@blamejs/pki 0.8.31 → 0.8.48

package/lib/http-transport.js

@@ -72,6 +72,15 @@ var nodeDns = require("node:dns");
 var nodeUtil = require("node:util");
 var constants = require("./constants");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
+/** @internal `resolve` and `reject` build their promise from the RECEIVER, so reading the global
+ *  binding at the call hands the construction to whatever that binding holds. A refusal returned as a
+ *  rejected promise is a verdict: a replacement whose `reject` resolves lets a request the preparation
+ *  step rejected proceed, and `peerChain`'s refusal to tunnel through a proxy is one of those. Taken at
+ *  load. */
+var _Promise = intrinsic.Promise;
+var _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
+var _promiseReject = intrinsic.uncurry(intrinsic.promiseReject);
 var frameworkError = require("./framework-error");
 
 var TransportError = frameworkError.TransportError;
@@ -124,6 +133,30 @@ function _tlsInfo(socket) {
   return { protocol: proto, cipher: cipher, peerCertificate: peer && peer.raw ? peer.raw : null, tlsUnique: tlsUnique, tlsExporter: tlsExporter };
 }
 
+/** @internal The chain the TLS session resolved, leaf first, walked through the detailed peer
+ * certificate's `issuerCertificate` links. The walk is bounded twice over: the top certificate
+ * issues itself, so the identity comparison ends it, and a cap ends any cycle a runtime could
+ * report instead.
+ * IT IS NOT THE SAME AS WHAT THE ENDPOINT TRANSMITTED, which this comment used to claim. Node
+ * completes `issuerCertificate` from the trust store in scope, so an endpoint that sends its leaf
+ * alone still yields a chain whose upper entries came from the configured anchors rather than off
+ * the wire. Node exposes no API for the transmitted list, so the distinction cannot be recovered
+ * here and is stated instead of guessed at: filtering the entries that match an anchor would drop
+ * a root an endpoint really did send. */
+function _peerChain(socket) {
+  if (!socket || typeof socket.getPeerCertificate !== "function") return [];
+  var out = [];
+  var seen = [];
+  var cur = socket.getPeerCertificate(true);
+  while (cur && Buffer.isBuffer(cur.raw) && out.length < constants.LIMITS.TLS_MAX_PEER_CHAIN) {
+    if (seen.indexOf(cur) !== -1) break;
+    seen.push(cur);
+    out.push(cur.raw);
+    cur = cur.issuerCertificate;
+  }
+  return out;
+}
+
 function _pemifyAnchor(a) {
   if (typeof a === "string") return a;
   if (Buffer.isBuffer(a)) {
@@ -557,8 +590,8 @@ function httpsTransport(defaults) {
     request = request || {};
     var prep;
     try { prep = _prepare(request); }
-    catch (e) { return Promise.reject(e); }
-    return new Promise(function (resolve, reject) {
+    catch (e) { return _promiseReject(_Promise, e); }
+    return new _Promise(function (resolve, reject) {
       var settled = false;
       var req = null;
       var creq = null;
@@ -625,7 +658,7 @@ function httpsTransport(defaults) {
               function _writeBoundBody() {
                 if (settled) return;
                 var info = _tlsInfo(socket);
-                Promise.resolve().then(function () { return prep.body(info); }).then(function (b) {
+                _promiseResolve(_Promise, undefined).then(function () { return prep.body(info); }).then(function (b) {
                   if (settled) return;
                   try {
                     if (guard.bytes.isByteSource(b)) b = guard.bytes.source(b, E, C("bad-input"), "the channel-binding body");
@@ -745,7 +778,126 @@ function httpsTransport(defaults) {
     });
   };
   _transportFn.blocksPrivateAddresses = true;
+
+  /** @internal peerChain negotiates TLS and hands back the channel without sending a request. It
+   * prepares the connection through the SAME `_prepare` the request path uses, so the anchors, the
+   * SNI, the version floor, the identity hook, the private-address block and the URL scheme gate are
+   * one policy with two entry points rather than two policies. `tls.connect` takes `host` where
+   * `https.request` takes `hostname`, and ignores the method, path and headers `_prepare` also
+   * builds. A proxy is refused rather than bypassed: tunnelling belongs to the request path, and
+   * connecting directly while a proxy is configured would reach an origin the caller asked not to
+   * reach directly. */
+  _transportFn.peerChain = function peerChain(request) {
+    request = request || {};
+    var prep;
+    try { prep = _prepare({
+      url: request.url,
+      method: "GET",
+      tls: request.tls,
+      timeout: request.timeout,
+      blockPrivateAddresses: request.blockPrivateAddresses,
+      allowPlaintextHttp: false,
+      proxy: request.proxy,
+    }); }
+    catch (e) { return _promiseReject(_Promise, e); }
+    if (prep.proxy) {
+      return _promiseReject(_Promise, E(C("bad-proxy"),
+        "peerChain opens a direct connection and does not tunnel; fetch through a proxy with the request verb"));
+    }
+    var o = prep.options;
+    var connectOpts = {
+      host: o.hostname, port: o.port, minVersion: o.minVersion,
+      rejectUnauthorized: o.rejectUnauthorized,
+    };
+    if (o.servername !== undefined) connectOpts.servername = o.servername;
+    if (o.ca !== undefined) connectOpts.ca = o.ca;
+    if (o.cert !== undefined) connectOpts.cert = o.cert;
+    if (o.key !== undefined) connectOpts.key = o.key;
+    if (o.checkServerIdentity !== undefined) connectOpts.checkServerIdentity = o.checkServerIdentity;
+    if (o.lookup !== undefined) connectOpts.lookup = o.lookup;
+
+    return new _Promise(function (resolve, reject) {
+      var settled = false;
+      var socket;
+      var timer = null;
+      function done(fn, arg) {
+        if (settled) return;
+        settled = true;
+        if (timer !== null) { clearTimeout(timer); timer = null; }
+        try { if (socket) socket.destroy(); } catch (_de) { /* allow:swallow-unverified the socket is being abandoned either way */ }
+        fn(arg);
+      }
+      try { socket = nodeTls.connect(connectOpts); }
+      catch (e) {
+        reject(E(_classifyError(e, C), "the TLS connection failed: " + e.message, e));
+        return;
+      }
+      /** @internal The budget is an ABSOLUTE deadline, the same timer the request path above uses, and not
+       *  `socket.setTimeout`: that one bounds INACTIVITY, so what it measures is the gap between bytes
+       *  rather than the elapsed time a caller asked to be bounded by. A peer that keeps the socket busy
+       *  without completing the handshake is the case the two differ on. The socket inactivity timeout is
+       *  kept as well, since it ends a connection that goes silent sooner than the deadline would. */
+      timer = setTimeout(function () {
+        done(reject, E(C("timeout"), "the TLS handshake did not complete within " + prep.timeout + "ms"));
+      }, prep.timeout);
+      socket.setTimeout(prep.timeout, function () {
+        done(reject, E(C("timeout"), "the TLS handshake did not complete within " + prep.timeout + "ms"));
+      });
+      socket.once("secureConnect", function () {
+        var info = _tlsInfo(socket);
+        info.peerChain = _peerChain(socket);
+        done(resolve, info);
+      });
+      socket.once("error", function (e) {
+        var code = _classifyError(e, C);
+        done(reject, E(code || C("tls-failed"), "the TLS connection failed: " + e.message, e));
+      });
+    });
+  };
+
   return _transportFn;
 }
 
