@blamejs/pki 0.8.30 → 0.8.48

package/lib/path-validate.js

@@ -47,15 +47,26 @@ var csrVerify = require("./csr-verify");
 var crmfVerify = require("./crmf-verify");
 var attrcertVerify = require("./attrcert-verify");
 var ocspRequestVerify = require("./ocsp-request-verify");
+var relatedCert = require("./related-cert");
+var altSig = require("./alt-sig");
+var possession = require("./possession");
 var cmpVerify = require("./cmp-verify");
 var cmsVerify = require("./cms-verify");
 var cmpSession = require("./cmp-session");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
+var _pop = intrinsic.pop;
+var _splice = intrinsic.splice;
 var _strSlice = intrinsic.uncurry(String.prototype.slice);
 var _strIndexOf = intrinsic.uncurry(String.prototype.indexOf);
 var _resolve = intrinsic.uncurry(intrinsic.promiseResolve);
+var _reject = intrinsic.uncurry(intrinsic.promiseReject);
+/** @internal The promise constructor, captured at load. `promiseResolve` builds its promise from the
+ * RECEIVER it is called on, so reading the global binding at the call hands that construction to
+ * whatever the binding holds: a descriptor failure answering `false` through a replaced constructor is
+ * not a refusal, and this module's verdicts are what a caller acts on. */
+var _Promise = intrinsic.Promise;
 var constants = require("./constants");
 var validator = require("./validator-all");
 var cms = require("./schema-cms");
@@ -90,6 +101,11 @@ var EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
 var ANCHOR_SPKI_SCHEMA = pkix.spki(NS);
 
 var subtle = webcrypto.webcrypto.subtle;
+/** @internal The two SubtleCrypto operations a certificate signature verdict rests on, captured at
+ * load. The object was held and its METHODS fetched per call, which leaves them replaceable: a
+ * `verify` answering true accepts a certificate nothing in the path signed. */
+var _subtleImportKey = intrinsic.uncurry(subtle.importKey);
+var _subtleVerify = intrinsic.uncurry(subtle.verify);
 
 var OID = intrinsic.assign(intrinsic.create(null), {
   basicConstraints: oid.byName("basicConstraints"),
@@ -250,18 +266,18 @@ function assertKeyMatchesSigAlg(spkiBytes, sigOid, d) {
 function compositeKeyUsageCheck(cert) {
   var ku;
   try { ku = decodeExt(cert, OID.keyUsage); }
-  catch (e) { return { ok: false, code: "path/composite-key-usage", error: e }; }
-  if (!ku) return { ok: true };
+  catch (e) { return guard.verdict.of({ ok: false, code: "path/composite-key-usage", error: e }); }
+  if (!ku) return guard.verdict.of({ ok: true });
   var v = ku.value;
   if (v.keyEncipherment || v.dataEncipherment || v.keyAgreement || v.encipherOnly || v.decipherOnly) {
-    return { ok: false, code: "path/composite-key-usage",
-      error: E("path/composite-key-usage", "a composite ML-DSA key asserts a forbidden encryption/key-establishment keyUsage bit (draft-ietf-lamps-pq-composite-sigs sec. 5.2)") };
+    return guard.verdict.of({ ok: false, code: "path/composite-key-usage",
+      error: E("path/composite-key-usage", "a composite ML-DSA key asserts a forbidden encryption/key-establishment keyUsage bit (draft-ietf-lamps-pq-composite-sigs sec. 5.2)") });
   }
   if (!(v.digitalSignature || v.nonRepudiation || v.keyCertSign || v.cRLSign)) {
-    return { ok: false, code: "path/composite-key-usage",
-      error: E("path/composite-key-usage", "a composite ML-DSA key's keyUsage asserts no signature bit (draft-ietf-lamps-pq-composite-sigs sec. 5.2)") };
+    return guard.verdict.of({ ok: false, code: "path/composite-key-usage",
+      error: E("path/composite-key-usage", "a composite ML-DSA key's keyUsage asserts no signature bit (draft-ietf-lamps-pq-composite-sigs sec. 5.2)") });
   }
-  return { ok: true };
+  return guard.verdict.of({ ok: true });
 }
 
