@blamejs/pki 0.8.30 → 0.8.48

package/lib/schema-pkix.js

@@ -479,11 +479,44 @@ function coerceToDer(input, opts) {
      * would otherwise be read end to end on the way to being refused for its size. */
     guard.limits.byteCap(buf, _COERCE_MAX_BYTES, function (c, m) { return new opts.ErrorClass(c, m); },
       opts.prefix + "/too-large", "parse input");
-    return _isPemArmor(buf) ? pemDecode(buf, opts.pemLabel, opts.PemError) : buf;
+    if (!_isPemArmor(buf)) return buf;
+    /** @internal A DER header short enough for the short form can be entirely text bytes, so the
+     * probe alone cannot separate armor from a DER value carrying an armor line in its content: an
+     * APPLICATION 3 primitive is identifier 0x43 and any content length from 32 to 126 is a
+     * printable length octet. Bytes that do not decode as one complete DER value are armor, which is
+     * the resolution `pki convert` takes and keeps every PEM file a caller reads into a Buffer on the
+     * PEM path. The decode runs only where the probe already said armor, so DER input reaches its
+     * parser without it. */
+    if (!_isCompleteDer(buf)) return pemDecode(buf, opts.pemLabel, opts.PemError);
+    /** @internal A primitive tag makes any content valid, so bytes can satisfy both readings at once
+     * and no rule chooses between them: a caller handed the wrong one would be handed the other
+     * reading's bytes, silently. The argument is what is ambiguous, not the file, so the message
+     * names the two unambiguous ways to say which was meant. */
+    if (_isPemBlock(buf, opts)) {
+      throw new opts.ErrorClass(opts.prefix + "/bad-input",
+        "parse input is both one complete DER value and a well-formed PEM block, so which was meant " +
+        "cannot be read from the bytes: pass PEM as a string, or pass the DER value on its own");
+    }
+    return buf;
   }
   throw new opts.ErrorClass(opts.prefix + "/bad-input", "parse expects a DER BufferSource (Buffer, typed array, DataView, or ArrayBuffer) or a PEM string");
 }
 
+/** @internal Whether a buffer also holds a well-formed PEM block, asked only to detect that both
+ * readings hold. The decoded bytes are discarded: the caller refuses rather than choosing one. */
+function _isPemBlock(buf, opts) {
+  try { pemDecode(buf, opts.pemLabel, opts.PemError); return true; }
+  catch (_e) { return false; }
+}
+
+/** @internal Whether a buffer is exactly one complete DER value. Trailing bytes disqualify it, so a
+ * PEM file whose leading text happened to decode cannot be taken for DER on that prefix alone. */
+function _isCompleteDer(buf) {
+  // allow:bare-decode classifies bytes AT the door, before a parse context exists to carry caps; the buffer is byte-capped above and the decode holds the codec's own caps.
+  try { asn1.decode(buf); return true; }
+  catch (_e) { return false; }
+}
+
 /** @internal Whether a buffer is armored text rather than DER. Read from a fixed window at the
  * front, the answer is wrong for a file whose explanatory text is longer than the window, and the
  * caller then hands PEM to the DER decoder and reports the DER as malformed. So the whole buffer is
@@ -493,7 +526,11 @@ function _isPemArmor(buf) {
   var n = buf.length;
   for (var i = 0; i < n; i++) {
     var c = buf[i];
-    var textByte = (c >= 0x20 && c < 0x7f) || c === 0x09 || c === 0x0a || c === 0x0d ||
+    /** @internal ASCII whitespace has six members and a text file carries all six, so the walk
+     * passes tab, line feed, vertical tab, form feed, carriage return and space, plus the printable
+     * range and the byte-order mark. Every other byte ends the walk: a boundary behind one means the
+     * buffer is not text, and DER is binary. A PEM file that does carry one is passed as a string. */
+    var textByte = (c >= 0x20 && c < 0x7f) || (c >= 0x09 && c <= 0x0d) ||
       c === 0xef || c === 0xbb || c === 0xbf;
     if (!textByte) return false;
     if (c === 0x2d && _bufToString(_subarray(buf, i, i + 10), "latin1") === "-----BEGIN") return true;
@@ -704,6 +741,68 @@ function algorithmIdentifier(ns, opts) {
   });
 }
 
