@blamejs/pki 0.8.31 → 0.8.49

package/lib/attrcert-sign.js

@@ -24,6 +24,12 @@ var x509 = require("./schema-x509");
 var signScheme = require("./sign-scheme");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+/** @internal The promise a signature verdict is awaited through, built from the constructor captured at
+ *  load. `Promise.resolve` builds from its RECEIVER, so reading the global binding at the call hands the
+ *  construction to whatever that binding holds: one settling without awaiting its argument drops the
+ *  self-check's rejection, and one settling truthy answers the verdict the caller reads. */
+var _Promise = intrinsic.Promise;
+var _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
 var _hasOwn = intrinsic.hasOwn, _bufferEquals = intrinsic.bufferEquals;
 var pkix = require("./schema-pkix");
 var schema = require("./schema-engine");
@@ -257,7 +263,7 @@ function _encodeClearance(cl) {
   try { parts = [b.oid(O(cl.policyId) || cl.policyId)]; } catch (e) { throw _err("attrcert/bad-input", "clearance.policyId is not a valid object identifier", e); }
   if (cl.classList != null) {
     if (!Array.isArray(cl.classList)) throw _err("attrcert/bad-input", "clearance.classList must be an array of class names");
-    var positions = cl.classList.map(function (n) {
+    var positions = guard.list.copyMap(cl.classList, function (n) {
       var pos = CLASSLIST_BIT[guard.text.keyOf(n)];
       if (pos == null) throw _err("attrcert/bad-input", "unknown clearance class " + guard.text.showValue(n));
       return pos;
@@ -267,7 +273,7 @@ function _encodeClearance(cl) {
   }
   if (cl.securityCategories != null) {
     if (!Array.isArray(cl.securityCategories) || !cl.securityCategories.length) throw _err("attrcert/bad-input", "clearance.securityCategories must be a non-empty array");
-    parts.push(b.set(cl.securityCategories.map(_encodeSecurityCategory)));
+    parts.push(b.set(guard.list.copyMap(cl.securityCategories, _encodeSecurityCategory)));
   }
   return b.sequence(parts);
 }
@@ -286,7 +292,7 @@ function _encodeIetfAttrSyntax(ia) {
   if (!Array.isArray(ia.values) || !ia.values.length) throw _err("attrcert/bad-input", "an IetfAttrSyntax attribute must be an object with a non-empty values array");
   var parts = [];
   if (ia.policyAuthority != null) parts.push(_b.encodeGeneralNames(_gnList(ia.policyAuthority), 0));
-  parts.push(b.sequence(ia.values.map(function (v) {
+  parts.push(b.sequence(guard.list.copyMap(ia.values, function (v) {
     if (v == null || typeof v !== "object") throw _err("attrcert/bad-input", "each IetfAttrSyntax value must be { octets }, { oid }, or { string }");
     _assertFields(v, KNOWN_IETF_ATTR_VALUE_KEYS, "IetfAttrSyntax value");
     if (v.octets != null) { if (!Buffer.isBuffer(v.octets)) throw _err("attrcert/bad-input", "IetfAttrSyntax octets must be a Buffer"); return b.octetString(v.octets); }
@@ -328,11 +334,11 @@ function _encodeTarget(t) {
 }
 function _encodeSeqOfTargets(targets) {
   if (!Array.isArray(targets) || !targets.length) throw _err("attrcert/bad-input", "a targets value must be a non-empty array of targets");
-  return b.sequence([b.sequence(targets.map(_encodeTarget))]);
+  return b.sequence([b.sequence(guard.list.copyMap(targets, _encodeTarget))]);
 }
 function _attrSpec(names, tag, label) {
   if (!Array.isArray(names)) throw _err("attrcert/bad-input", "aaControls." + label + " must be an array of attribute-type OIDs");
-  var oids = names.map(function (n) {
+  var oids = guard.list.copyMap(names, function (n) {
     try { return b.oid(O(n) || n); } catch (e) { throw _err("attrcert/bad-input", "aaControls." + label + " contains an invalid object identifier " + guard.text.showValue(n), e); }
   });
   return b.contextConstructed(tag, Buffer.concat(oids));
@@ -385,7 +391,9 @@ function _buildAttributes(attrSpec) {
     attrs.push(b.sequence([b.oid(type), b.set([valueTlv])]));
   }
   if (Array.isArray(attrSpec)) {
-    attrSpec.forEach(function (a, i) {
+    /** @internal Through the captured walk, never the caller's own `forEach`: these attributes are the
+     *  content this verb signs, and a replaced walk hands the callback a list it never validated. */
+    guard.list.copyMap(attrSpec, function (a, i) {
       var der = _b.reqDer(a, "attribute [" + i + "]");
       var n;
       try { n = asn1.decode(der); } catch (e) { throw _err("attrcert/bad-input", "pre-encoded attribute [" + i + "] is not valid DER", e); }
@@ -441,7 +449,7 @@ function _buildExtensions(extSpec, ctx) {
   if (Array.isArray(extSpec)) {
     if (!extSpec.length) return null;
     var seenA = intrinsic.create(null);
-    var exts = extSpec.map(function (e, i) {
+    var exts = guard.list.copyMap(extSpec, function (e, i) {
       var der = _b.reqDer(e, "extension");
       _b.assertValidExtension(der, i, EXT_DECODERS);
       var n = asn1.decode(der);
@@ -589,7 +597,7 @@ function _sign(spec, issuer, opts) {
   var acinfoDer = b.sequence(acinfoChildren);
 
