@blamejs/pki 0.8.31 → 0.8.48

package/lib/composite-sig.js

@@ -10,6 +10,21 @@ var validator = require("./validator-all");
 var edwardsPoint = require("./edwards-point");
 var _verdictOf = require("./guard-verdict").of;
 var subtle = webcrypto.webcrypto.subtle;
+/** @internal The verify operation, captured at load. A composite signature is verified in two halves
+ * and each must hold, so a replacement answering true for either accepts a signature that half of the
+ * pair never made, which is the guarantee a composite exists to give. */
+var _subtleVerify = require("./guard-intrinsic").uncurry(subtle.verify);
+/** @internal Every refusal this module returns is a RESOLVED promise carrying a negative verdict, and
+ *  `Promise.resolve` builds from its RECEIVER. Read from the global binding at the call, the refusal is
+ *  constructed by whatever that binding holds, so a replacement settling truthy turns each of these
+ *  into an acceptance. The constructor and the operation are both taken at load. */
+var _intrinsic = require("./guard-intrinsic");
+var _Promise = _intrinsic.Promise;
+var _promiseResolve = _intrinsic.uncurry(_intrinsic.promiseResolve);
+/** @internal The aggregator is the same defect one step out: the composite verdict is `ok` only when
+ *  BOTH component verifications resolve true, so a replaced `all` that resolves `[true, true]` without
+ *  awaiting either half reports a forged signature as verified. */
+var _promiseAll = _intrinsic.uncurry(_intrinsic.promiseAll);
 var _b = asn1.build;
 
 function _codeOf(e, fallback) {
@@ -69,10 +84,10 @@ function compositeMprime(d, phBuf, ctx) {
 
 function _verifyTradComponent(trad, tradPK, tradSig, mprime, E, badSig) {
   if (trad.ec) {
-    if (tradPK.length < 1 || tradPK[0] !== 0x04) return Promise.resolve(false);
+    if (tradPK.length < 1 || tradPK[0] !== 0x04) return _promiseResolve(_Promise, false);
     return subtle.importKey("spki", _ecSpki(trad.ec, tradPK), { name: "ECDSA" }, false, ["verify"]).then(function (k) {
       var p1363 = validator.sig.ecdsaDerToP1363(tradSig, trad.ec, E, badSig);
-      return subtle.verify({ name: "ECDSA", hash: trad.hash }, k, p1363, mprime);
+      return _subtleVerify(subtle, { name: "ECDSA", hash: trad.hash }, k, p1363, mprime);
     });
   }
   if (trad.eddsa) {
@@ -80,21 +95,21 @@ function _verifyTradComponent(trad, tradPK, tradSig, mprime, E, badSig) {
       throw new E(badSig, "the composite EdDSA component public key is not a valid, full-order Edwards point");
     }
     return subtle.importKey("spki", _edSpki(trad.eddsa, tradPK), { name: trad.eddsa }, false, ["verify"])
-      .then(function (k) { return subtle.verify({ name: trad.eddsa }, k, tradSig, mprime); });
+      .then(function (k) { return _subtleVerify(subtle, { name: trad.eddsa }, k, tradSig, mprime); });
   }
   if (trad.rsaPss || trad.rsaPkcs1) {
     var bits;
     try { bits = _rsaModulusBits(tradPK); }
-    catch (_e) { return Promise.resolve(false); }
-    if (bits !== trad.rsaBits) return Promise.resolve(false);
+    catch (_e) { return _promiseResolve(_Promise, false); }
+    if (bits !== trad.rsaBits) return _promiseResolve(_Promise, false);
     if (trad.rsaPss) {
       return subtle.importKey("spki", _rsaSpki(tradPK), { name: "RSA-PSS", hash: trad.hash }, false, ["verify"])
-        .then(function (k) { return subtle.verify({ name: "RSA-PSS", saltLength: trad.salt }, k, tradSig, mprime); });
+        .then(function (k) { return _subtleVerify(subtle, { name: "RSA-PSS", saltLength: trad.salt }, k, tradSig, mprime); });
     }
     return subtle.importKey("spki", _rsaSpki(tradPK), { name: "RSASSA-PKCS1-v1_5", hash: trad.hash }, false, ["verify"])
-      .then(function (k) { return subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, k, tradSig, mprime); });
+      .then(function (k) { return _subtleVerify(subtle, { name: "RSASSA-PKCS1-v1_5" }, k, tradSig, mprime); });
   }
-  return Promise.resolve(false);
+  return _promiseResolve(_Promise, false);
 }
 