-module.exports = { https: httpsTransport, isBlockedIp: _isBlockedIp, _makeGuardedLookup: _makeGuardedLookup, MAX_TIMEOUT: MAX_TIMEOUT, snapshotProxy: snapshotProxy };
+/**
+ * @primitive  pki.transport.peerChain
+ * @signature  pki.transport.peerChain(request, defaults?) -> Promise<channel>
+ * @since      0.8.32
+ * @status     stable
+ * @spec       RFC 8446, RFC 6125
+ * @defends    server-impersonation (CWE-297), tls-downgrade (CWE-757), ssrf (CWE-918)
+ * @related    pki.transport.https, pki.path.validate
+ *
+ * Negotiate TLS with an endpoint and return the channel it established, without sending a
+ * request: `{ protocol, cipher, peerCertificate, peerChain, tlsUnique, tlsExporter }`.
+ * `peerChain` is the chain the session resolved as DER, leaf first, walked up from the peer
+ * certificate and stopping at the one that issues itself. It is not a record of what crossed the
+ * wire: the runtime completes the chain from the trust anchors in scope, so an endpoint that sends
+ * only its leaf still yields the entries above it, and those came from the configured anchors.
+ * Treat the list as the chain this session built, and read `peerCertificate` for the one
+ * certificate the endpoint certainly sent. Nothing reaches the application behind the endpoint,
+ * which is the difference from making a request for the same purpose.
+ *
+ * The connection is prepared by the same code `pki.transport.https` prepares a request with,
+ * so the trust anchors, the SNI, the version floor, the `checkServerIdentity` hook, the
+ * private-address block and the https-only rule are one policy rather than a second copy of
+ * one. A request with neither an explicit anchor nor `useSystemStore` is refused
+ * (`transport/no-trust-anchors`) before any socket is opened, and an endpoint whose chain does
+ * not build to the configured anchors, or whose name does not match the URL, is refused
+ * (`transport/server-auth-failed`). A configured proxy is refused (`transport/bad-proxy`)
+ * rather than bypassed, since connecting directly would reach an origin the caller asked to
+ * reach through the proxy.
+ *
+ * **A chain this returns is not a validated one.** The handshake checked that it builds to a
+ * configured anchor and matches the name in the URL, and checked no revocation status and no
+ * policy. `pki.path.validate` is what validates a path.
+ *
+ * @example
+ *   var channel = await pki.transport.peerChain(
+ *     { url: "https://example.com/" }, { tls: { useSystemStore: true } });
+ *   channel.peerChain.length;                                  // the chain the session resolved
+ *   pki.schema.x509.parse(channel.peerChain[0]).subject.dn;    // the leaf's subject
+ *   channel.peerCertificate;                                   // the one certificate the endpoint sent
+ */
+function peerChain(request, defaults) { return httpsTransport(defaults || {}).peerChain(request); }
+
+module.exports = { https: httpsTransport, peerChain: peerChain, isBlockedIp: _isBlockedIp, _makeGuardedLookup: _makeGuardedLookup, MAX_TIMEOUT: MAX_TIMEOUT, snapshotProxy: snapshotProxy };

