@blamejs/pki 0.8.50 → 0.8.52

package/lib/tsp-sign.js

@@ -25,7 +25,6 @@ var smime = require("./schema-smime");
 var schemaTsp = require("./schema-tsp");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
-var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var _compare = intrinsic.compare;
 var _pop = intrinsic.pop;
 var _reverse = intrinsic.reverse;
@@ -44,10 +43,6 @@ var _EXT_DECODERS = pkix.certExtensionDecoders(_NS).byOid;
 var b = asn1.build;
 function _err(code, message, cause) { return new TspError(code, message, cause); }
 
-function _hasNonZeroDigit(s) {
-  for (var i = 0; i < s.length; i++) { var c = _charCodeAt(s, i); if (c >= 49 && c <= 57) return true; }
-  return false;
-}
 function O(name) { return oid.byName(name); }
 
 var _b = pkiBuild.makeBuilder({
@@ -67,9 +62,15 @@ function _moreEstablished(candidate, current) {
   return _rankRevocation(candidate) > _rankRevocation(current);
 }
 
+/** @internal The message imprint's algorithm identifier, emitted with the parameters field ABSENT.
+ *  RFC 5754 sec. 2: "Implementations MUST generate SHA2 AlgorithmIdentifiers with absent
+ *  parameters", and it is a SHA-2 digest here because that is the whole set this verb signs under.
+ *  Both forms are still read: a request or token from elsewhere carrying NULL parameters verifies,
+ *  and nothing compares the identifier's bytes, since an imprint is matched by the algorithm it
+ *  names and the digest it carries. */
 function _hashAlgId(name) {
   if (!NODE_DIGEST[guard.text.keyOf(name)]) throw _err("tsp/unsupported-algorithm", "unsupported hash algorithm " + guard.text.showValue(name));
-  return b.sequence([b.oid(O(name)), b.nullValue()]);
+  return b.sequence([b.oid(O(name))]);
 }
 function _policy(p) {
   if (typeof p !== "string") throw _err("tsp/bad-input", "the timestamp policy must be an OID name or dotted string");
@@ -88,12 +89,12 @@ function _certDer(c) {
   return der;
 }
 
+/** @internal The sec. 2.4.2 binding, encoded by the one builder that owns the ESS domain. A second
+ *  encoder here would be a second answer to "which bytes bind this certificate", and the two can
+ *  drift: the SHA-384 and SHA-512 algorithm identifiers are generated with the parameters field
+ *  absent (RFC 5754 sec. 2), and the SHA-256 field omitted as the RFC 5035 sec. 4 DEFAULT. */
 function _signingCertV2(certDer, hashName) {
-  var certHash = guard.crypto.digest(NODE_DIGEST[hashName], certDer);
-  var essCertId = hashName === "sha256"
-    ? b.sequence([b.octetString(certHash)])
-    : b.sequence([_hashAlgId(hashName), b.octetString(certHash)]);
-  return b.sequence([b.sequence([essCertId])]);
+  return smime.buildSigningCertificateV2(certDer, { hashAlgorithm: hashName });
 }
 
 /**
@@ -432,17 +433,21 @@ function response(token, opts) {
 function parseResponse(input) { return schemaTsp.parse(input); }
 
 
-var _VERIFY_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: "sha256", sha384: "sha384", sha512: "sha512", sha1: "sha1" });
+var _VERIFY_DIGEST = constants.NAMES.TIMESTAMP_IMPRINT_DIGESTS;
 var _VERIFY_DIGEST_LEN = constants.NAMES.DIGEST_OCTETS;
-var _BIND_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: "sha256", sha384: "sha384", sha512: "sha512" });
 /** @internal The digests admitted for an imprint that are not collision resistant, so a token under one
  *  binds nothing an attacker with a collision cannot move. They verify only under `allowWeakDigests`. */
-var _WEAK_IMPRINT_DIGEST = intrinsic.assign(intrinsic.create(null), { sha1: 1 });
+var _WEAK_IMPRINT_DIGEST = constants.NAMES.WEAK_DIGESTS;
 