 /** @internal Every verdict this returns carries its own `then`: resolving a promise reads that property
@@ -102,7 +117,7 @@ function _verifyTradComponent(trad, tradPK, tradSig, mprime, E, badSig) {
  * caller a different object than the one the comparison produced (see guard-verdict). */
 function compositeVerify(spkiBytes, sigBytes, message, d, E, unsupported, badSig) {
   if (d.trad.unsupported) {
-    return Promise.resolve(_verdictOf({ ok: false, code: unsupported,
+    return _promiseResolve(_Promise, _verdictOf({ ok: false, code: unsupported,
       error: new E(unsupported, "composite " + d.name + ": " + d.trad.unsupported) }));
   }
   var rawKey;
@@ -110,9 +125,9 @@ function compositeVerify(spkiBytes, sigBytes, message, d, E, unsupported, badSig
     var bs = asn1.read.bitString(asn1.decode(spkiBytes).children[1]);
     if (bs.unusedBits !== 0) throw new E(badSig, "composite subjectPublicKey has unused bits");
     rawKey = bs.bytes;
-  } catch (e) { return Promise.resolve(_verdictOf({ ok: false, code: _codeOf(e, badSig), error: e })); }
+  } catch (e) { return _promiseResolve(_Promise, _verdictOf({ ok: false, code: _codeOf(e, badSig), error: e })); }
   if (rawKey.length <= d.mldsaPk || sigBytes.length <= d.mldsaSig) {
-    return Promise.resolve(_verdictOf({ ok: false, code: badSig,
+    return _promiseResolve(_Promise, _verdictOf({ ok: false, code: badSig,
       error: new E(badSig, "composite key/signature shorter than the fixed ML-DSA component") }));
   }
   var mldsaPK = rawKey.subarray(0, d.mldsaPk), tradPK = rawKey.subarray(d.mldsaPk);
@@ -120,9 +135,9 @@ function compositeVerify(spkiBytes, sigBytes, message, d, E, unsupported, badSig
   return subtle.digest({ name: d.ph }, message).then(function (phBuf) {
     var mprime = compositeMprime(d, phBuf);
     var mldsaP = subtle.importKey("spki", _mldsaSpki(d.mldsaOid, mldsaPK), { name: d.mldsa }, false, ["verify"])
-      .then(function (mk) { return subtle.verify({ name: d.mldsa, context: d.label }, mk, mldsaSig, mprime); });
+      .then(function (mk) { return _subtleVerify(subtle, { name: d.mldsa, context: d.label }, mk, mldsaSig, mprime); });
     var tradP = _verifyTradComponent(d.trad, tradPK, tradSig, mprime, E, badSig);
-    return Promise.all([mldsaP, tradP]).then(function (r) { return _verdictOf({ ok: r[0] === true && r[1] === true }); });
+    return _promiseAll(_Promise, [mldsaP, tradP]).then(function (r) { return _verdictOf({ ok: r[0] === true && r[1] === true }); });
   }).catch(function (e) { return _verdictOf({ ok: false, code: _codeOf(e, badSig), error: e }); });
 }
 
@@ -141,7 +156,7 @@ function compositeSign(d, keys, message, ctx) {
     var mldsaP = subtle.importKey("pkcs8", keys.mldsa, { name: d.mldsa }, false, ["sign"])
       .then(function (k) { return subtle.sign({ name: d.mldsa, context: d.label }, k, mprime); });
     var tradP = _signTradComponent(d.trad, keys.trad, mprime);
-    return Promise.all([mldsaP, tradP]).then(function (s) { return Buffer.concat([Buffer.from(s[0]), Buffer.from(s[1])]); });
+    return _promiseAll(_Promise, [mldsaP, tradP]).then(function (s) { return Buffer.concat([Buffer.from(s[0]), Buffer.from(s[1])]); });
   });
 }
 function _signTradComponent(trad, pkcs8, mprime) {

package/lib/constants.js

@@ -114,6 +114,20 @@ var LIMITS = Object.assign(Object.create(null), {
   DER_MAX_ITEMS: 4000000,
   DUMP_MAX_NODES: 65536,
   DUMP_MAX_VALUE_BYTES: 256,
+  /** @internal The values one deep copy of a caller's object may visit. A copy visits every reference
+   *  independently, so a value holding the same subobject in two places costs twice, and depth alone
+   *  bounds nothing: nested 19 levels with each level sharing its child expands to half a million values.
+   *  The figure bounds the WORST case as well as admitting the real one, which is why it is not larger.
+   *  MEASURED: a 1000-record trust-anchor list is about 9000 values and copies in 54 ms, 10000 records in
+   *  482 ms, and this bound is reached in about 400 ms, so a hostile value costs that much once instead of
+   *  growing without limit. An options bag or a key is tens of values. */
+  DEEP_COPY_MAX_NODES: 65536,
+  /** @internal The certificates a CT log's accepted-roots response may carry. A configured log is trusted
+   *  for its own signatures and not for its resource use, and the response body cap bounds the BYTES while
+   *  saying nothing about the element count: a body well under it carries about a million empty strings,
+   *  each of which becomes its own Buffer. The figure is far above any real log, the public ones listing a
+   *  few hundred roots. */
+  CT_MAX_ROOTS: 4096,
   NAMED_SCAN_MAX_ELEMENTS: 16777216,
   MAX_DECODE_DEPTH_CEILING: 256,
   PEM_MAX_BYTES: BYTES.mib(16),
@@ -149,6 +163,7 @@ var LIMITS = Object.assign(Object.create(null), {
   CMP_KEM_MAX_KEY_BYTES: 1024,
   CMP_KEM_MIN_KEY_BYTES: 20,
   MERKLE_MAX_PROOF_NODES: 65,
+  MERKLE_MAX_LEAVES: 1048576,
   PROXY_MAX_TLS_ANCHORS: 256,
   PATH_MAX_CERTS: 100,
   PATH_MAX_POLICY_NODES: 4096,
@@ -168,6 +183,8 @@ var LIMITS = Object.assign(Object.create(null), {
   JSON_MAX_BYTES: BYTES.mib(1),
   JSON_MAX_DEPTH: 32,
   CT_LOG_LIST_MAX_BYTES: BYTES.mib(4),
+  CT_MAX_ENTRIES_PER_REQUEST: 1024,
+  TUF_MAX_ROOT_CHAIN: 1024,
   PBKDF2_MAX_ITERATIONS: 10000000,
   PBKDF2_MAX_SALT: 1024,
   MIME_MAX_BYTES: BYTES.mib(16),
@@ -175,6 +192,15 @@ var LIMITS = Object.assign(Object.create(null), {
   COMPRESS_MAX_BYTES: BYTES.mib(16),
   TLS_CERT_MSG_MAX_BYTES: BYTES.mib(16) - 1,
   TLS_CERT_MAX_ENTRIES: 100,
+  TLS_MAX_PEER_CHAIN: 16,
+  TLOG_MAX_NOTE_BYTES: BYTES.mib(1),
+  TLOG_MAX_SIGNATURES: 64,
+  TLOG_MAX_EXTENSION_LINES: 64,
+  TLOG_MAX_ENTRY_BUNDLE_BYTES: BYTES.mib(16),
+  /** @internal A tile is 256 wide, so an entry bundle covers at most that many entries (C2SP tlog-tiles).
+   *  The byte cap alone does not bound the COUNT: a megabyte of zero bytes is half a million zero-length
+   *  entries, each one an object, so the permitted input allocates hundreds of megabytes. */
+  TLOG_MAX_ENTRY_BUNDLE_ENTRIES: 256,
   MDS_BLOB_MAX_BYTES: BYTES.mib(32),
   MDS_BLOB_HEADER_MAX_BYTES: BYTES.kib(256),
   MDS_BLOB_SIG_MAX_BYTES: BYTES.kib(8),

