@blamejs/pki 0.8.55 → 0.8.57

package/lib/lint.js

@@ -5087,6 +5087,51 @@ var RFC5652_CMS_RULES = [
       return (encap && encap.eContent) ? null : true;
     },
   },
+  {
+    id: "lint/rfc5652/other-revocation-format-not-read", severity: "notice", source: "rfc5652",
+    citation: "RFC 5940 4",
+    /** @internal The carriage is sec. 10.2.1's `other` arm, which is why the row sits in this
+     * profile; the document that registers the formats is the citation. RFC 5940 sec. 2 registers
+     * `id-ri-ocsp-response` for an OCSP response carried in the `crls` field and sec. 4 registers
+     * `id-ri-scvp` for an SCVP request-response pair. The parse reads the first and leaves the second
+     * as raw bytes, because acting on it needs an SCVP schema this build does not carry. An
+     * unregistered format is opaque for the same reason. Neither is a parse fault: sec. 10.2.1's ANY
+     * DEFINED BY is an extension point, so refusing an unknown format would refuse a future
+     * registered one. The finding tells an operator that revocation information present in the
+     * message was not read, which a reader counting on it needs to know. A notice: the message is
+     * conformant and the entry may be irrelevant to the certificates it travels with.
+     * An id-ri-ocsp-response entry whose OCSPResponse states a responseType this build does not
+     * decode (RFC 6960 sec. 4.2.1) is reported for the same reason: the format was recognized, the
+     * revocation information still was not read, and `responseType` in the context names why. */
+    message: "a crls entry carries revocation information this build does not read, so it was not consulted",
+    /** @internal Every content type that can carry a RevocationInfoChoice: SignedData's own `crls`
+     * and the `originatorInfo.crls` that EnvelopedData, AuthenticatedData and AuthEnvelopedData
+     * share. The buckets are read by presence rather than by content type, so one predicate admits
+     * each carrier and a type that carries neither draws nothing. */
+    appliesTo: function (cms) {
+      return Array.isArray(cms.crls) || !!(cms.originatorInfo && Array.isArray(cms.originatorInfo.crls));
+    },
+    check: function (cms) {
+      var out = [];
+      var buckets = [{ where: "crls", list: cms.crls },
+        { where: "originatorInfo.crls", list: cms.originatorInfo && cms.originatorInfo.crls }];
+      buckets.forEach(function (bucket) {
+        if (!Array.isArray(bucket.list)) return;
+        bucket.list.forEach(function (entry, index) {
+          if (!entry || entry.tagClass !== "context") return;
+          var resp = entry.ocspResponse;
+          if (resp && resp.basicResponse) return;
+          var rb = resp && resp.responseBytes;
+          out.push({ context: { placement: bucket.where, index: index,
+            otherRevInfoFormat: entry.otherRevInfoFormat,
+            otherRevInfoFormatName: entry.otherRevInfoFormatName,
+            responseType: (rb && rb.responseType) || null,
+            responseTypeName: (rb && rb.responseTypeName) || null } });
+        });
+      });
+      return out.length ? out : null;
+    },
+  },
 ];
 
 /** @internal RFC 8933 updates RFC 5652 rather than restating it, so its rows are their own profile:
@@ -7141,7 +7186,9 @@ function _ingestOcsp(input) {
  * already-parsed `pki.schema.ocsp.parseResponse` object. It returns the same `LintReport` shape
  * `pki.lint.certificate` returns, and it never throws on the data path: bytes that are not a
  * well-formed response produce a single `fatal` finding `lint/unparseable` carrying the strict
- * parser's own code. A non-successful response carries no BasicOCSPResponse and draws no row.
+ * parser's own code. A response with no BasicOCSPResponse to grade draws no row: a non-successful
+ * status carries none, and neither does a response carried in a CMS `crls` entry whose
+ * `responseType` this build does not decode.
  *
  * The `rfc6960` rows cover each SingleResponse's update times and their relation to producedAt,
  * an empty `certs` field, the extended revoked definition (criticality, value and placement) and
@@ -7203,8 +7250,9 @@ function ocsp(input, opts) {
     report = { findings: [ingested.fatal], ran: [],
       counts: Object.assign(Object.create(null), { fatal: 1, error: 0, warn: 0, notice: 0, pass: 0, na: 0, ne: 0 }) };
   } else if (!ingested.response.basicResponse) {
-    /** @internal A non-successful response carries no BasicOCSPResponse, so every row is not
-     * applicable to it: the profile grades responses, and an error status is not one. */
+    /** @internal Every row is not applicable to a response with no BasicOCSPResponse: the profile
+     * grades a response body, and neither an error status nor a responseType this build does not
+     * decode produces one. */
     report = { findings: [], ran: [],
       counts: Object.assign(Object.create(null), { fatal: 0, error: 0, warn: 0, notice: 0, pass: 0, na: rules_.length, ne: 0 }) };
   } else {

