@blamejs/pki 0.8.31 → 0.8.49

package/lib/revocation-fetch.js

@@ -352,8 +352,8 @@ async function _tryOcsp(state, cert, issuer, ctx, candidate) {
   if (!state.nonce && v.nextUpdate && v.thisUpdate) {
     state.cache.put(key, hit, v.thisUpdate, v.nextUpdate, hit.length);
   }
-  return { status: v.status, reason: "an OCSP response from " + candidate.url,
-    revocationReason: v.revocationReason, revocationTime: v.revocationTime };
+  return guard.verdict.of({ status: v.status, reason: "an OCSP response from " + candidate.url,
+    revocationReason: v.revocationReason, revocationTime: v.revocationTime });
 }
 
 /** @internal The bytes the nonce extension carries, which is what the response echoes. The
@@ -490,14 +490,14 @@ async function _tryCrl(state, cert, issuer, ctx, candidates, certDeltas) {
     var interim = await state.crlChecker(gathered, { useDeltas: state.useDeltas }).check(cert, issuer, ctx);
     if (interim && (interim.status === "good" || interim.status === "revoked")) {
       if (authentic) _keep(state, url, parsed, fetchedBytes, cert.issuer.bytes, issuer.workingPublicKey);
-      return { status: interim.status, reason: "a CRL from " + url,
-        revocationReason: _reasonCodeOf(interim), revocationTime: interim.revocationTime };
+      return guard.verdict.of({ status: interim.status, reason: "a CRL from " + url,
+        revocationReason: _reasonCodeOf(interim), revocationTime: interim.revocationTime });
     }
   }
   if (gathered.length === 0) throw E("path/revocation-fetch-failed", "no CRL was fetched");
   var last = await state.crlChecker(gathered, { useDeltas: state.useDeltas }).check(cert, issuer, ctx);
-  return { status: (last && last.status) || "unknown", reason: (last && last.reason) || "the fetched CRLs did not settle the status",
-    revocationReason: _reasonCodeOf(last), revocationTime: last && last.revocationTime };
+  return guard.verdict.of({ status: (last && last.status) || "unknown", reason: (last && last.reason) || "the fetched CRLs did not settle the status",
+    revocationReason: _reasonCodeOf(last), revocationTime: last && last.revocationTime });
 }
 
 /** @internal `crlChecker` names the CRLReason integer `reasonCode` and `verifyOcspResponse` names it

package/lib/scep.js

@@ -473,7 +473,7 @@ function _buildIssuerAndSerial(spec) {
  *
  * @opts
  *   - `recipientKey` -- `{ cert, key }` for the recipient, to decrypt the pkcsPKIEnvelope into `messageData`.
- *   - `signerCert` -- the expected signer certificate DER (the CA certificate for a CertRep); the message signer's public key must match it, or the message is refused.
+ *   - `signerCert` -- the expected signer certificate DER (the CA certificate for a CertRep); the message signer's public key must match it, or the message is refused. It also decides whether an envelope using RSAES-PKCS1-v1_5 key transport over a content with no integrity tag is read: that combination is refused for a signer this option has not authenticated.
  *   - `expectedSenderNonce` -- a 16-byte Buffer; a message whose `recipientNonce` does not echo it is refused.
  * @example
  *   // requires: pkiMessage -- a SCEP pkiMessage DER (from pki.scep.build, or a CA's response)
@@ -571,7 +571,17 @@ async function parse(bytes, opts) {
   }
   if (recipientKey != null && carriesEnvelope && v.eContent != null) {
     var dec;
-    try { dec = await cmsDecrypt.decrypt(v.eContent, recipientKey); }
+    /** @internal The opt-in is passed only once the signer has been authenticated, which is what the
+     *  premise rests on. `pki.cms.decrypt` refuses RSAES-PKCS1-v1_5 key transport over a content with no
+     *  integrity tag because acceptance tells an attacker submitting chosen ciphertexts that theirs
+     *  decoded. With `opts.signerCert` matched, the envelope arrived inside a signature an authorized
+     *  peer made, and an attacker who cannot sign as that peer cannot submit one. Without it the
+     *  signature is any signer's, this verb reports `signerAuthenticated: false`, and the caller
+     *  authenticates the surfaced certificate after the decrypt has already produced its outcome, so the
+     *  refusal stands. RFC 8894 sec. 3.1 puts the envelope there, and v1.5 over a CBC content is what
+     *  deployed SCEP peers send, so an authenticated exchange still reads them. */
+    var decOpts = signerAuthenticated ? { allowUnauthenticatedRsa15: true } : {};
+    try { dec = await cmsDecrypt.decrypt(v.eContent, recipientKey, decOpts); }
     catch (e) {
       if (e && e.isPkiError) throw _err("scep/decrypt-failed", "the pkcsPKIEnvelope could not be decrypted with the recipient key: " + e.message, e);
       throw e;
@@ -606,7 +616,7 @@ async function parse(bytes, opts) {
       if (isnCh[1].content.length > 20) throw _err("scep/bad-request-payload", "a " + messageType + " messageData serialNumber must not exceed 20 octets (RFC 5280 sec. 4.1.2.2)");
     }
   }
-  return out;
+  return guard.verdict.shield(out);
 }
 var _PARSE_KEYS = Object.assign(Object.create(null), { recipientKey: 1, expectedSenderNonce: 1, signerCert: 1 });
 
