@blamejs/pki 0.8.30 → 0.8.48

package/lib/revocation-fetch.js

@@ -352,8 +352,8 @@ async function _tryOcsp(state, cert, issuer, ctx, candidate) {
   if (!state.nonce && v.nextUpdate && v.thisUpdate) {
     state.cache.put(key, hit, v.thisUpdate, v.nextUpdate, hit.length);
   }
-  return { status: v.status, reason: "an OCSP response from " + candidate.url,
-    revocationReason: v.revocationReason, revocationTime: v.revocationTime };
+  return guard.verdict.of({ status: v.status, reason: "an OCSP response from " + candidate.url,
+    revocationReason: v.revocationReason, revocationTime: v.revocationTime });
 }
 
 /** @internal The bytes the nonce extension carries, which is what the response echoes. The
@@ -490,14 +490,14 @@ async function _tryCrl(state, cert, issuer, ctx, candidates, certDeltas) {
     var interim = await state.crlChecker(gathered, { useDeltas: state.useDeltas }).check(cert, issuer, ctx);
     if (interim && (interim.status === "good" || interim.status === "revoked")) {
       if (authentic) _keep(state, url, parsed, fetchedBytes, cert.issuer.bytes, issuer.workingPublicKey);
-      return { status: interim.status, reason: "a CRL from " + url,
-        revocationReason: _reasonCodeOf(interim), revocationTime: interim.revocationTime };
+      return guard.verdict.of({ status: interim.status, reason: "a CRL from " + url,
+        revocationReason: _reasonCodeOf(interim), revocationTime: interim.revocationTime });
     }
   }
   if (gathered.length === 0) throw E("path/revocation-fetch-failed", "no CRL was fetched");
   var last = await state.crlChecker(gathered, { useDeltas: state.useDeltas }).check(cert, issuer, ctx);
-  return { status: (last && last.status) || "unknown", reason: (last && last.reason) || "the fetched CRLs did not settle the status",
-    revocationReason: _reasonCodeOf(last), revocationTime: last && last.revocationTime };
+  return guard.verdict.of({ status: (last && last.status) || "unknown", reason: (last && last.reason) || "the fetched CRLs did not settle the status",
+    revocationReason: _reasonCodeOf(last), revocationTime: last && last.revocationTime });
 }
 
 /** @internal `crlChecker` names the CRLReason integer `reasonCode` and `verifyOcspResponse` names it

package/lib/scep.js

@@ -473,7 +473,7 @@ function _buildIssuerAndSerial(spec) {
  *
  * @opts
  *   - `recipientKey` -- `{ cert, key }` for the recipient, to decrypt the pkcsPKIEnvelope into `messageData`.
- *   - `signerCert` -- the expected signer certificate DER (the CA certificate for a CertRep); the message signer's public key must match it, or the message is refused.
+ *   - `signerCert` -- the expected signer certificate DER (the CA certificate for a CertRep); the message signer's public key must match it, or the message is refused. It also decides whether an envelope using RSAES-PKCS1-v1_5 key transport over a content with no integrity tag is read: that combination is refused for a signer this option has not authenticated.
  *   - `expectedSenderNonce` -- a 16-byte Buffer; a message whose `recipientNonce` does not echo it is refused.
  * @example
  *   // requires: pkiMessage -- a SCEP pkiMessage DER (from pki.scep.build, or a CA's response)
@@ -571,7 +571,17 @@ async function parse(bytes, opts) {
   }
   if (recipientKey != null && carriesEnvelope && v.eContent != null) {
     var dec;
-    try { dec = await cmsDecrypt.decrypt(v.eContent, recipientKey); }
+    /** @internal The opt-in is passed only once the signer has been authenticated, which is what the
+     *  premise rests on. `pki.cms.decrypt` refuses RSAES-PKCS1-v1_5 key transport over a content with no
+     *  integrity tag because acceptance tells an attacker submitting chosen ciphertexts that theirs
+     *  decoded. With `opts.signerCert` matched, the envelope arrived inside a signature an authorized
+     *  peer made, and an attacker who cannot sign as that peer cannot submit one. Without it the
+     *  signature is any signer's, this verb reports `signerAuthenticated: false`, and the caller
+     *  authenticates the surfaced certificate after the decrypt has already produced its outcome, so the
+     *  refusal stands. RFC 8894 sec. 3.1 puts the envelope there, and v1.5 over a CBC content is what
+     *  deployed SCEP peers send, so an authenticated exchange still reads them. */
+    var decOpts = signerAuthenticated ? { allowUnauthenticatedRsa15: true } : {};
+    try { dec = await cmsDecrypt.decrypt(v.eContent, recipientKey, decOpts); }
     catch (e) {
       if (e && e.isPkiError) throw _err("scep/decrypt-failed", "the pkcsPKIEnvelope could not be decrypted with the recipient key: " + e.message, e);
       throw e;
@@ -606,7 +616,7 @@ async function parse(bytes, opts) {
       if (isnCh[1].content.length > 20) throw _err("scep/bad-request-payload", "a " + messageType + " messageData serialNumber must not exceed 20 octets (RFC 5280 sec. 4.1.2.2)");
     }
   }
-  return out;
+  return guard.verdict.shield(out);
 }
 var _PARSE_KEYS = Object.assign(Object.create(null), { recipientKey: 1, expectedSenderNonce: 1, signerCert: 1 });
 