+/** @internal IssuerAndSerialNumber ::= SEQUENCE { issuer Name, serialNumber CertificateSerialNumber }
+ *  (RFC 5652 sec. 10.2.4). CMS names the type and RFC 9763 sec. 3.1 reuses it inside a CSR attribute,
+ *  so the shape is defined once and each caller supplies its own code and name for the refusal. */
+function issuerAndSerialNumber(ns, opts) {
+  opts = opts || {};
+  return schema.seq([
+    schema.field("issuer", name(ns)),
+    schema.field("serialNumber", schema.integerLeaf()),
+  ], {
+    assert: "sequence", arity: { exact: 2 },
+    code: opts.code || (ns.prefix + "/bad-issuer-and-serial"), what: opts.what || "IssuerAndSerialNumber",
+    build: function (m) {
+      return {
+        issuer: m.fields.issuer.value.result,
+        serialNumber: m.fields.serialNumber.value,
+        serialNumberHex: _bufToString(m.fields.serialNumber.node.content, "hex"),
+      };
+    },
+  });
+}
+
+/** @internal The digest a signature algorithm OID names, where it names one. RFC 9763 sec. 4.1 reads
+ *  this relation directly ("a hash algorithm explicitly indicated by the related certificate's
+ *  signature OID"), and an algorithm whose OID fixes no digest, such as Ed25519 or ML-DSA, is absent
+ *  rather than mapped to a default. The value is the registry name, so a caller that needs its own
+ *  spelling maps from one table instead of carrying a second copy of the relation. */
+var SIG_OID_DIGEST_ROWS = [
+  ["sha1WithRSAEncryption", "sha1"], ["sha256WithRSAEncryption", "sha256"],
+  ["sha384WithRSAEncryption", "sha384"], ["sha512WithRSAEncryption", "sha512"],
+  ["ecdsaWithSHA1", "sha1"], ["ecdsaWithSHA256", "sha256"],
+  ["ecdsaWithSHA384", "sha384"], ["ecdsaWithSHA512", "sha512"],
+  ["sha1", "sha1"], ["sha256", "sha256"], ["sha384", "sha384"], ["sha512", "sha512"],
+  ["sha3-256", "sha3-256"], ["sha3-512", "sha3-512"],
+  ["id-RSASSA-PSS-SHAKE128", "shake128"], ["id-RSASSA-PSS-SHAKE256", "shake256"],
+];
+/** @internal The digest output length in octets, for the readers that hold a hash value to the length
+ *  of the algorithm named beside it. A SHAKE is absent: its output length is a parameter of the use,
+ *  not of the algorithm, so there is no single length to hold a value to. */
+var DIGEST_LENGTH_ROWS = [
+  ["sha1", 20], ["sha256", 32], ["sha384", 48], ["sha512", 64],
+  ["sha3-256", 32], ["sha3-512", 64],
+];
+function digestLengths() {
+  var out = _create(null);
+  _forEach(DIGEST_LENGTH_ROWS, function (r) { out[r[0]] = r[1]; });
+  return out;
+}
+var DIGEST_LENGTHS = digestLengths();
+/** @internal Keyed by dotted OID through the registry the caller passes, this module taking its
+ *  registry as a parameter rather than requiring it. A row whose name the registry does not carry
