@blamejs/pki 0.8.31 → 0.8.48

package/lib/pkcs12-build.js

@@ -89,9 +89,14 @@ var _ENCRYPT_KEYS = intrinsic.assign(intrinsic.create(null), { password: 1, ciph
 var _MAC_KEYS = intrinsic.assign(intrinsic.create(null), { algorithm: 1, hash: 1, salt: 1, iterations: 1, keyLength: 1, password: 1 });
 var _MAC_KEYS_HMAC = intrinsic.assign(intrinsic.create(null), { algorithm: 1, hash: 1, salt: 1, iterations: 1, password: 1 });
 var _MAC_KEYS_PBMAC1 = intrinsic.assign(intrinsic.create(null), { algorithm: 1, hash: 1, salt: 1, iterations: 1, keyLength: 1, password: 1 });
+/** @internal `allowUnauthenticatedRsa15` reaches `pki.cms.decrypt` through the options this verb already
+ *  forwards. A public-key-privacy safe IS a CMS EnvelopedData, and the one `openssl pkcs12` or
+ *  `openssl cms -encrypt` produces uses RSAES-PKCS1-v1_5 key transport over an AES-CBC content, which that
+ *  verb refuses by default. An operator opening such a file needs the option, and naming it here is what
+ *  lets them pass it rather than meeting an unknown-option refusal first. */
 var _OPEN_OPTS = intrinsic.assign(intrinsic.create(null), {
-  allowUnauthenticated: 1, importAlgorithm: 1, keys: 1, maxIterations: 1, signerCerts: 1,
-  recipientKey: 1, recipientCert: 1, recipientIndex: 1,
+  allowUnauthenticated: 1, allowUnauthenticatedRsa15: 1, importAlgorithm: 1, keys: 1, maxIterations: 1,
+  signerCerts: 1, recipientKey: 1, recipientCert: 1, recipientIndex: 1,
 });
 var _VERIFY_MAC_OPTS = intrinsic.assign(intrinsic.create(null), { maxIterations: 1 });
 

package/lib/pki-build.js

@@ -29,6 +29,7 @@ var _stringify = intrinsic.stringify;
 var _mapIntrinsic = intrinsic.map;
 var _bufferConcatIntrinsic = intrinsic.bufferConcat;
 var OID_SKI = oid.byName("subjectKeyIdentifier");
+var OID_SAPKI = oid.byName("subjectAltPublicKeyInfo");
 
 function _isAlphaCode(c) { return (c >= 65 && c <= 90) || (c >= 97 && c <= 122); }
 function _isDigitCode(c) { return c >= 48 && c <= 57; }
@@ -1375,15 +1376,15 @@ function makeBuilder(ctx) {
       });
     }
     var pub;
-    try { pub = nodeCrypto.createPublicKey({ key: spki, format: "der", type: "spki" }); }
+    try { pub = guard.crypto.publicKey({ key: spki, format: "der", type: "spki" }); }
     catch (e) { throw E("bad-input", "the public key could not be imported for the signature self-check", e); }
     var s = scheme.sign, ok;
     try {
-      if (s.name === "ECDSA") ok = nodeCrypto.verify(scheme.digest, preimage, { key: pub, dsaEncoding: "der" }, sig);
-      else if (s.name === "RSA-PSS") ok = nodeCrypto.verify(scheme.digest, preimage, { key: pub, padding: nodeCrypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: s.saltLength }, sig);
-      else if (s.name === "RSASSA-PKCS1-v1_5") ok = nodeCrypto.verify(scheme.digest, preimage, pub, sig);
+      if (s.name === "ECDSA") ok = guard.crypto.verify(scheme.digest, preimage, { key: pub, dsaEncoding: "der" }, sig);
+      else if (s.name === "RSA-PSS") ok = guard.crypto.verify(scheme.digest, preimage, { key: pub, padding: guard.crypto.padding.RSA_PKCS1_PSS, saltLength: s.saltLength }, sig);
+      else if (s.name === "RSASSA-PKCS1-v1_5") ok = guard.crypto.verify(scheme.digest, preimage, pub, sig);
       // allow:eddsa-verify-without-loworder-gate -- a self-check that OUR just-produced signature verifies
-      else ok = nodeCrypto.verify(null, preimage, pub, sig);
+      else ok = guard.crypto.verify(null, preimage, pub, sig);
     } catch (e) { throw E("bad-input", "the signature self-check could not run against the public key", e); }
     if (!ok) throw E("bad-input", "the signing key does not correspond to the public key -- the signature would not verify");
   }
@@ -1404,6 +1405,7 @@ function makeBuilder(ctx) {
     extMsCertificateTemplate: extMsCertificateTemplate, extMsCaVersion: extMsCaVersion,
     extMsPreviousCertHash: extMsPreviousCertHash, extMsEnrollCertType: extMsEnrollCertType,
     spkiKeyId: spkiKeyId, skiKeyId: skiKeyId, skiValueOf: skiValueOf,
+    altPublicKeyValueOf: altPublicKeyValueOf,
     reqDer: reqDer, reqDenseArray: reqDenseArray, reqDerSequence: reqDerSequence, assertValidSpki: assertValidSpki, assertValidExtension: assertValidExtension,
     assertExtnValueIsDer: assertExtnValueIsDer,
     assertCertCriticality: assertCertCriticality,
@@ -1435,6 +1437,28 @@ function skiValueOf(parsedCert) {
   catch (_e) { return null; }   // allow:swallow-unverified -- a malformed SKI is read as absent; a signer then derives the authorityKeyIdentifier keyIdentifier from the public key, and a verifier matches on nothing
 }
 