   return signScheme.signOverTbs(scheme, issuer.key, acinfoDer, _signE).then(function (sig) {
-    return Promise.resolve(_b.assertSignatureVerifies(acinfoDer, sig, aaSpki, scheme)).then(function () {
+    return _promiseResolve(_Promise, _b.assertSignatureVerifies(acinfoDer, sig, aaSpki, scheme)).then(function () {
       var acDer = b.sequence([acinfoDer, scheme.sigAlgId, b.bitString(sig, 0)]);
       return opts.pem ? attrcert.pemEncode(acDer, "ATTRIBUTE CERTIFICATE") : acDer;
     });
@@ -697,17 +705,17 @@ function _checkTargeting(ac, want) {
   for (var i = 0; i < ac.extensions.length; i++) {
     if (ac.extensions[i].name === "targetInformation") ext = ac.extensions[i];
   }
-  if (!ext) return { checked: true, ok: true };
+  if (!ext) return guard.verdict.of({ checked: true, ok: true });
   if (want === undefined) {
-    return { checked: false, ok: false,
-      reason: "this attribute certificate is targeted, and no opts.target names this verifier (RFC 5755 sec. 4.3.2)" };
+    return guard.verdict.of({ checked: false, ok: false,
+      reason: "this attribute certificate is targeted, and no opts.target names this verifier (RFC 5755 sec. 4.3.2)" });
   }
   var groups = ext.decoded || [];
   for (var g0 = 0; g0 < groups.length; g0++) {
     for (var t0 = 0; t0 < groups[g0].length; t0++) {
       if (groups[g0][t0].kind !== "targetCert") continue;
-      return { checked: false, ok: false,
-        reason: "this attribute certificate carries a targetCert target, which RFC 5755 sec. 4.3.2 says MUST NOT be used, so the targeting check did not run" };
+      return guard.verdict.of({ checked: false, ok: false,
+        reason: "this attribute certificate carries a targetCert target, which RFC 5755 sec. 4.3.2 says MUST NOT be used, so the targeting check did not run" });
     }
   }
 
@@ -717,17 +725,17 @@ function _checkTargeting(ac, want) {
       var entry = groups[g][t];
       if (entry.kind !== "targetName" && entry.kind !== "targetGroup") continue;
       var m = _generalNameMatches(entry.name, want);
-      if (m === true) return { checked: true, ok: true };
+      if (m === true) return guard.verdict.of({ checked: true, ok: true });
       if (m === null) uncomparable = entry.name && entry.name.tagNumber;
     }
   }
   if (uncomparable !== null) {
-    return { checked: false, ok: false,
+    return guard.verdict.of({ checked: false, ok: false,
       reason: "this attribute certificate names a target in a GeneralName form ([" + uncomparable +
-        "]) this verifier does not compare, so the RFC 5755 sec. 4.3.2 check did not run" };
+        "]) this verifier does not compare, so the RFC 5755 sec. 4.3.2 check did not run" });
   }
-  return { checked: true, ok: false,
-    reason: "this attribute certificate does not name this verifier among its targets (RFC 5755 sec. 4.3.2)" };
+  return guard.verdict.of({ checked: true, ok: false,
+    reason: "this attribute certificate does not name this verifier among its targets (RFC 5755 sec. 4.3.2)" });
 }
 
 var SUPPORTED_CRITICAL = intrinsic.create(null);
@@ -908,7 +916,7 @@ function _verify(ac, issuer, opts) {
     reason: undefined,
   });
 
-  return Promise.resolve(attrcertVerify.verifyAcSignature(parsed, trust.spki)).then(function (sigOk) {
+  return _promiseResolve(_Promise, attrcertVerify.verifyAcSignature(parsed, trust.spki)).then(function (sigOk) {
     result.signatureValid = sigOk === true;
     var fail = function (reason) { result.reason = reason; return result; };
     if (!result.signatureValid) return fail("the signature does not verify under the issuer public key");

package/lib/cbor-det.js

@@ -56,7 +56,7 @@ function _asBuffer(input, who) {
 
 function _profile(name) {
   var p = name === undefined ? "deterministic" : name;
-  if (p === "deterministic") return { mapKeyCompare: Buffer.compare };
+  if (p === "deterministic") return { mapKeyCompare: guard.bytes.compare };
   throw new TypeError("decode: unknown profile " + JSON.stringify(p) + " (only \"deterministic\" is supported)");
 }
 
