-of-range` for a `leafIndex` at or above the leaf
+ * count, and the `leafHashes` errors `root` throws.
+ *
+ * @opts
+ *   leafHashes:  Buffer[],       // the whole tree, each leaf a 32-byte hash
+ *   leafIndex:   number | bigint, // 0-based position of the leaf to prove
+ *
+ * @example
+ *   var leaves = [Buffer.from([0]), Buffer.from([1])].map(pki.merkle.leafHash);
+ *   pki.merkle.inclusionProof({ leafHashes: leaves, leafIndex: 0 }); // -> [<Buffer ...>]
+ */
+var _INCLUSION_PROOF_KEYS = _assign(_create(null), { leafHashes: 1, leafIndex: 1 });
+function inclusionProof(opts) {
+  opts = opts || {};
+  guard.identifier.assertKnownKeys(opts, _INCLUSION_PROOF_KEYS, _merkleErr,
+    "merkle/bad-input", "unknown inclusionProof option ");
+  var leaves = _leafArray(opts.leafHashes, "leafHashes");
+  var n = leaves.length;
+  if (n === 0) throw new MerkleError("merkle/empty-tree", "an empty tree has no leaves to include");
+  var leafIndex = _coerceCoord(opts.leafIndex, "leafIndex");
+  var m = guard.range.int(leafIndex, 0n, _BigInt(n - 1), _merkleErr,
+    "merkle/index-out-of-range", "leafIndex");
+  return _path(leaves, 0, n, m);
+}
+
+/**
+ * @primitive  pki.merkle.consistencyProof
+ * @signature  pki.merkle.consistencyProof(opts) -> Buffer[]
+ * @since      0.8.34
+ * @status     stable
+ * @spec       RFC 6962, RFC 9162
+ * @related    pki.merkle.verifyConsistency, pki.merkle.root
+ *
+ * Produce the RFC 6962 sec. 2.1.2 consistency proof `PROOF(oldSize, D[n])`
+ * between an older tree of `oldSize` leaves and the tree held in `leafHashes`.
+ * The returned array is the `proof` that `verifyConsistency` checks against
+ * `root(leafHashes.slice(0, oldSize))` and `root(leafHashes)`.
+ *
+ * The newer size is the length of `leafHashes` and is not a separate option.
+ * Equal sizes produce the empty proof, which is what the verifier requires
+ * there. Throws `merkle/old-size-exceeds-new` when `oldSize` is past the leaf
+ * count and `merkle/no-consistency-claim` for an `oldSize` of 0 against a
+ * non-empty tree, matching `verifyConsistency`: RFC 6962 sec. 2.1.2 defines the
+ * proof for `0 < oldSize < newSize`, so there is no proof to produce.
+ *
+ * @opts
+ *   leafHashes:  Buffer[],        // the newer tree, each leaf a 32-byte hash
+ *   oldSize:     number | bigint, // leaf count of the older tree
+ *
+ * @example
+ *   var leaves = [Buffer.from([0]), Buffer.from([1])].map(pki.merkle.leafHash);
+ *   pki.merkle.consistencyProof({ leafHashes: leaves, oldSize: 1 }); // -> [<Buffer ...>]
+ */
+var _CONSISTENCY_PROOF_KEYS = _assign(_create(null), { leafHashes: 1, oldSize: 1 });
+function consistencyProof(opts) {
+  opts = opts || {};
+  guard.identifier.assertKnownKeys(opts, _CONSISTENCY_PROOF_KEYS, _merkleErr,
+    "merkle/bad-input", "unknown consistencyProof option ");
+  var leaves = _leafArray(opts.leafHashes, "leafHashes");
+  var n = leaves.length;
+  var oldSize = _coerceCoord(opts.oldSize, "oldSize");
+  if (oldSize > _BigInt(n)) {
+    throw new MerkleError("merkle/old-size-exceeds-new", "oldSize " + oldSize + " exceeds newSize " + n);
+  }
+  if (oldSize === 0n) {
+    if (n === 0) return [];
+    throw new MerkleError("merkle/no-consistency-claim", NO_CONSISTENCY_CLAIM);
+  }
+  var m = guard.range.int(oldSize, 1n, _BigInt(n), _merkleErr, "merkle/bad-input", "oldSize");
+  if (m === n) return [];
+  return _subproof(leaves, 0, n, m, true);
+}
+
 module.exports = {
   leafHash:          leafHash,
   nodeHash:          nodeHash,
   emptyRootHash:     emptyRootHash,
+  root:              root,
   verifyInclusion:   verifyInclusion,
   verifyConsistency: verifyConsistency,
+  inclusionProof:    inclusionProof,
+  consistencyProof:  consistencyProof,
 };