+ *  throws rather than being skipped: a skipped row is a digest the readers silently stop deriving,
+ *  which reads as "this certificate names no hash" on a certificate that names one. */
+function signatureDigestNames(oidRegistry) {
+  var out = _create(null);
+  _forEach(SIG_OID_DIGEST_ROWS, function (r) {
+    var dotted = oidRegistry.byName(r[0]);
+    if (!dotted) throw new Error("schema-pkix: the signature-digest table names " + r[0] + ", which the OID registry does not carry");
+    out[dotted] = r[1];
+  });
+  return out;
+}
+
 function pbkdf2Params(ns) {
   return schema.seq([
     schema.field("salt", schema.octetString()),
@@ -1349,7 +1448,12 @@ function crlExtensionDecoders(ns) {
   var doorScope = _create(null);
   doorScope.crl = _assign(_create(null), byScope.crl);
   doorScope.entry = _assign(_create(null), byScope.entry);
-  _forEach(["authorityKeyIdentifier", "issuerAltName", "authorityInfoAccess", "freshestCRL"], function (n) {
+  /** @internal ITU-T X.509 (2019) clause 9.8 states altSignatureAlgorithm and altSignatureValue as CRL
+   * extensions as well as certificate ones, and clause 7.10.3 gives the CRL the same procedure, so the
+   * two share one decoder with the certificate scope. subjectAltPublicKeyInfo is absent: the NOTE in
+   * clause 7.2.2 says it "is only used as a public-key certificate extension". */
+  _forEach(["authorityKeyIdentifier", "issuerAltName", "authorityInfoAccess", "freshestCRL",
+    "altSignatureAlgorithm", "altSignatureValue"], function (n) {
     doorScope.crl[O(n)] = scopedCertDecoder(ns, n);
   });
   doorScope.entry[O("certificateIssuer")] = _generalNamesDecoder(ns);
@@ -1670,10 +1774,93 @@ function _acceptExtensionRecord(ext, E, code, key) {
   record.oid = checked.oid;
   record.name = typeof checked.name === "string" ? checked.name : null;
   record.critical = checked.critical === true;
-  record.value = guard.bytes.snapshot(checked.value, E, code, "the extension value");
+  /** @internal Normalized to a byte view before it is copied. The check above admits what
+   *  `guard.bytes.isByteSource` admits, which includes a DataView and an ArrayBuffer, and
+   *  `guard.bytes.snapshot` takes neither: a value this verb had just called acceptable was then refused
+   *  for being the wrong kind of container, so the two messages contradicted each other about one value.
+   *  `snapshotSource` views and copies in one call, and the view shares the caller's store rather than
+   *  copying it, so the copy is still the only allocation. */
+  record.value = guard.bytes.snapshotSource(checked.value, E, code, "the extension value");
   return record;
 }
 