@@ -1006,7 +1016,7 @@ function _dispatchCertRep(rep, transactionId, spki) {
   if (findIssuedCert(repCerts.filter(function (c) { return c !== issued; }), spki.bytes) != null) {
     throw _err("scep/ambiguous-issued-cert", "the SUCCESS CertRep carried more than one certificate matching the request public key; the issued certificate is ambiguous (RFC 8894 sec. 3.3)");
   }
-  return { pending: false, result: { status: "SUCCESS", certificate: issued, certificates: repCerts, transactionId: rep.transactionId } };
+  return guard.verdict.of({ pending: false, result: guard.verdict.of({ status: "SUCCESS", certificate: issued, certificates: repCerts, transactionId: rep.transactionId }) });
 }
 
 function _pollExhausted(which, transactionId, senderNonce) {
@@ -1089,7 +1099,7 @@ async function _pkiOperation(messageType, baseUrl, opts, verbName) {
   var rep = await parse(body, { signerCert: signerCert, expectedSenderNonce: senderNonce, recipientKey: recipientKey });
   var d = _dispatchCertRep(rep, transactionId, spki);
   if (!d.pending) return d.result;
-  if (pollCount <= 0) return { status: "PENDING", transactionId: rep.transactionId, senderNonce: senderNonce };
+  if (pollCount <= 0) return guard.verdict.of({ status: "PENDING", transactionId: rep.transactionId, senderNonce: senderNonce });
   return _pollForIssuance({
     firstResponse: res, firstSenderNonce: senderNonce, postUrl: postUrl, httpMethod: httpMethod, clientOpts: clientOpts,
     caCert: caCert, csrSubject: csrSubject, issuerCert: issuerCert, signer: signer, signerCert: signerCert, recipientKey: recipientKey,

package/lib/schema-c509.js

@@ -1282,7 +1282,7 @@ function _requireStrictDerTlv(content, code, label) {
 
 function _derSetInDeclaredOrder(vals) {
   for (var i = 1; i < vals.length; i++) {
-    if (Buffer.compare(vals[i - 1], vals[i]) > 0) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes attributeValue list must be in DER ascending order (X.690 sec. 11.6)");
+    if (guard.bytes.compare(vals[i - 1], vals[i]) > 0) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes attributeValue list must be in DER ascending order (X.690 sec. 11.6)");
   }
   return b.set(vals);
 }
@@ -2033,7 +2033,10 @@ function encode(input, opts) {
   var origDer = pkix.coerceToDer(input, { pemLabel: "CERTIFICATE", PemError: frameworkError.PemError, ErrorClass: C509Error, prefix: "c509" });
   var encoded = _encodeC509Array(_derToType3(origDer, opts));
   var recon = parse(encoded).reconstructedDer;
-  if (!recon || Buffer.compare(recon, origDer) !== 0) throw _err("c509/non-invertible", "the type-3 C509 does not reconstruct the source certificate byte-for-byte");
+  /** @internal Through the captured comparator: this IS the byte-for-byte claim a type-3 C509 makes
+   *  about the certificate it re-encodes, so a replacement answering zero asserts it over bytes that
+   *  do not match. */
+  if (!recon || guard.bytes.compare(recon, origDer) !== 0) throw _err("c509/non-invertible", "the type-3 C509 does not reconstruct the source certificate byte-for-byte");
   return encoded;
 }
 

package/lib/schema-cmc.js

@@ -245,7 +245,7 @@ function parseStatusInfo(valueDer, version, bodyPartID, ctx) {
     extendedFailInfo: other ? other.extendedFailInfo : null,
   };
   _assertStatusCoherent(out);
-  return out;
+  return guard.verdict.shield(out);
 }
 
 function _assertStatusCoherent(s) {

package/lib/schema-cmp.js

@@ -231,11 +231,11 @@ var PKI_STATUS_INFO = schema.seq([
 ], {
   assert: "sequence", code: "cmp/bad-status-info", what: "PKIStatusInfo",
   build: function (m) {
-    return {
+    return guard.verdict.of({
       status: m.fields.status.value,
       statusString: m.fields.statusString.present ? m.fields.statusString.value.result : null,
       failInfo: m.fields.failInfo.present ? m.fields.failInfo.value : null,
-    };
+    });
   },
 });
 
@@ -329,11 +329,11 @@ var REV_REP_CONTENT = schema.seq([
 ], {
   assert: "sequence", code: "cmp/bad-rev-rep", what: "RevRepContent",
   build: function (m) {
-    return {
+    return guard.verdict.of({
       status: m.fields.status.value.result,
       revCerts: m.fields.revCerts.present ? m.fields.revCerts.value.result : null,
       crls: m.fields.crls.present ? m.fields.crls.value.result : null,
-    };
+    });
   },
 });
 