package/lib/ocsp.js

@@ -26,6 +26,19 @@
 var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
 var pkiBuild = require("./pki-build");
+var _ocspIntrinsic = require("./guard-intrinsic");
+/** @internal The promise a signature self-check is awaited through, built from the constructor captured
+ *  at load. `Promise.resolve` builds from its RECEIVER, so reading the global binding at the call hands
+ *  the construction to whatever that binding holds, and one settling without awaiting its argument runs
+ *  the continuation before the check has finished. */
+var _Promise = _ocspIntrinsic.Promise;
+var _promiseResolve = _ocspIntrinsic.uncurry(_ocspIntrinsic.promiseResolve);
+/** @internal A refusal returned as a REJECTED promise is a verdict too: read from the global binding, a
+ *  replacement whose `reject` resolves instead turns each `ocsp/bad-input` below into a pass. */
+var _promiseReject = _ocspIntrinsic.uncurry(_ocspIntrinsic.promiseReject);
+/** @internal The CertID hashes bind a response to the certificate it answers for, and they are awaited
+ *  as a pair, so a replaced `all` decides what that pair contains. */
+var _promiseAll = _ocspIntrinsic.uncurry(_ocspIntrinsic.promiseAll);
 var oid = require("./oid");
 var x509 = require("./schema-x509");
 var ocspSchema = require("./schema-ocsp");
@@ -100,7 +113,7 @@ var REQUESTER_NONCE_FLOOR = 32, RESPONDER_NONCE_FLOOR = 1;
 function _buildCertID(cert, issuer, hashName) {
   var wc = HASH_WC[guard.text.keyOf(hashName)];
   if (!wc) throw _err("ocsp/bad-input", "unsupported CertID hashAlgorithm " + guard.text.showValue(hashName) + " (sha1 / sha256 / sha384 / sha512)");
-  return Promise.all([
+  return _promiseAll(_Promise, [
     _digest(wc, issuer.subject.bytes),
     _digest(wc, _keyValue(issuer.subjectPublicKeyInfo.bytes)),
   ]).then(function (hashes) {
@@ -189,7 +202,7 @@ function _buildRequest(query, opts) {
     requestorNameDer = signerCert.subject.bytes;
   }
 
-  return Promise.all(queries.map(function (q) {
+  return _promiseAll(_Promise, queries.map(function (q) {
     if (!q || typeof q !== "object") throw _err("ocsp/bad-input", "each query must be { cert, issuer }");
     guard.identifier.assertKnownKeys(q, _QUERY_KEYS, _err, "ocsp/bad-input", "unknown query field (a query is { cert, issuer, singleRequestExtensions? }): ");
     if (q.cert == null || q.issuer == null) throw _err("ocsp/bad-input", "each query must be { cert, issuer }");
@@ -227,7 +240,7 @@ function _buildRequest(query, opts) {
     return signScheme.signOverTbs(scheme, opts.signer.key, tbsRequest, _signE).then(function (sig) {
       /** @internal The request is held to the same proof a certificate is: the signature verifies
        * against the public key the certificate it carries declares. */
-      return Promise.resolve(_b.assertSignatureVerifies(tbsRequest, sig, signerCert.subjectPublicKeyInfo.bytes, scheme)).then(function () {
+      return _promiseResolve(_Promise, _b.assertSignatureVerifies(tbsRequest, sig, signerCert.subjectPublicKeyInfo.bytes, scheme)).then(function () {
         var optionalSignature = b.sequence([scheme.sigAlgId, b.bitString(sig, 0), b.explicit(0, b.sequence([b.raw(signerCertDer)]))]);
         return _emitReq(b.sequence([tbsRequest, b.explicit(0, optionalSignature)]), opts);
       });
@@ -347,7 +360,7 @@ function _signResponse(responseData, responder, respCert, respCertDer, responder
   if (!responses.length) throw _err("ocsp/bad-input", "a response MUST include at least one SingleResponse (RFC 6960 sec. 4.2.1)");
 