 function _imprintMatches(mi, data, allowWeakDigests) {
   var name = mi.hashAlgorithm && mi.hashAlgorithm.name;
   var nodeAlg = (name && intrinsic.hasOwn(_VERIFY_DIGEST, name)) ? _VERIFY_DIGEST[name] : null;
   if (!nodeAlg) return "tsp/unsupported-algorithm";
+  /** @internal The identifier is held to its own encoding as well as to its name. A digest
+   *  AlgorithmIdentifier carries absent or DER NULL parameters (RFC 5754 clause 2), and the ANY
+   *  field reaches here unvalidated from the generic PKIX decoder, so an imprint naming sha256
+   *  beside arbitrary bytes would otherwise be hashed as a well-formed one. */
+  if (!guard.der.paramsAbsentOrNull(mi.hashAlgorithm.parameters)) return "tsp/unsupported-algorithm";
   /** @internal The imprint is the ONLY thing binding a token to the data it timestamps, so the digest
    *  that computes it carries the whole binding and a collision in it substitutes the data under a
    *  genuine token. `allowWeakDigests` used to reach only the token's own signature digest, through
@@ -452,7 +457,11 @@ function _imprintMatches(mi, data, allowWeakDigests) {
    *  already does with a signature digest, and the opt-in is the same option an archived token needs. */
   if (!allowWeakDigests && intrinsic.hasOwn(_WEAK_IMPRINT_DIGEST, name)) return "tsp/weak-digest";
   var wantLen = _VERIFY_DIGEST_LEN[name];
-  if (mi.hashedMessage.length !== wantLen) return "tsp/imprint-mismatch";
+  /** @internal An imprint whose length is not the output length of the algorithm it names cannot be
+   *  a digest under that algorithm, which is a different fault from a digest that covers other
+   *  bytes, and it gets a code of its own: the first says the token is malformed, the second that it
+   *  is well formed and stamps something else (RFC 3161 sec. 2.4.2). */
+  if (mi.hashedMessage.length !== wantLen) return "tsp/imprint-length";
   var actual;
   if (guard.bytes.isByteSource(data)) {
     var dataBytes = guard.bytes.source(data, TspError, "tsp/bad-input", "data");
@@ -468,104 +477,57 @@ function _imprintMatches(mi, data, allowWeakDigests) {
   return _compare(actual, _bufferFrom(mi.hashedMessage)) === 0 ? true : "tsp/imprint-mismatch";
 }
 
