@blamejs/pki 0.8.31 → 0.8.48

package/lib/tls-cert-compress.js

@@ -168,11 +168,19 @@ function _resolveAllowed(opts) {
  */
 function decompressCertificate(bytes, opts) {
   opts = opts || {};
-  var view = guard.bytes.view(bytes, TlsError, "tls/bad-input", "the compressed certificate message");
-  if (view.length > C.LIMITS.TLS_CERT_MSG_MAX_BYTES) {
-    throw _err("tls/too-large", "the compressed certificate message is " + view.length +
+  /** @internal Viewed, CAPPED, then COPIED, and only then are the options read. A view stays a window
+   *  onto the caller's buffer, and `_resolveCap` reads `opts`, which is caller code when it is an
+   *  accessor: a `maxOutputBytes` getter that wrote another valid message of the same length over the
+   *  buffer had this verb decompress the REPLACEMENT, having framed the one it was handed. Measured, a
+   *  message framing `0141000000` came back as `0142000000`. `compressCertificate` takes its copy before
+   *  reading `opts.algorithm` for the same reason; this is the other half of that pair. The cap sits
+   *  ahead of the copy so the copy is not an allocation the size of whatever arrived. */
+  var viewed = guard.bytes.source(bytes, TlsError, "tls/bad-input", "the compressed certificate message");
+  if (guard.bytes.lengthOf(viewed) > C.LIMITS.TLS_CERT_MSG_MAX_BYTES) {
+    throw _err("tls/too-large", "the compressed certificate message is " + guard.bytes.lengthOf(viewed) +
       " bytes, over the " + C.LIMITS.TLS_CERT_MSG_MAX_BYTES + "-byte handshake framing limit");
   }
+  var view = guard.bytes.snapshot(viewed, TlsError, "tls/bad-input", "the compressed certificate message");
   var cap = _resolveCap(opts);
   var allowed = _resolveAllowed(opts);
 
@@ -308,7 +316,20 @@ function parseCertificateMessage(bytes, opts) {
  */
 function compressCertificate(certificateMessage, opts) {
   opts = opts || {};
-  var view = guard.bytes.view(certificateMessage, TlsError, "tls/bad-input", "the certificate message");
+  /** @internal Copied, not viewed. `opts.algorithm` is read below, and reading an option is caller code
+   *  when it is an accessor, so over a view it would run between the message being looked at and being
+   *  compressed and replace what this verb compresses, after it had accepted the message it was handed.
+   *  A substitute the framing check below accepts goes through unseen, so the copy has to come first. */
+  /** @internal Viewed, CAPPED, then copied, in that order, and the option is read after all three. The
+   *  copy has to come before the option for the reason above; the cap has to come before the copy or the
+   *  copy is an allocation the size of whatever arrived: measured, a 64 MiB message allocated another
+   *  64 MiB before the framing limit below refused it. Viewing allocates nothing, so both hold. */
+  var viewed = guard.bytes.source(certificateMessage, TlsError, "tls/bad-input", "the certificate message");
+  if (guard.bytes.lengthOf(viewed) > C.LIMITS.TLS_CERT_MSG_MAX_BYTES) {
+    throw _err("tls/too-large", "the certificate message is " + guard.bytes.lengthOf(viewed) +
+      " bytes, over the " + C.LIMITS.TLS_CERT_MSG_MAX_BYTES + "-byte handshake framing limit");
+  }
+  var view = guard.bytes.snapshot(viewed, TlsError, "tls/bad-input", "the certificate message");
   var sel = opts.algorithm === undefined ? "zlib" : opts.algorithm;
   var name = (typeof sel === "number") ? ALG_BY_NUMBER[sel] : sel;
   if (typeof name !== "string" || SUPPORTED.indexOf(name) === -1) {
@@ -317,10 +338,6 @@ function compressCertificate(certificateMessage, opts) {
   if (view.length < MIN_CERT_MSG_BYTES) {
     throw _err("tls/bad-input", "a Certificate message is at least " + MIN_CERT_MSG_BYTES + " bytes (RFC 8446 sec. 4.4.2)");
   }
-  if (view.length > C.LIMITS.TLS_CERT_MSG_MAX_BYTES) {
-    throw _err("tls/too-large", "the certificate message is " + view.length + " bytes, over the " +
-      C.LIMITS.TLS_CERT_MSG_MAX_BYTES + "-byte handshake framing limit");
-  }
   if (opts.level !== undefined && (typeof opts.level !== "number" || !isFinite(opts.level) || Math.floor(opts.level) !== opts.level)) {
     throw _err("tls/bad-input", "opts.level must be an integer");
   }