@@ -1006,7 +1016,7 @@ function _dispatchCertRep(rep, transactionId, spki) {
   if (findIssuedCert(repCerts.filter(function (c) { return c !== issued; }), spki.bytes) != null) {
     throw _err("scep/ambiguous-issued-cert", "the SUCCESS CertRep carried more than one certificate matching the request public key; the issued certificate is ambiguous (RFC 8894 sec. 3.3)");
   }
-  return { pending: false, result: { status: "SUCCESS", certificate: issued, certificates: repCerts, transactionId: rep.transactionId } };
+  return guard.verdict.of({ pending: false, result: guard.verdict.of({ status: "SUCCESS", certificate: issued, certificates: repCerts, transactionId: rep.transactionId }) });
 }
 
 function _pollExhausted(which, transactionId, senderNonce) {
@@ -1089,7 +1099,7 @@ async function _pkiOperation(messageType, baseUrl, opts, verbName) {
   var rep = await parse(body, { signerCert: signerCert, expectedSenderNonce: senderNonce, recipientKey: recipientKey });
   var d = _dispatchCertRep(rep, transactionId, spki);
   if (!d.pending) return d.result;
-  if (pollCount <= 0) return { status: "PENDING", transactionId: rep.transactionId, senderNonce: senderNonce };
+  if (pollCount <= 0) return guard.verdict.of({ status: "PENDING", transactionId: rep.transactionId, senderNonce: senderNonce });
   return _pollForIssuance({
     firstResponse: res, firstSenderNonce: senderNonce, postUrl: postUrl, httpMethod: httpMethod, clientOpts: clientOpts,
     caCert: caCert, csrSubject: csrSubject, issuerCert: issuerCert, signer: signer, signerCert: signerCert, recipientKey: recipientKey,

package/lib/schema-c509.js

@@ -1282,7 +1282,7 @@ function _requireStrictDerTlv(content, code, label) {
 
 function _derSetInDeclaredOrder(vals) {
   for (var i = 1; i < vals.length; i++) {
-    if (Buffer.compare(vals[i - 1], vals[i]) > 0) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes attributeValue list must be in DER ascending order (X.690 sec. 11.6)");
+    if (guard.bytes.compare(vals[i - 1], vals[i]) > 0) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes attributeValue list must be in DER ascending order (X.690 sec. 11.6)");
   }
   return b.set(vals);
 }
@@ -2033,7 +2033,10 @@ function encode(input, opts) {
   var origDer = pkix.coerceToDer(input, { pemLabel: "CERTIFICATE", PemError: frameworkError.PemError, ErrorClass: C509Error, prefix: "c509" });
   var encoded = _encodeC509Array(_derToType3(origDer, opts));
   var recon = parse(encoded).reconstructedDer;
-  if (!recon || Buffer.compare(recon, origDer) !== 0) throw _err("c509/non-invertible", "the type-3 C509 does not reconstruct the source certificate byte-for-byte");
+  /** @internal Through the captured comparator: this IS the byte-for-byte claim a type-3 C509 makes
+   *  about the certificate it re-encodes, so a replacement answering zero asserts it over bytes that
+   *  do not match. */
+  if (!recon || guard.bytes.compare(recon, origDer) !== 0) throw _err("c509/non-invertible", "the type-3 C509 does not reconstruct the source certificate byte-for-byte");
   return encoded;
 }
 