-/** @internal The certificate one binding attribute names, and the digest under which it names it.
- *  An ESSCertID v1 carries NO hashAlgorithm field: it is SHA-1 by definition (RFC 2634 sec. 5.4.1),
- *  and EN 319 122-1 clause 5.2.2.2 says the v1 attribute "shall be used if the SHA-1 hash algorithm is
- *  used", so these tokens exist. An absent algorithm therefore means SHA-1 rather than nothing, and
- *  reporting `tsp/unsupported-algorithm` for one named the wrong fault: the algorithm is known and the
- *  binding is deliberately weak, which is a different refusal from one this build cannot compute.
- *  ABSENT IS NOT THE SAME AS UNRECOGNIZED: a v1 ESSCertID omits the field, so absent carries the type's
- *  default of SHA-1; an ESSCertIDv2 naming an OID this build does not know carries an algorithm that
- *  genuinely cannot be computed, and that one is `tsp/unsupported-algorithm`.
- *  Returns a refusal code, or the ESSCertID with the digest resolved. SHA-1 resolves rather than
- *  refusing, because whether a weak binding is a refusal depends on what the caller is doing with it:
- *  the attribute the verdict rests on is held to it, and an attribute read only for agreement is not. */
-function _readBinding(attr) {
-  var decoded;
-  try { decoded = smime.decodeAttribute(attr); }
-  catch (_e) { return "tsp/bad-signing-certificate"; }
-  var essCert = decoded.certs && decoded.certs[0];
-  if (!essCert) return "tsp/bad-signing-certificate";
-  var name = essCert.hashAlgorithm == null ? "sha1" : essCert.hashAlgorithm.name;
-  if (name === "sha1") return { essCert: essCert, nodeDigest: "sha1", weak: true };
-  if (!name || !intrinsic.hasOwn(_BIND_DIGEST, name)) return "tsp/unsupported-algorithm";
-  return { essCert: essCert, nodeDigest: _BIND_DIGEST[name], weak: false };
-}
-
-/** @internal Whether one ESSCertID names the certificate that signed the token, by every claim it
- *  carries: the hash under its own digest, and the issuer and serial where it states them. Returns
- *  true or the refusal code. An ESSCertID states the signer in two independent ways and both are
- *  compared, because a hash that agrees beside an issuer and serial that name another certificate is
- *  the same contradiction as two attributes disagreeing. Certificate identifiers after the first are
- *  not read: RFC 2634 sec. 5.4 makes the first the signing certificate and leaves the rest as the
- *  chain, so they say nothing about the signer. */
-function _bindingNamesCert(read, tsaCertDer) {
-  /** @internal Through the captured digest: this comparison IS the binding between a token and the
-   *  certificate its signing-certificate attribute names, so what the digest covers is not the
-   *  caller's to choose. */
-  if (_compare(guard.crypto.digest(read.nodeDigest, tsaCertDer),
-    _bufferFrom(read.essCert.certHash)) !== 0) return "tsp/cert-binding-mismatch";
-  var issuerSerial = read.essCert.issuerSerial;
-  if (!issuerSerial) return true;
-  var signerCert;
-  try { signerCert = pkiX509.parse(tsaCertDer); }
-  catch (_e) { return "tsp/bad-signing-certificate"; }
-  if (issuerSerial.serialNumber !== signerCert.serialNumber) return "tsp/cert-binding-mismatch";
-  var names = issuerSerial.issuer.names || [];
-  var gn = null;
-  try { if (names.length === 1) gn = schemaTsp.decodeGeneralName(names[0].bytes); }
-  catch (_e2) { return "tsp/cert-binding-mismatch"; }
-  if (!gn || gn.tagNumber !== 4 || !gn.value || !guard.name.dnEqual(gn.value.rdns, signerCert.issuer.rdns, _err, "tsp/cert-binding-mismatch", "the ESSCertID issuer")) {
-    return "tsp/cert-binding-mismatch";
-  }
-  return true;
-}
+/** @internal An ESSCertID v1 carries NO hashAlgorithm field: it is SHA-1 by definition (RFC 2634
+ *  sec. 5.4.1), and EN 319 122-1 clause 5.2.2.2 says the v1 attribute "shall be used if the SHA-1 hash
+ *  algorithm is used", so these tokens exist. The reader therefore reports SHA-1 as WEAK rather than as
+ *  unsupported, which is a different refusal: the algorithm is known and the binding is deliberately
+ *  weak, where an ESSCertIDv2 naming an OID this build does not know carries one that genuinely cannot
+ *  be computed. Which of the two a caller refuses on is the caller's policy, applied below. */
 