@@ -411,12 +411,12 @@ var CERT_RESPONSE = schema.seq([
       throw ctx.E("cmp/bad-cert-response",
         "a CertResponse certifiedKeyPair is allowed only under a granting status (accepted or grantedWithMods) (RFC 9810 sec. 5.3.4)");
     }
-    return {
+    return guard.verdict.of({
       certReqId: m.fields.certReqId.value,
       status: status,
       certifiedKeyPair: certifiedKeyPair,
       rspInfo: m.fields.rspInfo.present ? m.fields.rspInfo.value : null,
-    };
+    });
   },
 });
 
@@ -455,12 +455,12 @@ var KEY_REC_REP_CONTENT = schema.seq([
 ], {
   assert: "sequence", code: "cmp/bad-key-rec-rep", what: "KeyRecRepContent",
   build: function (m) {
-    return {
+    return guard.verdict.of({
       status: m.fields.status.value.result,
       newSigCert: m.fields.newSigCert.present ? m.fields.newSigCert.value : null,
       caCerts: m.fields.caCerts.present ? m.fields.caCerts.value.result : null,
       keyPairHist: m.fields.keyPairHist.present ? m.fields.keyPairHist.value.result : null,
-    };
+    });
   },
 });
 

package/lib/schema-cms.js

@@ -60,7 +60,6 @@ var NS = pkix.makeNS("cms", CmsError, oid);
 
 var ALGORITHM_IDENTIFIER = pkix.algorithmIdentifier(NS);
 var ATTRIBUTE = pkix.attribute(NS);
-var NAME = pkix.name(NS);
 
 var SIGNED_DATA_VERSION = pkix.versionReader(NS, { "1": 1, "3": 3, "4": 4, "5": 5 });
 var SIGNER_VERSION = pkix.versionReader(NS, { "1": 1, "3": 3 });
@@ -179,7 +178,7 @@ function _readsAsTime(vals) {
 
 function _ascendingDer(nodes) {
   for (var i = 1; i < nodes.length; i++) {
-    if (Buffer.compare(nodes[i - 1].bytes, nodes[i].bytes) > 0) return false;
+    if (guard.bytes.compare(nodes[i - 1].bytes, nodes[i].bytes) > 0) return false;
   }
   return true;
 }
@@ -330,19 +329,7 @@ var ENCAP_CONTENT_INFO = schema.seq([
   },
 });
 
-var ISSUER_AND_SERIAL = schema.seq([
-  schema.field("issuer", NAME),
-  schema.field("serialNumber", schema.integerLeaf()),
-], {
-  assert: "sequence", arity: { exact: 2 }, code: "cms/bad-issuer-and-serial", what: "IssuerAndSerialNumber",
-  build: function (m) {
-    return {
-      issuer: m.fields.issuer.value.result,
-      serialNumber: m.fields.serialNumber.value,
-      serialNumberHex: m.fields.serialNumber.node.content.toString("hex"),
-    };
-  },
-});
+var ISSUER_AND_SERIAL = pkix.issuerAndSerialNumber(NS, { code: "cms/bad-issuer-and-serial" });
 
 var SIGNER_IDENTIFIER = schema.choice([
   { when: { tagClass: "universal", tagNumber: asn1.TAGS.SEQUENCE }, schema: ISSUER_AND_SERIAL },

package/lib/schema-csr.js

@@ -35,6 +35,7 @@ var pkix = require("./schema-pkix");
 var oid = require("./oid");
 var frameworkError = require("./framework-error");
 var intrinsic = require("./guard-intrinsic");
+var constants = require("./constants");
 
 var CsrError = frameworkError.CsrError;
 var PemError = frameworkError.PemError;
@@ -73,6 +74,74 @@ RECOGNIZED_ATTRIBUTE_VALUE[oid.byName("challengePassword")] = function (node, ct
   }
 };
 