   return _responderID(responseData.responderID, respCert).then(function (ridNode) {
-    return Promise.all(responses.map(function (r) { return _buildSingleResponse(r, opts); })).then(function (built) {
+    return _promiseAll(_Promise, responses.map(function (r) { return _buildSingleResponse(r, opts); })).then(function (built) {
       var srNodes = built.map(function (x) { return x.node; });
       var anyNonIssued = built.some(function (x) { return x.nonIssued; });
       /** @internal Sec. 2.2 and 4.4.8: a "revoked" answer for a non-issued certificate MUST carry the
@@ -366,7 +379,7 @@ function _signResponse(responseData, responder, respCert, respCertDer, responder
       return signScheme.signOverTbs(scheme, responderKey, responseDataDer, _signE).then(function (sig) {
         /** @internal The response is held to the same proof a certificate is: the signature verifies
          * against the public key the responder certificate declares. */
-        return Promise.resolve(_b.assertSignatureVerifies(responseDataDer, sig, respCert.subjectPublicKeyInfo.bytes, scheme)).then(function () {
+        return _promiseResolve(_Promise, _b.assertSignatureVerifies(responseDataDer, sig, respCert.subjectPublicKeyInfo.bytes, scheme)).then(function () {
           var basicChildren = [responseDataDer, scheme.sigAlgId, b.bitString(sig, 0)];
           if (opts.embedCert !== false) basicChildren.push(b.explicit(0, b.sequence([b.raw(respCertDer)])));
           var responseBytes = b.sequence([b.oid(OID_OCSP_BASIC), b.octetString(b.sequence(basicChildren))]);
@@ -406,19 +419,19 @@ function _snapshotSignerKey(key, owned) {
 }
 
 function _responderID(rid, respCert) {
-  if (rid == null || rid === "byName") return Promise.resolve(b.explicit(1, b.raw(respCert.subject.bytes)));
+  if (rid == null || rid === "byName") return _promiseResolve(_Promise, b.explicit(1, b.raw(respCert.subject.bytes)));
   if (rid === "byKey") return _digest("SHA-1", _keyValue(respCert.subjectPublicKeyInfo.bytes)).then(function (kh) { return b.explicit(2, b.octetString(kh)); });
   throw _err("ocsp/bad-input", "responderID must be \"byName\" or \"byKey\"");
 }
 function _buildSingleResponse(r, opts) {
   r = r || {};
   var certIdP;
-  if (typeof r !== "object") return Promise.reject(_err("ocsp/bad-input", "each response entry must be an object"));
+  if (typeof r !== "object") return _promiseReject(_Promise, _err("ocsp/bad-input", "each response entry must be an object"));
   try { guard.identifier.assertKnownKeys(r, _SINGLE_RESPONSE_KEYS, _err, "ocsp/bad-input", "unknown response entry field (accepted: cert, issuer, certID, hashAlgorithm, status, thisUpdate, nextUpdate, singleExtensions): "); }
-  catch (e) { return Promise.reject(e); }
-  if (r.certID != null) certIdP = Promise.resolve(b.raw(guard.bytes.view(r.certID, OcspError, "ocsp/bad-input", "a response entry's certID")));
+  catch (e) { return _promiseReject(_Promise, e); }
+  if (r.certID != null) certIdP = _promiseResolve(_Promise, b.raw(guard.bytes.view(r.certID, OcspError, "ocsp/bad-input", "a response entry's certID")));
   else if (r.cert != null && r.issuer != null) certIdP = _buildCertID(_certOf(r.cert, "a response certificate"), _certOf(r.issuer, "a response issuer"), r.hashAlgorithm || "sha1");
-  else return Promise.reject(_err("ocsp/bad-input", "each response entry needs { certID } or { cert, issuer }"));
+  else return _promiseReject(_Promise, _err("ocsp/bad-input", "each response entry needs { certID } or { cert, issuer }"));
   /** @internal Every per-entry refusal stays INSIDE this chain. These entries are built through a
    * map into Promise.all, so a synchronous throw here would abort the map before Promise.all
    * attached handlers, and an earlier entry's rejection would be orphaned: the caller catches
@@ -653,15 +666,15 @@ function verify(response, opts) {
     opts = guard.identifier.optionsObject(opts, _err, "ocsp/bad-input", "pki.ocsp.verify options");
     guard.identifier.assertKnownKeys(opts, _VERIFY_OPTS, _err, "ocsp/bad-input",
       "pki.ocsp.verify has an unknown option (the request nonce to bind against is `requestNonce`): ");
-  } catch (e) { return Promise.reject(e); }
-  if (opts.cert == null || opts.issuer == null) return Promise.reject(_err("ocsp/bad-input", "verify requires opts.cert and opts.issuer"));
+  } catch (e) { return _promiseReject(_Promise, e); }
+  if (opts.cert == null || opts.issuer == null) return _promiseReject(_Promise, _err("ocsp/bad-input", "verify requires opts.cert and opts.issuer"));
   var parsed, cert, issuerCert, time;
   try {
     parsed = _responseFromBytes(response);
     cert = _certOf(opts.cert, "the target certificate");
     issuerCert = _certOf(opts.issuer, "the issuer certificate");
     time = opts.time == null ? new Date() : _asDate(opts.time);
-  } catch (e) { return Promise.reject(e); }
+  } catch (e) { return _promiseReject(_Promise, e); }
   /** @internal The nonce rule is applied by the acceptance gate rather than restated here, so this
    * door and every other consumer of that gate answer alike. The bytes are snapshotted here so a
    * fault in them carries this door's own code; a value that is not bytes is passed through for the
@@ -670,7 +683,7 @@ function verify(response, opts) {
   var reqNonce = opts.requestNonce;
   if (guard.bytes.isByteSource(reqNonce)) {
     try { reqNonce = guard.bytes.snapshotSource(reqNonce, OcspError, "ocsp/bad-input", "opts.requestNonce"); }
-    catch (e) { return Promise.reject(e); }
+    catch (e) { return _promiseReject(_Promise, e); }
   }
   return pathValidate.verifyOcspResponse(parsed, cert, issuerCert, time,
     { historicalMode: opts.historicalMode === true, requestNonce: reqNonce }).then(function (verdict) {