package/lib/merkle.js

@@ -516,7 +516,7 @@ function consistencyProof(opts) {
   return _subproof(leaves, 0, n, m, true);
 }
 
-module.exports = {
+module.exports = intrinsic.freeze({
   leafHash:          leafHash,
   nodeHash:          nodeHash,
   emptyRootHash:     emptyRootHash,
@@ -525,4 +525,4 @@ module.exports = {
   verifyConsistency: verifyConsistency,
   inclusionProof:    inclusionProof,
   consistencyProof:  consistencyProof,
-};
+});

package/lib/ocsp-request-verify.js

@@ -12,4 +12,4 @@ function verifyRequestSignature(signatureAlgorithm, signature, signerSpkiBytes,
   return _seam.verify(signatureAlgorithm, signature, signerSpkiBytes, tbsRequestBytes);
 }
 
-module.exports = { setEngine: _seam.setEngine, verifyRequestSignature: verifyRequestSignature };
+module.exports = Object.freeze({ setEngine: _seam.setEngine, verifyRequestSignature: verifyRequestSignature });

package/lib/ocsp.js

@@ -40,7 +40,6 @@ var _promiseResolve = _ocspIntrinsic.uncurry(_ocspIntrinsic.promiseResolve);
 var _promiseReject = _ocspIntrinsic.uncurry(_ocspIntrinsic.promiseReject);
 /** @internal The CertID hashes bind a response to the certificate it answers for, and they are awaited
  *  as a pair, so a replaced `all` decides what that pair contains. */
-var _promiseAll = _ocspIntrinsic.uncurry(_ocspIntrinsic.promiseAll);
 var oid = require("./oid");
 var x509 = require("./schema-x509");
 var ocspSchema = require("./schema-ocsp");
@@ -77,7 +76,12 @@ var ENTRY_EXTENSION_CRITICALITY = crlSchema.entryExtensionCriticality(oid);
 var CERTIFICATE_HOLD = REASON_CODE.certificateHold, REMOVE_FROM_CRL = REASON_CODE.removeFromCRL;
 var OID_REASON_CODE = O("reasonCode");
 
-function _digest(wcHash, buf) { return subtle.digest(wcHash, buf).then(function (h) { return Buffer.from(h); }); }
+/** @internal Continued through the capture. Every CertID in a request and the key hash a responder
+ *  names itself by come out of this step, so a replacement settling it names another certificate's
+ *  identity, or another responder's key, in bytes that are then signed. */
+function _digest(wcHash, buf) {
+  return _ocspIntrinsic.chain(subtle.digest(wcHash, buf), function (h) { return Buffer.from(h); });
+}
 function _certOf(arg, what) {
   var label = what || "a certificate";
   return guard.parsed.acceptDerived(arg, "certificate", function (bytes) {
@@ -115,10 +119,14 @@ var REQUESTER_NONCE_FLOOR = 32, RESPONDER_NONCE_FLOOR = 1;
 function _buildCertID(cert, issuer, hashName) {
   var wc = HASH_WC[guard.text.keyOf(hashName)];
   if (!wc) throw _err("ocsp/bad-input", "unsupported CertID hashAlgorithm " + guard.text.showValue(hashName) + " (sha1 / sha256 / sha384 / sha512)");
-  return _promiseAll(_Promise, [
+  /** @internal The two hashes are awaited through the aggregate that consults nothing replaceable.
+   *  The static form reads `resolve` off the constructor at each call, and these two digests ARE the
+   *  CertID a responder answers about, so a replacement answering for either names another
+   *  certificate's identity in the request. */
+  return _ocspIntrinsic.chain(_ocspIntrinsic.allOf([
     _digest(wc, issuer.subject.bytes),
     _digest(wc, _keyValue(issuer.subjectPublicKeyInfo.bytes)),
-  ]).then(function (hashes) {
+  ]), function (hashes) {
     var hashAlgId = hashName === "sha1" ? b.sequence([b.oid(O(hashName)), b.nullValue()]) : b.sequence([b.oid(O(hashName))]);
     return b.sequence([
       hashAlgId,
@@ -204,13 +212,15 @@ function _buildRequest(query, opts) {
     requestorNameDer = signerCert.subject.bytes;
   }
 