+/** @internal Whether a parsed certificate's keyUsage permits a named set of purposes, as one definition
+ *  three verifiers share. RFC 5280 sec. 4.2.1.3 confines a key to the purposes a present keyUsage asserts,
+ *  so a verifier checking a signature under a certificate's key owes this check: a certificate confined to
+ *  `keyAgreement` does not authorize a signature. Absent keyUsage is unconfined and permits; a keyUsage that
+ *  does not DECODE denies rather than permits, since an extension nothing could read has not been satisfied.
+ *  `allowed` is the set each caller's own specification names, which is the only thing that differs between
+ *  them: RFC 9483 sec. 3.2 requires `digitalSignature` alone, while a signature over content is also
+ *  authorized by `contentCommitment` or `nonRepudiation`. */
+function keyUsagePermits(ns, allowed) {
+  var kuOid = ns.oid.byName("keyUsage");
+  var decoders = certExtensionDecoders(ns).byOid;
+  return function (parsedCert) {
+    var exts = (parsedCert && parsedCert.extensions) || [];
+    for (var i = 0; i < exts.length; i++) {
+      if (exts[i].oid !== kuOid) continue;
+      var ku;
+      try { ku = decoders[kuOid](exts[i].value); }
+      catch (e) { void e; return false; }
+      for (var a = 0; a < allowed.length; a++) if (ku[allowed[a]] === true) return true;
+      return false;
+    }
+    return true;
+  };
+}
+
+/** @internal The subject-key algorithms that can only ever SIGN, as one table the linter and the verifier
+ *  share. RFC 9883 sec. 6 states "The privateKeyPossessionStatement attribute MUST NOT be used to obtain a
+ *  signature certificate", and sec. 4 states the same requirement as a property of the request: "the
+ *  subjectPKInfo MUST contain the public key for the key establishment algorithm". The mechanism exists
+ *  because a key-establishment key cannot sign and so cannot prove possession the PKCS#10 way. A key that
+ *  can only sign has no such problem, so a request to certify one through that attribute asks for the
+ *  certificate those sentences forbid, whether or not the request names a key usage. Read off the requested
+ *  usages alone, the rule missed every request that omitted the keyUsage extension; read off this table
+ *  too, the two doors that apply it reach the same verdict on the same request.
+ *
+ *  Only the signature-ONLY families are here. RSA and EC can do either, so an RSA or EC subject key says
+ *  nothing on its own and is left to the usages a request asks for. `rsassaPss` IS here and
+ *  `rsaEncryption` is NOT, which is the distinction the rule turns on: a bare RSA key can do key
+ *  transport, while an id-RSASSA-PSS SPKI is restricted to signing and can no more establish a key than
+ *  an EdDSA one. `dsa` and the stateful hash-based algorithms sign by construction. */
+var SIGNATURE_ONLY_KEY_NAMES = [
+  "Ed25519", "Ed448", "rsassaPss", "dsa",
+  "id-alg-hss-lms-hashsig", "id-alg-xmss-hashsig", "id-alg-xmssmt-hashsig",
+];
+/** @internal The families, matched by the prefix the registry files them under rather than listed one at a
+ *  time: three ML-DSA sets, twelve SLH-DSA sets and eighteen composite ML-DSA arms, all of which sign and
+ *  none of which establishes a key. Taking them by family means a set the registry gains later belongs to
+ *  this rule without a second edit, which is what kept RSASSA-PSS out of an earlier hand-written list. */
+var SIGNATURE_ONLY_KEY_PREFIXES = ["id-ml-dsa-", "id-slh-dsa-", "id-MLDSA"];
+
+var _signatureOnlyByNs = new _WeakMapI();
+
+/** @internal Whether a dotted subject-key algorithm OID names a signature-only family. Built once per
+ *  OID registry and memoized on it, since the registry is enumerated to pick the families up by prefix. */
+function signatureOnlyKeyOid(ns) {
+  var table = _weakGet(_signatureOnlyByNs, ns.oid);
+  if (table === undefined) {
+    table = _assign(_create(null), {});
+    _forEach(SIGNATURE_ONLY_KEY_NAMES, function (n) {
+      var dotted = ns.oid.byName(n);
+      if (dotted !== undefined && dotted !== null) table[dotted] = n;
+    });
+    var registry = ns.oid.all();
+    _forEach(intrinsic.keys(registry), function (dotted) {
+      var n = registry[dotted];
+      if (typeof n !== "string") return;
+      _forEach(SIGNATURE_ONLY_KEY_PREFIXES, function (p) {
+        if (_strIndexOf(n, p) === 0) table[dotted] = n;
+      });
+    });
+    _weakSet(_signatureOnlyByNs, ns.oid, table);
+  }
+  return function (dotted) {
+    return typeof dotted === "string" && _hasOwn(table, dotted);
+  };
+}
+
 function certExtensionDecoders(ns) {
   var GN_SUBTREE = generalName(ns, { decodeValue: true, subtreeBase: true, code: ns.prefix + "/bad-name-constraints" });
   var _h = _decodeHelpers(ns), decodeTop = _h.decodeTop, seqChildren = _h.seqChildren, readInt = _h.readInt, O = _h.O;
@@ -1876,6 +2063,67 @@ function certExtensionDecoders(ns) {
     return null;
   }
 