package/lib/identity-match.js

@@ -446,8 +446,8 @@ function _search(refs, entries, wildcardsAllowed) {
       pairs.tick();
       var got = _compare(refs[r], entries[e], wildcardsAllowed);
       if (got.disposition === "match") {
-        return { matched: true, matchedReference: refs[r].input, matchedEntry: _entryLabel(entries[e]),
-          ignored: ignored, reason: null };
+        return guard.verdict.of({ matched: true, matchedReference: refs[r].input, matchedEntry: _entryLabel(entries[e]),
+          ignored: ignored, reason: null });
       }
       if (got.disposition === "ignored") {
         var key = e + "|" + got.reason;
@@ -458,10 +458,10 @@ function _search(refs, entries, wildcardsAllowed) {
       }
     }
   }
-  return { matched: false, matchedReference: null, matchedEntry: null, ignored: ignored,
+  return guard.verdict.of({ matched: false, matchedReference: null, matchedEntry: null, ignored: ignored,
     reason: entries.length === 0
       ? "the certificate presents no subjectAltName entry, and RFC 9525 sec. 2 forbids reading an identity from the subject"
-      : "no presented identifier matched a reference identity" };
+      : "no presented identifier matched a reference identity" });
 }
 
 /**

package/lib/inspect.js

@@ -409,6 +409,29 @@ var EXT_RENDERERS = Object.assign(Object.create(null), {
   ocspNoCheck: function (decoded, inner) {
     return inner + "OCSP No Check (this is an OCSP responder certificate; do not check its revocation)";
   },
+  /** @internal ITU-T X.509 (2019) clause 9.8. The alternative key and signature run to thousands of
+   *  octets for a post-quantum algorithm, which is the case the extensions exist for, so each is
+   *  reported by its algorithm and its length rather than dumped whole. The algorithm is what a reader
+   *  needs: it says which set of algorithms this certificate is migrating to. */
+  subjectAltPublicKeyInfo: function (decoded, inner) {
+    return inner + "Algorithm: " + (decoded.algorithm.name || decoded.algorithm.oid) + "\n" +
+      inner + "Alternative Public Key: " + decoded.subjectAltPublicKey.length + " bytes";
+  },
+  altSignatureAlgorithm: function (decoded, inner) {
+    return inner + (decoded.name || decoded.oid);
+  },
+  altSignatureValue: function (decoded, inner) {
+    return inner + "Alternative Signature: " + decoded.bytes.length + " bytes";
+  },
+  /** @internal RFC 9763 sec. 4.1 names a second certificate of the same subject by the digest of the
+   *  whole certificate, so both fields are shown: the digest is only meaningful beside the algorithm
+   *  that produced it. */
+  relatedCertificate: function (decoded, inner) {
+    var alg = decoded.hashAlgorithm || decoded.hashAlgorithmOid || "(unnamed algorithm)";
+    var value = Buffer.isBuffer(decoded.hashValue) ? decoded.hashValue : Buffer.alloc(0);
+    return inner + "Hash Algorithm: " + alg + "\n" +
+      inner + "Related Certificate: " + _hexColon(value, { upper: true });
+  },
   subjectKeyIdentifier: function (decoded, inner) {
     return inner + _hexColon(Buffer.isBuffer(decoded) ? decoded : (decoded.bytes || Buffer.alloc(0)), { upper: true });
   },
@@ -419,8 +442,8 @@ var EXT_RENDERERS = Object.assign(Object.create(null), {
       decoded.authorityCertIssuer.names.forEach(function (g) { akiLines.push(inner + _gn(g)); });
     }
     if (decoded.authorityCertSerialNumber != null) {
-      var sn = (typeof decoded.authorityCertSerialNumber === "bigint"
-        ? decoded.authorityCertSerialNumber : BigInt(decoded.authorityCertSerialNumber)).toString(16);
+      var sn = guard.range.authoredInteger(decoded.authorityCertSerialNumber, _err,
+        "inspect/bad-input", "authorityCertSerialNumber").toString(16);
       if (sn.length % 2) sn = "0" + sn;
       akiLines.push(inner + "serial:0x" + sn.toUpperCase());
     }
@@ -2350,12 +2373,16 @@ function asn1Dump(input, opts) {
   var der;
   try { der = pkix.coerceToDer(input, _INSPECT_ENTRY); }
   catch (e) { throw _err("inspect/bad-input", "input must be a DER Buffer or a PEM block", e); }
-  if (der.length === 0) throw _err("inspect/bad-input", "input is empty");
-  if (der.length > maxBytes) {
-    throw _err("inspect/bad-input", "input " + der.length + " bytes exceeds the cap " + maxBytes);
+  /** @internal Read once, and safe to read off `der` because `pkix.coerceToDer` above has already
+   *  normalized the caller's input: an own `length` property shadowing the real byte count cannot reach
+   *  here. The cap below is therefore a cap on the bytes the walk decodes. */
+  var derLen = der.length;
+  if (derLen === 0) throw _err("inspect/bad-input", "input is empty");
+  if (derLen > maxBytes) {
+    throw _err("inspect/bad-input", "input " + derLen + " bytes exceeds the cap " + maxBytes);
   }
 
