@blamejs/pki 0.8.31 → 0.8.48

package/lib/csr-sign.js

@@ -25,12 +25,22 @@ var pkix = require("./schema-pkix");
 var pkiBuild = require("./pki-build");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
+/** @internal The promise a self-check is awaited through, built from the constructor captured at load.
+ *  `Promise.resolve` builds from its RECEIVER, so reading the global binding at the call hands the
+ *  construction to whatever that binding holds, and a constructor settling without awaiting its
+ *  argument runs the continuation before the check has finished. */
+var _Promise = intrinsic.Promise;
+var _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
 require("./path-validate");
 var csrVerify = require("./csr-verify");
+var relatedCert = require("./related-cert");
+var possession = require("./possession");
+var x509Schema = require("./schema-x509");
 var lint = require("./lint");
 
 var CsrError = frameworkError.CsrError;
-var KNOWN_SPEC_KEYS = Object.assign(Object.create(null), { subject: 1, subjectPublicKey: 1, extensionRequest: 1, challengePassword: 1, attributes: 1 });
+var KNOWN_SPEC_KEYS = Object.assign(Object.create(null), { subject: 1, subjectPublicKey: 1, extensionRequest: 1, challengePassword: 1, relatedCertRequest: 1, privateKeyPossessionStatement: 1, attributes: 1 });
 /** @internal The four this verb reads, which are the four `pki.x509.sign` reads. A name outside
  * them was accepted and dropped, so asking for PEM and misspelling the option returned DER and
  * reported nothing. */
@@ -53,7 +63,11 @@ var _b = pkiBuild.makeBuilder({
 });
 
 function _implicitSetOf0(members) {
-  return b.contextConstructed(0, Buffer.concat(members.slice().sort(Buffer.compare)));
+  /** @internal The copy, the DER SET-OF ordering AND the comparator go through captured operations.
+   *  Read off their own homes, `slice`, `sort` and `Buffer.compare` each decide the bytes emitted:
+   *  measured, replacing any of them made this set encode an attribute other than the one just
+   *  validated, on bytes this verb then signs. */
+  return b.contextConstructed(0, Buffer.concat(guard.list.sortedCopy(members, guard.bytes.compare)));
 }
 
 function _buildRequestedExtensions(extSpec, subjectSpki) { return _b.requestedExtensions(extSpec, subjectSpki); }
@@ -63,6 +77,80 @@ function _challengePassword(pw) {
   return asn1.isPrintableString(pw) ? b.printable(pw) : b.utf8(pw);
 }
 