+/** @internal RequesterCertificate ::= SEQUENCE { certID IssuerAndSerialNumber, requestTime BinaryTime,
+ *  locationInfo UniformResourceIdentifiers, signature BIT STRING } (RFC 9763 sec. 3.1), where
+ *  UniformResourceIdentifiers ::= SEQUENCE SIZE (1..MAX) OF URI and URI ::= IA5String. locationInfo is
+ *  a SEQUENCE OF rather than one URI, and it is the one field the signature does not cover. */
+var REQUESTER_CERTIFICATE = schema.seq([
+  schema.field("certID", pkix.issuerAndSerialNumber(NS, { code: "csr/bad-attribute-value" })),
+  schema.field("requestTime", schema.integerLeaf()),
+  /** @internal A SEQUENCE OF, so the DER SET-OF ordering rule does not apply and the URIs keep the
+   *  order the requester wrote them in. */
+  schema.field("locationInfo", schema.seqOf(schema.decode(function (n, ctx) {
+    if (n.tagClass !== "universal" || n.tagNumber !== asn1.TAGS.IA5_STRING) {
+      throw ctx.E("csr/bad-attribute-value", "a RequesterCertificate locationInfo entry must be an IA5String URI (RFC 9763 sec. 3.1)");
+    }
+    return asn1.read.string(n);
+  }), { assert: "sequence", min: 1, max: constants.LIMITS.ATTRIBUTE_MAX_VALUES,
+    code: "csr/bad-attribute-value", what: "RequesterCertificate locationInfo" })),
+  schema.field("signature", schema.bitString()),
+], {
+  assert: "sequence", arity: { exact: 4 }, code: "csr/bad-attribute-value", what: "RequesterCertificate",
+  build: function (m, ctx) {
+    var t = m.fields.requestTime.value;
+    if (t < 0n) throw ctx.E("csr/bad-attribute-value", "a RequesterCertificate requestTime must not be negative (BinaryTime is INTEGER (0..MAX), RFC 6019 sec. 2)");
+    var bits = m.fields.signature.value;
+    if (bits.unusedBits !== 0) throw ctx.E("csr/bad-attribute-value", "a RequesterCertificate signature BIT STRING must be octet-aligned");
+    if (bits.bytes.length === 0) throw ctx.E("csr/bad-attribute-value", "a RequesterCertificate signature must not be empty");
+    return {
+      certID: m.fields.certID.value.result,
+      requestTime: t,
+      locationInfo: intrinsic.map(m.fields.locationInfo.value.items, function (it) { return it.value; }),
+      signature: { unusedBits: bits.unusedBits, bytes: bits.bytes },
+    };
+  },
+});
+/** @internal PrivateKeyPossessionStatement ::= SEQUENCE { signer IssuerAndSerialNumber,
+ *  cert Certificate OPTIONAL } (RFC 9883 sec. 3). The signer is the shared IssuerAndSerialNumber; the
+ *  certificate is surfaced as raw DER, because it is a whole Certificate a caller parses and verifies
+ *  rather than a field read here. */
+var POSSESSION_STATEMENT = schema.seq([
+  schema.field("signer", pkix.issuerAndSerialNumber(NS, { code: "csr/bad-attribute-value" })),
+  schema.optional("certificate", schema.any(), { whenUniversal: [asn1.TAGS.SEQUENCE] }),
+], {
+  assert: "sequence", arity: { min: 1, max: 2 },
+  code: "csr/bad-attribute-value", what: "PrivateKeyPossessionStatement",
+  build: function (m) {
+    return {
+      signer: m.fields.signer.value.result,
+      certificate: m.fields.certificate.present ? m.fields.certificate.node.bytes : null,
+    };
+  },
+});
+RECOGNIZED_ATTRIBUTE_VALUE[oid.byName("statementOfPossession")] = function (node, ctx) {
+  try { return { privateKeyPossessionStatement: schema.walk(POSSESSION_STATEMENT, node, ctx).result }; }
+  catch (e) {
+    if (e instanceof CsrError) throw e;
+    throw ctx.E("csr/bad-attribute-value",
+      "statementOfPossession value must be a well-formed PrivateKeyPossessionStatement SEQUENCE (RFC 9883 sec. 3): " + ((e && e.message) || intrinsic.String(e)), e);
+  }
+};
+
+RECOGNIZED_ATTRIBUTE_VALUE[oid.byName("relatedCertRequest")] = function (node, ctx) {
+  try { return { relatedCertRequest: schema.walk(REQUESTER_CERTIFICATE, node, ctx).result }; }
+  catch (e) {
+    if (e instanceof CsrError) throw e;
+    throw ctx.E("csr/bad-attribute-value",
+      "relatedCertRequest value must be a well-formed RequesterCertificate SEQUENCE (RFC 9763 sec. 3.1): " + ((e && e.message) || intrinsic.String(e)), e);
+  }
+};
+
 var CERTIFICATION_REQUEST_INFO = schema.seq([
   schema.field("version", CSR_VERSION),
   schema.field("subject", NAME),

package/lib/schema-engine.js

@@ -28,6 +28,10 @@
 
 var asn1 = require("./asn1-der.js");
 var intrinsic = require("./guard-intrinsic");
+/** @internal Just the list guard, not the whole family: this module sits below the format layer and
+ *  takes the one primitive it needs. The copy-and-sort it provides reads `length` once and orders
+ *  through operations captured at load, which is what a DER SET ordering rests on. */
+var guardList = require("./guard-list");
 
 var TAGS = asn1.TAGS;
 