package/lib/crl-sign.js

@@ -25,6 +25,11 @@ var signScheme = require("./sign-scheme");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
 var _hasOwn = intrinsic.hasOwn, _bufferEquals = intrinsic.bufferEquals;
+var _arrSlice = intrinsic.arraySlice, _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
+/** @internal The RECEIVER for the captured `Promise.resolve`, captured too. `resolve` builds through
+ *  its receiver, so handing it the live `globalThis.Promise` put the capture back under a constructor a
+ *  replacement could take over and decide what the awaited value became. */
+var _Promise = intrinsic.Promise;
 var frameworkError = require("./framework-error");
 var pkix = require("./schema-pkix");
 var schema = require("./schema-engine");
@@ -53,7 +58,8 @@ var _encodeName = _b.encodeName, _isEmptyName = _b.isEmptyName, _reqDer = _b.req
   _assertValidSpki = _b.assertValidSpki, _assertValidExtension = _b.assertValidExtension,
   _timeDer = _b.timeDer, _ext = _b.ext, _extAki = _b.extAki, _spkiKeyId = _b.spkiKeyId,
   _serialInteger = _b.serialInteger, _encodeGeneralName = _b.encodeGeneralName,
-  _certLikeFromSpki = _b.certLikeFromSpki, _assertSignatureVerifies = _b.assertSignatureVerifies;
+  _certLikeFromSpki = _b.certLikeFromSpki, _assertSignatureVerifies = _b.assertSignatureVerifies,
+  _altPublicKeyValueOf = _b.altPublicKeyValueOf;
 var EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
 
 /** @internal A pre-encoded extension is admitted on the shape of its Extension SEQUENCE, which says
@@ -84,8 +90,11 @@ var KNOWN_SPEC_KEYS = intrinsic.assign(intrinsic.create(null), {
 var KNOWN_SPEC_KEYS_ISSUER_NAMED = intrinsic.assign(intrinsic.create(null), {
   thisUpdate: 1, nextUpdate: 1, revoked: 1, crlNumber: 1, extensions: 1,
 });
-var KNOWN_ISSUER_CERT_KEYS = intrinsic.assign(intrinsic.create(null), { key: 1, cert: 1 });
-var KNOWN_ISSUER_EXPLICIT_KEYS = intrinsic.assign(intrinsic.create(null), { key: 1, name: 1, publicKey: 1 });
+/** @internal `altKey` and `altPublicKey` are the issuer's ALTERNATIVE signing key and its public half.
+ *  ITU-T X.509 (2019) clause 7.10.3 gives a CRL the same alternative-signature procedure a certificate
+ *  gets, with the same two extensions. */
+var KNOWN_ISSUER_CERT_KEYS = intrinsic.assign(intrinsic.create(null), { key: 1, cert: 1, altKey: 1, altPublicKey: 1 });
+var KNOWN_ISSUER_EXPLICIT_KEYS = intrinsic.assign(intrinsic.create(null), { key: 1, name: 1, publicKey: 1, altKey: 1, altPublicKey: 1 });
 var KNOWN_SIGN_OPTS = intrinsic.assign(intrinsic.create(null), { digestAlgorithm: 1, pem: 1, pss: 1, profile: 1 });
 
 /** @internal The signature the build-time gate lints against, standing in for one that does not exist
@@ -214,7 +223,7 @@ function _freshestValue(spec) {
 function _aiaValue(spec) {
   if (!Array.isArray(spec) || !spec.length) throw _err("crl/bad-input", "authorityInfoAccess must be a non-empty array of caIssuers GeneralNames");
   var caIssuers = O("caIssuers");
-  return b.sequence(spec.map(function (gn) { return b.sequence([b.oid(caIssuers), _encodeGeneralName(gn)]); }));
+  return b.sequence(guard.list.copyMap(spec, function (gn) { return b.sequence([b.oid(caIssuers), _encodeGeneralName(gn)]); }));
 }
 
 function _buildCrlExtensions(spec, ctx) {
@@ -231,7 +240,10 @@ function _buildCrlExtensions(spec, ctx) {
   if (ext == null) ext = {};
   if (Array.isArray(ext)) {
     var arrBase = null, arrCrlNum = null;
-    ext.forEach(function (e, i) {
+    /** @internal The walk goes through `guard.list.copyMap`, never the caller's own `forEach`. Reached
+     *  off the array a caller supplied, it is that caller's to replace, and one handing the callback a
+     *  different list bypasses every per-element rule below at once on content this verb then signs. */
+    guard.list.copyMap(ext, function (e, i) {
       var der = _reqDer(e, "extension");
       _assertValidExtension(der, i, EXT_DECODERS);
       var node = asn1.decode(der);
@@ -324,7 +336,9 @@ function _buildRevoked(entryList, isDelta) {
     if (e.certificateIssuer != null) throw _err("crl/bad-input", _CERT_ISSUER_DEFERRED);
     if (e.extensions != null) {
       if (!Array.isArray(e.extensions)) throw _err("crl/bad-input", "revoked entry [" + idx + "] extensions must be an array of pre-encoded Extension DER");
-      e.extensions.forEach(function (x, j) {
+      /** @internal Through the captured walk for the reason the extension list above gives: a revoked
+       *  entry's extensions are signed content too. */
+      guard.list.copyMap(e.extensions, function (x, j) {
         var der = _reqDer(x, "entry extension");
         _assertValidExtension(der, j, EXT_DECODERS);
         var xnode = asn1.decode(der);
@@ -423,21 +437,65 @@ function _sign(spec, issuer, opts) {
 
   var scheme = signScheme.resolveSignScheme(_certLikeFromSpki(issuerSpki), { combinedRsaSig: true, pss: opts.pss, digestAlgorithm: opts.digestAlgorithm }, true, _signE);
 