-  return _promiseAll(_Promise, queries.map(function (q) {
+  /** @internal Each query's CertID is awaited through the aggregate that consults nothing
+   *  replaceable, for the reason at `_buildCertID`. */
+  var builtRequests = _ocspIntrinsic.allOf(_ocspIntrinsic.mapList(queries, function (q) {
     if (!q || typeof q !== "object") throw _err("ocsp/bad-input", "each query must be { cert, issuer }");
     guard.identifier.assertKnownKeys(q, _QUERY_KEYS, _err, "ocsp/bad-input", "unknown query field (a query is { cert, issuer, singleRequestExtensions? }): ");
     if (q.cert == null || q.issuer == null) throw _err("ocsp/bad-input", "each query must be { cert, issuer }");
     var cert = _certOf(q.cert, "the query certificate");
     var issuer = _certOf(q.issuer, "the issuer certificate");
-    return _buildCertID(cert, issuer, hashName).then(function (certID) {
+    return _ocspIntrinsic.chain(_buildCertID(cert, issuer, hashName), function (certID) {
       var reqChildren = [certID];
       if (q.singleRequestExtensions != null) {
         /** @internal Read through the same door the sibling lists in this module use, so a value that is
@@ -225,7 +235,8 @@ function _buildRequest(query, opts) {
       }
       return b.sequence(reqChildren);
     });
-  })).then(function (requests) {
+  }));
+  return _ocspIntrinsic.chain(builtRequests, function (requests) {
     var tbsChildren = [];
     if (requestorNameDer !== null) tbsChildren.push(b.explicit(1, b.contextConstructed(4, requestorNameDer)));
     tbsChildren.push(b.sequence(requests));
@@ -239,10 +250,12 @@ function _buildRequest(query, opts) {
     var tbsRequest = b.sequence(tbsChildren);
     if (signerCert === null) return _emitReq(b.sequence([tbsRequest]), opts);
     var scheme = signScheme.resolveSignScheme(signerCert, { combinedRsaSig: true }, true, _signE);
-    return signScheme.signOverTbs(scheme, opts.signer.key, tbsRequest, _signE).then(function (sig) {
+    return _ocspIntrinsic.chain(signScheme.signOverTbs(scheme, opts.signer.key, tbsRequest, _signE), function (sig) {
       /** @internal The request is held to the same proof a certificate is: the signature verifies
-       * against the public key the certificate it carries declares. */
-      return _promiseResolve(_Promise, _b.assertSignatureVerifies(tbsRequest, sig, signerCert.subjectPublicKeyInfo.bytes, scheme)).then(function () {
+       * against the public key the certificate it carries declares. Both continuations are captured,
+       * since the inner one runs only after that proof has been made. */
+      var selfChecked = _promiseResolve(_Promise, _b.assertSignatureVerifies(tbsRequest, sig, signerCert.subjectPublicKeyInfo.bytes, scheme));
+      return _ocspIntrinsic.chain(selfChecked, function () {
         var optionalSignature = b.sequence([scheme.sigAlgId, b.bitString(sig, 0), b.explicit(0, b.sequence([b.raw(signerCertDer)]))]);
         return _emitReq(b.sequence([tbsRequest, b.explicit(0, optionalSignature)]), opts);
       });
@@ -353,7 +366,8 @@ function _sign(responseData, responder, opts) {
   try {
     pending = _signResponse(responseData, responder, respCert, respCertDer, responderKey, opts);
   } catch (e) { _wipeOwnedKey(); throw e; }
-  return pending.then(function (out) { _wipeOwnedKey(); return out; },
+  /** @internal Captured: this continuation is what wipes a key this verb owns, on either outcome. */
+  return _ocspIntrinsic.chain(pending, function (out) { _wipeOwnedKey(); return out; },
     function (e) { _wipeOwnedKey(); throw e; });
 }
 
