@blamejs/pki 0.8.59 → 0.8.60

package/lib/cmc-build.js

@@ -22,6 +22,9 @@ var key = require("./key");
 var _createPublicKey = nodeCrypto.createPublicKey;
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+/** @internal The append every list here is built with: `push` stores at the index and a store
+ *  consults a setter inherited there, and these lists become the controls a request carries. */
+var _push = intrinsic.append;
 var _hasOwn = intrinsic.hasOwn;
 var _isArray = intrinsic.isArray;
 var _isBuffer = intrinsic.isBuffer;
@@ -449,7 +452,7 @@ function _assertSecret(secret, what) {
 }
 
 function _ownSecret(buf, owned) {
-  owned.push(buf);
+  _push(owned,buf);
   return buf;
 }
 
@@ -804,15 +807,15 @@ async function _build(spec, signer, opts) {
 
   _assertNoDuplicateBinding(callerControls, spec);
   if (spec.transactionId != null) {
-    controls.push(encodeControl(OID_TRANSACTION_ID,
+    _push(controls,encodeControl(OID_TRANSACTION_ID,
       [b.integer(_asBigInt(spec.transactionId, "spec.transactionId"))], ids));
   }
   if (spec.senderNonce != null) {
-    controls.push(encodeControl(OID_SENDER_NONCE,
+    _push(controls,encodeControl(OID_SENDER_NONCE,
       [b.octetString(_der(spec.senderNonce, "spec.senderNonce"))], ids));
   }
   if (spec.dataReturn != null) {
-    controls.push(encodeControl(OID_DATA_RETURN,
+    _push(controls,encodeControl(OID_DATA_RETURN,
       [b.octetString(_der(spec.dataReturn, "spec.dataReturn"))], ids));
   }
 
@@ -839,8 +842,8 @@ async function _build(spec, signer, opts) {
     if (identity != null && typeof identity !== "string") {
       throw E("cmc/bad-input", "identityProof.identity is the UTF8String the Identification control carries");
     }
-    if (identity != null) controls.push(encodeControl(OID_IDENTIFICATION, [b.utf8(identity)], ids));
-    controls.push(encodeControl(OID_IDENTITY_PROOF_V2,
+    if (identity != null) _push(controls,encodeControl(OID_IDENTIFICATION, [b.utf8(identity)], ids));
+    _push(controls,encodeControl(OID_IDENTITY_PROOF_V2,
       [identityProofV2(spec.identityProof.secret, reqSequenceBytes, carriedIdentity)], ids));
   }
 
@@ -933,8 +936,8 @@ async function _build(spec, signer, opts) {
       throw E("cmc/bad-input", "popLinkRandomBytes must be a positive integer");
     }
     var R = nodeCrypto.randomBytes(rBytes);
-    controls.push(encodeControl(OID_POP_LINK_RANDOM, [b.octetString(R)], ids));
-    controls.push(encodeControl(O("id-cmc-popLinkWitnessV2"),
+    _push(controls,encodeControl(OID_POP_LINK_RANDOM, [b.octetString(R)], ids));
+    _push(controls,encodeControl(O("id-cmc-popLinkWitnessV2"),
       [popLinkWitnessV2(spec.popLink.secret, R)], ids));
   }
 
@@ -1016,7 +1019,7 @@ function _copySigners(signer, owned) {
     return c;
   }
   function _own(buf, isSecret) {
-    if (isSecret && owned) owned.push(buf);
+    if (isSecret && owned) _push(owned,buf);
     return buf;
   }
   return Array.isArray(signer) ? guard.list.copyMap(signer, one) : one(signer);

package/lib/cmp-build.js

@@ -56,7 +56,9 @@ var _bufferConcat = intrinsic.bufferConcat;
 var _map = intrinsic.map;
 var _keys = intrinsic.keys;
 var _forEach = intrinsic.forEach;
-var _push = intrinsic.push;
+/** @internal `append`, not a captured `push`: a store at an index walks the prototype chain for a
+ *  setter, so an accessor there takes the element being appended. `append` defines it. */
+var _push = intrinsic.append;
 var _stringify = intrinsic.stringify;
 var _bigInt = intrinsic.BigInt;
 var _Date = intrinsic.Date;
@@ -167,7 +169,7 @@ function _encodeInfoTypeAndValue(itav) {
   if (typeof itav.infoType !== "string" || O(itav.infoType) == null) throw _err("cmp/bad-name", "unknown infoType " + guard.text.showValue(itav.infoType));
   var children = [b.oid(O(itav.infoType))];
   var val = _encodeInfoValue(itav);
-  if (val != null) children.push(val);
+  if (val != null) _push(children,val);
   return b.sequence(children);
 }
 