package/lib/tsp-sign.js

@@ -15,7 +15,6 @@
  * @card Create an RFC 3161 timestamp token (a CMS SignedData over a TSTInfo).
  */
 
-var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var cmsSign = require("./cms-sign");
@@ -27,6 +26,11 @@ var schemaTsp = require("./schema-tsp");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
+var _compare = intrinsic.compare;
+var _pop = intrinsic.pop;
+var _reverse = intrinsic.reverse;
+var _arrSlice = intrinsic.arraySlice;
+var _bufferFrom = intrinsic.bufferFrom;
 var frameworkError = require("./framework-error");
 
 var pkix = require("./schema-pkix");
@@ -85,7 +89,7 @@ function _certDer(c) {
 }
 
 function _signingCertV2(certDer, hashName) {
-  var certHash = nodeCrypto.createHash(NODE_DIGEST[hashName]).update(certDer).digest();
+  var certHash = guard.crypto.digest(NODE_DIGEST[hashName], certDer);
   var essCertId = hashName === "sha256"
     ? b.sequence([b.octetString(certHash)])
     : b.sequence([_hashAlgId(hashName), b.octetString(certHash)]);
@@ -195,7 +199,10 @@ function _sign(messageImprint, tsa, opts) {
   var tstInfo = b.sequence(fields);
 
   var signCert = { type: "signingCertificateV2", values: [_signingCertV2(certDer, certHashAlg)] };
-  var extra = [signCert].concat(opts.additionalSignedAttributes || []);
+  /** @internal Through the capture: assembled by a live `Array.prototype.concat`, the signed attribute
+   *  set was that method's to choose, and the first entry is the signing-certificate attribute that
+   *  binds the token to the certificate it names. A replacement could drop it. */
+  var extra = intrinsic.concat([signCert], opts.additionalSignedAttributes || []);
   var signer = { cert: certDer, key: tsa && tsa.key, digestAlgorithm: opts.digestAlgorithm, pss: opts.pss };
   return cmsSign.sign(tstInfo, signer, {
     eContentType: "tSTInfo",
@@ -428,16 +435,28 @@ function parseResponse(input) { return schemaTsp.parse(input); }
 var _VERIFY_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: "sha256", sha384: "sha384", sha512: "sha512", sha1: "sha1" });
 var _VERIFY_DIGEST_LEN = constants.NAMES.DIGEST_OCTETS;
 var _BIND_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: "sha256", sha384: "sha384", sha512: "sha512" });
+/** @internal The digests admitted for an imprint that are not collision resistant, so a token under one
+ *  binds nothing an attacker with a collision cannot move. They verify only under `allowWeakDigests`. */
+var _WEAK_IMPRINT_DIGEST = intrinsic.assign(intrinsic.create(null), { sha1: 1 });
 