@@ -637,15 +637,21 @@ function _asText(s, who) {
   return s;
 }
 
+/** @internal @guard-via guard\.text\.assertWellFormedUtf16\( */
 function _assertWellFormedText(str, who) {
-  for (var i = 0; i < str.length; i++) {
-    var c = str.charCodeAt(i);
-    if (c >= 0xd800 && c <= 0xdbff) { var n = str.charCodeAt(i + 1); if (!(n >= 0xdc00 && n <= 0xdfff)) throw new CborError("cbor/bad-utf8", who + ": the string has an unpaired high surrogate"); i++; }
-    else if (c >= 0xdc00 && c <= 0xdfff) throw new CborError("cbor/bad-utf8", who + ": the string has an unpaired low surrogate");
-  }
+  return guard.text.assertWellFormedUtf16(str, CborError, "cbor/bad-utf8", who + ": the string");
+}
+/** @internal A builder's integer argument is authoring-tier input, so it is held to being an
+ *  integer rather than converted into one. `BigInt(x)` accepts a string in any radix, a padded or
+ *  empty string, and a boolean, each of which becomes a well-formed encoding of a number the caller
+ *  never wrote; an empty string in particular encodes as zero. */
+function _authoredInt(v, who) {
+  return guard.range.authoredInteger(v, function (c, m) { return new CborError(c, m); },
+    "cbor/bad-argument", who + ": the value");
 }
+
 function _head(mt, argument, who) {
-  var a = typeof argument === "bigint" ? argument : BigInt(argument);
+  var a = _authoredInt(argument, who);
   if (a < 0n) throw new CborError("cbor/bad-argument", who + ": a CBOR head argument must be non-negative");
   if (a > 0xffffffffffffffffn) throw new CborError("cbor/bad-argument", who + ": a CBOR head argument exceeds 64 bits");
   var mtb = mt << 5, b;
@@ -656,9 +662,9 @@ function _head(mt, argument, who) {
   b = Buffer.alloc(9); b[0] = mtb | 27; b.writeBigUInt64BE(a, 1); return b;
 }
 var build = Object.assign(Object.create(null), {
-  uint: function (n) { var a = typeof n === "bigint" ? n : BigInt(n); if (a < 0n) throw new CborError("cbor/bad-argument", "build.uint: value must be non-negative"); return _head(0, a, "build.uint"); },
-  nint: function (n) { var a = typeof n === "bigint" ? n : BigInt(n); if (a >= 0n) throw new CborError("cbor/bad-argument", "build.nint: value must be negative"); return _head(1, -1n - a, "build.nint"); },
-  int:  function (n) { var a = typeof n === "bigint" ? n : BigInt(n); return a >= 0n ? _head(0, a, "build.int") : _head(1, -1n - a, "build.int"); },
+  uint: function (n) { var a = _authoredInt(n, "build.uint"); if (a < 0n) throw new CborError("cbor/bad-argument", "build.uint: value must be non-negative"); return _head(0, a, "build.uint"); },
+  nint: function (n) { var a = _authoredInt(n, "build.nint"); if (a >= 0n) throw new CborError("cbor/bad-argument", "build.nint: value must be negative"); return _head(1, -1n - a, "build.nint"); },
+  int:  function (n) { var a = _authoredInt(n, "build.int"); return a >= 0n ? _head(0, a, "build.int") : _head(1, -1n - a, "build.int"); },
   byteString: function (buf) { var b = _asBuffer(buf, "build.byteString"); return _capString(Buffer.concat([_head(2, b.length, "build.byteString"), b]), "build.byteString"); },
   textString: function (s) { var str = _asText(s, "build.textString"); _assertWellFormedText(str, "build.textString"); var b = Buffer.from(str, "utf8"); return _capString(Buffer.concat([_head(3, b.length, "build.textString"), b]), "build.textString"); },
   array: function (items) {
@@ -669,8 +675,12 @@ var build = Object.assign(Object.create(null), {
   map: function (pairs) {
     if (!Array.isArray(pairs)) throw new CborError("cbor/bad-argument", "build.map: expected an array of [key, value] pairs");
     var enc = pairs.map(function (p, i) { if (!Array.isArray(p) || p.length !== 2) throw new CborError("cbor/bad-argument", "build.map[" + i + "]: each entry is a [key, value] pair"); return [_cbItem(p[0], "build.map key"), _cbItem(p[1], "build.map value")]; });
-    enc.sort(function (a, b) { return Buffer.compare(a[0], b[0]); });
-    for (var i = 1; i < enc.length; i++) { if (Buffer.compare(enc[i - 1][0], enc[i][0]) === 0) throw new CborError("cbor/duplicate-map-key", "build.map: duplicate map key"); }
+    /** @internal The map-key ordering and the duplicate test go through the captured comparator. A
+     * deterministic encoding IS its key order, so whatever decides "before" decides the bytes, and the
+     * duplicate test asked the same question: a replacement answering a fixed order would emit a map
+     * this decoder refuses and would let two equal keys through. */
+    enc = guard.list.sortedCopy(enc, function (a, b) { return guard.bytes.compare(a[0], b[0]); });
+    for (var i = 1; i < enc.length; i++) { if (guard.bytes.compare(enc[i - 1][0], enc[i][0]) === 0) throw new CborError("cbor/duplicate-map-key", "build.map: duplicate map key"); }
     var flat = [_head(5, pairs.length, "build.map")];
     enc.forEach(function (p) { flat.push(p[0], p[1]); });
     return _assertDecodes(Buffer.concat(flat), "build.map");
@@ -680,7 +690,7 @@ var build = Object.assign(Object.create(null), {
   nullValue: function () { return Buffer.from([0xf6]); },
   raw: function (buf) { return _assertDecodes(_asBuffer(buf, "build.raw"), "build.raw"); },
   biguint: function (n) {
-    var a = typeof n === "bigint" ? n : BigInt(n);
+    var a = _authoredInt(n, "build.biguint");
     if (a < 0n) throw new CborError("cbor/bad-argument", "build.biguint: value must be non-negative");
     var hex = a.toString(16); if (hex.length % 2) hex = "0" + hex;
     var mag = a === 0n ? Buffer.alloc(0) : Buffer.from(hex, "hex");
@@ -695,7 +705,7 @@ var build = Object.assign(Object.create(null), {
       if (Number.isNaN(ms)) throw new CborError("cbor/bad-time", "build.time: an Invalid Date has no epoch value");
       if (ms % 1000 !== 0) throw new CborError("cbor/bad-time", "build.time: a Date with sub-second precision cannot be a second-granularity CBOR epoch; round to whole seconds");
     }
-    var secs = guard.time.isDate(v) ? BigInt(Math.floor(ms / 1000)) : (typeof v === "bigint" ? v : BigInt(v));
+    var secs = guard.time.isDate(v) ? BigInt(Math.floor(ms / 1000)) : _authoredInt(v, "build.time");
     if (secs < -_MAX_EPOCH_SECONDS || secs > _MAX_EPOCH_SECONDS) throw new CborError("cbor/bad-time", "build.time: epoch seconds " + secs + " are outside the representable Date range");
     return build.tag(1, build.int(secs));
   },