 var STATEFUL_HBS_OIDS = intrinsic.create(null);
@@ -284,24 +300,24 @@ function _isCaCert(cert) {
 function statefulHbsKeyUsageCheck(cert, isCa) {
   var ku;
   try { ku = decodeExt(cert, OID.keyUsage); }
-  catch (e) { return { ok: false, code: "path/hbs-key-usage", error: e }; }
-  if (!ku) return { ok: true };
+  catch (e) { return guard.verdict.of({ ok: false, code: "path/hbs-key-usage", error: e }); }
+  if (!ku) return guard.verdict.of({ ok: true });
   var v = ku.value;
   var where = isCa ? "a certification authority" : "an end entity";
   var allowed = isCa ? "digitalSignature, nonRepudiation, keyCertSign or cRLSign"
     : "digitalSignature, nonRepudiation or cRLSign";
   var asserted = v.digitalSignature || v.nonRepudiation || v.cRLSign || v.keyCertSign;
   if (!asserted) {
-    return { ok: false, code: "path/hbs-key-usage",
-      error: E("path/hbs-key-usage", "a stateful hash-based key in " + where + " certificate must assert at least one of " + allowed + " (RFC 9802 sec. 6)") };
+    return guard.verdict.of({ ok: false, code: "path/hbs-key-usage",
+      error: E("path/hbs-key-usage", "a stateful hash-based key in " + where + " certificate must assert at least one of " + allowed + " (RFC 9802 sec. 6)") });
   }
   var forbidden = v.keyEncipherment || v.dataEncipherment || v.keyAgreement || v.encipherOnly ||
     v.decipherOnly || (!isCa && v.keyCertSign) || (v.reservedBitsSet === true);
   if (forbidden) {
-    return { ok: false, code: "path/hbs-key-usage",
-      error: E("path/hbs-key-usage", "a stateful hash-based key in " + where + " certificate must assert no keyUsage value outside " + allowed + " (RFC 9802 sec. 6)") };
+    return guard.verdict.of({ ok: false, code: "path/hbs-key-usage",
+      error: E("path/hbs-key-usage", "a stateful hash-based key in " + where + " certificate must assert no keyUsage value outside " + allowed + " (RFC 9802 sec. 6)") });
   }
-  return { ok: true };
+  return guard.verdict.of({ ok: true });
 }
 
 var ML_KEM_OIDS = intrinsic.create(null);
@@ -310,23 +326,23 @@ var ML_KEM_OIDS = intrinsic.create(null);
 function kemKeyUsageCheck(cert) {
   var ku;
   try { ku = decodeExt(cert, OID.keyUsage); }
-  catch (e) { return { ok: false, code: "path/kem-key-usage", error: e }; }
-  if (!ku) return { ok: true };
+  catch (e) { return guard.verdict.of({ ok: false, code: "path/kem-key-usage", error: e }); }
+  if (!ku) return guard.verdict.of({ ok: true });
   var v = ku.value;
   var others = v.digitalSignature || v.nonRepudiation || v.dataEncipherment || v.keyAgreement ||
     v.keyCertSign || v.cRLSign || v.encipherOnly || v.decipherOnly || (v.reservedBitsSet === true);
   if (!v.keyEncipherment || others) {
-    return { ok: false, code: "path/kem-key-usage",
-      error: E("path/kem-key-usage", "an ML-KEM key's keyUsage must assert keyEncipherment as the only bit (RFC 9935 sec. 5)") };
+    return guard.verdict.of({ ok: false, code: "path/kem-key-usage",
+      error: E("path/kem-key-usage", "an ML-KEM key's keyUsage must assert keyEncipherment as the only bit (RFC 9935 sec. 5)") });
   }
-  return { ok: true };
+  return guard.verdict.of({ ok: true });
 }
 
 function _importVerifyKey(spkiBytes, d) {
   try {
     if (d.eddsa) edwardsPoint.validateSpki(spkiBytes, d.eddsa, PathError, "path/bad-signature");
-  } catch (e) { return Promise.reject(e); }
-  return subtle.importKey("spki", spkiBytes, d.imp, false, ["verify"]);
+  } catch (e) { return _reject(_Promise, e); }
+  return _subtleImportKey(subtle, "spki", spkiBytes, d.imp, false, ["verify"]);
 }
 