 function _checkCertBinding(signerInfo, tsaCertDer) {
-  var attrs = (signerInfo && signerInfo.signedAttrs) || [];
-  var binding = [];
-  for (var i = 0; i < attrs.length; i++) {
-    if (attrs[i].type === O("signingCertificateV2") || attrs[i].type === O("signingCertificate")) {
-      intrinsic.push(binding, attrs[i]);
-    }
-  }
-  if (!binding.length) return "tsp/missing-signing-certificate";
+  var facts = smime.certBindingFacts((signerInfo && signerInfo.signedAttrs) || [], tsaCertDer);
+  if (!facts.present) return "tsp/missing-signing-certificate";
   /** @internal A v2 binding supersedes a v1 one (RFC 5035), and that is why the verdict rests on the v2
    *  where there is one. But the v1 attribute does not stop existing: a token carrying both used to be
    *  checked against the v2 alone, so one naming the real signer in v2 and a DIFFERENT certificate in v1
    *  verified, and a legacy verifier reading only v1 resolves a certificate this one never checked. Both
    *  sit in signedAttrs, so the TSA signed the contradiction. One structure making two incompatible
    *  claims about one fact is refused rather than resolved in favor of whichever attribute a reader
-   *  prefers.
-   *  EVERY BINDING ATTRIBUTE IS COLLECTED, not the first of each type. signedAttrs is a DER SET OF,
-   *  sorted by encoded value, so which of the two attributes comes first is a function of their lengths
-   *  and the producer of a hostile token chooses it: a scan that stopped at the v2 caught the
-   *  contradiction in one ordering and missed it in the other, and an ordering-dependent check is no
-   *  check. The same applies to a repeated instance of either type, which `pki.cms.verify` refuses
-   *  before this runs and which is not relied on here.
+   *  prefers. Which attribute is `chosen` and which is `superseded` is decided over EVERY binding
+   *  attribute rather than the first of each type, because signedAttrs is a DER SET OF and a hostile
+   *  producer picks the order through the encodings.
    *  THE SHA-1 ON A SUPERSEDED ATTRIBUTE PINS NOTHING. It detects a disagreement, while the binding the
    *  verdict rests on is the v2 one. A collision would let a disagreeing v1 pass for an agreeing one,
    *  which costs an attacker the refusal and gains them nothing: the certificate the token is held to is
    *  the one v2 names, under its own digest. */
-  var chosen = 0;
-  for (var j = 0; j < binding.length; j++) {
-    if (binding[j].type === O("signingCertificateV2")) { chosen = j; break; }
-  }
-  for (var k = 0; k < binding.length; k++) {
-    if (k === chosen) continue;
-    var alt = _readBinding(binding[k]);
-    if (typeof alt === "string") return alt;
-    var altCode = _bindingNamesCert(alt, tsaCertDer);
+  for (var k = 0; k < facts.superseded.length; k++) {
+    var altCode = _bindingClaimCode(facts.superseded[k]);
     if (altCode !== true) return altCode;
   }
-  var read = _readBinding(binding[chosen]);
-  if (typeof read === "string") return read;
+  var read = facts.chosen;
+  if (!read.readable) return "tsp/bad-signing-certificate";
+  if (!read.supported) return "tsp/unsupported-algorithm";
   /** @internal The refusal of a weak binding stands whatever `allowWeakDigests` says, because a binding
    *  is not the archived-signature case the option exists for. Whether it should follow the imprint and
    *  become an opt-in is a posture question, and the refusal was pinned deliberately, so it is left as
    *  it was. */
   if (read.weak) return "tsp/weak-digest";
-  return _bindingNamesCert(read, tsaCertDer);
+  return _bindingClaimCode(read);
+}
+
+/** @internal The refusal one binding attribute's claims earn, in the order the claims are decided:
+ *  an attribute that does not decode, then a digest this build does not bind with, then the hash,
+ *  then the certificate the issuer and serial would be read off, then those two. The hash is
+ *  compared before the certificate is parsed, because a hash that disagrees is a mismatch whatever
+ *  the certificate turns out to be. The weak-digest refusal is the caller's, since it applies to the
+ *  attribute the verdict rests on and not to one read only for agreement. */
+function _bindingClaimCode(e) {
+  if (!e.readable) return "tsp/bad-signing-certificate";
+  if (!e.supported) return "tsp/unsupported-algorithm";
+  if (e.matches !== true) return "tsp/cert-binding-mismatch";
+  if (e.certUnreadable) return "tsp/bad-signing-certificate";
+  if (e.issuerSerialMatches === false) return "tsp/cert-binding-mismatch";
+  return true;
 }
 