+  /** @internal RelatedCertificate ::= SEQUENCE { hashAlgorithm DigestAlgorithmIdentifier,
+   *  hashValue OCTET STRING } (RFC 9763 sec. 4.1), the digest of "the entire related certificate".
+   *  The value is held to the length of the algorithm it names, since a hash of the wrong length for
+   *  its own algorithm identifies no certificate and would otherwise be carried forward as an
+   *  identity to compare against. */
+  function relatedCertificate(buf) {
+    var C = ns.prefix + "/bad-extension-value";
+    var kids = seqChildren(buf, C, "RelatedCertificate");
+    if (kids.length !== 2) throw ns.E(C, "RelatedCertificate must be a SEQUENCE { hashAlgorithm, hashValue } (RFC 9763 sec. 4.1)");
+    var alg;
+    try { alg = schema.walk(algorithmIdentifier(ns), kids[0], ns).result; }
+    catch (e) { throw ns.E(C, "RelatedCertificate hashAlgorithm must be a DigestAlgorithmIdentifier (RFC 9763 sec. 4.1)", e); }
+    var value;
+    try { value = _bufferFrom(asn1.read.octetString(kids[1])); }
+    catch (e) { throw ns.E(C, "RelatedCertificate hashValue must be an OCTET STRING (RFC 9763 sec. 4.1)", e); }
+    if (value.length === 0) throw ns.E(C, "RelatedCertificate hashValue must not be empty (RFC 9763 sec. 4.1)");
+    var want = DIGEST_LENGTHS[alg.name];
+    if (want !== undefined && value.length !== want) {
+      throw ns.E(C, "RelatedCertificate hashValue is " + value.length + " octets, and " + alg.name + " produces " + want);
+    }
+    return { hashAlgorithm: alg.name, hashAlgorithmOid: alg.oid, hashValue: value };
+  }
+
+  /** @internal SubjectAltPublicKeyInfo ::= SEQUENCE { algorithm AlgorithmIdentifier,
+   *  subjectAltPublicKey BIT STRING } (ITU-T X.509 (2019) clause 9.8.2). Those are the two components
+   *  SubjectPublicKeyInfo has, in that order, and a field name is not encoded, so the two types share
+   *  one encoding and this reads through the shared SPKI sub-schema. The whole value is surfaced as
+   *  `bytes` because it IS an SPKI on the wire: an importer takes it unchanged. */
+  function subjectAltPublicKeyInfo(buf) {
+    var C = ns.prefix + "/bad-extension-value";
+    var n = decodeTop(buf, C, "SubjectAltPublicKeyInfo");
+    var v;
+    try { v = schema.walk(spki(ns), n, ns).result; }
+    catch (e) { throw ns.E(C, "SubjectAltPublicKeyInfo must be a SEQUENCE { algorithm, subjectAltPublicKey BIT STRING } (ITU-T X.509 (2019) clause 9.8.2)", e); }
+    if (v.publicKey.unusedBits !== 0) throw ns.E(C, "the subjectAltPublicKey BIT STRING must hold whole octets");
+    if (v.publicKey.bytes.length === 0) throw ns.E(C, "the subjectAltPublicKey must not be empty");
+    return { algorithm: v.algorithm, subjectAltPublicKey: v.publicKey.bytes, bytes: v.bytes };
+  }
+
+  /** @internal AltSignatureAlgorithm ::= AlgorithmIdentifier (clause 9.8.3). The extension value is the
+   *  AlgorithmIdentifier itself, not a SEQUENCE wrapping one. */
+  function altSignatureAlgorithm(buf) {
+    var C = ns.prefix + "/bad-extension-value";
+    var n = decodeTop(buf, C, "AltSignatureAlgorithm");
+    try { return schema.walk(algorithmIdentifier(ns), n, ns).result; }
+    catch (e) { throw ns.E(C, "AltSignatureAlgorithm must be an AlgorithmIdentifier (ITU-T X.509 (2019) clause 9.8.3)", e); }