 /** @internal The RFC 8554 public key the SubjectPublicKeyInfo carries, and the verdict on a signature over
@@ -397,23 +413,24 @@ function builtinVerify(state, cert) {
   try {
     d = resolveDescriptor(cert.signatureAlgorithm);
     assertKeyMatchesSigAlg(state.workingPublicKey, cert.signatureAlgorithm.oid, d);
-  /** @internal Resolving reads `then` off the value, so a synchronous verdict is built with an own one:
-   * an inherited accessor would otherwise run with the verdict as its receiver and hand the caller a
-   * different object (see guard-verdict). */
-  } catch (e) { return _resolve(Promise, guard.verdict.of({ ok: false, code: pathCode(e, "path/unsupported-algorithm"), error: e })); }
-  if (!guard.crypto.isOctetAligned(cert.signatureValue)) return _resolve(Promise, guard.verdict.of({ ok: false, code: "path/bad-signature" }));
+  /** @internal Resolving reads `then` off the value, so every verdict here is built with an own one,
+   * on the asynchronous arms as much as the synchronous ones: an inherited accessor would otherwise run
+   * with the verdict as its receiver and hand the caller a different object (see guard-verdict). The
+   * resolution of the `.then` callbacks below is the same window as the `_resolve` calls here. */
+  } catch (e) { return _resolve(_Promise, guard.verdict.of({ ok: false, code: pathCode(e, "path/unsupported-algorithm"), error: e })); }
+  if (!guard.crypto.isOctetAligned(cert.signatureValue)) return _resolve(_Promise, guard.verdict.of({ ok: false, code: "path/bad-signature" }));
   if (d.composite) return compositeSig.compositeVerify(state.workingPublicKey, cert.signatureValue.bytes, cert.tbsBytes, d.composite, PathError, "path/unsupported-algorithm", "path/bad-signature");
-  if (d.shbs) return _resolve(Promise, _shbsVerify(state.workingPublicKey, cert.signatureValue.bytes, cert.tbsBytes));
+  if (d.shbs) return _resolve(_Promise, _shbsVerify(state.workingPublicKey, cert.signatureValue.bytes, cert.tbsBytes));
   var key;
   return _importVerifyKey(state.workingPublicKey, d).then(function (k) {
     key = k;
     var sig = cert.signatureValue.bytes;
     if (d.ecdsa) sig = validator.sig.ecdsaDerToP1363(sig, key.algorithm.namedCurve, PathError, "path/bad-signature");
-    return subtle.verify(d.verify, key, sig, cert.tbsBytes);
+    return _subtleVerify(subtle, d.verify, key, sig, cert.tbsBytes);
   }).then(function (ok) {
-    return { ok: ok === true };
+    return guard.verdict.of({ ok: ok === true });
   }, function (e) {
-    return { ok: false, code: pathCode(e, "path/bad-signature"), error: e };
+    return guard.verdict.of({ ok: false, code: pathCode(e, "path/bad-signature"), error: e });
   });
 }
 
@@ -596,8 +613,8 @@ function checkNameConstraints(state, cert) {
     var ex = state.excludedSubtrees[e];
     for (var i = 0; i < forms.length; i++) {
       var m = nameMatchesConstraint(forms[i].tag, forms[i].value, { tagNumber: ex.tag, value: ex.base }, true);
-      if (m === true) return { ok: false, code: "path/name-constraint-excluded" };
-      if (m === "unsupported") return { ok: false, code: "path/name-constraint-unsupported" };
+      if (m === true) return guard.verdict.of({ ok: false, code: "path/name-constraint-excluded" });
+      if (m === "unsupported") return guard.verdict.of({ ok: false, code: "path/name-constraint-unsupported" });
     }
   }
   for (var f = 0; f < forms.length; f++) {
@@ -611,10 +628,10 @@ function checkNameConstraints(state, cert) {
         if (r === true) permitted = true;
         else if (r === "unsupported") unsupported = true;
       });
-      if (!permitted) return { ok: false, code: unsupported ? "path/name-constraint-unsupported" : "path/name-constraint-not-permitted" };
+      if (!permitted) return guard.verdict.of({ ok: false, code: unsupported ? "path/name-constraint-unsupported" : "path/name-constraint-not-permitted" });
     }
   }
-  return { ok: true };
+  return guard.verdict.of({ ok: true });
 }
 
 function absorbNameConstraints(state, decoded) {
@@ -683,11 +700,11 @@ function addPolicyNode(state, depth, validPolicy, qualifiers, expectedPolicySet,
 function removePolicyNode(state, node) {
   node.parents.forEach(function (p) {
     var idx = p.children.indexOf(node);
-    if (idx !== -1) p.children.splice(idx, 1);
+    if (idx !== -1) _splice(p.children, idx, 1);
   });
   node.children.forEach(function (c) {
     var idx = c.parents.indexOf(node);
-    if (idx !== -1) c.parents.splice(idx, 1);
+    if (idx !== -1) _splice(c.parents, idx, 1);
   });
   node.parents = [];
   var layer = state.policyIndex[node.depth];
@@ -1156,7 +1173,9 @@ function validateCriticalExtensionStructure(cert) {
  * `crlChecker` gives the CRLReason integer and `revocationReason` the name `ocspChecker` gives it;
  * both are read so the row does not depend on which checker answered. */
 function _revocationRow(row, rv) {
-  if (rv == null) return row;
+  /** @internal The row carries the sentinel from here rather than only from the walk that shields the
+   * finished results, so a row returned to anything that awaits it is shielded on both arms. */
+  if (rv == null) return guard.verdict.shield(row);
   var reason = rv.reason;
   if (typeof reason === "string" && reason.length > 0) row.reason = reason;
   var code = rv.revocationReason;
@@ -1164,7 +1183,7 @@ function _revocationRow(row, rv) {
   if (intrinsic.numberIsFinite(code)) row.revocationReason = code;
   var at = rv.revocationTime;
   if (guard.time.isDate(at)) row.revocationTime = new intrinsic.Date(guard.time.instantOf(at));
-  return row;
+  return guard.verdict.shield(row);
 }
 