-  var head = ["ASN.1 structure: " + der.length + " bytes, decoded as DER"];
+  var head = ["ASN.1 structure: " + derLen + " bytes, decoded as DER"];
   var node = null;
   var refusal = null;
   /** @internal The decoder builds the whole node tree before the renderer counts a line, so the

package/lib/jose.js

@@ -39,6 +39,10 @@
 var constants = require("./constants");
 var wcEngine = require("./webcrypto");
 var webcrypto = wcEngine.webcrypto;
+/** @internal The verify operation, captured at load. The object was held and its METHOD fetched per
+ * call, which leaves it replaceable: one answering true accepts a JWS whose signer never signed it,
+ * including on the embedded-key route this module pins against its thumbprint. */
+var _subtleVerify = require("./guard-intrinsic").uncurry(webcrypto.subtle.verify);
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
 var edwardsPoint = require("./edwards-point");
@@ -121,11 +125,11 @@ function b64uDecode(text) {
  *   pki.jose.parseJson('{"a":1}');   // -> { a: 1 }
  */
 function parseJson(input) {
-  return guard.json.parse(input, E, {
+  return guard.verdict.shield(guard.json.parse(input, E, {
     maxBytes: LIMITS.JSON_MAX_BYTES, maxDepth: LIMITS.JSON_MAX_DEPTH,
     badJson: "jose/bad-json", tooDeep: "jose/too-deep", duplicateMember: "jose/duplicate-member",
     tooLarge: "jose/too-large", badInput: "jose/bad-input", label: "the JSON document",
-  });
+  }));
 }
 