+  }
+
+  /** @internal AltSignatureValue ::= BIT STRING (clause 9.8.4). Held to whole octets, a signature being
+   *  an octet string of bits and every algorithm here producing one. */
+  function altSignatureValue(buf) {
+    var C = ns.prefix + "/bad-extension-value";
+    var n = decodeTop(buf, C, "AltSignatureValue");
+    var bs;
+    try { bs = asn1.read.bitString(n); }
+    catch (e) { throw ns.E(C, "AltSignatureValue must be a BIT STRING (ITU-T X.509 (2019) clause 9.8.4)", e); }
+    if (bs.unusedBits !== 0) throw ns.E(C, "the AltSignatureValue BIT STRING must hold whole octets");
+    if (bs.bytes.length === 0) throw ns.E(C, "the AltSignatureValue must not be empty");
+    return { unusedBits: bs.unusedBits, bytes: _bufferFrom(bs.bytes) };
+  }
+
   function extKeyUsage(buf) {
     var C = ns.prefix + "/bad-extension-value";
     var kids = seqChildren(buf, C, "ExtKeyUsage");
@@ -2233,6 +2481,10 @@ function certExtensionDecoders(ns) {
   byOid[O("subjectInfoAccess")] = subjectInfoAccess;
   byOid[O("subjectDirectoryAttributes")] = subjectDirectoryAttributes;
   byOid[O("ocspNoCheck")] = ocspNoCheck;
+  byOid[O("relatedCertificate")] = relatedCertificate;
+  byOid[O("subjectAltPublicKeyInfo")] = subjectAltPublicKeyInfo;
+  byOid[O("altSignatureAlgorithm")] = altSignatureAlgorithm;
+  byOid[O("altSignatureValue")] = altSignatureValue;
   byOid[O("msCertificateTemplate")] = msCertificateTemplate;
   byOid[O("msEnrollCertType")] = msEnrollCertType;
   byOid[O("msCaVersion")] = msCaVersion;
@@ -2340,6 +2592,12 @@ function signedEnvelope(ns, tbsSchema, opts) {
     schema.field("signatureAlgorithm", algorithmIdentifier(ns)),
     schema.field("signatureValue", schema.bitString()),
   ], {
+    /** @internal Exactly three, with no trailing element. X.509 (2019) extended the SIGNED
+     *  parameterized type with optional `altAlgorithmIdentifier` and `altSignature` components after
+     *  the signature, and then forbade them for every structure it profiles: "only one digital
+     *  signature shall be generated, i.e., the altAlgorithmIdentifier and the altSignature components
+     *  shall be absent" (clauses 7.2.1, 7.10.2, 11.3 and 14.2). Declaring either as an optional field
+     *  here would admit a second signature the text excludes, in every format that composes this. */
     assert: "sequence", arity: { exact: 3 }, code: opts.code, what: opts.what,
     build: function (m, ctx) {
       var tbsMatch = m.fields.toBeSigned.value;
@@ -2415,6 +2673,9 @@ module.exports = {
   DN_SHORT: DN_SHORT,
   time: time,
   algorithmIdentifier: algorithmIdentifier,
+  issuerAndSerialNumber: issuerAndSerialNumber,
+  digestLengths: digestLengths,
+  signatureDigestNames: signatureDigestNames,
   pbkdf2Params: pbkdf2Params,
   pbmac1Params: pbmac1Params,
   spki: spki,
@@ -2447,6 +2708,8 @@ module.exports = {
   crlFixedCriticality: crlFixedCriticality,
   crlEntryFixedCriticality: crlEntryFixedCriticality,
   certExtensionDecoders: certExtensionDecoders,
+  keyUsagePermits: keyUsagePermits,
+  signatureOnlyKeyOid: signatureOnlyKeyOid,
   scopedCertDecoder: scopedCertDecoder,
   crlExtensionDecoders: crlExtensionDecoders,
   decodeExtensionList: decodeExtensionList,