 /**
@@ -1333,12 +1352,26 @@ async function validate(path, opts) {
    * holds its state against this object; the object is unreachable once the validation returns, so
    * a checker stays reusable and nothing accumulates between runs. The anchor recursion carries the
    * same one, and a caller has no way to supply one, so two validations never share a budget. */
-  return _validate(path, checked, intrinsic.freeze(intrinsic.create(null)));
+  /** @internal The verifier's `verify` is read ONCE here, in the door, and carried through every anchor
+   * attempt. Read inside `_validate` it was read once per attempt, because a list of trust anchors
+   * whose names all match the first certificate's issuer retries the walk per anchor: measured, an
+   * accessor whose first answer refused both certificates and whose second accepted them returned
+   * `valid: true` over two matching anchors. It is the function that answers whether each signature in
+   * the path verifies, so one reading of it governs the whole call. */
+  var suppliedVerifier = checked.verifier || null;
+  var suppliedVerify = suppliedVerifier === null ? null : suppliedVerifier.verify;
+  if (suppliedVerifier !== null && typeof suppliedVerify !== "function") {
+    throw E("path/bad-input", "validate: opts.verifier must carry a verify(args) function");
+  }
+  var scope = intrinsic.freeze(intrinsic.assign(intrinsic.create(null), {
+    verifier: suppliedVerifier, verify: suppliedVerify,
+  }));
+  return _validate(path, checked, intrinsic.freeze(intrinsic.create(null)), scope);
 }
 
 /** @internal The options are the ones the door above checked, and each anchor attempt is handed a
  * copy this module built, so the door runs once per call rather than once per anchor. */
-async function _validate(path, opts, run) {
+async function _validate(path, opts, run, scope) {
   if (opts.ctPolicy != null && opts.ctLogList == null) throw E("path/bad-input", "validate: opts.ctPolicy requires opts.ctLogList (the trusted CT log-list to verify the certificate's SCTs against)");
   if (opts.ctLogList != null) {
     if (typeof opts.ctLogList !== "object" || opts.ctLogList.byLogId == null) throw E("path/bad-input", "validate: opts.ctLogList must be a pki.ct.parseLogList result");
@@ -1409,11 +1442,11 @@ async function _validate(path, opts, run) {
     for (var ai = 0; ai < tuples.length; ai++) {
       if (!dnEqual(tuples[ai].name.rdns, certs[0].issuer.rdns)) continue;
       anyMatched = true;
-      var oneRes = await _validate(path, singleOpts(tuples[ai]), run);
+      var oneRes = await _validate(path, singleOpts(tuples[ai]), run, scope);
       if (oneRes && oneRes.valid) return oneRes;
       lastMatched = oneRes;
     }
-    return anyMatched ? lastMatched : _validate(path, singleOpts(tuples[0]), run);
+    return anyMatched ? lastMatched : _validate(path, singleOpts(tuples[0]), run, scope);
   }
   var anchor = toAnchor(anchorList[0], "validate");
   guard.time.assertValid(opts.time, E, "path/bad-input", "validate: opts.time (the always-on validity-window check date)");
@@ -1438,7 +1471,11 @@ async function _validate(path, opts, run) {
   var state = initialize(certs, opts, seeds, anchor, taConstraints);
   state._n = n;
   state.requiredEku = requiredEku;
-  var verifier = opts.verifier || null;
+  /** @internal The verifier comes from the per-call scope the door built, never from `opts`: the option
+   * bag is rebuilt per anchor attempt and reading it again would ask the caller's object once per
+   * attempt (see the note in `validate`). */
+  var verifier = scope.verifier;
+  var verifierVerify = scope.verify;
   var revocationChecker = opts.revocationChecker || null;
   var softFail = opts.softFail === true;
   var requireRevocation = opts.requireRevocation === true;
@@ -1458,18 +1495,18 @@ async function _validate(path, opts, run) {
     var sigRes;
     var weak = _weakIssuerKey(state);
     if (weak) {
-      sigRes = { ok: false, code: "path/weak-key", error: weak };
+      sigRes = guard.verdict.of({ ok: false, code: "path/weak-key", error: weak });
     } else if (verifier) {
       var vv;
       try {
-        vv = await verifier.verify({
+        vv = await intrinsic.apply(verifierVerify, verifier, [{
           cert: cert,
           workingPublicKey: state.workingPublicKey,
           workingPublicKeyAlgorithm: state.workingPublicKeyAlgorithm,
           workingPublicKeyParameters: state.workingPublicKeyParameters,
-        });
+        }]);
       } catch (_e) { vv = false; }
-      sigRes = { ok: vv === true };
+      sigRes = guard.verdict.of({ ok: vv === true });
     } else {
       sigRes = await builtinVerify(state, cert);
     }
@@ -1670,7 +1707,7 @@ async function _validate(path, opts, run) {
       nameConstraintsApplied: anchorNameConstraintsApplied,
     },
     path: certs,
-    results: state.results,
+    results: shieldResults(state.results),
     workingPublicKey: state.workingPublicKey,
     workingPublicKeyAlgorithm: state.workingPublicKeyAlgorithm,
     workingPublicKeyParameters: state.workingPublicKeyParameters,
@@ -1679,6 +1716,22 @@ async function _validate(path, opts, run) {
   });
 }
 