-  var tbsChildren = [];
-  if (version === 2) tbsChildren.push(b.integer(1n));
-  tbsChildren.push(scheme.sigAlgId);
-  tbsChildren.push(issuerDer);
-  tbsChildren.push(thisU);
-  if (nextU) tbsChildren.push(nextU);
-  if (revoked.entries.length) tbsChildren.push(b.sequence(revoked.entries));
-  if (crlExts.length) tbsChildren.push(b.explicit(0, b.sequence(crlExts)));
-  var tbsDer = b.sequence(tbsChildren);
-  lint.assertBuildClean("crl",
-    b.sequence([tbsDer, scheme.sigAlgId, b.bitString(GATE_PLACEHOLDER_SIG, 0)]),
-    opts.profile, _err, "crl/profile-violation");
+  /** @internal ITU-T X.509 (2019) clause 7.10.3. The alternative signature covers the PreTBSCertList,
+   *  which is the tbsCertList without its `signature` AlgorithmIdentifier and without its own
+   *  altSignatureValue extension (draft-truskovsky-lamps-pq-hybrid-x509 sec. 5), so the extension list
+   *  is built twice from one function and the alternative signature is generated first.
+   *  subjectAltPublicKeyInfo is not emitted on a CRL: the NOTE in clause 7.2.2 states it is a
+   *  certificate extension only. */
+  var altCrl = _resolveCrlAltSigning(issuer, issuerCert);
+  if (altCrl !== null) {
+    guard.list.append(crlExts, _ext(O("altSignatureAlgorithm"), false, b.raw(altCrl.altSigAlgId)));
+    version = 2;
+  }
+
+  /** @internal `omitSignatureAlg` drops the `signature` AlgorithmIdentifier, turning the tbsCertList
+   *  into the PreTBSCertList the alternative signature covers. */
+  function tbsOver(extList, omitSignatureAlg) {
+    var tbsChildren = [];
+    if (version === 2) tbsChildren.push(b.integer(1n));
+    if (omitSignatureAlg !== true) tbsChildren.push(scheme.sigAlgId);
+    tbsChildren.push(issuerDer);
+    tbsChildren.push(thisU);
+    if (nextU) tbsChildren.push(nextU);
+    if (revoked.entries.length) tbsChildren.push(b.sequence(revoked.entries));
+    if (extList.length) tbsChildren.push(b.explicit(0, b.sequence(extList)));
+    return b.sequence(tbsChildren);
+  }
+
+  /** @internal Self-checked against issuer.altPublicKey before it is embedded, the same gate the native
+   *  pass applies below. An altKey and an altPublicKey that are different keys of one algorithm resolve
+   *  to the same scheme, so without this the CRL ships with an alternative signature that does not
+   *  verify under the alternative key its own issuer names. */
+  var altFirst;
+  if (altCrl === null) {
+    altFirst = _promiseResolve(_Promise, null);
+  } else {
+    var altPreimage = tbsOver(crlExts, true);
+    altFirst = signScheme.signOverTbs(altCrl.scheme, issuer.altKey, altPreimage, _signE)
+      .then(function (altSigBytes) {
+        return _promiseResolve(_Promise,
+          _assertSignatureVerifies(altPreimage, altSigBytes, altCrl.issuerAltSpki, altCrl.scheme)
+        ).then(function () { return altSigBytes; });
+      });
+  }
+
+  return altFirst.then(function (altSigBytes) {
+    var finalExts = crlExts;
+    if (altCrl !== null) {
+      finalExts = _arrSlice(crlExts);
+      guard.list.append(finalExts, _ext(O("altSignatureValue"), false, b.bitString(altSigBytes, 0)));
+    }
+    var tbsDer = tbsOver(finalExts);
+    lint.assertBuildClean("crl",
+      b.sequence([tbsDer, scheme.sigAlgId, b.bitString(GATE_PLACEHOLDER_SIG, 0)]),
+      opts.profile, _err, "crl/profile-violation");
+    return _signNativeCrl(tbsDer);
+  });
 