package/lib/cmc-build.js

@@ -590,7 +590,13 @@ async function _recoverProofValue(decoded, recipient, witnessHash) {
   for (var i = 0; i < count; i++) {
     var opened;
     try {
-      opened = await cmsDecrypt.decrypt(decoded.cms, recipient, { recipientIndex: i });
+      /** @internal The refusal `pki.cms.decrypt` applies to RSAES-PKCS1-v1_5 key transport protects a
+       *  content whose padding is the only integrity check. Here the witness digest below is that check:
+       *  it decides the candidate, and a decrypt that fails and a candidate the witness rejects both
+       *  continue to the next recipient and end in the one `cmc/pop-failed`, so a submitter who does not
+       *  know the proof value observes one outcome whatever their ciphertext did. RFC 5272 sec. 6.7
+       *  defines the position. */
+      opened = await cmsDecrypt.decrypt(decoded.cms, recipient, { recipientIndex: i, allowUnauthenticatedRsa15: true });
     } catch (_e) {
       continue;   // allow:swallow-unverified this recipient is not addressed to the supplied key; the witness decides
     }
@@ -677,8 +683,9 @@ async function answerPopChallenge(popChallenge, ids) {
 function popLinkWitnessV2(secret, R) {
   _assertSecret(secret, "a POP Link Witness V2 control");
   var key = nodeCrypto.createHash("sha256").update(secret, "utf8").digest();
-  var witness = nodeCrypto.createHmac("sha256", key).update(R).digest();
   try {
+    /** @internal Inside the try, so a MAC that faults on its message still wipes the key above it. */
+    var witness = nodeCrypto.createHmac("sha256", key).update(R).digest();
     return b.sequence([algId(OID_SHA256), algId(OID_HMAC_SHA256), b.octetString(witness)]);
   } finally {
     guard.secret.zeroize(key, CmcError, "cmc/bad-input", "the POP Link MAC key");

package/lib/cmc-verify.js

@@ -27,6 +27,12 @@ var cmsDecrypt = require("./cms-decrypt");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
 var _hasOwn = intrinsic.hasOwn;
+/** @internal The verify entry gates its body on a resolved promise and returns its refusals as
+ *  rejected ones, and both build from the RECEIVER, so a replacement read at the call decides whether
+ *  the body runs and whether a refusal stays a refusal. Taken at load. */
+var _Promise = intrinsic.Promise;
+var _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
+var _promiseReject = intrinsic.uncurry(intrinsic.promiseReject);
 var frameworkError = require("./framework-error");
 
 var CmcError = frameworkError.CmcError;
@@ -308,7 +314,7 @@ function verify(response, sent) {
     frozenResponse = _snapshotIfBytes(response);
   } catch (e) {
     _wipeOwnedSecret();
-    return Promise.reject(e);
+    return _promiseReject(_Promise, e);
   }
   return guard.async.deferred(function () { return _verify(frozenResponse, frozenSent); })
     .then(function (v) { _wipeOwnedSecret(); return v; },
@@ -387,7 +393,7 @@ function _verify(response, sent) {
 
 
 function _assertAuthentic(body, sent, responseBytes) {
-  return Promise.resolve().then(function () {
+  return _promiseResolve(_Promise, undefined).then(function () {
     var haveBytes = typeof responseBytes === "string" ||
       Buffer.isBuffer(responseBytes) || responseBytes instanceof Uint8Array;   // allow:byte-source-narrow -- responseBytes is _snapshotIfBytes's return: any BufferSource is already a Buffer here, so this is Buffer-or-string by construction
     if (body.cms && body.cms.contentTypeName === "authData") {
@@ -413,7 +419,12 @@ function _assertAuthentic(body, sent, responseBytes) {
           derivedKey = cmcBuild.macPassword(recipient);
           recipient = { password: derivedKey };
         }
-        return cmsDecrypt.decrypt(responseBytes, recipient).then(function (r) { _wipeDerived(); return r; },
+        /** @internal The refusal `pki.cms.decrypt` applies to RSAES-PKCS1-v1_5 key transport protects a
+         *  content whose padding is the only integrity check. This is an AuthenticatedData, whose MAC is
+         *  that check, so the premise does not hold here and the opt-in states it. The opt-in is inert on
+         *  this path, because an AuthenticatedData is dispatched to the MAC verifier before the refusal is
+         *  reached; it is passed so the premise stays recorded where the content type is decided. */
+        return cmsDecrypt.decrypt(responseBytes, recipient, { allowUnauthenticatedRsa15: true }).then(function (r) { _wipeDerived(); return r; },
           function (e) {
             _wipeDerived();
             throw E("cmc/unverified-response",