+/**
+ * @internal A per-certificate result and every check row inside it is a verdict a caller reads `ok`
+ * off, and the rows are appended from some thirty places, two of them after the result itself is
+ * recorded. The sentinel is applied once over the finished set rather than at each append, so a row
+ * a check written later contributes carries it without being told to. `shield` adds the member in
+ * place, which keeps the row identity the appends and the identity lookup above rely on.
+ */
+function shieldResults(results) {
+  for (var r = 0; r < results.length; r++) {
+    var row = results[r];
+    for (var c = 0; c < row.checks.length; c++) guard.verdict.shield(row.checks[c]);
+    guard.verdict.shield(row);
+  }
+  return results;
+}
+
 /**
  * @internal RFC 9618 sec. 5.5 rewrites RFC 5280 sec. 6.1.5 step (g) over the graph. The set is read
  * from the nodes whose only parent is the anyPolicy node, at ANY depth rather than at the deepest
@@ -1902,6 +1955,14 @@ function selectDelta(candidates) {
  *   typeof checker.check;                     // "function"
  */
 function crlChecker(crls, opts) {
+  /** @internal A LIST, held to being one before it is mapped. An omitted list is "nothing to check" and
+   *  stays accepted; anything else that is not an array fell through to `.map`, where an ArrayBuffer or a
+   *  plain object raised a bare TypeError naming an internal expression and a single CRL Buffer mapped
+   *  over its BYTES and reported the first byte as a malformed CRL. Passing one CRL where a list belongs
+   *  is the natural slip, and it is the one that read furthest before failing. */
+  if (crls !== undefined && crls !== null && !intrinsic.isArray(crls)) {
+    throw E("path/bad-input", "crlChecker: crls must be an array of CRLs");
+  }
   var parsed = (crls || []).map(function (c, ci) {
     return guard.parsed.acceptDerived(c, "crl", crl.parse, E, "path/bad-input",
       "crlChecker: crls[" + ci + "]");
@@ -2101,15 +2162,15 @@ function _verifyWithSpki(sigAlg, rawSig, spkiBytes, tbsBytes) {
   try {
     d = resolveDescriptor(sigAlg);
     assertKeyMatchesSigAlg(spkiBytes, sigAlg.oid, d);
-  } catch (_e) { return Promise.resolve(false); }
+  } catch (_e) { return _resolve(_Promise, false); }
   if (d.composite) return compositeSig.compositeVerify(spkiBytes, rawSig, tbsBytes, d.composite, PathError, "path/unsupported-algorithm", "path/bad-signature").then(function (r) { return r.ok === true; });
   /** @internal RFC 9802 sec. 6 names the CertificateList as well as the Certificate, so a revocation list
    * signed with a stateful hash-based key reaches the same engine the certificate path uses. */
-  if (d.shbs) return _resolve(Promise, _shbsVerify(spkiBytes, rawSig, tbsBytes).ok === true);
+  if (d.shbs) return _resolve(_Promise, _shbsVerify(spkiBytes, rawSig, tbsBytes).ok === true);
   return _importVerifyKey(spkiBytes, d).then(function (key) {
     var sig = rawSig;
     if (d.ecdsa) sig = validator.sig.ecdsaDerToP1363(sig, key.algorithm.namedCurve, PathError, "path/bad-signature");
-    return subtle.verify(d.verify, key, sig, tbsBytes);
+    return _subtleVerify(subtle, d.verify, key, sig, tbsBytes);
   }).then(function (ok) { return ok === true; }, function () { return false; });
 }
 
@@ -2123,6 +2184,21 @@ attrcertVerify.setEngine(_verifyWithSpki);
 
 ocspRequestVerify.setEngine(_verifyWithSpki);
 
+/** @internal RFC 9763 sec. 3.1's proof of possession is a signature by the key of a certificate the
+ *  request names, so it reaches the same engine the certificate path uses and the same binding of the
+ *  advertised algorithm to the key. */
+relatedCert.setEngine(_verifyWithSpki);
+
+/** @internal An ITU-T X.509 (2019) clause 9.8 alternative signature is a signature over a certificate
+ *  or a CRL by a key in an extension, so it reaches the same engine and the same binding of the
+ *  advertised algorithm to the key. */
+altSig.setEngine(_verifyWithSpki);
+
+/** @internal RFC 9883 sec. 4 makes certification path validation of the signature certificate a MUST
+ *  alongside the signature check, so the possession verb needs the validator as well as the engine and
+ *  runs the same `validate` a caller would call rather than holding a second copy of it. */
+possession.setEngine({ verifyWithSpki: _verifyWithSpki, validate: validate });
+
 