+  function _signNativeCrl(tbsDer) {
   return signScheme.signOverTbs(scheme, issuer.key, tbsDer, _signE).then(function (sig) {
-    return Promise.resolve(_assertSignatureVerifies(tbsDer, sig, issuerSpki, scheme)).then(function () {
+    return _promiseResolve(_Promise, _assertSignatureVerifies(tbsDer, sig, issuerSpki, scheme)).then(function () {
       var crlDer = b.sequence([tbsDer, scheme.sigAlgId, b.bitString(sig, 0)]);
       return opts.pem ? crlSchema.pemEncode(crlDer, "X509 CRL") : crlDer;
     });
@@ -445,6 +503,40 @@ function _sign(spec, issuer, opts) {
     if (e instanceof CrlError) throw e;
     throw _err("crl/bad-input", "signing the CRL failed -- the signing key does not match the resolved algorithm or is invalid", e);
   });
+  }
+}
+
+/** @internal The alternative signing side for a CRL. A CRL carries no subjectAltPublicKeyInfo, so the
+ *  issuer's alternative key alone turns the mechanism on and there is nothing for the spec to name. */
+function _resolveCrlAltSigning(issuer, issuerCert) {
+  if (issuer.altKey == null) {
+    if (issuer.altPublicKey != null) {
+      throw _err("crl/bad-input", "issuer.altPublicKey needs issuer.altKey to sign the alternative signature with (ITU-T X.509 (2019) clause 7.10.3)");
+    }
+    return null;
+  }
+  if (issuer.altPublicKey == null) {
+    throw _err("crl/bad-input", "an issuer altKey needs issuer.altPublicKey, the SPKI of its public half, to resolve the alternative signature algorithm");
+  }
+  var issuerAltSpki = _reqDer(issuer.altPublicKey, "issuer.altPublicKey (the issuer's alternative SPKI DER)");
+  _assertValidSpki(issuerAltSpki, "issuer.altPublicKey");
+  /** @internal Bound to the issuer's certificate, as the native key already is: that one is read OUT of
+   *  issuer.cert while this one arrives beside it. A relying party checks a CRL's alternative signature
+   *  with the alternative key the CRL issuer's certificate publishes (clause 9.8.4), so a CRL signed with
+   *  any other key carries a signature nobody can check. */
+  if (issuerCert !== null && issuerCert !== undefined) {
+    var published = _altPublicKeyValueOf(issuerCert);
+    if (published === null) {
+      throw _err("crl/bad-input",
+        "issuer.cert publishes no subjectAltPublicKeyInfo, so it names no alternative key for a relying party to check this CRL's alternative signature with (ITU-T X.509 (2019) clause 9.8.4)");
+    }
+    if (!_bufferEquals(published, issuerAltSpki)) {
+      throw _err("crl/bad-input",
+        "issuer.altPublicKey is not the alternative key issuer.cert publishes in its subjectAltPublicKeyInfo, so the alternative signature would verify under no key a relying party can find (ITU-T X.509 (2019) clause 9.8.4)");
+    }
+  }
+  var altScheme = signScheme.resolveSignScheme(_certLikeFromSpki(issuerAltSpki), { combinedRsaSig: true }, true, _signE);
+  return { scheme: altScheme, altSigAlgId: altScheme.sigAlgId, issuerAltSpki: issuerAltSpki };
 }
 