package/lib/cmp-build.js

@@ -29,6 +29,12 @@ var cmp = require("./schema-cmp");
 var crmf = require("./crmf-sign");
 var schemaCrmf = require("./schema-crmf");
 var intrinsic = require("./guard-intrinsic");
+/** @internal The promise a signature self-check is awaited through, built from the constructor captured
+ *  at load. `Promise.resolve` builds from its RECEIVER, so reading the global binding at the call hands
+ *  the construction to whatever that binding holds, and one settling without awaiting its argument runs
+ *  the continuation before the check has finished. */
+var _Promise = intrinsic.Promise;
+var _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
 var _hasOwn = intrinsic.hasOwn;
 var _isArray = intrinsic.isArray;
 var _isBuffer = intrinsic.isBuffer;
@@ -603,7 +609,7 @@ function _encodeBody(bodySpec, key, opts) {
     if (bodySpec.pkiconf !== null && bodySpec.pkiconf !== true) throw _err("cmp/bad-input", "pkiconf takes null or true (PKIConfirmContent is NULL)");
     inner = b.nullValue();
   }
-  return Promise.resolve({ bodyTLV: b.explicit(tag, inner), usesCmp2021: state.usesCmp2021 });
+  return _promiseResolve(_Promise, { bodyTLV: b.explicit(tag, inner), usesCmp2021: state.usesCmp2021 });
 }
 
 async function _p10crBody(csrDer, parsedCsr, tag, state) {
@@ -786,8 +792,8 @@ function _resolveProtection(opts, message) {
       protectionAlgDer: scheme.sigAlgId,
       certDer: certDer,
       computeBits: function (protectedPartDer) {
-        return Promise.resolve(signScheme.signOverTbs(scheme, opts.key, protectedPartDer, _signE)).then(function (sig) {
-          return Promise.resolve(_b.assertSignatureVerifies(protectedPartDer, sig, senderSpki, scheme)).then(function () {
+        return _promiseResolve(_Promise, signScheme.signOverTbs(scheme, opts.key, protectedPartDer, _signE)).then(function (sig) {
+          return _promiseResolve(_Promise, _b.assertSignatureVerifies(protectedPartDer, sig, senderSpki, scheme)).then(function () {
             return b.bitString(sig, 0);
           });
         });
@@ -999,12 +1005,18 @@ function _tlsForTransfer(opts) {
 function _ctypeToken(headers) { return String((headers || {})["content-type"] || "").split(";")[0].trim().toLowerCase(); }
 function _isPkixcmp(headers) { var t = _ctypeToken(headers); return t === PKIXCMP || t === PKIXCMP_POLL; }
 
+/** @internal The sentinel is added at the one exit rather than at each `return`, so a branch added
+ * later carries it without being told to. */
 function _classifyCmpResponse(status, headers, body, tls) {
+  return guard.verdict.shield(_classifyCmpResponseBody(status, headers, body, tls));
+}
+
+function _classifyCmpResponseBody(status, headers, body, tls) {
   var ctype = _ctypeToken(headers);
   if (status === 200) {
     if (!_isPkixcmp(headers)) throw _err("cmp/bad-content-type", "a 200 CMP response must be application/pkixcmp (RFC 9811 sec. 3.2), got " + JSON.stringify(ctype || null));
     if (body.length === 0) throw _err("cmp/empty-response", "a 200 CMP response carried an empty body (RFC 9811 sec. 3.3)");
-    return { response: cmp.parse(body), responseBytes: body, status: 200, contentType: ctype, tls: tls };
+    return guard.verdict.of({ response: cmp.parse(body), responseBytes: body, status: 200, contentType: ctype, tls: tls });
   }
   var httpStatus = (typeof status === "number" && Number.isSafeInteger(status) && status >= 100 && status <= 599) ? status : null;
   if (httpStatus !== null && httpStatus >= 300 && httpStatus < 400) throw _err("cmp/redirect-not-followed", "a CMP " + httpStatus + " redirect is not followed (RFC 9811 sec. 3.1, sec. 5); reconfigure the endpoint URL");
@@ -1014,7 +1026,7 @@ function _classifyCmpResponse(status, headers, body, tls) {
       try { forwarded = cmp.parse(body); }
       catch (e) { throw _err("cmp/http-error", "the CMP server returned HTTP " + httpStatus + " with an undecodable body", e); }
       if (forwarded.body.arm !== "error") throw _err("cmp/http-error", "the CMP server returned HTTP " + httpStatus + " with a non-error '" + forwarded.body.arm + "' body; an HTTP failure forwards only a CMP error message (RFC 9811 sec. 1.2/3.1)");
-      return { response: forwarded, responseBytes: body, status: httpStatus, contentType: ctype, tls: tls };
+      return guard.verdict.of({ response: forwarded, responseBytes: body, status: httpStatus, contentType: ctype, tls: tls });
     }
     throw _err("cmp/http-error", "the CMP server returned HTTP " + httpStatus + " with no forwardable CMP error body");
   }