 
@@ -329,9 +333,18 @@ async function verify(jws, opts) {
   if (!jws || typeof jws !== "object" || _isArray(jws)) throw E("jose/bad-jws", "a flattened JWS object is required");
   if (_hasOwn(jws, "signatures")) throw E("jose/bad-jws", "the multi-signature signatures member is forbidden");
   if (_hasOwn(jws, "header")) throw E("jose/bad-jws", "the unprotected header member is forbidden");
-  if (typeof jws.protected !== "string" || typeof jws.signature !== "string") throw E("jose/bad-jws", "protected and signature must be base64url strings");
-  if (typeof jws.payload !== "string") throw E("jose/bad-jws", "payload must be a base64url string (never detached)");
-  var header = parseJson(b64uDecode(jws.protected));
+  /** @internal The three members are taken ONCE, for the reason `opts` is above: the JWS is the caller's
+   *  object, and a member reached through an accessor answers every read separately. `protected` decides
+   *  both the header the profile rules are applied to and the signing input the signature is checked over,
+   *  and the thumbprint comparison awaits between those two uses, so reading it twice would let the rules
+   *  be applied to one message and the signature checked over another. Everything below reads these
+   *  locals. */
+  var protectedB64 = jws.protected;
+  var signatureB64 = jws.signature;
+  var payloadB64 = jws.payload;
+  if (typeof protectedB64 !== "string" || typeof signatureB64 !== "string") throw E("jose/bad-jws", "protected and signature must be base64url strings");
+  if (typeof payloadB64 !== "string") throw E("jose/bad-jws", "payload must be a base64url string (never detached)");
+  var header = parseJson(b64uDecode(protectedB64));
   var profileName = opts.profile || "acme-outer";
   var checked = _checkHeader(header, profileName);
   /** @internal The embedded jwk is the signer's PUBLIC key (RFC 7515 sec. 4.1.3). One carrying
@@ -342,14 +355,32 @@ async function verify(jws, opts) {
   if (opts.key !== undefined && (typeof opts.key !== "object" || opts.key === null || _isArray(opts.key))) {
     throw E("jose/bad-key", "opts.key was supplied but is not a JWK object, so the key this message must be signed under cannot be established");
   }
-  var jwk = header.jwk || opts.key;
+  /** @internal The caller's key is COPIED here, before ANY member of it is read, and everything below
+   *  reads the copy: the thumbprint comparison against the embedded jwk, the key-type check, the Edwards
+   *  low-order point gate, the signature-width calculation, the import parameters and the algorithm
+   *  selector. Its members were read many times over, `crv` eight times and `kty` nine on one successful
+   *  verify, and an accessor answers each read separately.
+   *
+   *  The FIRST read is the one that decides which curve the point gate validates against
+   *  (`jwk.crv === "Ed25519" ? 6 : 7`), so a `crv` answering `Ed448` once and `Ed25519` afterwards had the
+   *  point gated under the wrong curve's parameters while an Ed25519 key was imported and verified. That
+   *  gate is the whole defense against a low-order key verifying a FORGED signature. Copying before the
+   *  thumbprint comparison rather than after it matters for the same reason: otherwise a key could
+   *  thumbprint as the embedded one and be copied as a different one.
+   *
+   *  `snapshotDeep` refuses an accessor-backed member rather than reading it once, which is the stronger
+   *  answer for a value that selects an algorithm. The embedded jwk comes from the parsed header and is
+   *  this module's own object, so it needs no copy. */
+  var suppliedKey = opts.key === undefined ? undefined
+    : guard.bytes.snapshotDeep(opts.key, JoseError, "jose/bad-key", "opts.key");
+  var jwk = header.jwk || suppliedKey;
   if (!jwk) throw E("jose/bad-key", "a verification key is required (opts.key) when the profile does not embed a jwk");
   var keySource = "embedded-jwk";
-  if (opts.key) {
+  if (suppliedKey) {
     keySource = "opts.key";
     if (header.jwk) {
       var embeddedTp, suppliedTp;
-      try { embeddedTp = await thumbprint(header.jwk); suppliedTp = await thumbprint(opts.key); }
+      try { embeddedTp = await thumbprint(header.jwk); suppliedTp = await thumbprint(suppliedKey); }
       catch (e) { throw E("jose/bad-key", "the embedded jwk and opts.key could not be compared as RFC 7638 thumbprints", e); }
       if (embeddedTp !== suppliedTp) {
         throw E("jose/key-mismatch",
@@ -358,19 +389,19 @@ async function verify(jws, opts) {
           ", supplied " + suppliedTp + ")");
       }
     }
-    jwk = opts.key;
+    jwk = suppliedKey;
   }
   _assertKeyType(checked.algRow, jwk);
-  var sig = b64uDecode(jws.signature);
+  var sig = b64uDecode(signatureB64);
   var want = _expectedSigBytes(checked.algRow, jwk);
   if (want != null && sig.length !== want) throw E("jose/bad-signature", "the signature length " + sig.length + " is not the " + want + " bytes " + checked.alg + " requires");
-  var signingInput = _bufferFrom(jws.protected + "." + jws.payload, "ascii");
+  var signingInput = _bufferFrom(protectedB64 + "." + payloadB64, "ascii");
   var key;
   try { key = await webcrypto.subtle.importKey("jwk", jwk, _importParams(checked.algRow, jwk), false, ["verify"]); }
   catch (e) { throw E("jose/bad-key", "the JWK could not be imported for verification", e); }
-  var ok = await webcrypto.subtle.verify(_cryptoAlg(checked.algRow, jwk), key, sig, signingInput);
+  var ok = await _subtleVerify(webcrypto.subtle, _cryptoAlg(checked.algRow, jwk), key, sig, signingInput);
   if (!ok) throw E("jose/verify-failed", "the JWS signature did not verify");
-  return { header: header, payload: b64uDecode(jws.payload), keySource: keySource };
+  return { header: header, payload: b64uDecode(payloadB64), keySource: keySource };
 }
 