+var KNOWN_POSSESSION_KEYS = Object.assign(Object.create(null), { signer: 1, certificate: 1, includeCertificate: 1 });
+/** @internal PrivateKeyPossessionStatement ::= SEQUENCE { signer IssuerAndSerialNumber,
+ *  cert Certificate OPTIONAL } (RFC 9883 sec. 3). The statement declares that this request is signed by
+ *  a key OTHER than the one being certified, which is what lets a key-establishment key be certified at
+ *  all: it cannot sign, so it cannot prove possession the PKCS#10 way. A carried certificate must be the
+ *  one the signer names, since the two would otherwise describe different keys and only one of them
+ *  signed. */
+function _possessionStatement(spec) {
+  if (spec === null || typeof spec !== "object" || Buffer.isBuffer(spec)) {
+    throw _err("csr/bad-input", "privateKeyPossessionStatement must be an object { signer, certificate? }");
+  }
+  guard.identifier.assertKnownKeys(spec, KNOWN_POSSESSION_KEYS, _err, "csr/bad-input",
+    "privateKeyPossessionStatement has an unknown field: ");
+  var signer = spec.signer;
+  if (signer === null || typeof signer !== "object" || Buffer.isBuffer(signer)) {
+    throw _err("csr/bad-input", "privateKeyPossessionStatement needs a signer naming the signature certificate's issuer and serial (RFC 9883 sec. 3)");
+  }
+  var issuerRaw = (signer.issuer !== null && typeof signer.issuer === "object" && !Buffer.isBuffer(signer.issuer) &&
+    signer.issuer.bytes !== undefined) ? signer.issuer.bytes : signer.issuer;
+  var issuerDer = _b.reqDer(issuerRaw, "privateKeyPossessionStatement signer.issuer (the signature certificate's issuer Name DER)");
+  var serial = guard.range.authoredInteger(signer.serialNumber, _err, "csr/bad-input",
+    "privateKeyPossessionStatement signer.serialNumber");
+  if (serial < 1n) throw _err("csr/bad-input", "privateKeyPossessionStatement signer.serialNumber must be a positive integer (RFC 5280 sec. 4.1.2.2)");
+
+  /** @internal The certificate is required HERE even though RFC 9883 sec. 3 lets the wire form omit it,
+   *  because this verb has to know which key signs: it resolves the signature algorithm from that key and
+   *  checks its own signature against it. The omission the RFC allows is for the CA's benefit, and a
+   *  requester holding the signing key holds its certificate too, so `includeCertificate: false` emits
+   *  the compact form while the builder still knows the key. */
+  if (spec.certificate == null) {
+    throw _err("csr/bad-input",
+      "privateKeyPossessionStatement needs the certificate: this verb resolves the signature algorithm from its key and checks the signature against it. Pass includeCertificate: false to leave it off the wire, which RFC 9883 sec. 3 allows");
+  }
+  var certDer = _b.reqDer(spec.certificate, "privateKeyPossessionStatement certificate");
+  var include = spec.includeCertificate === undefined ? true : spec.includeCertificate;
+  if (include !== true && include !== false) {
+    throw _err("csr/bad-input", "privateKeyPossessionStatement includeCertificate is a flag, so it is true, false or omitted");
+  }
+  var signerIsn = b.sequence([b.raw(issuerDer), b.integer(serial)]);
+  /** @internal Read back through the one statement reader with the certificate ALWAYS present, so the
+   *  shape rule and the signer-names-the-certificate rule are applied by the same code a consumer
+   *  applies. The emitted form may then drop it; dropping it cannot make a checked statement wrong. */
+  try { possession.parse(b.sequence([signerIsn, b.raw(certDer)])); }
+  catch (e) { throw _err("csr/bad-input", "privateKeyPossessionStatement: " + ((e && e.message) || String(e)), e); }
+  return { der: b.sequence(include ? [signerIsn, b.raw(certDer)] : [signerIsn]), certificate: certDer };
+}
+
+var KNOWN_RELATED_CERT_KEYS = Object.assign(Object.create(null), { certID: 1, requestTime: 1, locationInfo: 1, signature: 1 });
+/** @internal RequesterCertificate ::= SEQUENCE { certID IssuerAndSerialNumber, requestTime BinaryTime,
+ *  locationInfo UniformResourceIdentifiers, signature BIT STRING } (RFC 9763 sec. 3.1), where
+ *  UniformResourceIdentifiers ::= SEQUENCE SIZE (1..MAX) OF IA5String. The first two fields are the
+ *  ones the signature covers, so they are encoded by the module that defines that preimage rather than
+ *  a second time here: an encoder that disagreed with it would produce a proof no verifier accepts. */
+function _relatedCertRequest(spec) {
+  if (spec === null || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("csr/bad-input", "relatedCertRequest must be an object { certID, requestTime, locationInfo, signature }");
+  guard.identifier.assertKnownKeys(spec, KNOWN_RELATED_CERT_KEYS, _err, "csr/bad-input", "relatedCertRequest has an unknown field: ");
+  var signed;
+  try { signed = relatedCert.requestSignedData({ certID: spec.certID, requestTime: spec.requestTime }); }
+  catch (e) { throw _err("csr/bad-input", "relatedCertRequest certID and requestTime: " + ((e && e.message) || String(e)), e); }
+
+  var locations = spec.locationInfo;
+  if (!Array.isArray(locations)) throw _err("csr/bad-input", "relatedCertRequest locationInfo must be an array of URI strings (RFC 9763 sec. 3.1)");
+  if (locations.length < 1) throw _err("csr/bad-input", "relatedCertRequest locationInfo must name at least one URI (SEQUENCE SIZE (1..MAX))");
+  var uris = guard.list.copyMap(locations, function (u, i) {
+    if (typeof u !== "string" || u.length === 0) throw _err("csr/bad-input", "relatedCertRequest locationInfo[" + i + "] must be a non-empty URI string");
+    if (!guard.encoding.isAsciiText(u)) throw _err("csr/bad-input", "relatedCertRequest locationInfo[" + i + "] must be an IA5String, so every character is ASCII (RFC 9763 sec. 3.1)");
+    return b.ia5(u);
+  });
+
+  var sig = _b.reqDer(spec.signature, "relatedCertRequest signature (the proof of possession over pki.relatedCert.requestSignedData)");
+  if (sig.length === 0) throw _err("csr/bad-input", "relatedCertRequest signature must not be empty");
+  return b.sequence([b.raw(signed), b.sequence(uris), b.bitString(sig, 0)]);
+}
+
 /**
  * @primitive pki.csr.sign
  * @signature pki.csr.sign(spec, key, opts?) -> Promise<Buffer|string>
@@ -140,9 +228,22 @@ function _sign(spec, key, opts) {
   }
   if (spec.extensionRequest != null) addAttr(O("extensionRequest"), _buildRequestedExtensions(spec.extensionRequest, subjectSpki));
   if (spec.challengePassword != null) addAttr(O("challengePassword"), _challengePassword(spec.challengePassword));
+  if (spec.relatedCertRequest != null) addAttr(O("relatedCertRequest"), _relatedCertRequest(spec.relatedCertRequest));
+  /** @internal The statement, and the key its certificate carries: the signature is made by that key, so
+   *  the scheme below resolves from it. A statement that omits the certificate leaves the signing key
+   *  unverifiable here, since there is nothing to check it against, so the certificate is required at
+   *  build time even though RFC 9883 sec. 3 lets the wire form omit it. */
+  var possessionCertSpki = null;
+  if (spec.privateKeyPossessionStatement != null) {
+    var statement = _possessionStatement(spec.privateKeyPossessionStatement);
+    addAttr(O("statementOfPossession"), b.raw(statement.der));
+    possessionCertSpki = x509Schema.parse(statement.certificate).subjectPublicKeyInfo.bytes;
+  }
   if (spec.attributes != null) {
     if (!Array.isArray(spec.attributes)) throw _err("csr/bad-input", "spec.attributes must be an array of pre-encoded Attribute DER");
-    spec.attributes.forEach(function (a, i) {
+    /** @internal Through the captured walk, never the caller's own `forEach`: a request's attributes are
+     *  signed content, and a replaced walk hands the callback a list it never validated. */
+    guard.list.copyMap(spec.attributes, function (a, i) {
       var der = _b.reqDer(a, "attribute [" + i + "]");
       var n;
       try { n = asn1.decode(der); }
@@ -153,6 +254,8 @@ function _sign(spec, key, opts) {
       catch (e) { throw _err("csr/bad-input", "pre-encoded attribute [" + i + "] type is not an OBJECT IDENTIFIER", e); }
       if (at === O("extensionRequest")) throw _err("csr/bad-input", "pass requested extensions via spec.extensionRequest, not a pre-encoded extensionRequest attribute");
       if (at === O("challengePassword")) throw _err("csr/bad-input", "pass the challenge password via spec.challengePassword, not a pre-encoded challengePassword attribute");
+      if (at === O("relatedCertRequest")) throw _err("csr/bad-input", "pass the related-certificate request via spec.relatedCertRequest, not a pre-encoded relatedCertRequest attribute");
+      if (at === O("statementOfPossession")) throw _err("csr/bad-input", "pass the possession statement via spec.privateKeyPossessionStatement, not a pre-encoded statementOfPossession attribute");
       if (!n.children[1].children || n.children[1].children.length === 0) throw _err("csr/bad-input", "pre-encoded attribute [" + i + "] value SET must contain at least one value (RFC 2986 SET SIZE(1..MAX))");
       if (seenAttr[at]) throw _err("csr/bad-input", "duplicate " + (oid.name(at) || at) + " attribute");
       seenAttr[at] = true;
@@ -160,7 +263,15 @@ function _sign(spec, key, opts) {
     });
   }
 