@@ -310,7 +314,7 @@ function _walkRepeat(schema, node, ctx) {
   }
   if (schema.derSetOrder) {
     for (var s = 1; s < kids.length; s++) {
-      if (Buffer.compare(kids[s - 1].bytes, kids[s].bytes) > 0) {
+      if (intrinsic.compare(kids[s - 1].bytes, kids[s].bytes) > 0) {
         _fail(ctx, schema.code, (schema.what || "value") + " components must be in ascending DER order (X.690 sec. 11.6)");
       }
     }
@@ -474,7 +478,7 @@ function _encodeSeq(schema, value, ctx) {
         if (!isDefault) parts.push(fld.explicit ? asn1.build.explicit(fld.tag, enc) : enc);
       }
     } else if (fld.fkind === "trailing") {
-      var members = fld.members.slice().sort(function (a, b) { return a.tag - b.tag; });
+      var members = guardList.sortedCopy(fld.members, function (a, b) { return a.tag - b.tag; });
       for (var i = 0; i < members.length; i++) {
         var mm = members[i];
         if (_present(value[mm.name])) {
@@ -509,7 +513,10 @@ function _encodeRepeat(schema, items, ctx) {
       seen.add(key);
     });
   }
-  if (schema.derSetOrder) parts = parts.slice().sort(Buffer.compare);
+  /** @internal The comparator goes through the captured operation, as the copy and the sort do. This
+   *  is the engine's own SET OF emission, so whatever decides "before" decides the bytes every schema
+   *  built on it emits. */
+  if (schema.derSetOrder) parts = guardList.sortedCopy(parts, intrinsic.compare);
   if (schema.implicitTag != null) return asn1.build.contextConstructed(schema.implicitTag, Buffer.concat(parts));
   return schema.assert === "set" ? asn1.build.set(parts) : asn1.build.sequence(parts);
 }

package/lib/schema-pkix.js

@@ -741,6 +741,68 @@ function algorithmIdentifier(ns, opts) {
   });
 }
 
+/** @internal IssuerAndSerialNumber ::= SEQUENCE { issuer Name, serialNumber CertificateSerialNumber }
+ *  (RFC 5652 sec. 10.2.4). CMS names the type and RFC 9763 sec. 3.1 reuses it inside a CSR attribute,
+ *  so the shape is defined once and each caller supplies its own code and name for the refusal. */
+function issuerAndSerialNumber(ns, opts) {
+  opts = opts || {};
+  return schema.seq([
+    schema.field("issuer", name(ns)),
+    schema.field("serialNumber", schema.integerLeaf()),
+  ], {
+    assert: "sequence", arity: { exact: 2 },
+    code: opts.code || (ns.prefix + "/bad-issuer-and-serial"), what: opts.what || "IssuerAndSerialNumber",
+    build: function (m) {
+      return {
+        issuer: m.fields.issuer.value.result,
+        serialNumber: m.fields.serialNumber.value,
+        serialNumberHex: _bufToString(m.fields.serialNumber.node.content, "hex"),
+      };
+    },
+  });
+}
+
+/** @internal The digest a signature algorithm OID names, where it names one. RFC 9763 sec. 4.1 reads
+ *  this relation directly ("a hash algorithm explicitly indicated by the related certificate's
+ *  signature OID"), and an algorithm whose OID fixes no digest, such as Ed25519 or ML-DSA, is absent
+ *  rather than mapped to a default. The value is the registry name, so a caller that needs its own
+ *  spelling maps from one table instead of carrying a second copy of the relation. */
+var SIG_OID_DIGEST_ROWS = [
+  ["sha1WithRSAEncryption", "sha1"], ["sha256WithRSAEncryption", "sha256"],
+  ["sha384WithRSAEncryption", "sha384"], ["sha512WithRSAEncryption", "sha512"],
+  ["ecdsaWithSHA1", "sha1"], ["ecdsaWithSHA256", "sha256"],
+  ["ecdsaWithSHA384", "sha384"], ["ecdsaWithSHA512", "sha512"],
+  ["sha1", "sha1"], ["sha256", "sha256"], ["sha384", "sha384"], ["sha512", "sha512"],