package/lib/schema-tsp.js

@@ -42,6 +42,7 @@ var oid = require("./oid");
 var smime = require("./schema-smime");
 var cms = require("./schema-cms");
 var frameworkError = require("./framework-error");
+var guard = require("./guard-all");
 
 var TspError = frameworkError.TspError;
 var PemError = frameworkError.PemError;
@@ -177,11 +178,11 @@ var PKI_STATUS_INFO = schema.seq([
       _assertMinimalNamedBits(bs.unusedBits, bs.bytes);
       failInfo = { unusedBits: bs.unusedBits, bytes: bs.bytes, bits: _namedBits(bs.bytes) };
     }
-    return {
+    return guard.verdict.of({
       status: Number(status),
       statusString: m.fields.statusString.present ? m.fields.statusString.value.items.map(function (it) { return it.value; }) : null,
       failInfo: failInfo,
-    };
+    });
   },
 });
 
@@ -213,14 +214,14 @@ var TIME_STAMP_RESP = schema.seq([
     if (granted && !present) throw NS.E("tsp/missing-token", "a granted TimeStampResp must carry a timeStampToken (RFC 3161 sec. 2.4.2)");
     if (!granted && present) throw NS.E("tsp/unexpected-token", "a non-granted TimeStampResp must not carry a timeStampToken (RFC 3161 sec. 2.4.2)");
     if (status.status !== 2 && status.failInfo) throw NS.E("tsp/unexpected-failinfo", "failInfo is present only when the status is rejection(2) (RFC 3161 sec. 2.4.2)");
-    return {
+    return guard.verdict.of({
       status: status.status,
       statusString: status.statusString,
       failInfo: status.failInfo,
       /** @internal The token is a second parse of bytes carried inside this one, so it takes the
        *  caps this door was given rather than the built-in ceilings. */
       timeStampToken: present ? parseToken(m.fields.timeStampToken.value.bytes, ctx ? ctx.caps : undefined) : null,
-    };
+    });
   },
 });
 
@@ -552,7 +553,7 @@ function signerCertificateDer(token) {
      * one key. Two that name two different certificates leave which of them signed the token
      * unsettled, so this answers with nothing and the caller says so, rather than taking one of
      * them. */
-    if (found !== null) return Buffer.compare(found, named) === 0 ? found : null;
+    if (found !== null) return guard.bytes.compare(found, named) === 0 ? found : null;
     found = named;
   }
   return found;
@@ -576,7 +577,7 @@ function _essNamedCertificate(token, attr) {
     var element = certs[j];
     if (!element || element.tagClass !== "universal" || !Buffer.isBuffer(element.bytes)) continue;
     var actual = digest().update(element.bytes).digest();
-    if (actual.length === want.length && Buffer.compare(actual, want) === 0) return element.bytes;
+    if (actual.length === want.length && guard.bytes.compare(actual, want) === 0) return element.bytes;
   }
   return null;
 }

package/lib/sign-scheme.js

@@ -5,7 +5,6 @@
 
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
-var nodeCrypto = require("crypto");
 var pkcs8 = require("./schema-pkcs8");
 var pkix = require("./schema-pkix");
 var frameworkError = require("./framework-error");
@@ -14,6 +13,13 @@ var subtle = webcrypto.webcrypto.subtle;
 var validator = require("./validator-all");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+/** @internal The signing and key-import operations, captured at load. The objects were held and their
+ * METHODS fetched per call, which leaves them replaceable: a `sign` returning bytes of its own choosing
+ * decides the signature that goes out on a certificate, a CRL or a request, and an `importKey` or an
+ * `adoptKey` returning a different private key makes the captured signer sign with that key instead. */
+var _subtleSign = intrinsic.uncurry(subtle.sign);
+var _subtleImportKey = intrinsic.uncurry(subtle.importKey);
+var _adoptKey = webcrypto.adoptKey;
 var compositeSig = require("./composite-sig");
 var b = asn1.build;
 function O(name) { return oid.byName(name); }
@@ -28,6 +34,10 @@ var _isBuffer = intrinsic.isBuffer;
 var _bufferFrom = intrinsic.bufferFrom;
 var _isU8 = intrinsic.types.isUint8Array;
 var _resolve = intrinsic.uncurry(intrinsic.promiseResolve);
+/** @internal The promise constructor, captured at load, for the reason `guard-intrinsic` gives: the
+ * resolve builds its promise from the receiver, and the bytes a signature is made of travel through
+ * these promises. */
+var _Promise = intrinsic.Promise;
 