package/lib/schema-cmc.js

@@ -245,7 +245,7 @@ function parseStatusInfo(valueDer, version, bodyPartID, ctx) {
     extendedFailInfo: other ? other.extendedFailInfo : null,
   };
   _assertStatusCoherent(out);
-  return out;
+  return guard.verdict.shield(out);
 }
 
 function _assertStatusCoherent(s) {

package/lib/schema-cmp.js

@@ -231,11 +231,11 @@ var PKI_STATUS_INFO = schema.seq([
 ], {
   assert: "sequence", code: "cmp/bad-status-info", what: "PKIStatusInfo",
   build: function (m) {
-    return {
+    return guard.verdict.of({
       status: m.fields.status.value,
       statusString: m.fields.statusString.present ? m.fields.statusString.value.result : null,
       failInfo: m.fields.failInfo.present ? m.fields.failInfo.value : null,
-    };
+    });
   },
 });
 
@@ -329,11 +329,11 @@ var REV_REP_CONTENT = schema.seq([
 ], {
   assert: "sequence", code: "cmp/bad-rev-rep", what: "RevRepContent",
   build: function (m) {
-    return {
+    return guard.verdict.of({
       status: m.fields.status.value.result,
       revCerts: m.fields.revCerts.present ? m.fields.revCerts.value.result : null,
       crls: m.fields.crls.present ? m.fields.crls.value.result : null,
-    };
+    });
   },
 });
 
@@ -411,12 +411,12 @@ var CERT_RESPONSE = schema.seq([
       throw ctx.E("cmp/bad-cert-response",
         "a CertResponse certifiedKeyPair is allowed only under a granting status (accepted or grantedWithMods) (RFC 9810 sec. 5.3.4)");
     }
-    return {
+    return guard.verdict.of({
       certReqId: m.fields.certReqId.value,
       status: status,
       certifiedKeyPair: certifiedKeyPair,
       rspInfo: m.fields.rspInfo.present ? m.fields.rspInfo.value : null,
-    };
+    });
   },
 });
 
@@ -455,12 +455,12 @@ var KEY_REC_REP_CONTENT = schema.seq([
 ], {
   assert: "sequence", code: "cmp/bad-key-rec-rep", what: "KeyRecRepContent",
   build: function (m) {
-    return {
+    return guard.verdict.of({
       status: m.fields.status.value.result,
       newSigCert: m.fields.newSigCert.present ? m.fields.newSigCert.value : null,
       caCerts: m.fields.caCerts.present ? m.fields.caCerts.value.result : null,
       keyPairHist: m.fields.keyPairHist.present ? m.fields.keyPairHist.value.result : null,
-    };
+    });
   },
 });
 

package/lib/schema-cms.js

@@ -60,7 +60,6 @@ var NS = pkix.makeNS("cms", CmsError, oid);
 
 var ALGORITHM_IDENTIFIER = pkix.algorithmIdentifier(NS);
 var ATTRIBUTE = pkix.attribute(NS);
-var NAME = pkix.name(NS);
 
 var SIGNED_DATA_VERSION = pkix.versionReader(NS, { "1": 1, "3": 3, "4": 4, "5": 5 });
 var SIGNER_VERSION = pkix.versionReader(NS, { "1": 1, "3": 3 });
@@ -179,7 +178,7 @@ function _readsAsTime(vals) {
 
 function _ascendingDer(nodes) {
   for (var i = 1; i < nodes.length; i++) {
-    if (Buffer.compare(nodes[i - 1].bytes, nodes[i].bytes) > 0) return false;
+    if (guard.bytes.compare(nodes[i - 1].bytes, nodes[i].bytes) > 0) return false;
   }
   return true;
 }
@@ -330,19 +329,7 @@ var ENCAP_CONTENT_INFO = schema.seq([
   },
 });
 