+  ["sha3-256", "sha3-256"], ["sha3-512", "sha3-512"],
+  ["id-RSASSA-PSS-SHAKE128", "shake128"], ["id-RSASSA-PSS-SHAKE256", "shake256"],
+];
+/** @internal The digest output length in octets, for the readers that hold a hash value to the length
+ *  of the algorithm named beside it. A SHAKE is absent: its output length is a parameter of the use,
+ *  not of the algorithm, so there is no single length to hold a value to. */
+var DIGEST_LENGTH_ROWS = [
+  ["sha1", 20], ["sha256", 32], ["sha384", 48], ["sha512", 64],
+  ["sha3-256", 32], ["sha3-512", 64],
+];
+function digestLengths() {
+  var out = _create(null);
+  _forEach(DIGEST_LENGTH_ROWS, function (r) { out[r[0]] = r[1]; });
+  return out;
+}
+var DIGEST_LENGTHS = digestLengths();
+/** @internal Keyed by dotted OID through the registry the caller passes, this module taking its
+ *  registry as a parameter rather than requiring it. A row whose name the registry does not carry
+ *  throws rather than being skipped: a skipped row is a digest the readers silently stop deriving,
+ *  which reads as "this certificate names no hash" on a certificate that names one. */
+function signatureDigestNames(oidRegistry) {
+  var out = _create(null);
+  _forEach(SIG_OID_DIGEST_ROWS, function (r) {
+    var dotted = oidRegistry.byName(r[0]);
+    if (!dotted) throw new Error("schema-pkix: the signature-digest table names " + r[0] + ", which the OID registry does not carry");
+    out[dotted] = r[1];
+  });
+  return out;
+}
+
 function pbkdf2Params(ns) {
   return schema.seq([
     schema.field("salt", schema.octetString()),
@@ -1386,7 +1448,12 @@ function crlExtensionDecoders(ns) {
   var doorScope = _create(null);
   doorScope.crl = _assign(_create(null), byScope.crl);
   doorScope.entry = _assign(_create(null), byScope.entry);
-  _forEach(["authorityKeyIdentifier", "issuerAltName", "authorityInfoAccess", "freshestCRL"], function (n) {
+  /** @internal ITU-T X.509 (2019) clause 9.8 states altSignatureAlgorithm and altSignatureValue as CRL
+   * extensions as well as certificate ones, and clause 7.10.3 gives the CRL the same procedure, so the
+   * two share one decoder with the certificate scope. subjectAltPublicKeyInfo is absent: the NOTE in
+   * clause 7.2.2 says it "is only used as a public-key certificate extension". */
+  _forEach(["authorityKeyIdentifier", "issuerAltName", "authorityInfoAccess", "freshestCRL",
+    "altSignatureAlgorithm", "altSignatureValue"], function (n) {
     doorScope.crl[O(n)] = scopedCertDecoder(ns, n);
   });
   doorScope.entry[O("certificateIssuer")] = _generalNamesDecoder(ns);
@@ -1707,10 +1774,93 @@ function _acceptExtensionRecord(ext, E, code, key) {
   record.oid = checked.oid;
   record.name = typeof checked.name === "string" ? checked.name : null;
   record.critical = checked.critical === true;
-  record.value = guard.bytes.snapshot(checked.value, E, code, "the extension value");
+  /** @internal Normalized to a byte view before it is copied. The check above admits what
+   *  `guard.bytes.isByteSource` admits, which includes a DataView and an ArrayBuffer, and
+   *  `guard.bytes.snapshot` takes neither: a value this verb had just called acceptable was then refused
+   *  for being the wrong kind of container, so the two messages contradicted each other about one value.
+   *  `snapshotSource` views and copies in one call, and the view shares the caller's store rather than
+   *  copying it, so the copy is still the only allocation. */
+  record.value = guard.bytes.snapshotSource(checked.value, E, code, "the extension value");
   return record;
 }
 