 var ocspCore = ocspVerify.makeOcspVerify({
   verifyWithSpki: _verifyWithSpki,
@@ -2170,6 +2246,10 @@ cmsVerify.setEngine({ build: build, validate: validate, toAnchor: toAnchor,
  *   typeof checker.check;                       // "function"
  */
 function ocspChecker(responses) {
+  /** @internal A LIST, for the reason at `crlChecker`. */
+  if (responses !== undefined && responses !== null && !intrinsic.isArray(responses)) {
+    throw E("path/bad-input", "ocspChecker: responses must be an array of OCSP responses");
+  }
   var parsed = (responses || []).map(function (r) { return _ocspFromBytes(r); });
   return {
     check: async function (cert, issuer, ctx) {
@@ -2288,7 +2368,7 @@ async function verifyOcspResponse(response, cert, issuerCert, time, opts) {
     parsedResponse = _ocspFromBytes(response);
     subject = coerceCert(cert, "the certificate");
     issuer = coerceCert(issuerCert, "the issuer certificate");
-  } catch (e) { return Promise.reject(e); }
+  } catch (e) { return _reject(_Promise, e); }
   var v = await _verifyOcspParsed(parsedResponse, subject, issuer, time, checkedOpts);
   var out = guard.verdict.of(v);
   return guard.verdict.of(out, { valid: out.status === "good" });
@@ -2308,7 +2388,7 @@ function _ocspFromBytes(response) {
 function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
   opts = opts || {};
   if (!guard.time.isDate(time) || isNaN(guard.time.instantOf(time))) {
-    return Promise.reject(E("path/bad-input", "verifyOcspResponse: time must be a valid Date (the currency + responder-validity check date)"));
+    return _reject(_Promise, E("path/bad-input", "verifyOcspResponse: time must be a valid Date (the currency + responder-validity check date)"));
   }
   /** @internal Snapshotted in the synchronous prologue: the bytes compared are the bytes the caller
    * passed, not what its BufferSource holds once the verify has awaited. A value that is not bytes
@@ -2327,9 +2407,9 @@ function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
   }
   var boundName;
   try { boundName = dnEqual(cert.issuer.rdns, issuerCert.subject.rdns); }
-  catch (e) { return Promise.reject(e); }
+  catch (e) { return _reject(_Promise, e); }
   if (!boundName) {
-    return Promise.resolve(unbound("the supplied issuer certificate's subject does not match the target certificate's issuer"));
+    return _resolve(_Promise, unbound("the supplied issuer certificate's subject does not match the target certificate's issuer"));
   }
   return builtinVerify({ workingPublicKey: issuerCert.subjectPublicKeyInfo.bytes }, cert).then(function (sig) {
     if (!sig.ok) return unbound("the target certificate's signature does not verify under the supplied issuer certificate's key");
@@ -2984,7 +3064,9 @@ function _bestByPolicy(accepted, uips) {
     var s = _policyScore(accepted[i].result, uips);
     if (s > bestScore) { best = accepted[i]; bestScore = s; }
   }
-  return best;
+  /** @internal The candidate carries a verdict in its `result`, so the wrapper carries the sentinel
+   * too: whichever of the two a caller awaits, the lookup ends on the object itself. */
+  return guard.verdict.shield(best);
 }
 
 function _assertUserInitialPolicySet(uips, prefix) {
@@ -3015,7 +3097,7 @@ function _pushCandidates(frame, scored, stack, counter, down) {
     intrinsic.setAdd(childKeys, candKey);
     guard.list.append(stack, down
       ? { chain: intrinsic.concat(frame.chain, [cand]), hop: frame.hop + 1, keys: childKeys, anchor: frame.anchor }
-      : { chain: [cand].concat(frame.chain), hop: frame.hop + 1, keys: childKeys });
+      : { chain: intrinsic.concat([cand], frame.chain), hop: frame.hop + 1, keys: childKeys });
   }
   return n;
 }
@@ -3216,7 +3298,7 @@ async function build(leaf, opts) {
   var poolCeiling = constants.LIMITS.PATH_BUILD_MAX_CANDIDATES;
   if (poolInput.length > poolCeiling) throw E("path/bad-input", "build: the candidate pool has " + poolInput.length + " certificates, exceeding the " + poolCeiling + " ceiling");
   var pool;
-  try { pool = poolInput.map(coerceCert); }
+  try { pool = intrinsic.map(poolInput, coerceCert); }
   catch (e) { throw E("path/bad-input", "build: a candidate certificate did not parse", e); }
   var poolDerKeys = new Set();
   for (var pdk = 0; pdk < pool.length; pdk++) intrinsic.setAdd(poolDerKeys, certDerKey(pool[pdk]));
@@ -3280,7 +3362,7 @@ async function build(leaf, opts) {
   var BUILD_ONLY_OPT = { candidates: 1, intermediates: 1, trustAnchors: 1, maxDepth: 1, maxCandidatesConsidered: 1, validate: 1,
     fetchAia: 1, transport: 1, tls: 1, maxAiaFetches: 1, maxAiaPerCert: 1, aiaTimeout: 1, maxResponseBytes: 1 };
   var forwarded = Object.create(null);
-  Object.keys(_VALIDATE_OPTS).forEach(function (k) {
+  intrinsic.forEach(intrinsic.keys(_VALIDATE_OPTS), function (k) {
     if (intrinsic.hasOwn(BUILD_ONLY_OPT, k)) return;
     if (k in opts) forwarded[k] = opts[k];
   });
@@ -3319,7 +3401,7 @@ async function build(leaf, opts) {
     var rstack = [];
     for (var rsi = 0; rsi < anchors.length; rsi++) guard.list.append(rstack, { chain: [], hop: 0, keys: new Set([identityKey(leafCert)]), anchor: anchors[rsi] });
     while (rstack.length) {
-      var rframe = rstack.pop();
+      var rframe = _pop(rstack);
       var frontierCert = rframe.chain.length ? rframe.chain[rframe.chain.length - 1] : null;
       var frontierName = frontierCert ? frontierCert.subject.rdns : rframe.anchor.name.rdns;
       if (nameMatchSoft(leafCert.issuer.rdns, frontierName)) {
@@ -3384,7 +3466,7 @@ async function build(leaf, opts) {
       considered += _pushCandidates(fb, fbScored, stack, counter);
       continue;
     }
-    var frame = stack.pop();
+    var frame = _pop(stack);
     var current = frame.chain[0];
 