+/** @internal The alternative public key a parsed certificate PUBLISHES, from its
+ *  subjectAltPublicKeyInfo extension (ITU-T X.509 (2019) clause 9.8.2), or null when it carries none.
+ *
+ *  A signer needs this to bind an alternative signature to the issuer the same way the native signature
+ *  is already bound: the native key is read out of the issuer certificate, while the alternative key is
+ *  handed in beside it, so without this the two can be different keys. Clause 9.8.4 has a relying party
+ *  check an alternative signature with the issuer's alternative public key, which is the one in the
+ *  issuer's own certificate, so a signature made with any other key verifies for nobody. */
+function altPublicKeyValueOf(parsedCert) {
+  var exts = intrinsic.filter(parsedCert.extensions, function (e) { return e.oid === OID_SAPKI; });
+  if (!exts.length) return null;
+  /** @internal The extension's value IS a SubjectPublicKeyInfo, so unlike subjectKeyIdentifier there is
+   *  no inner OCTET STRING to read through: the bytes are the SPKI. They are decoded only to confirm the
+   *  shape, and the original bytes returned rather than a re-encoding, so the comparison a signer makes is
+   *  against what the certificate actually carries. */
+  try {
+    var node = asn1.decode(exts[0].value);
+    if (!node.constructed || node.tagNumber !== asn1.TAGS.SEQUENCE) return null;
+    return _bufferFrom(exts[0].value);
+  } catch (_e) { return null; }   // allow:swallow-unverified -- an unreadable extension publishes no key, and a signer then refuses rather than binding to bytes it could not decode
+}
+
 /** @internal Whether two SubjectPublicKeyInfo encodings carry the same public key: byte-equal, or
  *  equal under the runtime's key comparison once both import. */
 function samePublicKey(spkiA, spkiB) {
@@ -1443,8 +1467,8 @@ function samePublicKey(spkiA, spkiB) {
   var ka, kb;
   // allow:swallow-unverified an SPKI the key layer cannot import matches nothing, which is the
   try {
-    ka = nodeCrypto.createPublicKey({ key: a, format: "der", type: "spki" });
-    kb = nodeCrypto.createPublicKey({ key: bb, format: "der", type: "spki" });
+    ka = guard.crypto.publicKey({ key: a, format: "der", type: "spki" });
+    kb = guard.crypto.publicKey({ key: bb, format: "der", type: "spki" });
   } catch (_e) { return false; }
   /** @internal Two keys of different types are never the same key, and comparing them through
    *  the runtime's equality leaves a fault queued in the crypto library that surfaces on the