-var ISSUER_AND_SERIAL = schema.seq([
-  schema.field("issuer", NAME),
-  schema.field("serialNumber", schema.integerLeaf()),
-], {
-  assert: "sequence", arity: { exact: 2 }, code: "cms/bad-issuer-and-serial", what: "IssuerAndSerialNumber",
-  build: function (m) {
-    return {
-      issuer: m.fields.issuer.value.result,
-      serialNumber: m.fields.serialNumber.value,
-      serialNumberHex: m.fields.serialNumber.node.content.toString("hex"),
-    };
-  },
-});
+var ISSUER_AND_SERIAL = pkix.issuerAndSerialNumber(NS, { code: "cms/bad-issuer-and-serial" });
 
 var SIGNER_IDENTIFIER = schema.choice([
   { when: { tagClass: "universal", tagNumber: asn1.TAGS.SEQUENCE }, schema: ISSUER_AND_SERIAL },

package/lib/schema-csr.js

@@ -35,6 +35,7 @@ var pkix = require("./schema-pkix");
 var oid = require("./oid");
 var frameworkError = require("./framework-error");
 var intrinsic = require("./guard-intrinsic");
+var constants = require("./constants");
 
 var CsrError = frameworkError.CsrError;
 var PemError = frameworkError.PemError;
@@ -73,6 +74,74 @@ RECOGNIZED_ATTRIBUTE_VALUE[oid.byName("challengePassword")] = function (node, ct
   }
 };
 
+/** @internal RequesterCertificate ::= SEQUENCE { certID IssuerAndSerialNumber, requestTime BinaryTime,
+ *  locationInfo UniformResourceIdentifiers, signature BIT STRING } (RFC 9763 sec. 3.1), where
+ *  UniformResourceIdentifiers ::= SEQUENCE SIZE (1..MAX) OF URI and URI ::= IA5String. locationInfo is
+ *  a SEQUENCE OF rather than one URI, and it is the one field the signature does not cover. */
+var REQUESTER_CERTIFICATE = schema.seq([
+  schema.field("certID", pkix.issuerAndSerialNumber(NS, { code: "csr/bad-attribute-value" })),
+  schema.field("requestTime", schema.integerLeaf()),
+  /** @internal A SEQUENCE OF, so the DER SET-OF ordering rule does not apply and the URIs keep the
+   *  order the requester wrote them in. */
+  schema.field("locationInfo", schema.seqOf(schema.decode(function (n, ctx) {
+    if (n.tagClass !== "universal" || n.tagNumber !== asn1.TAGS.IA5_STRING) {
+      throw ctx.E("csr/bad-attribute-value", "a RequesterCertificate locationInfo entry must be an IA5String URI (RFC 9763 sec. 3.1)");
+    }
+    return asn1.read.string(n);
+  }), { assert: "sequence", min: 1, max: constants.LIMITS.ATTRIBUTE_MAX_VALUES,
+    code: "csr/bad-attribute-value", what: "RequesterCertificate locationInfo" })),
+  schema.field("signature", schema.bitString()),
+], {
+  assert: "sequence", arity: { exact: 4 }, code: "csr/bad-attribute-value", what: "RequesterCertificate",
+  build: function (m, ctx) {
+    var t = m.fields.requestTime.value;
+    if (t < 0n) throw ctx.E("csr/bad-attribute-value", "a RequesterCertificate requestTime must not be negative (BinaryTime is INTEGER (0..MAX), RFC 6019 sec. 2)");
+    var bits = m.fields.signature.value;
+    if (bits.unusedBits !== 0) throw ctx.E("csr/bad-attribute-value", "a RequesterCertificate signature BIT STRING must be octet-aligned");
+    if (bits.bytes.length === 0) throw ctx.E("csr/bad-attribute-value", "a RequesterCertificate signature must not be empty");
+    return {
+      certID: m.fields.certID.value.result,
+      requestTime: t,
+      locationInfo: intrinsic.map(m.fields.locationInfo.value.items, function (it) { return it.value; }),
+      signature: { unusedBits: bits.unusedBits, bytes: bits.bytes },
+    };
+  },
+});
+/** @internal PrivateKeyPossessionStatement ::= SEQUENCE { signer IssuerAndSerialNumber,
+ *  cert Certificate OPTIONAL } (RFC 9883 sec. 3). The signer is the shared IssuerAndSerialNumber; the
+ *  certificate is surfaced as raw DER, because it is a whole Certificate a caller parses and verifies
+ *  rather than a field read here. */
+var POSSESSION_STATEMENT = schema.seq([
+  schema.field("signer", pkix.issuerAndSerialNumber(NS, { code: "csr/bad-attribute-value" })),
+  schema.optional("certificate", schema.any(), { whenUniversal: [asn1.TAGS.SEQUENCE] }),
+], {
+  assert: "sequence", arity: { min: 1, max: 2 },
+  code: "csr/bad-attribute-value", what: "PrivateKeyPossessionStatement",
+  build: function (m) {
+    return {
+      signer: m.fields.signer.value.result,
+      certificate: m.fields.certificate.present ? m.fields.certificate.node.bytes : null,
+    };
+  },
+});
+RECOGNIZED_ATTRIBUTE_VALUE[oid.byName("statementOfPossession")] = function (node, ctx) {
+  try { return { privateKeyPossessionStatement: schema.walk(POSSESSION_STATEMENT, node, ctx).result }; }
+  catch (e) {
+    if (e instanceof CsrError) throw e;
+    throw ctx.E("csr/bad-attribute-value",
+      "statementOfPossession value must be a well-formed PrivateKeyPossessionStatement SEQUENCE (RFC 9883 sec. 3): " + ((e && e.message) || intrinsic.String(e)), e);
+  }
+};
+
+RECOGNIZED_ATTRIBUTE_VALUE[oid.byName("relatedCertRequest")] = function (node, ctx) {
+  try { return { relatedCertRequest: schema.walk(REQUESTER_CERTIFICATE, node, ctx).result }; }
+  catch (e) {
+    if (e instanceof CsrError) throw e;
+    throw ctx.E("csr/bad-attribute-value",
+      "relatedCertRequest value must be a well-formed RequesterCertificate SEQUENCE (RFC 9763 sec. 3.1): " + ((e && e.message) || intrinsic.String(e)), e);
+  }
+};
+
 var CERTIFICATION_REQUEST_INFO = schema.seq([
   schema.field("version", CSR_VERSION),
   schema.field("subject", NAME),