package/lib/cmp-session.js

@@ -125,8 +125,8 @@ var PKI_STATUS_WAITING = 3;
  * single process. The authority's own diagnostic strings are not reproduced from stored state, since a
  * verdict must not present text the authority did not sign in this exchange as though it had. */
 function _waitingStatus() {
-  return { status: { code: PKI_STATUS_WAITING, name: PKI_STATUS_NAMES[PKI_STATUS_WAITING] },
-    statusString: null, failInfo: null };
+  return guard.verdict.of({ status: { code: PKI_STATUS_WAITING, name: PKI_STATUS_NAMES[PKI_STATUS_WAITING] },
+    statusString: null, failInfo: null });
 }
 
 function _certReqIdEq(a, b) { return a != null && b != null && BigInt(a) === BigInt(b); }
@@ -717,10 +717,10 @@ function session(opts) {
     if (code === 3) {
       if (txnKind === "enroll") throw _err("cmp/bad-error", "an error message answering an enrollment must not carry status waiting -- the profile places enrollment waiting in an ip/cp/kup (RFC 9483 sec. 4.4)");
       if (si.failInfo != null) throw _err("cmp/bad-error", "an error message with status waiting must not carry failInfo (RFC 9483 sec. 4.4)");
-      return { state: "waiting", resp: { status: si } };
+      return guard.verdict.of({ state: "waiting", resp: guard.verdict.of({ status: si }) });
     }
     if (code !== 2) throw _err("cmp/bad-error", "an error message carries status rejection(2), or waiting(3) for a revoke/info delayed delivery (RFC 9483 sec. 4.2); got " + (code == null ? "no status" : code));
-    return { state: "rejected", status: si };
+    return guard.verdict.of({ state: "rejected", status: si });
   }
 
   function _classifyRevRep(body) {
@@ -735,9 +735,9 @@ function session(opts) {
       if (si.failInfo != null) {
         return { state: "unexpected", reason: "an accepted rp must not carry failInfo (RFC 9483 sec. 4.2)" };
       }
-      return { state: "granted", status: si, revCerts: d.revCerts, crls: d.crls };
+      return guard.verdict.of({ state: "granted", status: si, revCerts: d.revCerts, crls: d.crls });
     }
-    if (code === 2) return { state: "rejected", status: si };
+    if (code === 2) return guard.verdict.of({ state: "rejected", status: si });
     return { state: "unexpected", reason: "an rp status code " + code + " has no transition in a revocation (RFC 9483 sec. 4.2 allows accepted or rejection)" };
   }
 
@@ -851,7 +851,7 @@ function session(opts) {
   async function _pollLoop(lastWaitingResp, alreadyWaited) {
     var polls = 0, waited = alreadyWaited || 0, lastStatus = _statusOf(lastWaitingResp);
     for (;;) {
-      if (polls >= maxPolls || waited > maxTotalWait) return { timeout: true, polls: polls, status: lastStatus };
+      if (polls >= maxPolls || waited > maxTotalWait) return guard.verdict.of({ timeout: true, polls: polls, status: lastStatus });
       var verdict = await _send({ pollReq: [{ certReqId: activeCertReqId }] }, "pollReq");
       polls += 1;
       var t = _classify(verdict);
@@ -865,8 +865,8 @@ function session(opts) {
         /** @internal The authority asked to be polled again after `checkAfter`, and the budget ran out
          * before that wait was taken. Reporting it lets a resumed poll honor the interval rather than
          * poll immediately in a new process. */
-        if (waited > maxTotalWait) return { timeout: true, polls: polls, status: lastStatus, dueIn: checkAfter };
-        if (polls >= maxPolls) return { timeout: true, polls: polls, status: lastStatus, dueIn: checkAfter };
+        if (waited > maxTotalWait) return guard.verdict.of({ timeout: true, polls: polls, status: lastStatus, dueIn: checkAfter });
+        if (polls >= maxPolls) return guard.verdict.of({ timeout: true, polls: polls, status: lastStatus, dueIn: checkAfter });
         await sleep(checkAfter * constants.TIME.seconds(1));
         continue;
       }
@@ -920,7 +920,11 @@ function session(opts) {
     if (pk == null) return true;
     if (!guard.bytes.isByteSource(pk)) return false;
     var bits;
-    try { bits = asn1.read.bitString(asn1.decode(guard.bytes.view(pk, CmpError, "cmp/bad-input", "the certTemplate publicKey")).children[1]); }
+    /** @internal `source` rather than `view`, so the set read is the set the line above admits. `view`
+     *  wants a Buffer or a Uint8Array and its refusal is caught below, so an ArrayBuffer or a DataView
+     *  carrying a zero-length key was read as an ordinary request for a key the caller holds rather
+     *  than as the request for a centrally generated one that it is. */
+    try { bits = asn1.read.bitString(asn1.decode(guard.bytes.source(pk, CmpError, "cmp/bad-input", "the certTemplate publicKey")).children[1]); }
     catch (_e) { return false; }
     return bits.bytes.length === 0;
   }
@@ -1031,6 +1035,15 @@ function session(opts) {
     if (ckp.privateKey.bytes == null) {
       throw _err("cmp/bad-key-package", "a delivered key package is carried as an EnvelopedData, and this grant carries the legacy RFC 4211 EncryptedValue form (RFC 9483 sec. 4.1.6, RFC 9810 sec. 5.2.2)");
     }
+    /** @internal `pki.cmp.openKeyPackage` leaves the RSAES-PKCS1-v1_5 decision to its caller, because
+     * taking a container on its own it cannot establish that one arrived inside an authenticated
+     * exchange. A session can: it reaches here only for a response whose protection verified AND whose
+     * signer chained to a supplied trust anchor, so a container reaching this point came inside a
+     * message the authority protected and an attacker cannot submit chosen ciphertexts to it. The
+     * premise the refusal protects therefore holds, and the opt-in is the session's to make rather than
+     * a hole the caller has to open. Deployed authorities deliver v1.5 over a CBC content, so withholding
+     * it would refuse the key delivery this verb exists to complete. */
+    open.allowUnauthenticatedRsa15 = true;
     return cmp.openKeyPackage(ckp.privateKey.bytes, open);
   }
 