package/lib/oid.js

@@ -65,11 +65,13 @@ var FAMILIES = Object.assign(Object.create(null), {
     policyConstraints: 36, extKeyUsage: 37, freshestCRL: 46,
     inhibitAnyPolicy: 54,
     anyPolicy: [32, 0], anyExtendedKeyUsage: [37, 0],
-    targetInformation: 55, noRevAvail: 56 } },
+    targetInformation: 55, noRevAvail: 56,
+    subjectAltPublicKeyInfo: 72, altSignatureAlgorithm: 73, altSignatureValue: 74 } },
 
   pkixAccess: { base: [1, 3, 6, 1, 5, 5, 7, 1], of: {
     authorityInfoAccess: 1, acAuditIdentity: 4, aaControls: 6, acProxying: 10,
     acmeIdentifier: 31,
+    relatedCertificate: 36,
     subjectInfoAccess: 11,
     tlsFeature: 24,
     qcStatements: 3,
@@ -187,6 +189,12 @@ var FAMILIES = Object.assign(Object.create(null), {
 
   wisun: { base: [1, 3, 6, 1, 4, 1, 45605], of: { fanDevice: 1 } },
 
+  /** @internal RFC 9883 assigns its attribute on a private-enterprise arc rather than a PKIX one, and
+   *  uses the SAME value as a PKCS#10 attribute and as a CRMF registration control, so the two names
+   *  resolve to one dotted OID. `byName` is one-to-one in the other direction, so the attribute name is
+   *  the one the registry returns for the dotted form. */
+  rfc9883: { base: [1, 3, 6, 1, 4, 1, 22112, 2], of: { statementOfPossession: 1 } },
+
   ct: { base: [1, 3, 6, 1, 4, 1, 11129, 2, 4], of: {
     signedCertificateTimestampList: 2, precertificatePoison: 3,
     precertificateSigningCert: 4, ocspSignedCertificateTimestampList: 5 } },
@@ -314,7 +322,9 @@ var FAMILIES = Object.assign(Object.create(null), {
     msgSigDigest: 5, contentIdentifier: 7, equivalentLabels: 9, contentReference: 10,
     signingCertificate: 12, timeStampToken: 14, decryptKeyID: 37, signingCertificateV2: 47,
     cmcUnsignedData: 34,
-    asymmDecryptKeyID: 54, certificationRequestInfoTemplate: 61, extensionReqTemplate: 62 } },
+    binarySigningTime: 46,
+    asymmDecryptKeyID: 54, relatedCertRequest: 60,
+    certificationRequestInfoTemplate: 61, extensionReqTemplate: 62 } },
 
   ansiX962: { base: [1, 2, 840, 10045], of: {
     ecPublicKey: [2, 1], prime192v1: [3, 1, 1], prime256v1: [3, 1, 7],
@@ -443,8 +453,8 @@ function _assertEncodableArcs(arcs, who) {
   if (arcs.length < 2) {
     throw new OidError("oid/bad-input", who + ": an OID must have at least 2 arcs");
   }
-  var root = typeof arcs[0] === "bigint" ? arcs[0] : BigInt(arcs[0]);
-  var second = typeof arcs[1] === "bigint" ? arcs[1] : BigInt(arcs[1]);
+  var root = guard.range.authoredInteger(arcs[0], _oidError, "oid/bad-arc", who + ": the root arc");
+  var second = guard.range.authoredInteger(arcs[1], _oidError, "oid/bad-arc", who + ": the second arc");
   if (root > 2n) throw new OidError("oid/bad-arc", who + ": the root arc must be 0, 1, or 2 (X.660)");
   if (root < 2n && second > 39n) throw new OidError("oid/bad-arc", who + ": the second arc must be 0..39 under roots 0 and 1 (X.660)");
 }