 function _checkTsaCertUsage(tsaCertDer) {
@@ -755,7 +717,8 @@ async function verify(token, data, opts) {
   if (opts.trustAnchors) {
     var pathRes = null;
     var floorT = tst.genTime;
-    var ceilT = (tst.genTimeFraction != null && _hasNonZeroDigit(tst.genTimeFraction.slice(3))) ? new Date(guard.time.instantOf(floorT) + 1) : floorT;
+    var ceilAt = guard.time.ceilInstantOf(floorT, tst.genTimeFraction);
+    var ceilT = ceilAt === guard.time.instantOf(floorT) ? floorT : new Date(ceilAt);
     try {
       var pool = (parsed.certificates || []).filter(function (c) { return c.tagClass === "universal"; }).map(function (c) { return pkiX509.parse(c.bytes); });
       (opts.certs || []).forEach(function (c) { guard.list.append(pool, pkiX509.parse(c)); });

package/lib/x509-sign.js

@@ -71,6 +71,7 @@ var KNOWN_EXT_KEYS = intrinsic.assign(intrinsic.create(null), {
   authorityInfoAccess: 1, cRLDistributionPoints: 1, freshestCRL: 1,
   policyConstraints: 1, inhibitAnyPolicy: 1, policyMappings: 1, policyMappingsCritical: 1,
   issuerAltName: 1, qcStatements: 1, qcStatementsCritical: 1,
+  tlsFeature: 1, tlsFeatureCritical: 1,
   precertificatePoison: 1, signedCertificateTimestampList: 1,
   msCertificateTemplate: 1, msEnrollCertType: 1, msCaVersion: 1, msPreviousCertHash: 1,
   msApplicationPolicies: 1,
@@ -279,6 +280,9 @@ function _buildExtensions(extSpec, ctx) {
    *  unrecognized critical extension; the default is the form that validates and the knob reaches
    *  the other, as policyMappings and certificatePolicies do. */
   if (extSpec.qcStatements != null) guard.list.append(out, _ext(O("qcStatements"), !!extSpec.qcStatementsCritical, _extQcStatements(extSpec.qcStatements)));
+  /** @internal RFC 7633 sec. 4: SHOULD NOT be critical, and the clause names the case where critical
+   *  is the desired behavior, so the knob exists and the default is the compatible form. */
+  if (extSpec.tlsFeature != null) guard.list.append(out, _ext(O("tlsFeature"), !!extSpec.tlsFeatureCritical, _b.extTlsFeature(extSpec.tlsFeature)));
   if (extSpec.nameConstraints != null) {
     if (!caTrue) throw _err("x509/bad-input", "nameConstraints appears only in a CA certificate, so it requires basicConstraints cA=TRUE (RFC 5280 sec. 4.2.1.10)");
     guard.list.append(out, _ext(O("nameConstraints"), true, _extNameConstraints(extSpec.nameConstraints)));
@@ -628,6 +632,18 @@ function _hasCriticalSan(extSpec) {
  * know an unknown syntax. `pki.path.validate` does not process this extension, so it is emitted
  * non-critical unless `qcStatementsCritical` is set.
  *
+ * `extensions.tlsFeature` builds the RFC 7633 TLS Feature extension, the "must-staple" declaration,
+ * from a list of TLS ExtensionType values. Each is a number, a bigint, or one of the registry names
+ * this build knows, `status_request` and `status_request_v2`. The values come from the IANA TLS
+ * Extensions registry that RFC 7633 sec. 4.1 points at, and the type states no range, so a value
+ * outside that registry's width encodes and `pki.lint.certificate(der, { profile: "rfc7633" })`
+ * reports it rather than the encoder refusing it; the same holds for a repeated value, which the
+ * syntax permits. An EMPTY list is refused, because the extension it would emit advertises nothing.
+ * Emitted non-critical unless `tlsFeatureCritical` is set: sec. 4 says it SHOULD NOT be critical and
+ * names the case where critical is the caller's intent. `pki.path.validate` enforces sec. 4.2.2 over