@@ -1111,7 +1124,7 @@ function session(opts) {
     if (t.state === "waiting") {
       var polled = await _pollLoop(t.resp);
       polls = polled.polls;
-      if (polled.timeout) return { timeout: true, polls: polls, status: polled.status };
+      if (polled.timeout) return guard.verdict.of({ timeout: true, polls: polls, status: polled.status });
       t = polled.done;
     }
     return { done: t, polls: polls };

package/lib/cmp-verify.js

@@ -413,6 +413,11 @@ function _headerChecks(m, opts) {
   if (!guard.bytes.isByteSource(m.header.transactionID)) {
     return { code: "cmp/bad-transaction-id", reason: "the header transactionID is absent; a received PKIMessage MUST carry one (RFC 9483 sec. 3.5)" };
   }
+  /** @internal `lengthOf` wants a view and the check above admits every BufferSource, which elsewhere
+   *  let an ArrayBuffer through a door and be refused by the line after it. Not reachable here: this
+   *  verb takes DER bytes rather than a record, so `m` is always what the parser produced, and the
+   *  parser reads this field as an OCTET STRING, whose value is a Buffer. The field cannot arrive as
+   *  anything else, so there is nothing to normalize. */
   if (!guard.bytes.isByteSource(m.header.senderNonce) ||
       guard.bytes.lengthOf(m.header.senderNonce) < constants.LIMITS.CMP_MIN_NONCE_BYTES) {
     return { code: "cmp/bad-sender-nonce", reason: "the header senderNonce is absent or shorter than 128 bits (RFC 9483 sec. 3.5)" };
@@ -442,18 +447,9 @@ function _headerChecks(m, opts) {
   return null;
 }
 
-function _keyUsageAllowsSigning(parsed) {
-  var kuOid = oid.byName("keyUsage");
-  var exts = parsed.extensions;
-  for (var i = 0; i < exts.length; i++) {
-    if (exts[i].oid !== kuOid) continue;
-    var ku;
-    try { ku = _certExtDecoders[kuOid](exts[i].value); }
-    catch (_e) { return false; }
-    return ku.digitalSignature === true;
-  }
-  return true;
-}
+/** @internal RFC 9483 sec. 3.2 names `digitalSignature` alone, which is stricter than the set a signature
+ *  over content takes elsewhere; the shared helper carries the rest of the rule. */
+var _keyUsageAllowsSigning = pkix.keyUsagePermits(NS, ["digitalSignature"]);
 
 /** @internal The verifying half of RFC 9810 sec. 5.1.3.4. The peer that encapsulated holds the same
  * shared secret, and derives the key from it through the derivation `pki.cmp.build` uses, so the two
@@ -634,7 +630,7 @@ function _certKey(c) {
 
 async function _chainSigner(signer, m, opts, extra) {
   if (!_keyUsageAllowsSigning(signer.parsed)) {
-    return { trusted: false, reason: "the signer certificate keyUsage does not assert digitalSignature (RFC 9483 sec. 3.2)" };
+    return guard.verdict.of({ trusted: false, reason: "the signer certificate keyUsage does not assert digitalSignature (RFC 9483 sec. 3.2)" });
   }
   var time = opts.time != null ? opts.time : new _Date();
   var anchors = _certList(opts.trustAnchors);
@@ -657,7 +653,7 @@ async function _chainSigner(signer, m, opts, extra) {
   if (opts.revocationChecker != null) buildOpts.revocationChecker = opts.revocationChecker;
   try {
     var res = await _engine.build(signer.der, buildOpts);
-    if (!res || res.valid !== true) return { trusted: false, reason: "the signer certificate did not chain to a supplied trust anchor" };
+    if (!res || res.valid !== true) return guard.verdict.of({ trusted: false, reason: "the signer certificate did not chain to a supplied trust anchor" });
     var byKey = _create(null);
     var skey = _certKey(signer.parsed); if (skey) byKey[skey] = signer.der;
     var ci, ck;
@@ -672,12 +668,12 @@ async function _chainSigner(signer, m, opts, extra) {
       var d = ck ? byKey[ck] : null;
       if (d) _append(chain, _bufferFrom(d));
     }
-    return { trusted: true, reason: null, chain: chain };
+    return guard.verdict.of({ trusted: true, reason: null, chain: chain });
   } catch (e) {
     if (e && e.code === "path/bad-input") {
       throw _err("cmp/bad-input", "invalid trust / validation options for signer-certificate path validation: " + (e.message || e), e);
     }
-    return { trusted: false, reason: "signer certificate path validation failed: " + (e.message || e) };
+    return guard.verdict.of({ trusted: false, reason: "signer certificate path validation failed: " + (e.message || e) });
   }
 }
 