 
@@ -409,9 +440,23 @@ async function verify(jws, opts) {
  */
 var _SIGN_KEYS = intrinsic.assign(intrinsic.create(null), { protected: 1, payload: 1, key: 1, jwk: 1, profile: 1 });
 var _SIGN_KEYS_EMBEDDED_JWK = intrinsic.assign(intrinsic.create(null), { protected: 1, payload: 1, key: 1, profile: 1 });
+
+/** @internal The payload, copied, taken before anything else on the caller's object is read. Every later
+ *  read of that object is caller code when the field is an accessor, and the protected header is read
+ *  FIRST and SERIALIZED, which reaches the header object, each of its fields and any `toJSON` on it. Over
+ *  a view of the payload any of those would replace what gets signed, after the verb had accepted the
+ *  payload it was handed, so the copy comes before all of them rather than before whichever one is in
+ *  view. A payload that is not a Buffer is carried through untouched and refused where it always was, so
+ *  no diagnostic moves ahead of the header's own. */
+function _fixedPayload(supplied) {
+  if (!_isBuffer(supplied)) return supplied;
+  return guard.bytes.snapshot(supplied, JoseError, "jose/bad-input", "payload");
+}
+
 async function sign(opts) {
   opts = opts || {};
   guard.identifier.assertKnownKeys(opts, _SIGN_KEYS, E, "jose/bad-input", "unknown pki.jose.sign option ");
+  var fixedPayload = _fixedPayload(opts.payload);
   var headerJson;
   try { headerJson = _stringify(opts.protected); }
   catch (e) { throw E("jose/bad-header", "the protected header must be JSON-serializable", e); }
@@ -424,13 +469,25 @@ async function sign(opts) {
         (k === "jwk" ? "; the protected header already embeds the public JWK" : "");
     });
   }
-  var payload = opts.payload;
+  var payload = fixedPayload;
   if (!_isBuffer(payload)) throw E("jose/bad-input", "payload must be a Buffer (empty Buffer for POST-as-GET)");
-  payload = guard.bytes.view(payload, JoseError, "jose/bad-input", "payload");
-  if (!wcEngine.isCryptoKeyLike(opts.key)) throw E("jose/bad-input", "a private or secret CryptoKey (opts.key) is required");
+  /** @internal ONE read of the caller's signing key, taken before anything inspects it, and every use
+   *  below reads this binding. It was read four times: the key-like test, twice by the hash-to-algorithm
+   *  check, and once more to sign with. An accessor answers each read separately, so the check could
+   *  approve a SHA-256 key while the signature was produced by a SHA-512 one, and the JWS emitted then
+   *  DECLARES an algorithm its signature was not made under, which is the algorithm confusion the header
+   *  registry exists to close before any crypto call.
+   *
+   *  The RSA arms are where it showed: the registry's fixed signature widths catch the HMAC and EC arms,
+   *  and two 2048-bit RSA keys produce the same 256-byte signature, so the width pin below cannot see a
+   *  substitution between them. */
+  var suppliedKey = opts.key;
+  if (!wcEngine.isCryptoKeyLike(suppliedKey)) throw E("jose/bad-input", "a private or secret CryptoKey (opts.key) is required");
   var checked = _checkHeader(header, opts.profile || "acme-outer");
+  var suppliedAlg = suppliedKey.algorithm;
+  var suppliedHash = suppliedAlg && suppliedAlg.hash;
   if ((checked.algRow.kty === "RSA" || checked.algRow.kty === "oct") &&
-      (!opts.key.algorithm.hash || opts.key.algorithm.hash.name !== checked.algRow.hash)) {
+      (!suppliedHash || suppliedHash.name !== checked.algRow.hash)) {
     throw E("jose/bad-key", "the signing key's hash does not match the algorithm " + checked.alg);
   }
   if (header.jwk) { _assertKeyType(checked.algRow, header.jwk); assertPublicJwk(header.jwk); }
@@ -438,15 +495,18 @@ async function sign(opts) {
   var payloadB64 = payload.length === 0 ? "" : b64uEncode(payload);
   var signingInput = _bufferFrom(protectedB64 + "." + payloadB64, "ascii");