+ * a built path, so a certificate issued under a CA that advertises features must offer the same set
+ * or a superset.
+ *
  * `extensions.subjectInfoAccess` takes the same `{ accessMethod, accessLocation }` list
  * `authorityInfoAccess` takes, since RFC 5280 sec. 4.2.2.2 gives it sec. 4.2.2.1's syntax; the two
  * access methods that section defines are the registered names `id-ad-caRepository` and
@@ -910,6 +926,10 @@ var EXTENSION_ROWS = [
   ["cRLDistributionPoints", "cRLDistributionPoints", { fixed: false, cite: "RFC 5280 sec. 4.2.1.13" }, function (v) { return _extCrlDp(v, "cRLDistributionPoints"); }],
   ["freshestCRL", "freshestCRL", { fixed: false, cite: "RFC 5280 sec. 4.2.1.15" }, function (v) { return _extCrlDp(v, "freshestCRL"); }],
   ["qcStatements", "qcStatements", { knob: true, dflt: false }, function (v) { return _extQcStatements(v); }],
+  /** @internal RFC 7633 sec. 4 reads "SHOULD NOT be marked critical" and then names the case where
+   *  the critical form is what the caller wants, so this takes a knob defaulting to the compatible
+   *  form rather than refusing one: `fixed: false` would promote that SHOULD NOT into a refusal. */
+  ["tlsFeature", "tlsFeature", { knob: true, dflt: false }, function (v) { return _b.extTlsFeature(v); }],
   ["subjectDirectoryAttributes", "subjectDirectoryAttributes", { fixed: false, cite: "RFC 5280 sec. 4.2.1.8" }, function (v) { return _b.extSubjectDirectoryAttributes(v); }],
   ["msCertificateTemplate", "msCertificateTemplate", { fixed: false, cite: "the toolkit issues the form its readers accept" }, function (v) { return _b.extMsCertificateTemplate(v); }],
   ["msEnrollCertType", "msEnrollCertType", { fixed: false, cite: "the toolkit issues the form its readers accept" }, function (v) { return _b.extMsEnrollCertType(v); }],
@@ -971,8 +991,8 @@ function _extensionCritical(row, opts) {
  * (the key identifiers, the constraint and policy-constraint extensions, the access and
  * distribution extensions), or the toolkit issues one form only, `opts.critical` may only restate
  * that value. `keyUsage` (default critical), `extendedKeyUsage`, `certificatePolicies`,
- * `policyMappings`, `qcStatements` (default non-critical), and `subjectAltName` (critical exactly
- * when the subject is empty, which the caller knows) take `opts.critical`; `basicConstraints`
+ * `policyMappings`, `qcStatements` and `tlsFeature` (default non-critical), and `subjectAltName`
+ * (critical exactly when the subject is empty, which the caller knows) take `opts.critical`; `basicConstraints`
  * carries `critical` inside its value. An unregistered OID takes `opts.critical` as stated.
  *
  * @opts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.50",
+  "version": "0.8.52",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:4d5a42e5-0e36-46fe-8ef5-f6f19d7c2347",
+  "serialNumber": "urn:uuid:4d4aadb5-0f2b-4564-b30c-638343b637e8",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-05T11:51:03.115Z",
+    "timestamp": "2026-10-05T18:37:07.808Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.50",
+      "bom-ref": "@blamejs/pki@0.8.52",
       "type": "application",
       "name": "pki",
-      "version": "0.8.50",
+      "version": "0.8.52",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.50",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.52",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.50",
+      "ref": "@blamejs/pki@0.8.52",
       "dependsOn": []
     }
   ]