 /**

package/lib/crmf-sign.js

@@ -20,8 +20,6 @@
 var nodeCrypto = require("node:crypto");
 /** @internal Bound at module load, like every other capture here: the proof below decides what it
  * agrees and what it hashes, so a replacement swapped in afterwards must not be able to steer it. */
-var _createHash = nodeCrypto.createHash;
-var _createHmac = nodeCrypto.createHmac;
 var _diffieHellman = nodeCrypto.diffieHellman;
 var _createPublicKey = nodeCrypto.createPublicKey;
 var _createPrivateKey = nodeCrypto.createPrivateKey;
@@ -37,10 +35,21 @@ var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
 var constants = require("./constants");
 var intrinsic = require("./guard-intrinsic");
+/** @internal The promise a signature verdict is awaited through, built from the constructor captured at
+ *  load. `Promise.resolve` builds from its RECEIVER, so reading the global binding at the call hands the
+ *  construction to whatever that binding holds: one settling without awaiting its argument drops the
+ *  self-check's rejection, and one settling truthy answers the verdict the caller reads. */
+var _Promise = intrinsic.Promise;
+var _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
+/** @internal `verifyPop`'s verdict is the aggregate of the per-message results, so a replaced `all`
+ *  that resolves a fabricated array reports an unverified proof of possession as verified. */
+var _promiseAll = intrinsic.uncurry(intrinsic.promiseAll);
 var _hasOwn = intrinsic.hasOwn;
 var _isBuffer = intrinsic.isBuffer;
+var _push = intrinsic.push, _String = intrinsic.String;
 var _stringify = intrinsic.stringify;
 var cms = require("./schema-cms");
+var possession = require("./possession");
 var cmsEncrypt = require("./cms-encrypt");
 var key = require("./key");
 require("./path-validate");
@@ -77,7 +86,89 @@ var KNOWN_TEMPLATE_KEYS = intrinsic.assign(intrinsic.create(null), { version: 1,
 var REVOCATION_TEMPLATE_KEYS = intrinsic.assign(intrinsic.create(null), { version: 1, subject: 1, publicKey: 1, validity: 1, extensions: 1, issuer: 1, serialNumber: 1 });
 function _ctlUtf8(v) { return b.utf8(String(v)); }
 function _ctlSpki(v) { var k = _b.reqDer(v, "protocolEncrKey (an SPKI DER)"); _b.assertValidSpki(k, "protocolEncrKey"); return b.raw(k); }
-var CONTROL_VALUE = intrinsic.assign(intrinsic.create(null), { regToken: _ctlUtf8, authenticator: _ctlUtf8, oldCertID: function (v) { return _encodeCertId(v); }, protocolEncrKey: _ctlSpki });
+/** @internal RFC 9883 sec. 5 gives its registration control the value of its PKCS#10 attribute,
+ *  `regCtrl-privateKeyPossessionStatement ATTRIBUTE ::= privateKeyPossessionStatement` under
+ *  `id-regCtrl-statementOfPossession ::= id-at-statementOfPossession`, so the control and the attribute
+ *  are one OID carrying one structure. The structure itself is sec. 3. The value is built and then read
+ *  back through the one statement reader, which is what applies the signer-names-the-certificate rule
+ *  here rather than a second copy of it. */
+function _ctlPossession(v) {
+  if (v === null || typeof v !== "object" || _isBuffer(v)) {
+    throw _err("crmf/bad-controls", "statementOfPossession must be an object { signer, certificate? }");
+  }
+  guard.identifier.assertKnownKeys(v, KNOWN_POSSESSION_CONTROL_KEYS, _err, "crmf/bad-controls",
+    "statementOfPossession has an unknown field: ");
+  var signer = v.signer;
+  if (signer === null || typeof signer !== "object" || _isBuffer(signer)) {
+    throw _err("crmf/bad-controls", "statementOfPossession needs a signer naming the signature certificate's issuer and serial (RFC 9883 sec. 3)");
+  }
+  var issuerRaw = (signer.issuer !== null && typeof signer.issuer === "object" && !_isBuffer(signer.issuer) &&
+    signer.issuer.bytes !== undefined) ? signer.issuer.bytes : signer.issuer;
+  var fields = [b.sequence([
+    b.raw(_b.reqDer(issuerRaw, "statementOfPossession signer.issuer (the signature certificate's issuer Name DER)")),
+    b.integer(guard.range.authoredInteger(signer.serialNumber, _err, "crmf/bad-controls", "statementOfPossession signer.serialNumber")),
+  ])];
+  if (v.certificate != null) _push(fields, b.raw(_b.reqDer(v.certificate, "statementOfPossession certificate")));
+  var der = b.sequence(fields);
+  try { possession.parse(der); }
+  catch (e) { throw _err("crmf/bad-controls", "statementOfPossession: " + ((e && e.message) || _String(e)), e); }
+  return b.raw(der);
+}
+var KNOWN_POSSESSION_CONTROL_KEYS = intrinsic.assign(intrinsic.create(null), { signer: 1, certificate: 1 });
+/** @internal The RFC 9883 statement a parsed certReq carries, or null. The control value is raw DER, so
+ *  it goes through the one statement reader; a value that reader refuses is reported as absent here and
+ *  the verdict below says so, since a control this verifier cannot read is not a proof it can use. */
+function _possessionControlOf(certReq) {
+  var controls = (certReq && certReq.controls) || [];
+  /** @internal A request carrying MORE THAN ONE statement is refused before any of it is read, the way
+   *  `pki.possession.verifyRequest` refuses the PKCS#10 attribute. Taking the first and returning left
+   *  every later statement unchecked: a request whose first statement is sound and whose second names a
+   *  different certificate verified on the strength of the first. The controls are a sequence nothing
+   *  orders for this purpose, and which one a CA should honor is stated nowhere, so naming the ambiguity
+   *  is the only reading that does not check one statement and certify against another. */
+  var found = null, count = 0;
+  for (var i = 0; i < controls.length; i++) {
+    if (controls[i].type !== possession.OID_SOP) continue;
+    count += 1;
+    if (found === null) found = controls[i].value;
+  }
+  if (count > 1) {
+    throw _err("crmf/bad-controls", "this request carries " + count + " statementOfPossession controls, " +
+      "and which of them a CA should honor is not stated anywhere, so the RFC 9883 checks cannot be made " +
+      "against one of them alone");
+  }
+  if (found === null) return null;
+  try { return possession.parse(found); }
+  catch (_e) { return { signer: null, certificate: null }; }
+}
+/** @internal The signature certificate's key from an ALREADY-ENCODED control list, so the array form of
+ *  `spec.controls` resolves the proof-of-possession algorithm the same way the object form does. The
+ *  entries arrive as `_buildAttrTypeAndValues` decoded them, which is the point: that walk already held
+ *  each one to being a `SEQUENCE { type OID, value }` with no duplicate type, so this one neither
+ *  re-decodes nor re-validates. A second validator over the same bytes is the shape that put a
+ *  fail-open skip here, where an entry that did not decode was passed over and the request was then
+ *  reported as carrying no statement, leaving the algorithm resolved from the key being certified while
+ *  the request traveled carrying the statement that was skipped. Returns null when the list carries
+ *  none. */
+function _encodedPossessionSpki(entries) {
+  for (var i = 0; i < entries.length; i++) {
+    if (entries[i].type !== possession.OID_SOP) continue;
+    var statement;
+    try { statement = possession.parse(entries[i].node.children[1].bytes); }
+    catch (e) {
+      throw _err("crmf/bad-controls",
+        "the pre-encoded statementOfPossession control does not decode as a PrivateKeyPossessionStatement", e);
+    }
+    if (statement.certificate == null) {
+      throw _err("crmf/bad-controls",
+        "statementOfPossession needs the certificate: this verb resolves the proof-of-possession algorithm from its key and checks the signature against it");
+    }
+    return x509.parse(statement.certificate).subjectPublicKeyInfo.bytes;
+  }
+  return null;
+}
+
+var CONTROL_VALUE = intrinsic.assign(intrinsic.create(null), { regToken: _ctlUtf8, authenticator: _ctlUtf8, oldCertID: function (v) { return _encodeCertId(v); }, protocolEncrKey: _ctlSpki, statementOfPossession: _ctlPossession });
 var REGINFO_VALUE = intrinsic.assign(intrinsic.create(null), { utf8Pairs: _ctlUtf8 });
 
 
@@ -115,7 +206,11 @@ function _encodeCertTemplate(tpl, opts) {
   return { der: b.sequence(fields), spki: spki, complete: tpl.subject != null && tpl.publicKey != null };
 }
 