   var jwk = header.jwk || opts.jwk || {};
-  var signKey = await wcEngine.adoptKey(opts.key, null, ["sign"], E, "jose/bad-input");
+  /** @internal `suppliedKey` is the reading taken at the top, so the key adopted for signing, the key the
+   *  hash-to-algorithm check approved and the key the expected signature width is computed from are all
+   *  one key. */
+  var signKey = await wcEngine.adoptKey(suppliedKey, null, ["sign"], E, "jose/bad-input");
   var sigBuf = _bufferFrom(await webcrypto.subtle.sign(_cryptoAlg(checked.algRow, jwk, signKey), signKey, signingInput));
-  var want = _expectedSigBytes(checked.algRow, jwk, opts.key);
+  var want = _expectedSigBytes(checked.algRow, jwk, suppliedKey);
   if (want != null && sigBuf.length !== want) throw E("jose/bad-key", "the signing key produced a " + sigBuf.length + "-byte signature but " + checked.alg + " requires " + want + " (the key does not match the algorithm)");
   if (header.jwk) {
     var pubKey;
     try { pubKey = await webcrypto.subtle.importKey("jwk", header.jwk, _importParams(checked.algRow, header.jwk), false, ["verify"]); }
     catch (e) { throw E("jose/bad-key", "the embedded jwk could not be imported to confirm it matches the signing key", e); }
-    if (!(await webcrypto.subtle.verify(_cryptoAlg(checked.algRow, header.jwk), pubKey, sigBuf, signingInput))) {
+    if (!(await _subtleVerify(webcrypto.subtle, _cryptoAlg(checked.algRow, header.jwk), pubKey, sigBuf, signingInput))) {
       throw E("jose/bad-key", "the embedded jwk does not match the signing key (it cannot verify the produced signature)");
     }
   }
@@ -485,14 +545,22 @@ var THUMBPRINT_MEMBERS = intrinsic.assign(intrinsic.create(null), {
  *   await pki.jose.thumbprint(accountJwk);   // -> "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
  */
 async function thumbprint(jwk) {
-  if (!jwk || typeof jwk !== "object" || typeof jwk.kty !== "string") throw E("jose/bad-key", "a JWK object with a kty is required");
-  var members = THUMBPRINT_MEMBERS[jwk.kty];
-  if (!members) throw E("jose/bad-key", "unsupported JWK key type " + _stringify(jwk.kty));
+  if (!jwk || typeof jwk !== "object") throw E("jose/bad-key", "a JWK object with a kty is required");
+  /** @internal COPIED before any member is read, because what this returns is an IDENTITY. Each member
+   *  was read twice, the type check and then the value put into the hash, and `kty` four times; an
+   *  accessor answers each read separately, so a member could be checked as one value and HASHED as
+   *  another. The thumbprint is what RFC 7638 identifies a key by: `pki.jose.verify` compares an embedded
+   *  jwk against `opts.key` with it, and ACME uses it as the account identity in a key authorization. A
+   *  thumbprint over a value the checks never approved names a key that was never the one validated. */
+  var copied = guard.bytes.snapshotDeep(jwk, JoseError, "jose/bad-key", "the JWK");
+  if (typeof copied.kty !== "string") throw E("jose/bad-key", "a JWK object with a kty is required");
+  var members = THUMBPRINT_MEMBERS[copied.kty];
+  if (!members) throw E("jose/bad-key", "unsupported JWK key type " + _stringify(copied.kty));
   var parts = [];
   for (var i = 0; i < members.length; i++) {
     var m = members[i];
-    if (typeof jwk[m] !== "string") throw E("jose/bad-key", "the JWK is missing the required member " + _stringify(m));
-    _push(parts, _stringify(m) + ":" + _stringify(jwk[m]));
+    if (typeof copied[m] !== "string") throw E("jose/bad-key", "the JWK is missing the required member " + _stringify(m));
+    _push(parts, _stringify(m) + ":" + _stringify(copied[m]));
   }
   var canonical = "{" + _join(parts, ",") + "}";
   var digest = _bufferFrom(await webcrypto.subtle.digest("SHA-256", _bufferFrom(canonical, "utf8")));