     for (var ai = 0; ai < anchors.length; ai++) {

package/lib/pkcs12-build.js

@@ -89,9 +89,14 @@ var _ENCRYPT_KEYS = intrinsic.assign(intrinsic.create(null), { password: 1, ciph
 var _MAC_KEYS = intrinsic.assign(intrinsic.create(null), { algorithm: 1, hash: 1, salt: 1, iterations: 1, keyLength: 1, password: 1 });
 var _MAC_KEYS_HMAC = intrinsic.assign(intrinsic.create(null), { algorithm: 1, hash: 1, salt: 1, iterations: 1, password: 1 });
 var _MAC_KEYS_PBMAC1 = intrinsic.assign(intrinsic.create(null), { algorithm: 1, hash: 1, salt: 1, iterations: 1, keyLength: 1, password: 1 });
+/** @internal `allowUnauthenticatedRsa15` reaches `pki.cms.decrypt` through the options this verb already
+ *  forwards. A public-key-privacy safe IS a CMS EnvelopedData, and the one `openssl pkcs12` or
+ *  `openssl cms -encrypt` produces uses RSAES-PKCS1-v1_5 key transport over an AES-CBC content, which that
+ *  verb refuses by default. An operator opening such a file needs the option, and naming it here is what
+ *  lets them pass it rather than meeting an unknown-option refusal first. */
 var _OPEN_OPTS = intrinsic.assign(intrinsic.create(null), {
-  allowUnauthenticated: 1, importAlgorithm: 1, keys: 1, maxIterations: 1, signerCerts: 1,
-  recipientKey: 1, recipientCert: 1, recipientIndex: 1,
+  allowUnauthenticated: 1, allowUnauthenticatedRsa15: 1, importAlgorithm: 1, keys: 1, maxIterations: 1,
+  signerCerts: 1, recipientKey: 1, recipientCert: 1, recipientIndex: 1,
 });
 var _VERIFY_MAC_OPTS = intrinsic.assign(intrinsic.create(null), { maxIterations: 1 });
 

package/lib/pki-build.js

@@ -29,6 +29,7 @@ var _stringify = intrinsic.stringify;
 var _mapIntrinsic = intrinsic.map;
 var _bufferConcatIntrinsic = intrinsic.bufferConcat;
 var OID_SKI = oid.byName("subjectKeyIdentifier");
+var OID_SAPKI = oid.byName("subjectAltPublicKeyInfo");
 