@@ -361,10 +375,12 @@ function _signResponse(responseData, responder, respCert, respCertDer, responder
   var responses = responseData.responses != null ? pkiBuild.reqDenseArray(responseData.responses, "responses", _err, "ocsp/bad-input") : [];
   if (!responses.length) throw _err("ocsp/bad-input", "a response MUST include at least one SingleResponse (RFC 6960 sec. 4.2.1)");
 
-  return _responderID(responseData.responderID, respCert).then(function (ridNode) {
-    return _promiseAll(_Promise, responses.map(function (r) { return _buildSingleResponse(r, opts); })).then(function (built) {
-      var srNodes = built.map(function (x) { return x.node; });
-      var anyNonIssued = built.some(function (x) { return x.nonIssued; });
+  return _ocspIntrinsic.chain(_responderID(responseData.responderID, respCert), function (ridNode) {
+    return _ocspIntrinsic.chain(_ocspIntrinsic.allOf(_ocspIntrinsic.mapList(responses, function (r) {
+      return _buildSingleResponse(r, opts);
+    })), function (built) {
+      var srNodes = _ocspIntrinsic.mapList(built, function (x) { return x.node; });
+      var anyNonIssued = _ocspIntrinsic.some(built, function (x) { return x.nonIssued; });
       /** @internal Sec. 2.2 and 4.4.8: a "revoked" answer for a non-issued certificate MUST carry the
        *  extended revoked definition in responseExtensions, so the shape itself places it there,
        *  and a caller declining it is refused rather than left with a response the section forbids. */
@@ -378,10 +394,12 @@ function _signResponse(responseData, responder, respCert, respCertDer, responder
       if (respExts.length) rdChildren.push(b.explicit(1, b.sequence(respExts)));
       var responseDataDer = b.sequence(rdChildren);
       var scheme = signScheme.resolveSignScheme(respCert, { combinedRsaSig: true }, true, _signE);
-      return signScheme.signOverTbs(scheme, responderKey, responseDataDer, _signE).then(function (sig) {
+      return _ocspIntrinsic.chain(signScheme.signOverTbs(scheme, responderKey, responseDataDer, _signE), function (sig) {
         /** @internal The response is held to the same proof a certificate is: the signature verifies
-         * against the public key the responder certificate declares. */
-        return _promiseResolve(_Promise, _b.assertSignatureVerifies(responseDataDer, sig, respCert.subjectPublicKeyInfo.bytes, scheme)).then(function () {
+         * against the public key the responder certificate declares. Both continuations are captured,
+         * since the inner one runs only after that proof has been made. */
+        var selfChecked = _promiseResolve(_Promise, _b.assertSignatureVerifies(responseDataDer, sig, respCert.subjectPublicKeyInfo.bytes, scheme));
+        return _ocspIntrinsic.chain(selfChecked, function () {
           var basicChildren = [responseDataDer, scheme.sigAlgId, b.bitString(sig, 0)];
           if (opts.embedCert !== false) basicChildren.push(b.explicit(0, b.sequence([b.raw(respCertDer)])));
           var responseBytes = b.sequence([b.oid(OID_OCSP_BASIC), b.octetString(b.sequence(basicChildren))]);
@@ -422,7 +440,10 @@ function _snapshotSignerKey(key, owned) {
 