package/lib/key.js

@@ -30,6 +30,11 @@ var schemaSec1 = require("./schema-sec1");
 var pkix = require("./schema-pkix");
 var schema = require("./schema-engine");
 var webcrypto = require("./webcrypto");
+/** @internal The key-material exporter, captured at load. The signature probe that decides whether two
+ *  halves are a pair imports and signs with what this returns, so a replacement exporting a different
+ *  private key makes a mismatched pair report as corresponding: the probe then signs and verifies with
+ *  a pair that does correspond, and neither half is the one the caller supplied. */
+var _exportAnyKey = webcrypto.exportAnyKey;
 var compositeKem = require("./composite-kem");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
@@ -123,7 +128,7 @@ function _sec1ToPkcs8(der, curveOid) {
 async function _toPrivateKeyDer(input) {
   if (_isCryptoKey(input)) {
     if (input.type !== "private") throw _err("key/bad-input", "a private CryptoKey is required (got a " + input.type + " key)");
-    return webcrypto.exportAnyKey(input, _err, "key/bad-input");
+    return _exportAnyKey(input, _err, "key/bad-input");
   }
   return pkix.coerceToDer(input, { pemLabel: "PRIVATE KEY", PemError: PemError, ErrorClass: KeyError, prefix: "key" });
 }
@@ -295,13 +300,13 @@ async function export_(key, opts) {
   var fmt = opts.format || "der";
   if (fmt === "jwk") {
     try {
-      return await webcrypto.exportAnyKey(key, _err, "key/bad-input", "jwk");
+      return await _exportAnyKey(key, _err, "key/bad-input", "jwk");
     } catch (e) {
       if (e && e.isPkiError) throw e;
       throw _err("key/bad-input", "exporting the key as a JWK failed", e);
     }
   }
-  var der = await webcrypto.exportAnyKey(key, _err, "key/bad-input");
+  var der = await _exportAnyKey(key, _err, "key/bad-input");
   if (fmt === "der") return der;
   if (fmt === "pem") return pkix.pemEncode(der, opts.label || defaultLabel, PemError);
   if (fmt === "pkcs1") return _toPkcs1(der, key);
@@ -870,8 +875,8 @@ async function publicFromPrivate(privateKey, opts) {
     return opts.pem ? pkix.pemEncode(spki, "PUBLIC KEY", PemError) : spki;
   }
   try {
-    var priv = nodeCrypto.createPrivateKey({ key: der, format: "der", type: "pkcs8" });
-    spki = nodeCrypto.createPublicKey(priv).export({ format: "der", type: "spki" });
+    var priv = guard.crypto.privateKey({ key: der, format: "der", type: "pkcs8" });
+    spki = guard.crypto.exportKey(guard.crypto.publicKey(priv), { format: "der", type: "spki" });
   } catch (e) { throw _err("key/bad-input", "could not derive the public key from the private key", e); }
   return opts.pem ? pkix.pemEncode(spki, "PUBLIC KEY", PemError) : spki;
 }
@@ -946,7 +951,7 @@ function _pairSignOptions(priv, pub) {
   /** @internal Null-prototype, because the engine READS this object by name. A plain object would
    * let an inherited `saltLength` reach the signature as a restriction neither half stated. */
   var options = _create(null);
-  options.padding = nodeCrypto.constants.RSA_PKCS1_PSS_PADDING;
+  options.padding = guard.crypto.padding.RSA_PKCS1_PSS;
   if (salt != null) options.saltLength = salt;
   return { digest: digest, options: options };
 }
@@ -1006,7 +1011,7 @@ async function correspondsTo(privateKey, spkiDer) {
   var privAsPkcs3 = _dhAsPkcs3(privDer, 1, "the private key's");
   try {
     _assertDhWithin(privAsPkcs3, 1, "the private key's");
-    try { priv = nodeCrypto.createPrivateKey({ key: privAsPkcs3, format: "der", type: "pkcs8" }); }
+    try { priv = guard.crypto.privateKey({ key: privAsPkcs3, format: "der", type: "pkcs8" }); }
     catch (e) { throw _err("key/bad-input", "the private key could not be read", e); }
   } finally { if (privAsPkcs3 !== privDer) guard.secret.zeroize(privAsPkcs3, KeyError, "key/bad-input", "the rewritten private key"); }
   var publicOid = _algorithmOidAt(spki, 0);
@@ -1014,7 +1019,7 @@ async function correspondsTo(privateKey, spkiDer) {
   if (_isDhOid(_algorithmOidAt(privDer, 1)) !== _isDhOid(publicOid)) return false;
   var pubAsPkcs3 = _dhAsPkcs3(spki, 0, "the public key's");
   _assertDhWithin(pubAsPkcs3, 0, "the public key's");
-  try { pub = nodeCrypto.createPublicKey({ key: pubAsPkcs3, format: "der", type: "spki" }); }
+  try { pub = guard.crypto.publicKey({ key: pubAsPkcs3, format: "der", type: "spki" }); }
   catch (e) { throw _err("key/bad-input", "the public key could not be read", e); }
   if (!_sameKeyFamily(priv, pub)) return false;
   var kind = guard.text.keyOf(priv.asymmetricKeyType);
@@ -1029,7 +1034,7 @@ async function correspondsTo(privateKey, spkiDer) {
       /** @internal Compared as KEYS rather than as encodings: a PKCS #3 DHParameter may carry the
        * optional privateValueLength beside the same p and g, and two encodings of one public value
        * are one key. The runtime's equality compares the group and the value. */
-      return _keyEquals(nodeCrypto.createPublicKey(priv), pub) === true;
+      return _keyEquals(guard.crypto.publicKey(priv), pub) === true;
     }
     if (_PAIR_KEM[kind]) {
       var sealed = nodeCrypto.encapsulate(pub);
@@ -1053,8 +1058,8 @@ async function correspondsTo(privateKey, spkiDer) {
        * structure for an attacker to plant, so what the scalar generates IS the canonical answer and
        * comparing against it adds a bound the agreement alone does not give. */
       return guard.crypto.constantTimeEqual(
-        nodeCrypto.createPublicKey(priv).export({ format: "der", type: "spki" }),
-        pub.export({ format: "der", type: "spki" }));
+        guard.crypto.exportKey(guard.crypto.publicKey(priv), { format: "der", type: "spki" }),
+        guard.crypto.exportKey(pub, { format: "der", type: "spki" }));
     }
     var how = _pairSignOptions(priv, pub);
     if (how === null) {
@@ -1062,8 +1067,8 @@ async function correspondsTo(privateKey, spkiDer) {
     }
     var signKey = how.options ? _assign(_create(null), { key: priv }, how.options) : priv;
     var verifyKey = how.options ? _assign(_create(null), { key: pub }, how.options) : pub;
-    return nodeCrypto.verify(how.digest, _PAIR_PROBE, verifyKey,
-      nodeCrypto.sign(how.digest, _PAIR_PROBE, signKey)) === true;
+    return guard.crypto.verify(how.digest, _PAIR_PROBE, verifyKey,
+      guard.crypto.sign(how.digest, _PAIR_PROBE, signKey)) === true;
   } catch (e) {
     /** @internal The incompatible-parameters verdict is decided rather than caught, so it is passed
      * through with the reason it was raised for. Rewrapping it would tell an operator the pair could