package/lib/schema-engine.js

@@ -28,6 +28,10 @@
 
 var asn1 = require("./asn1-der.js");
 var intrinsic = require("./guard-intrinsic");
+/** @internal Just the list guard, not the whole family: this module sits below the format layer and
+ *  takes the one primitive it needs. The copy-and-sort it provides reads `length` once and orders
+ *  through operations captured at load, which is what a DER SET ordering rests on. */
+var guardList = require("./guard-list");
 
 var TAGS = asn1.TAGS;
 
@@ -310,7 +314,7 @@ function _walkRepeat(schema, node, ctx) {
   }
   if (schema.derSetOrder) {
     for (var s = 1; s < kids.length; s++) {
-      if (Buffer.compare(kids[s - 1].bytes, kids[s].bytes) > 0) {
+      if (intrinsic.compare(kids[s - 1].bytes, kids[s].bytes) > 0) {
         _fail(ctx, schema.code, (schema.what || "value") + " components must be in ascending DER order (X.690 sec. 11.6)");
       }
     }
@@ -474,7 +478,7 @@ function _encodeSeq(schema, value, ctx) {
         if (!isDefault) parts.push(fld.explicit ? asn1.build.explicit(fld.tag, enc) : enc);
       }
     } else if (fld.fkind === "trailing") {
-      var members = fld.members.slice().sort(function (a, b) { return a.tag - b.tag; });
+      var members = guardList.sortedCopy(fld.members, function (a, b) { return a.tag - b.tag; });
       for (var i = 0; i < members.length; i++) {
         var mm = members[i];
         if (_present(value[mm.name])) {
@@ -509,7 +513,10 @@ function _encodeRepeat(schema, items, ctx) {
       seen.add(key);
     });
   }
-  if (schema.derSetOrder) parts = parts.slice().sort(Buffer.compare);
+  /** @internal The comparator goes through the captured operation, as the copy and the sort do. This
+   *  is the engine's own SET OF emission, so whatever decides "before" decides the bytes every schema
+   *  built on it emits. */
+  if (schema.derSetOrder) parts = guardList.sortedCopy(parts, intrinsic.compare);
   if (schema.implicitTag != null) return asn1.build.contextConstructed(schema.implicitTag, Buffer.concat(parts));
   return schema.assert === "set" ? asn1.build.set(parts) : asn1.build.sequence(parts);
 }