-function _imprintMatches(mi, data) {
+function _imprintMatches(mi, data, allowWeakDigests) {
   var name = mi.hashAlgorithm && mi.hashAlgorithm.name;
   var nodeAlg = (name && intrinsic.hasOwn(_VERIFY_DIGEST, name)) ? _VERIFY_DIGEST[name] : null;
   if (!nodeAlg) return "tsp/unsupported-algorithm";
+  /** @internal The imprint is the ONLY thing binding a token to the data it timestamps, so the digest
+   *  that computes it carries the whole binding and a collision in it substitutes the data under a
+   *  genuine token. `allowWeakDigests` used to reach only the token's own signature digest, through
+   *  `cmsVerify.verify`, so a SHA-1 imprint verified under every setting of it including `false`.
+   *  NO FETCHED CLAUSE FORBIDS SHA-1 HERE: the one quoted algorithm prohibition is EN 319 122-1 clause
+   *  6.2.1 on MD5. Refusing it by default is this toolkit's posture, matching what `pki.cms.verify`
+   *  already does with a signature digest, and the opt-in is the same option an archived token needs. */
+  if (!allowWeakDigests && intrinsic.hasOwn(_WEAK_IMPRINT_DIGEST, name)) return "tsp/weak-digest";
   var wantLen = _VERIFY_DIGEST_LEN[name];
   if (mi.hashedMessage.length !== wantLen) return "tsp/imprint-mismatch";
   var actual;
   if (guard.bytes.isByteSource(data)) {
-    actual = nodeCrypto.createHash(nodeAlg).update(guard.bytes.source(data, TspError, "tsp/bad-input", "data")).digest();
+    var dataBytes = guard.bytes.source(data, TspError, "tsp/bad-input", "data");
+    actual = guard.crypto.digest(nodeAlg, dataBytes);
   } else if (data && typeof data === "object" && guard.bytes.isByteSource(data.hashedMessage)) {
     if (data.hashAlgorithm !== name) return "tsp/imprint-mismatch";
     var dhmLen = guard.bytes.source(data.hashedMessage, TspError, "tsp/bad-input", "precomputed imprint hashedMessage").length;
@@ -446,43 +465,109 @@ function _imprintMatches(mi, data) {
   } else {
     throw _err("tsp/bad-input", "pki.tsp.verify data must be a Buffer or a { hashAlgorithm, hashedMessage } imprint");
   }
-  return Buffer.compare(actual, Buffer.from(mi.hashedMessage)) === 0 ? true : "tsp/imprint-mismatch";
+  return _compare(actual, _bufferFrom(mi.hashedMessage)) === 0 ? true : "tsp/imprint-mismatch";
 }
 