@@ -878,7 +874,7 @@ async function _verify(message, opts) {
 
 var KNOWN_OPEN_KEY_PACKAGE_OPTS = intrinsic.assign(intrinsic.create(null), {
   key: 1, cert: 1, password: 1, trustAnchors: 1, intermediates: 1, time: 1,
-  authorizedBySharedSecret: 1,
+  authorizedBySharedSecret: 1, allowUnauthenticatedRsa15: 1,
 });
 var OID_A_KEY_PACKAGE = oid.byName("aKeyPackage");
 var OID_SIGNED_DATA = oid.byName("signedData");
@@ -953,6 +949,7 @@ function _fixOpenKeyPackageOptions(opts, made) {
     intermediates: _fixPoolCerts(opts.intermediates, "intermediates"),
     time: _fixTime(opts.time),
     exempt: opts.authorizedBySharedSecret === true,
+    allowRsa15: opts.allowUnauthenticatedRsa15 === true,
   };
   if (opts.authorizedBySharedSecret != null && typeof opts.authorizedBySharedSecret !== "boolean") {
     throw _err("cmp/bad-input", "opts.authorizedBySharedSecret is a boolean stating that this entity protected its request with the shared secret");
@@ -995,8 +992,16 @@ async function _openKeyPackage(container, opts) {
    * a single uniform result, and splitting that back out here would rebuild the oracle it removes. */
   var opened;
   try {
+    /** @internal The opt-in is the caller's, not this verb's. `pki.cms.decrypt` refuses RSAES-PKCS1-v1_5
+     *  key transport over a content with no integrity tag because acceptance tells an attacker
+     *  submitting chosen containers that theirs decoded. This verb takes the container itself, so it
+     *  cannot establish that one arrived inside an authenticated exchange, and only the caller knows
+     *  whether the containers it opens come from one. The password technique never reaches the refusal:
+     *  it is a `pwri` arm, not key transport. */
+    var decOpts = { recipientIndex: 0 };
+    if (opts.allowRsa15) decOpts.allowUnauthenticatedRsa15 = true;
     opened = await cmsDecrypt.decrypt(bytes, opts.password != null ? { password: opts.password } : { key: opts.key, cert: opts.cert },
-      { recipientIndex: 0 });
+      decOpts);
   } catch (e) {
     throw _keyPackageErr("the delivered key package could not be opened under the supplied key material", e);
   }
@@ -1016,7 +1021,7 @@ async function _openKeyPackage(container, opts) {
   if (!signerCert) throw _keyPackageErr("the SignedData names no signer certificate to authorize as the key generation authority");
   _authorizeKga(verdict, signerCert, opts);
   if (verdict.eContent == null) throw _keyPackageErr("the SignedData carries no encapsulated content, so no key package was delivered");
-  return { keys: _readKeyPackage(verdict.eContent), kga: _bufferFrom(signerCert), trusted: opts.exempt ? false : true };
+  return guard.verdict.of({ keys: _readKeyPackage(verdict.eContent), kga: _bufferFrom(signerCert), trusted: opts.exempt ? false : true });
 }
 
 /** @internal sec. 4.1.6: the entity "MUST use a certificate containing the additional extended key
@@ -1150,6 +1155,10 @@ function _coerceKeyPackageBytes(container) {
  *   - `authorizedBySharedSecret` (boolean) -- authorize the authority by the secret that protected
  *     the request rather than by a chain, which sec. 4.1.6 permits a MAC-protected exchange. Requires
  *     `opts.password` and refuses `opts.trustAnchors`.
+ *   - `allowUnauthenticatedRsa15` (boolean) -- forwarded to `pki.cms.decrypt`: open a container that
+ *     uses RSAES-PKCS1-v1_5 key transport over a content with no integrity tag, such as AES-CBC. Set
+ *     it only where the containers this entity opens arrive inside an authenticated exchange, because
+ *     acceptance otherwise tells an attacker submitting chosen containers that theirs decoded.
  * @example
  *   var nb = new Date("2026-01-01T00:00:00Z"), na = new Date("2036-01-01T00:00:00Z");
  *   var kgaPair = await pki.key.generate("Ed25519");                       // the key generation authority

package/lib/cms-compress.js

@@ -52,7 +52,9 @@ async function decompress(input, opts) {
   if (parsed.contentTypeName !== "compressedData") throw _err("cms/unsupported-content-type", "input is not a CMS CompressedData (got " + parsed.contentTypeName + ")");
   var alg = parsed.compressionAlgorithm;
   if (alg.oid !== OID_ZLIB) throw _err("cms/unsupported-algorithm", "unsupported compressionAlgorithm " + (alg.name || alg.oid) + " (only id-alg-zlibCompress, RFC 3274 sec. 2)");
-  if (alg.parameters != null && Buffer.compare(alg.parameters, NULL_PARAMS_DER) !== 0) throw _err("cms/bad-algorithm-parameters", "id-alg-zlibCompress parameters must be absent or NULL (RFC 3274 sec. 2)");
+  /** @internal Through the captured comparator, since this refusal is what a replacement answering
+   *  zero would turn into an acceptance of parameters the specification forbids. */
+  if (alg.parameters != null && guard.bytes.compare(alg.parameters, NULL_PARAMS_DER) !== 0) throw _err("cms/bad-algorithm-parameters", "id-alg-zlibCompress parameters must be absent or NULL (RFC 3274 sec. 2)");
   var eci = parsed.encapContentInfo;
   if (eci.eContent == null) throw _err("cms/no-encapsulated-content", "the CompressedData carries no encapsulated content (a detached CompressedData cannot be decompressed)");
   var content = _inflateBounded(eci.eContent, cap);