@@ -238,16 +240,16 @@ function _encodeHeader(headerSpec, protectionAlgDer, pvno) {
   ];
   if (headerSpec.messageTime != null) {
     guard.time.assertEncodable(headerSpec.messageTime, _err, "cmp/bad-input", "header.messageTime");
-    children.push(b.explicit(0, b.generalizedTime(headerSpec.messageTime)));
+    _push(children,b.explicit(0, b.generalizedTime(headerSpec.messageTime)));
   }
-  if (protectionAlgDer != null) children.push(b.explicit(1, b.raw(protectionAlgDer)));
-  if (headerSpec.senderKID != null) children.push(b.explicit(2, _reqOctets(headerSpec.senderKID, "header.senderKID")));
-  if (headerSpec.recipKID != null) children.push(b.explicit(3, _reqOctets(headerSpec.recipKID, "header.recipKID")));
-  if (headerSpec.transactionID != null) children.push(b.explicit(4, _reqOctets(headerSpec.transactionID, "header.transactionID")));
-  if (headerSpec.senderNonce != null) children.push(b.explicit(5, _reqOctets(headerSpec.senderNonce, "header.senderNonce")));
-  if (headerSpec.recipNonce != null) children.push(b.explicit(6, _reqOctets(headerSpec.recipNonce, "header.recipNonce")));
-  if (headerSpec.freeText != null) children.push(b.explicit(7, _encodePkiFreeText(headerSpec.freeText, "cmp/bad-freetext", "header.freeText")));
-  if (headerSpec.generalInfo != null) children.push(b.explicit(8, _encodeGeneralInfo(headerSpec.generalInfo, "cmp/bad-general-info", "header.generalInfo")));
+  if (protectionAlgDer != null) _push(children,b.explicit(1, b.raw(protectionAlgDer)));
+  if (headerSpec.senderKID != null) _push(children,b.explicit(2, _reqOctets(headerSpec.senderKID, "header.senderKID")));
+  if (headerSpec.recipKID != null) _push(children,b.explicit(3, _reqOctets(headerSpec.recipKID, "header.recipKID")));
+  if (headerSpec.transactionID != null) _push(children,b.explicit(4, _reqOctets(headerSpec.transactionID, "header.transactionID")));
+  if (headerSpec.senderNonce != null) _push(children,b.explicit(5, _reqOctets(headerSpec.senderNonce, "header.senderNonce")));
+  if (headerSpec.recipNonce != null) _push(children,b.explicit(6, _reqOctets(headerSpec.recipNonce, "header.recipNonce")));
+  if (headerSpec.freeText != null) _push(children,b.explicit(7, _encodePkiFreeText(headerSpec.freeText, "cmp/bad-freetext", "header.freeText")));
+  if (headerSpec.generalInfo != null) _push(children,b.explicit(8, _encodeGeneralInfo(headerSpec.generalInfo, "cmp/bad-general-info", "header.generalInfo")));
   return b.sequence(children);
 }
 
@@ -267,8 +269,8 @@ function _encodePkiStatusInfo(si, code) {
   if (!si || typeof si !== "object" || Buffer.isBuffer(si)) throw _err(code, "a PKIStatusInfo must be an object { status, statusString?, failInfo? }");
   if (typeof si.status !== "number" || !Number.isInteger(si.status) || si.status < 0 || si.status > 6) throw _err(code, "statusInfo.status must be a PKIStatus 0..6 (RFC 9810 sec. 5.2.3)");
   var children = [b.integer(BigInt(si.status))];
-  if (si.statusString != null) children.push(_encodePkiFreeText(si.statusString, code, "statusInfo.statusString"));
-  if (si.failInfo != null) children.push(_encodeFailInfo(si.failInfo, code));
+  if (si.statusString != null) _push(children,_encodePkiFreeText(si.statusString, code, "statusInfo.statusString"));
+  if (si.failInfo != null) _push(children,_encodeFailInfo(si.failInfo, code));
   return b.sequence(children);
 }
 