-function _checkCertBinding(signerInfo, tsaCertDer) {
-  var attrs = (signerInfo && signerInfo.signedAttrs) || [];
-  var sc = null, scV1 = null;
-  for (var i = 0; i < attrs.length; i++) {
-    if (attrs[i].type === O("signingCertificateV2")) { sc = attrs[i]; break; }
-    if (attrs[i].type === O("signingCertificate") && !scV1) scV1 = attrs[i];
-  }
-  if (!sc) sc = scV1;
-  if (!sc) return "tsp/missing-signing-certificate";
+/** @internal The certificate one binding attribute names, and the digest under which it names it.
+ *  An ESSCertID v1 carries NO hashAlgorithm field: it is SHA-1 by definition (RFC 2634 sec. 5.4.1),
+ *  and EN 319 122-1 clause 5.2.2.2 says the v1 attribute "shall be used if the SHA-1 hash algorithm is
+ *  used", so these tokens exist. An absent algorithm therefore means SHA-1 rather than nothing, and
+ *  reporting `tsp/unsupported-algorithm` for one named the wrong fault: the algorithm is known and the
+ *  binding is deliberately weak, which is a different refusal from one this build cannot compute.
+ *  ABSENT IS NOT THE SAME AS UNRECOGNIZED: a v1 ESSCertID omits the field, so absent carries the type's
+ *  default of SHA-1; an ESSCertIDv2 naming an OID this build does not know carries an algorithm that
+ *  genuinely cannot be computed, and that one is `tsp/unsupported-algorithm`.
+ *  Returns a refusal code, or the ESSCertID with the digest resolved. SHA-1 resolves rather than
+ *  refusing, because whether a weak binding is a refusal depends on what the caller is doing with it:
+ *  the attribute the verdict rests on is held to it, and an attribute read only for agreement is not. */
+function _readBinding(attr) {
   var decoded;
-  try { decoded = smime.decodeAttribute(sc); }
+  try { decoded = smime.decodeAttribute(attr); }
   catch (_e) { return "tsp/bad-signing-certificate"; }
   var essCert = decoded.certs && decoded.certs[0];
   if (!essCert) return "tsp/bad-signing-certificate";
-  var nodeAlg = essCert.hashAlgorithm && _BIND_DIGEST[essCert.hashAlgorithm.name];
-  if (!nodeAlg) return "tsp/unsupported-algorithm";
-  var actual = nodeCrypto.createHash(nodeAlg).update(tsaCertDer).digest();
-  if (Buffer.compare(actual, Buffer.from(essCert.certHash)) !== 0) return "tsp/cert-binding-mismatch";
-  if (essCert.issuerSerial) {
-    var signerCert;
-    try { signerCert = pkiX509.parse(tsaCertDer); }
-    catch (_e) { return "tsp/bad-signing-certificate"; }
-    if (essCert.issuerSerial.serialNumber !== signerCert.serialNumber) return "tsp/cert-binding-mismatch";
-    var names = essCert.issuerSerial.issuer.names || [];
-    var gn = null;
-    try { if (names.length === 1) gn = schemaTsp.decodeGeneralName(names[0].bytes); }
-    catch (_e) { return "tsp/cert-binding-mismatch"; }
-    if (!gn || gn.tagNumber !== 4 || !gn.value || !guard.name.dnEqual(gn.value.rdns, signerCert.issuer.rdns, _err, "tsp/cert-binding-mismatch", "the ESSCertID issuer")) {
-      return "tsp/cert-binding-mismatch";
-    }
+  var name = essCert.hashAlgorithm == null ? "sha1" : essCert.hashAlgorithm.name;
+  if (name === "sha1") return { essCert: essCert, nodeDigest: "sha1", weak: true };
+  if (!name || !intrinsic.hasOwn(_BIND_DIGEST, name)) return "tsp/unsupported-algorithm";
+  return { essCert: essCert, nodeDigest: _BIND_DIGEST[name], weak: false };
+}
+
+/** @internal Whether one ESSCertID names the certificate that signed the token, by every claim it
+ *  carries: the hash under its own digest, and the issuer and serial where it states them. Returns
+ *  true or the refusal code. An ESSCertID states the signer in two independent ways and both are
+ *  compared, because a hash that agrees beside an issuer and serial that name another certificate is
+ *  the same contradiction as two attributes disagreeing. Certificate identifiers after the first are
+ *  not read: RFC 2634 sec. 5.4 makes the first the signing certificate and leaves the rest as the
+ *  chain, so they say nothing about the signer. */
+function _bindingNamesCert(read, tsaCertDer) {
+  /** @internal Through the captured digest: this comparison IS the binding between a token and the
+   *  certificate its signing-certificate attribute names, so what the digest covers is not the
+   *  caller's to choose. */
+  if (_compare(guard.crypto.digest(read.nodeDigest, tsaCertDer),
+    _bufferFrom(read.essCert.certHash)) !== 0) return "tsp/cert-binding-mismatch";
+  var issuerSerial = read.essCert.issuerSerial;
+  if (!issuerSerial) return true;
+  var signerCert;
+  try { signerCert = pkiX509.parse(tsaCertDer); }
+  catch (_e) { return "tsp/bad-signing-certificate"; }
+  if (issuerSerial.serialNumber !== signerCert.serialNumber) return "tsp/cert-binding-mismatch";
+  var names = issuerSerial.issuer.names || [];
+  var gn = null;
+  try { if (names.length === 1) gn = schemaTsp.decodeGeneralName(names[0].bytes); }
+  catch (_e2) { return "tsp/cert-binding-mismatch"; }
+  if (!gn || gn.tagNumber !== 4 || !gn.value || !guard.name.dnEqual(gn.value.rdns, signerCert.issuer.rdns, _err, "tsp/cert-binding-mismatch", "the ESSCertID issuer")) {
+    return "tsp/cert-binding-mismatch";
   }
   return true;
 }
 