-function _buildAttrTypeAndValues(spec, code, label, valueMap) {
+/** @internal `collect`, when given, receives one `{ type, node }` per entry of the ARRAY form, in order.
+ *  That is how a caller that needs an entry back reads it: this walk already decoded each one and held
+ *  it to the shape, so a second walk would be a second validator of the same bytes, weaker than this one
+ *  wherever the two drifted apart. */
+function _buildAttrTypeAndValues(spec, code, label, valueMap, collect) {
   if (Array.isArray(spec)) {
     if (!spec.length) throw _err(code, label + " must carry at least one entry");
     var seenA = intrinsic.create(null);
@@ -128,6 +223,7 @@ function _buildAttrTypeAndValues(spec, code, label, valueMap) {
       try { t = asn1.read.oid(n.children[0]); } catch (err) { throw _err("crmf/bad-input", "pre-encoded " + label + " [" + i + "] type is not an OBJECT IDENTIFIER", err); }
       if (seenA[t]) throw _err(code, "duplicate " + label + " type " + (oid.name(t) || t));
       seenA[t] = true;
+      if (collect) guard.list.append(collect, { type: t, node: n });
       return b.raw(der);
     }));
   }
@@ -367,11 +463,11 @@ function _buildAgreeMac(pop, outerTag, certReqDer, template) {
      * digest the proof's own algorithm identifier names. */
     var popAlgOid = O("id-dhPop-static-HMAC-SHA1");
     var digest = DH_POP_DIGEST[popAlgOid];
-    k = _createHash(digest).update(leading).update(zz).update(trailing).digest();
+    k = guard.crypto.digestParts(digest, [leading, zz, trailing]);
     /** @internal Ordinary HMAC-SHA1. RFC 2875 sec. 3(d) writes the construction correctly and then
      * labels its pads the wrong way round, calling 0x36 the outer pad and 0x5C the inner one, which is
      * the reverse of RFC 2104; the same sentence says the MAC is computed "as per [RFC2104]". */
-    var mac = _createHmac(digest, k).update(certReqDer).digest();
+    var mac = guard.crypto.hmac(digest, k, certReqDer);
     /** @internal The BIT STRING carries the DhPopStatic SEQUENCE, not the raw MAC. RFC 2875 sec. 3
      * says so after the computation: "DhPopStatic is encoded as a BIT STRING and is the signature
      * value (i.e. encodes the above sequence instead of the raw output from 3d)". `issuerAndSerial`
@@ -868,7 +964,7 @@ function _assertEnclosedKeyMatches(privateKeyDer, templateSpki) {
    * cannot use it, so those are proven by USING the key against the template. */
   var enclosedAlg = key.algorithmOidAt(privateKeyDer, 1);
   if (enclosedAlg !== null && !key.isDhOid(enclosedAlg)) return _assertEnclosedKeyCorresponds(privateKeyDer, templateSpki);
-  return Promise.resolve()
+  return _promiseResolve(_Promise, undefined)
     .then(function () { return key.publicFromPrivate(privateKeyDer); })
     .then(function (derivedSpki) {
       var derived = guard.bytes.view(derivedSpki, CrmfError, "crmf/bad-input", "the derived public key");
@@ -945,7 +1041,7 @@ function _assertPopArmKeys(pop, mode) {
   });
 }
 
-function _buildProofOfPossession(pop, certReqDer, template, signingKey, opts) {
+function _buildProofOfPossession(pop, certReqDer, template, signingKey, opts, possessionSpki) {
   if (pop != null && (typeof pop !== "object" || _isBuffer(pop))) throw _err("crmf/bad-input", "spec.pop must be an object (e.g. { type: 'signature' } or { type: 'raVerified', raVerified: true })");
   var mode = (pop && pop.type) || (signingKey != null ? "signature" : null);
   if (pop != null) _assertPopArmKeys(pop, mode);
@@ -961,7 +1057,13 @@ function _buildProofOfPossession(pop, certReqDer, template, signingKey, opts) {
   }
   if (signingKey == null) throw _err("crmf/bad-input", "a signature proof of possession requires the requester's private key");
   if (template.spki == null) throw _err("crmf/bad-input", "a signature proof of possession requires certTemplate.publicKey");
-  var scheme = signScheme.resolveSignScheme(_b.certLikeFromSpki(template.spki), { combinedRsaSig: true, pss: opts.pss, digestAlgorithm: opts.digestAlgorithm }, true, _signE);
+  /** @internal Normally the requested key signs, which is what makes a signature POP a proof of
+   *  possession OF that key. With an RFC 9883 statement of possession the signature is made by the key
+   *  of the certificate the statement names, because the requested key is a key-establishment key and
+   *  cannot sign. The relaxation is scoped to a request carrying the control, so a request without one
+   *  is still held to signing with the key it asks to have certified. */
+  var provingSpki = possessionSpki == null ? template.spki : possessionSpki;
+  var scheme = signScheme.resolveSignScheme(_b.certLikeFromSpki(provingSpki), { combinedRsaSig: true, pss: opts.pss, digestAlgorithm: opts.digestAlgorithm }, true, _signE);
   var signedRegion, poposkInputField = null;
   if (template.complete) {
     signedRegion = certReqDer;
@@ -973,7 +1075,7 @@ function _buildProofOfPossession(pop, certReqDer, template, signingKey, opts) {
     poposkInputField = b.implicit(0, poposkSeq);
   }
   return signScheme.signOverTbs(scheme, signingKey, signedRegion, _signE).then(function (sig) {
-    return Promise.resolve(_b.assertSignatureVerifies(signedRegion, sig, template.spki, scheme)).then(function () {
+    return _promiseResolve(_Promise, _b.assertSignatureVerifies(signedRegion, sig, provingSpki, scheme)).then(function () {
       var popoChildren = [];
       if (poposkInputField) popoChildren.push(poposkInputField);
       popoChildren.push(scheme.sigAlgId);
@@ -1068,10 +1170,33 @@ function _buildCertReqMsg(spec, key, opts) {
   var signingKey = (key && typeof key === "object" && !_isBuffer(key) && !(key instanceof Uint8Array) && key.type == null && "key" in key) ? key.key : key;
   var template = _encodeCertTemplate(spec.certTemplate);
   var certReqChildren = [b.integer(_certReqId(spec.certReqId)), template.der];
-  if (spec.controls != null) certReqChildren.push(_buildAttrTypeAndValues(spec.controls, "crmf/bad-controls", "controls", CONTROL_VALUE));
+  var encodedControls = [];
+  if (spec.controls != null) certReqChildren.push(_buildAttrTypeAndValues(spec.controls, "crmf/bad-controls", "controls", CONTROL_VALUE, encodedControls));
   var certReqDer = b.sequence(certReqChildren);
 