 function _responderID(rid, respCert) {
   if (rid == null || rid === "byName") return _promiseResolve(_Promise, b.explicit(1, b.raw(respCert.subject.bytes)));
-  if (rid === "byKey") return _digest("SHA-1", _keyValue(respCert.subjectPublicKeyInfo.bytes)).then(function (kh) { return b.explicit(2, b.octetString(kh)); });
+  if (rid === "byKey") {
+    return _ocspIntrinsic.chain(_digest("SHA-1", _keyValue(respCert.subjectPublicKeyInfo.bytes)),
+      function (kh) { return b.explicit(2, b.octetString(kh)); });
+  }
   throw _err("ocsp/bad-input", "responderID must be \"byName\" or \"byKey\"");
 }
 function _buildSingleResponse(r, opts) {
@@ -438,7 +459,7 @@ function _buildSingleResponse(r, opts) {
    * map into Promise.all, so a synchronous throw here would abort the map before Promise.all
    * attached handlers, and an earlier entry's rejection would be orphaned: the caller catches
    * sign()'s failure and the process still sees an unhandled rejection. */
-  return certIdP.then(function (certID) {
+  return _ocspIntrinsic.chain(certIdP, function (certID) {
     var thisUpdate = _asEncodableDate(r.thisUpdate, "thisUpdate") || new Date();
     var nextUpdate = r.nextUpdate === null ? null : (_asEncodableDate(r.nextUpdate, "nextUpdate") || _defaultNextUpdate());
     /** @internal RFC 6960 sec. 4.2.2.1 makes thisUpdate and nextUpdate a validity interval, and says
@@ -638,6 +659,13 @@ function buildErrorResponse(status) {
  * replayed would hand a soft-failing caller the very certificate the responder refused. A replayed
  * `revoked` is therefore reported as `revoked` with `nonceMatched: false`.
  *
+ * `response` is DER `Buffer` / `Uint8Array`, a PEM `OCSP RESPONSE` string, or an unmodified
+ * `pki.schema.ocsp.parseResponse` result, which includes the record a CMS `crls` entry surfaces in
+ * `ocspResponse`. From bytes, a `responseType` this build does not decode is the parse fault
+ * `ocsp/unsupported-response-type`. A record that carries such a response, which RFC 5940 sec. 3
+ * permits a message to carry, is taken and determines nothing: the verdict is `"unknown"` with no
+ * `signatureValid`, because the body stating the certificate's status was never read.
+ *
  * @opts
  *   cert            the target certificate (parsed, DER, or PEM) -- REQUIRED.
  *   issuer          its issuer certificate (parsed, DER, or PEM) -- REQUIRED.
@@ -687,8 +715,11 @@ function verify(response, opts) {
     try { reqNonce = guard.bytes.snapshotSource(reqNonce, OcspError, "ocsp/bad-input", "opts.requestNonce"); }
     catch (e) { return _promiseReject(_Promise, e); }
   }
-  return pathValidate.verifyOcspResponse(parsed, cert, issuerCert, time,
-    { historicalMode: opts.historicalMode === true, requestNonce: reqNonce }).then(function (verdict) {
+  /** @internal Captured: this continuation is where the response's status becomes the verdict a
+   * caller reads, so a settled value in place of it reports a status nothing evaluated. */
+  var evaluated = pathValidate.verifyOcspResponse(parsed, cert, issuerCert, time,
+    { historicalMode: opts.historicalMode === true, requestNonce: reqNonce });
+  return _ocspIntrinsic.chain(evaluated, function (verdict) {
     return guard.verdict.of(verdict, { valid: verdict.status === "good" });
   });
 }

package/lib/oid.js

@@ -432,6 +432,13 @@ var FAMILIES = Object.assign(Object.create(null), {
     scepMessageType: 2, scepPkiStatus: 3, scepFailInfo: 4,
     scepSenderNonce: 5, scepRecipientNonce: 6, scepTransactionId: 7 } },
   scep: { base: [1, 3, 6, 1, 5, 5, 7, 24], of: { scepFailInfoText: 1 } },
+  /** @internal id-ri, the RFC 5940 revocation-information arc. Only the two leaves a reader can act
+   *  on are registered: 2 names an OCSPResponse carried in a CMS `crls` field (RFC 5940 sec. 2) and
+   *  4 names an SCVP request-response pair (sec. 4). Leaves 1 and 3 are the SCVP sub-arcs RFC 5940
+   *  does not define a CMS carriage for. The hyphenated member names are the RFC's own; `ocspResponse`
+   *  is already bound to the OCSP nonce arc's `1.3.6.1.5.5.7.48.1.4` and is read by name from the
+   *  OCSP extension-placement table, so reusing it here would redirect that table as well. */
+  idRi: { base: [1, 3, 6, 1, 5, 5, 7, 16], of: { "id-ri-ocsp-response": 2, "id-ri-scvp": 4 } },
 });
 
 var _byOid = new Map();