+/** @internal Whether a parsed certificate's keyUsage permits a named set of purposes, as one definition
+ *  three verifiers share. RFC 5280 sec. 4.2.1.3 confines a key to the purposes a present keyUsage asserts,
+ *  so a verifier checking a signature under a certificate's key owes this check: a certificate confined to
+ *  `keyAgreement` does not authorize a signature. Absent keyUsage is unconfined and permits; a keyUsage that
+ *  does not DECODE denies rather than permits, since an extension nothing could read has not been satisfied.
+ *  `allowed` is the set each caller's own specification names, which is the only thing that differs between
+ *  them: RFC 9483 sec. 3.2 requires `digitalSignature` alone, while a signature over content is also
+ *  authorized by `contentCommitment` or `nonRepudiation`. */
+function keyUsagePermits(ns, allowed) {
+  var kuOid = ns.oid.byName("keyUsage");
+  var decoders = certExtensionDecoders(ns).byOid;
+  return function (parsedCert) {
+    var exts = (parsedCert && parsedCert.extensions) || [];
+    for (var i = 0; i < exts.length; i++) {
+      if (exts[i].oid !== kuOid) continue;
+      var ku;
+      try { ku = decoders[kuOid](exts[i].value); }
+      catch (e) { void e; return false; }
+      for (var a = 0; a < allowed.length; a++) if (ku[allowed[a]] === true) return true;
+      return false;
+    }
+    return true;
+  };
+}
+
+/** @internal The subject-key algorithms that can only ever SIGN, as one table the linter and the verifier
+ *  share. RFC 9883 sec. 6 states "The privateKeyPossessionStatement attribute MUST NOT be used to obtain a
+ *  signature certificate", and sec. 4 states the same requirement as a property of the request: "the
+ *  subjectPKInfo MUST contain the public key for the key establishment algorithm". The mechanism exists
+ *  because a key-establishment key cannot sign and so cannot prove possession the PKCS#10 way. A key that
+ *  can only sign has no such problem, so a request to certify one through that attribute asks for the
+ *  certificate those sentences forbid, whether or not the request names a key usage. Read off the requested
+ *  usages alone, the rule missed every request that omitted the keyUsage extension; read off this table
+ *  too, the two doors that apply it reach the same verdict on the same request.
+ *
+ *  Only the signature-ONLY families are here. RSA and EC can do either, so an RSA or EC subject key says
+ *  nothing on its own and is left to the usages a request asks for. `rsassaPss` IS here and
+ *  `rsaEncryption` is NOT, which is the distinction the rule turns on: a bare RSA key can do key
+ *  transport, while an id-RSASSA-PSS SPKI is restricted to signing and can no more establish a key than
+ *  an EdDSA one. `dsa` and the stateful hash-based algorithms sign by construction. */
+var SIGNATURE_ONLY_KEY_NAMES = [
+  "Ed25519", "Ed448", "rsassaPss", "dsa",
+  "id-alg-hss-lms-hashsig", "id-alg-xmss-hashsig", "id-alg-xmssmt-hashsig",
+];
+/** @internal The families, matched by the prefix the registry files them under rather than listed one at a
+ *  time: three ML-DSA sets, twelve SLH-DSA sets and eighteen composite ML-DSA arms, all of which sign and
+ *  none of which establishes a key. Taking them by family means a set the registry gains later belongs to
+ *  this rule without a second edit, which is what kept RSASSA-PSS out of an earlier hand-written list. */
+var SIGNATURE_ONLY_KEY_PREFIXES = ["id-ml-dsa-", "id-slh-dsa-", "id-MLDSA"];
+
+var _signatureOnlyByNs = new _WeakMapI();
+
+/** @internal Whether a dotted subject-key algorithm OID names a signature-only family. Built once per
+ *  OID registry and memoized on it, since the registry is enumerated to pick the families up by prefix. */
+function signatureOnlyKeyOid(ns) {
+  var table = _weakGet(_signatureOnlyByNs, ns.oid);
+  if (table === undefined) {
+    table = _assign(_create(null), {});
+    _forEach(SIGNATURE_ONLY_KEY_NAMES, function (n) {
+      var dotted = ns.oid.byName(n);
+      if (dotted !== undefined && dotted !== null) table[dotted] = n;
+    });
+    var registry = ns.oid.all();
+    _forEach(intrinsic.keys(registry), function (dotted) {
+      var n = registry[dotted];
+      if (typeof n !== "string") return;
+      _forEach(SIGNATURE_ONLY_KEY_PREFIXES, function (p) {
+        if (_strIndexOf(n, p) === 0) table[dotted] = n;
+      });
+    });
+    _weakSet(_signatureOnlyByNs, ns.oid, table);
+  }
+  return function (dotted) {
+    return typeof dotted === "string" && _hasOwn(table, dotted);
+  };
+}
+
 function certExtensionDecoders(ns) {
   var GN_SUBTREE = generalName(ns, { decodeValue: true, subtreeBase: true, code: ns.prefix + "/bad-name-constraints" });
   var _h = _decodeHelpers(ns), decodeTop = _h.decodeTop, seqChildren = _h.seqChildren, readInt = _h.readInt, O = _h.O;
@@ -1913,6 +2063,67 @@ function certExtensionDecoders(ns) {
     return null;
   }
 