-  var scheme = signScheme.resolveSignScheme(_b.certLikeFromSpki(subjectSpki), { combinedRsaSig: true, pss: opts.pss, digestAlgorithm: opts.digestAlgorithm }, true, _signE);
+  /** @internal Which key signs, and therefore which key the scheme resolves from. Normally the subject's
+   *  own, because a PKCS#10 signature IS the proof of possession of the key being certified. With an
+   *  RFC 9883 statement of possession the signature is made by the key of the certificate the statement
+   *  names, which is the whole mechanism: a key-establishment key cannot sign, so it cannot prove
+   *  possession that way. The relaxation is scoped to a request that declares the statement, so a
+   *  request without one is still held to signing with the key it certifies. */
+  var provingSpki = subjectSpki;
+  if (possessionCertSpki !== null) provingSpki = possessionCertSpki;
+  var scheme = signScheme.resolveSignScheme(_b.certLikeFromSpki(provingSpki), { combinedRsaSig: true, pss: opts.pss, digestAlgorithm: opts.digestAlgorithm }, true, _signE);
 
   var criDer = b.sequence([b.integer(0n), subjectDer, b.raw(subjectSpki), _implicitSetOf0(attrs)]);
   lint.assertBuildClean("csr",
@@ -168,7 +279,7 @@ function _sign(spec, key, opts) {
     opts.profile, _err, "csr/profile-violation");
 
   return signScheme.signOverTbs(scheme, signingKey, criDer, _signE).then(function (sig) {
-    return Promise.resolve(_b.assertSignatureVerifies(criDer, sig, subjectSpki, scheme)).then(function () {
+    return _promiseResolve(_Promise, _b.assertSignatureVerifies(criDer, sig, provingSpki, scheme)).then(function () {
       var der = b.sequence([criDer, scheme.sigAlgId, b.bitString(sig, 0)]);
       return opts.pem ? csr.pemEncode(der, "CERTIFICATE REQUEST") : der;
     });
@@ -233,7 +344,7 @@ function _coerceCsr(request) {
 function verify(request) { return guard.async.deferred(function () { return _verify(request); }); }
 function _verify(request) {
   var parsed = _coerceCsr(request);
-  return Promise.resolve(csrVerify.verifyCsrSignature(parsed)).then(function (ok) {
+  return _promiseResolve(_Promise, csrVerify.verifyCsrSignature(parsed)).then(function (ok) {
     return guard.verdict.of({
       valid: ok === true,
       verified: ok === true,