-  return Promise.resolve(_buildProofOfPossession(spec.pop, certReqDer, template, signingKey, opts)).then(function (popoDer) {
+  /** @internal The key the RFC 9883 control names, when the request carries one: that key makes the
+   *  proof of possession rather than the requested key. The certificate is required in the control for
+   *  the same reason it is in the PKCS#10 spec field -- this verb has to know which key signs. */
+  var possessionSpki = null;
+  if (spec.controls != null && !intrinsic.isArray(spec.controls) && spec.controls.statementOfPossession != null) {
+    var sopCert = spec.controls.statementOfPossession.certificate;
+    if (sopCert == null) {
+      throw _err("crmf/bad-controls",
+        "statementOfPossession needs the certificate: this verb resolves the proof-of-possession algorithm from its key and checks the signature against it");
+    }
+    possessionSpki = x509.parse(_b.reqDer(sopCert, "statementOfPossession certificate")).subjectPublicKeyInfo.bytes;
+  } else if (spec.controls != null && intrinsic.isArray(spec.controls)) {
+    /** @internal The ARRAY form carries controls already encoded, and it reaches the same resolution. Read
+     *  only through the object form, a pre-encoded statement was invisible here and the signing algorithm
+     *  was resolved from the REQUESTED key instead of from the signature certificate: an X25519 request
+     *  carrying a perfectly good encoded statement was refused `crmf/unsupported-algorithm`, while the
+     *  object form of the same request succeeded. One control, two spellings, and the rule has to hold for
+     *  both. The entries are the ones the builder above decoded, so the statement is found without a
+     *  second walk over the same bytes, and read back through the one statement reader. */
+    possessionSpki = _encodedPossessionSpki(encodedControls);
+  }
+
+  return _promiseResolve(_Promise, _buildProofOfPossession(spec.pop, certReqDer, template, signingKey, opts, possessionSpki)).then(function (popoDer) {
     var msgChildren = [certReqDer];
     if (popoDer) msgChildren.push(popoDer);
     if (spec.regInfo != null) msgChildren.push(_buildAttrTypeAndValues(spec.regInfo, "crmf/bad-reg-info", "regInfo", REGINFO_VALUE));
@@ -1093,7 +1218,7 @@ function _build(spec, key, opts) {
     specs = [spec];
   }
   if (!specs.length) throw _err("crmf/bad-input", "at least one certificate request message is required (RFC 4211 sec. 3)");
-  return Promise.all(specs.map(function (s) { return _buildCertReqMsg(s, key, opts); })).then(function (msgs) {
+  return _promiseAll(_Promise, specs.map(function (s) { return _buildCertReqMsg(s, key, opts); })).then(function (msgs) {
     var der = b.sequence(msgs);
     if (opts.pem != null) {
       if (typeof opts.pem !== "string" || !opts.pem) throw _err("crmf/bad-input", "opts.pem must be a non-empty PEM label string");
@@ -1137,7 +1262,7 @@ function _verifyOne(msg) {
   };
   function settle(extra) {
     var v = guard.verdict.of(base, extra);
-    return Promise.resolve(guard.verdict.of(v, { valid: v.verified === true }));
+    return _promiseResolve(_Promise, guard.verdict.of(v, { valid: v.verified === true }));
   }
 
   var popo = msg.popo;
@@ -1158,6 +1283,33 @@ function _verifyOne(msg) {
   var preimage = pin ? pin.signedBytes : msg.certReq.certReqBytes;
   var spki = pin ? pin.publicKey : base.publicKey;
   var bound = !pin;
+
+  /** @internal RFC 9883 sec. 5, which states the CRMF conventions: a request carrying a statement of
+   *  possession has "the signature over the poposkInput MUST validate with the public key in the
+   *  signature certificate", so it is signed by the key of the
+   *  certificate the statement names, not by the key being requested, so the proof is checked against
+   *  that key. It therefore proves possession of the SIGNATURE key and not of the requested one, which
+   *  is why `subjectBound` is false here however complete the template is: the requested
+   *  key-establishment key cannot sign, and nothing in this message demonstrates possession of it. What
+   *  the statement buys is a signature the CA can attribute to the same entity, and the remaining
+   *  checks RFC 9883 states are `pki.possession.verifyRequest`'s, over a PKCS#10 request. */
+  var sop = _possessionControlOf(msg.certReq);
+  if (sop !== null) {
+    if (sop.certificate === null) {
+      return settle({ verified: false, method: "signature", cryptographicallyVerified: false,
+        subjectBound: false,
+        reason: "the statementOfPossession control omits its certificate, so the key that signed this request is not in the message (RFC 9883 sec. 3)" });
+    }
+    var sopSpki;
+    try { sopSpki = x509.parse(sop.certificate).subjectPublicKeyInfo.bytes; }
+    catch (_e) {
+      return settle({ verified: false, method: "signature", cryptographicallyVerified: false,
+        subjectBound: false,
+        reason: "the statementOfPossession control's certificate is not readable, so the key that signed this request cannot be recovered" });
+    }
+    spki = sopSpki;
+    bound = false;
+  }
   return crmfVerify.verifyPopSignature(popo, spki, preimage).then(function (ok) {
     return guard.verdict.of(base, {
       valid: ok === true, verified: ok === true, method: "signature", cryptographicallyVerified: ok === true,
@@ -1216,7 +1368,7 @@ function _verifyOne(msg) {
 function verifyPop(messages) { return guard.async.deferred(function () { return _verifyPop(messages); }); }
 function _verifyPop(messages) {
   var parsed = _coerceMessages(messages);
-  return Promise.all(parsed.messages.map(_verifyOne)).then(function (out) {
+  return _promiseAll(_Promise, parsed.messages.map(_verifyOne)).then(function (out) {
     var allVerified = out.length > 0 && out.every(function (m) { return m.verified === true; });
     return guard.verdict.of({ valid: allVerified, verified: allVerified, messages: out });
   });