+function _checkCertBinding(signerInfo, tsaCertDer) {
+  var attrs = (signerInfo && signerInfo.signedAttrs) || [];
+  var binding = [];
+  for (var i = 0; i < attrs.length; i++) {
+    if (attrs[i].type === O("signingCertificateV2") || attrs[i].type === O("signingCertificate")) {
+      intrinsic.push(binding, attrs[i]);
+    }
+  }
+  if (!binding.length) return "tsp/missing-signing-certificate";
+  /** @internal A v2 binding supersedes a v1 one (RFC 5035), and that is why the verdict rests on the v2
+   *  where there is one. But the v1 attribute does not stop existing: a token carrying both used to be
+   *  checked against the v2 alone, so one naming the real signer in v2 and a DIFFERENT certificate in v1
+   *  verified, and a legacy verifier reading only v1 resolves a certificate this one never checked. Both
+   *  sit in signedAttrs, so the TSA signed the contradiction. One structure making two incompatible
+   *  claims about one fact is refused rather than resolved in favor of whichever attribute a reader
+   *  prefers.
+   *  EVERY BINDING ATTRIBUTE IS COLLECTED, not the first of each type. signedAttrs is a DER SET OF,
+   *  sorted by encoded value, so which of the two attributes comes first is a function of their lengths
+   *  and the producer of a hostile token chooses it: a scan that stopped at the v2 caught the
+   *  contradiction in one ordering and missed it in the other, and an ordering-dependent check is no
+   *  check. The same applies to a repeated instance of either type, which `pki.cms.verify` refuses
+   *  before this runs and which is not relied on here.
+   *  THE SHA-1 ON A SUPERSEDED ATTRIBUTE PINS NOTHING. It detects a disagreement, while the binding the
+   *  verdict rests on is the v2 one. A collision would let a disagreeing v1 pass for an agreeing one,
+   *  which costs an attacker the refusal and gains them nothing: the certificate the token is held to is
+   *  the one v2 names, under its own digest. */
+  var chosen = 0;
+  for (var j = 0; j < binding.length; j++) {
+    if (binding[j].type === O("signingCertificateV2")) { chosen = j; break; }
+  }
+  for (var k = 0; k < binding.length; k++) {
+    if (k === chosen) continue;
+    var alt = _readBinding(binding[k]);
+    if (typeof alt === "string") return alt;
+    var altCode = _bindingNamesCert(alt, tsaCertDer);
+    if (altCode !== true) return altCode;
+  }
+  var read = _readBinding(binding[chosen]);
+  if (typeof read === "string") return read;
+  /** @internal The refusal of a weak binding stands whatever `allowWeakDigests` says, because a binding
+   *  is not the archived-signature case the option exists for. Whether it should follow the imprint and
+   *  become an opt-in is a posture question, and the refusal was pinned deliberately, so it is left as
+   *  it was. */
+  if (read.weak) return "tsp/weak-digest";
+  return _bindingNamesCert(read, tsaCertDer);
+}
+
 function _checkTsaCertUsage(tsaCertDer) {
   var cert;
   try { cert = pkiX509.parse(tsaCertDer); }
@@ -540,12 +625,12 @@ function _buildTsaChains(leaf, pool) {
       if (guard.name.dnEqual(pool[i].subject.rdns, current.issuer.rdns, _err, "tsp/bad-tsa-certificate", "the TSA certificate subject")) {
         used[i] = true; guard.list.append(acc, pool[i]);
         dfs(pool[i], acc, used);
-        acc.pop(); used[i] = false;
+        _pop(acc); used[i] = false;
       }
     }
   }
   dfs(leaf, [leaf], []);
-  return chains.map(function (c) { return c.slice().reverse(); }).sort(function (a, b) { return b.length - a.length; });
+  return chains.map(function (c) { return _reverse(_arrSlice(c)); }).sort(function (a, b) { return b.length - a.length; });
 }
 
 /**
@@ -643,7 +728,7 @@ async function verify(token, data, opts) {
   if (!cmsRes.valid) return fail("tsp/bad-signature", signer && (signer.code || signer.message));
   var tsaCertDer = signer && signer.cert;
   if (!tsaCertDer) return fail("tsp/bad-signature", "the TSA signer certificate was not found");
-  var mi = _imprintMatches(tst.messageImprint, data);
+  var mi = _imprintMatches(tst.messageImprint, data, opts.allowWeakDigests === true);
   if (mi !== true) return fail(mi);
   if (opts.nonce != null) {
     var wantNonce = guard.range.authoredInteger(opts.nonce, _err, "tsp/bad-input", "opts.nonce");