 var HASH = intrinsic.assign(intrinsic.create(null), { sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" });
 var NODE_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: "sha256", sha384: "sha384", sha512: "sha512", shake128: "shake128", shake256: "shake256" });
@@ -211,7 +221,7 @@ function _importKey(key, imp, E) {
       throw E("bad-input", "the signing key is a WebCrypto CryptoKey of type " + _stringify(key.type) + "; a signing key must be a private key (type \"private\")");
     }
     _assertKeyMatchesScheme(key, imp, E);
-    return webcrypto.adoptKey(key, imp, ["sign"], E, "bad-input");
+    return _adoptKey(key, imp, ["sign"], E, "bad-input");
   }
   var der, owned = false;
   if (_isBuffer(key)) der = guard.bytes.view(key, E, "bad-input", "the signer private key");
@@ -224,7 +234,7 @@ function _importKey(key, imp, E) {
     throw E("bad-input", "a signer key must be a WebCrypto CryptoKey, a node:crypto KeyObject, a PKCS#8 DER Buffer, " +
       "a PKCS#8 PEM string, or a signer { algorithm, publicKey, sign }");
   }
-  var imported = subtle.importKey("pkcs8", der, imp, false, ["sign"]);
+  var imported = _subtleImportKey(subtle, "pkcs8", der, imp, false, ["sign"]);
   if (!owned) return imported;
   return imported.then(function (k) {
     guard.secret.zeroize(der, E, "bad-input", "the signer private-key copy");
@@ -315,11 +325,14 @@ function _signExternally(signer, scheme, signedBytes, E) {
    *  the rewritten artifact. `Buffer.from` is not enough: a small copy comes out of Node's shared
    *  pool, whose backing ArrayBuffer the callback could reach the original through. */
   var handed = new intrinsic.Uint8Array(signedBytes.length);
-  handed.set(signedBytes);
+  /** @internal The copy goes through the captured `set`. Read off the instance it dispatches through
+   *  `Uint8Array.prototype`, and a replacement there writes different bytes into the allocation the
+   *  callback is handed, so the signer signs a message this never assembled. */
+  intrinsic.typedArraySet(handed, signedBytes);
   var produced;
   try { produced = intrinsic.apply(signer.sign, signer.receiver, [handed]); }
   catch (e) { throw E("bad-input", "the signer sign() callback failed", e); }
-  return _resolve(Promise, produced).then(function (raw) {
+  return _resolve(_Promise, produced).then(function (raw) {
     var sig = guard.bytes.snapshotSource(raw, E, "bad-input", "the signature the signer returned");
     return _assertSignerSignature(sig, scheme, E);
   }, function (e) {
@@ -369,7 +382,7 @@ function _nodeSignOptions(key, scheme) {
   var name = scheme.sign.name;
   if (name === "ECDSA") return { key: key, dsaEncoding: "ieee-p1363" };
   if (name === "RSA-PSS") {
-    return { key: key, padding: nodeCrypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: scheme.sign.saltLength };
+    return { key: key, padding: guard.crypto.padding.RSA_PKCS1_PSS, saltLength: scheme.sign.saltLength };
   }
   return key;
 }
@@ -393,7 +406,7 @@ function _signWithKeyObject(key, scheme, signedBytes, E) {
   }
   _assertKeyObjectMatchesScheme(key, scheme, E);
   try {
-    return _bufferFrom(nodeCrypto.sign(_nodeDigest(scheme), signedBytes, _nodeSignOptions(key, scheme)));
+    return _bufferFrom(guard.crypto.sign(_nodeDigest(scheme), signedBytes, _nodeSignOptions(key, scheme)));
   } catch (e) {
     throw E("bad-input", "the signer KeyObject could not produce a " + scheme.imp.name + " signature", e);
   }
@@ -402,7 +415,7 @@ function _signWithKeyObject(key, scheme, signedBytes, E) {
 function signOverTbs(scheme, key, signedBytes, E) {
   if (intrinsic.types.isKeyObject(key)) {
     var koSig = _signWithKeyObject(key, scheme, signedBytes, E);
-    return _resolve(Promise, scheme.ecdsaDer ? validator.sig.rawToEcdsaDer(koSig, scheme.coordLen) : koSig);
+    return _resolve(_Promise, scheme.ecdsaDer ? validator.sig.rawToEcdsaDer(koSig, scheme.coordLen) : koSig);
   }
   var signer = _snapshotSigner(key);
   if (signer) {
@@ -414,7 +427,7 @@ function signOverTbs(scheme, key, signedBytes, E) {
     return compositeSig.compositeSign(scheme.composite, _normCompositeKeys(key, scheme.composite, E), signedBytes).then(function (sig) { return _bufferFrom(sig); });
   }
   return _importKey(key, scheme.imp, E).then(function (priv) {
-    return subtle.sign(scheme.sign, priv, signedBytes).then(function (sigRaw) {
+    return _subtleSign(subtle, scheme.sign, priv, signedBytes).then(function (sigRaw) {
       var sig = _bufferFrom(sigRaw);
       if (scheme.ecdsaDer) sig = validator.sig.rawToEcdsaDer(sig, scheme.coordLen);
       return sig;