 function _isAlphaCode(c) { return (c >= 65 && c <= 90) || (c >= 97 && c <= 122); }
 function _isDigitCode(c) { return c >= 48 && c <= 57; }
@@ -1375,15 +1376,15 @@ function makeBuilder(ctx) {
       });
     }
     var pub;
-    try { pub = nodeCrypto.createPublicKey({ key: spki, format: "der", type: "spki" }); }
+    try { pub = guard.crypto.publicKey({ key: spki, format: "der", type: "spki" }); }
     catch (e) { throw E("bad-input", "the public key could not be imported for the signature self-check", e); }
     var s = scheme.sign, ok;
     try {
-      if (s.name === "ECDSA") ok = nodeCrypto.verify(scheme.digest, preimage, { key: pub, dsaEncoding: "der" }, sig);
-      else if (s.name === "RSA-PSS") ok = nodeCrypto.verify(scheme.digest, preimage, { key: pub, padding: nodeCrypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: s.saltLength }, sig);
-      else if (s.name === "RSASSA-PKCS1-v1_5") ok = nodeCrypto.verify(scheme.digest, preimage, pub, sig);
+      if (s.name === "ECDSA") ok = guard.crypto.verify(scheme.digest, preimage, { key: pub, dsaEncoding: "der" }, sig);
+      else if (s.name === "RSA-PSS") ok = guard.crypto.verify(scheme.digest, preimage, { key: pub, padding: guard.crypto.padding.RSA_PKCS1_PSS, saltLength: s.saltLength }, sig);
+      else if (s.name === "RSASSA-PKCS1-v1_5") ok = guard.crypto.verify(scheme.digest, preimage, pub, sig);
       // allow:eddsa-verify-without-loworder-gate -- a self-check that OUR just-produced signature verifies
-      else ok = nodeCrypto.verify(null, preimage, pub, sig);
+      else ok = guard.crypto.verify(null, preimage, pub, sig);
     } catch (e) { throw E("bad-input", "the signature self-check could not run against the public key", e); }
     if (!ok) throw E("bad-input", "the signing key does not correspond to the public key -- the signature would not verify");
   }
@@ -1404,6 +1405,7 @@ function makeBuilder(ctx) {
     extMsCertificateTemplate: extMsCertificateTemplate, extMsCaVersion: extMsCaVersion,
     extMsPreviousCertHash: extMsPreviousCertHash, extMsEnrollCertType: extMsEnrollCertType,
     spkiKeyId: spkiKeyId, skiKeyId: skiKeyId, skiValueOf: skiValueOf,
+    altPublicKeyValueOf: altPublicKeyValueOf,
     reqDer: reqDer, reqDenseArray: reqDenseArray, reqDerSequence: reqDerSequence, assertValidSpki: assertValidSpki, assertValidExtension: assertValidExtension,
     assertExtnValueIsDer: assertExtnValueIsDer,
     assertCertCriticality: assertCertCriticality,
@@ -1435,6 +1437,28 @@ function skiValueOf(parsedCert) {
   catch (_e) { return null; }   // allow:swallow-unverified -- a malformed SKI is read as absent; a signer then derives the authorityKeyIdentifier keyIdentifier from the public key, and a verifier matches on nothing
 }
 
+/** @internal The alternative public key a parsed certificate PUBLISHES, from its
+ *  subjectAltPublicKeyInfo extension (ITU-T X.509 (2019) clause 9.8.2), or null when it carries none.
+ *
+ *  A signer needs this to bind an alternative signature to the issuer the same way the native signature
+ *  is already bound: the native key is read out of the issuer certificate, while the alternative key is
+ *  handed in beside it, so without this the two can be different keys. Clause 9.8.4 has a relying party
+ *  check an alternative signature with the issuer's alternative public key, which is the one in the
+ *  issuer's own certificate, so a signature made with any other key verifies for nobody. */
+function altPublicKeyValueOf(parsedCert) {
+  var exts = intrinsic.filter(parsedCert.extensions, function (e) { return e.oid === OID_SAPKI; });
+  if (!exts.length) return null;
+  /** @internal The extension's value IS a SubjectPublicKeyInfo, so unlike subjectKeyIdentifier there is
+   *  no inner OCTET STRING to read through: the bytes are the SPKI. They are decoded only to confirm the
+   *  shape, and the original bytes returned rather than a re-encoding, so the comparison a signer makes is
+   *  against what the certificate actually carries. */
+  try {
+    var node = asn1.decode(exts[0].value);
+    if (!node.constructed || node.tagNumber !== asn1.TAGS.SEQUENCE) return null;
+    return _bufferFrom(exts[0].value);
+  } catch (_e) { return null; }   // allow:swallow-unverified -- an unreadable extension publishes no key, and a signer then refuses rather than binding to bytes it could not decode
+}
+
 /** @internal Whether two SubjectPublicKeyInfo encodings carry the same public key: byte-equal, or
  *  equal under the runtime's key comparison once both import. */
 function samePublicKey(spkiA, spkiB) {
@@ -1443,8 +1467,8 @@ function samePublicKey(spkiA, spkiB) {
   var ka, kb;
   // allow:swallow-unverified an SPKI the key layer cannot import matches nothing, which is the
   try {
-    ka = nodeCrypto.createPublicKey({ key: a, format: "der", type: "spki" });
-    kb = nodeCrypto.createPublicKey({ key: bb, format: "der", type: "spki" });
+    ka = guard.crypto.publicKey({ key: a, format: "der", type: "spki" });
+    kb = guard.crypto.publicKey({ key: bb, format: "der", type: "spki" });
   } catch (_e) { return false; }
   /** @internal Two keys of different types are never the same key, and comparing them through
    *  the runtime's equality leaves a fault queued in the crypto library that surfaces on the