+  /** @internal RelatedCertificate ::= SEQUENCE { hashAlgorithm DigestAlgorithmIdentifier,
+   *  hashValue OCTET STRING } (RFC 9763 sec. 4.1), the digest of "the entire related certificate".
+   *  The value is held to the length of the algorithm it names, since a hash of the wrong length for
+   *  its own algorithm identifies no certificate and would otherwise be carried forward as an
+   *  identity to compare against. */
+  function relatedCertificate(buf) {
+    var C = ns.prefix + "/bad-extension-value";
+    var kids = seqChildren(buf, C, "RelatedCertificate");
+    if (kids.length !== 2) throw ns.E(C, "RelatedCertificate must be a SEQUENCE { hashAlgorithm, hashValue } (RFC 9763 sec. 4.1)");
+    var alg;
+    try { alg = schema.walk(algorithmIdentifier(ns), kids[0], ns).result; }
+    catch (e) { throw ns.E(C, "RelatedCertificate hashAlgorithm must be a DigestAlgorithmIdentifier (RFC 9763 sec. 4.1)", e); }
+    var value;
+    try { value = _bufferFrom(asn1.read.octetString(kids[1])); }
+    catch (e) { throw ns.E(C, "RelatedCertificate hashValue must be an OCTET STRING (RFC 9763 sec. 4.1)", e); }
+    if (value.length === 0) throw ns.E(C, "RelatedCertificate hashValue must not be empty (RFC 9763 sec. 4.1)");
+    var want = DIGEST_LENGTHS[alg.name];
+    if (want !== undefined && value.length !== want) {
+      throw ns.E(C, "RelatedCertificate hashValue is " + value.length + " octets, and " + alg.name + " produces " + want);
+    }
+    return { hashAlgorithm: alg.name, hashAlgorithmOid: alg.oid, hashValue: value };
+  }
+
+  /** @internal SubjectAltPublicKeyInfo ::= SEQUENCE { algorithm AlgorithmIdentifier,
+   *  subjectAltPublicKey BIT STRING } (ITU-T X.509 (2019) clause 9.8.2). Those are the two components
+   *  SubjectPublicKeyInfo has, in that order, and a field name is not encoded, so the two types share
+   *  one encoding and this reads through the shared SPKI sub-schema. The whole value is surfaced as
+   *  `bytes` because it IS an SPKI on the wire: an importer takes it unchanged. */
+  function subjectAltPublicKeyInfo(buf) {
+    var C = ns.prefix + "/bad-extension-value";
+    var n = decodeTop(buf, C, "SubjectAltPublicKeyInfo");
+    var v;
+    try { v = schema.walk(spki(ns), n, ns).result; }
+    catch (e) { throw ns.E(C, "SubjectAltPublicKeyInfo must be a SEQUENCE { algorithm, subjectAltPublicKey BIT STRING } (ITU-T X.509 (2019) clause 9.8.2)", e); }
+    if (v.publicKey.unusedBits !== 0) throw ns.E(C, "the subjectAltPublicKey BIT STRING must hold whole octets");
+    if (v.publicKey.bytes.length === 0) throw ns.E(C, "the subjectAltPublicKey must not be empty");
+    return { algorithm: v.algorithm, subjectAltPublicKey: v.publicKey.bytes, bytes: v.bytes };
+  }
+
+  /** @internal AltSignatureAlgorithm ::= AlgorithmIdentifier (clause 9.8.3). The extension value is the
+   *  AlgorithmIdentifier itself, not a SEQUENCE wrapping one. */
+  function altSignatureAlgorithm(buf) {
+    var C = ns.prefix + "/bad-extension-value";
+    var n = decodeTop(buf, C, "AltSignatureAlgorithm");
+    try { return schema.walk(algorithmIdentifier(ns), n, ns).result; }
+    catch (e) { throw ns.E(C, "AltSignatureAlgorithm must be an AlgorithmIdentifier (ITU-T X.509 (2019) clause 9.8.3)", e); }
+  }
+
+  /** @internal AltSignatureValue ::= BIT STRING (clause 9.8.4). Held to whole octets, a signature being
+   *  an octet string of bits and every algorithm here producing one. */
+  function altSignatureValue(buf) {
+    var C = ns.prefix + "/bad-extension-value";
+    var n = decodeTop(buf, C, "AltSignatureValue");
+    var bs;
+    try { bs = asn1.read.bitString(n); }
+    catch (e) { throw ns.E(C, "AltSignatureValue must be a BIT STRING (ITU-T X.509 (2019) clause 9.8.4)", e); }
+    if (bs.unusedBits !== 0) throw ns.E(C, "the AltSignatureValue BIT STRING must hold whole octets");
+    if (bs.bytes.length === 0) throw ns.E(C, "the AltSignatureValue must not be empty");
+    return { unusedBits: bs.unusedBits, bytes: _bufferFrom(bs.bytes) };
+  }
+
   function extKeyUsage(buf) {
     var C = ns.prefix + "/bad-extension-value";
     var kids = seqChildren(buf, C, "ExtKeyUsage");
@@ -2270,6 +2481,10 @@ function certExtensionDecoders(ns) {
   byOid[O("subjectInfoAccess")] = subjectInfoAccess;
   byOid[O("subjectDirectoryAttributes")] = subjectDirectoryAttributes;
   byOid[O("ocspNoCheck")] = ocspNoCheck;
+  byOid[O("relatedCertificate")] = relatedCertificate;
+  byOid[O("subjectAltPublicKeyInfo")] = subjectAltPublicKeyInfo;
+  byOid[O("altSignatureAlgorithm")] = altSignatureAlgorithm;
+  byOid[O("altSignatureValue")] = altSignatureValue;
   byOid[O("msCertificateTemplate")] = msCertificateTemplate;
   byOid[O("msEnrollCertType")] = msEnrollCertType;
   byOid[O("msCaVersion")] = msCaVersion;
@@ -2377,6 +2592,12 @@ function signedEnvelope(ns, tbsSchema, opts) {
     schema.field("signatureAlgorithm", algorithmIdentifier(ns)),
     schema.field("signatureValue", schema.bitString()),
   ], {
+    /** @internal Exactly three, with no trailing element. X.509 (2019) extended the SIGNED
+     *  parameterized type with optional `altAlgorithmIdentifier` and `altSignature` components after
+     *  the signature, and then forbade them for every structure it profiles: "only one digital
+     *  signature shall be generated, i.e., the altAlgorithmIdentifier and the altSignature components
+     *  shall be absent" (clauses 7.2.1, 7.10.2, 11.3 and 14.2). Declaring either as an optional field
+     *  here would admit a second signature the text excludes, in every format that composes this. */
     assert: "sequence", arity: { exact: 3 }, code: opts.code, what: opts.what,
     build: function (m, ctx) {
       var tbsMatch = m.fields.toBeSigned.value;
@@ -2452,6 +2673,9 @@ module.exports = {
   DN_SHORT: DN_SHORT,
   time: time,
   algorithmIdentifier: algorithmIdentifier,
+  issuerAndSerialNumber: issuerAndSerialNumber,
+  digestLengths: digestLengths,
+  signatureDigestNames: signatureDigestNames,
   pbkdf2Params: pbkdf2Params,
   pbmac1Params: pbmac1Params,
   spki: spki,
@@ -2484,6 +2708,8 @@ module.exports = {
   crlFixedCriticality: crlFixedCriticality,
   crlEntryFixedCriticality: crlEntryFixedCriticality,
   certExtensionDecoders: certExtensionDecoders,
+  keyUsagePermits: keyUsagePermits,
+  signatureOnlyKeyOid: signatureOnlyKeyOid,
   scopedCertDecoder: scopedCertDecoder,
   crlExtensionDecoders: crlExtensionDecoders,
   decodeExtensionList: decodeExtensionList,