@@ -278,10 +280,10 @@ function _encodeCertStatus(cs, state) {
     _reqOctets(cs.certHash, "certConf certHash"),
     b.integer(_reqIdInt(cs.certReqId, "cmp/bad-cert-status", "CertStatus certReqId")),
   ];
-  if (cs.statusInfo != null) children.push(_encodePkiStatusInfo(cs.statusInfo, "cmp/bad-cert-status"));
+  if (cs.statusInfo != null) _push(children,_encodePkiStatusInfo(cs.statusInfo, "cmp/bad-cert-status"));
   if (cs.hashAlg != null) {
     if (typeof cs.hashAlg !== "string" || !CERT_CONF_HASH_ALGS[cs.hashAlg]) throw _err("cmp/bad-name", "certConf hashAlg must be a hash algorithm (sha256 / sha384 / sha512 / sha3-256 / sha3-512 / sha1); got " + guard.text.showValue(cs.hashAlg));
-    children.push(b.explicit(0, _algIdNoParams(cs.hashAlg)));
+    _push(children,b.explicit(0, _algIdNoParams(cs.hashAlg)));
     state.usesCmp2021 = true;
   }
   return b.sequence(children);
@@ -317,7 +319,7 @@ function _encodeRevDetails(rd) {
     certDetails = b.raw(crmf.buildCertTemplate(rd.certDetails));
   }
   var children = [certDetails];
-  if (rd.crlEntryDetails != null) children.push(b.raw(_encodeCrlEntryDetails(rd.crlEntryDetails)));
+  if (rd.crlEntryDetails != null) _push(children,b.raw(_encodeCrlEntryDetails(rd.crlEntryDetails)));
   return b.sequence(children);
 }
 
@@ -419,12 +421,12 @@ function _encodeCertifiedKeyPair(ckp, state) {
   var children = [_encodeCertOrEncCert(ckp, state)];
   if (ckp.privateKey != null) {
     var pk = _b.reqDer(ckp.privateKey, "certifiedKeyPair.privateKey (a pre-encoded EncryptedKey DER)");
-    children.push(b.explicit(0, b.raw(pk)));
+    _push(children,b.explicit(0, b.raw(pk)));
     var pkNode;
     try { pkNode = asn1.decode(pk); } catch (e) { throw _err("cmp/bad-cert-response", "certifiedKeyPair.privateKey is not valid DER", e); }
     if (pkNode.tagClass === "context" && pkNode.tagNumber === 0) state.usesCmp2021 = true;
   }
-  if (ckp.publicationInfo != null) children.push(b.explicit(1, b.raw(_b.reqDer(ckp.publicationInfo, "certifiedKeyPair.publicationInfo (a pre-encoded DER)"))));
+  if (ckp.publicationInfo != null) _push(children,b.explicit(1, b.raw(_b.reqDer(ckp.publicationInfo, "certifiedKeyPair.publicationInfo (a pre-encoded DER)"))));
   return b.sequence(children);
 }
 
@@ -435,8 +437,8 @@ function _encodeCertResponse(cr, state) {
   if (hasCkp && cr.status.failInfo != null) throw _err("cmp/bad-cert-response", "a CertResponse must not carry both failInfo and certifiedKeyPair");
   if (hasCkp && cr.status.status !== 0 && cr.status.status !== 1) throw _err("cmp/bad-cert-response", "a CertResponse certifiedKeyPair is allowed only under a granting status (accepted / grantedWithMods)");
   var children = [b.integer(_reqIdInt(cr.certReqId, "cmp/bad-cert-response", "CertResponse certReqId")), _encodePkiStatusInfo(cr.status, "cmp/bad-cert-response")];
-  if (hasCkp) children.push(_encodeCertifiedKeyPair(cr.certifiedKeyPair, state));
-  if (cr.rspInfo != null) children.push(_reqOctets(cr.rspInfo, "CertResponse.rspInfo"));
+  if (hasCkp) _push(children,_encodeCertifiedKeyPair(cr.certifiedKeyPair, state));
+  if (cr.rspInfo != null) _push(children,_reqOctets(cr.rspInfo, "CertResponse.rspInfo"));
   return b.sequence(children);
 }
 
@@ -446,9 +448,9 @@ function _encodeCertRepMessage(spec, state, arm) {
   var children = [];
   if (spec.caPubs != null) {
     if (!Array.isArray(spec.caPubs) || !spec.caPubs.length) throw _err("cmp/bad-cert-rep", arm + ".caPubs must be a non-empty array of certificate DERs");
-    children.push(b.explicit(1, b.sequence(spec.caPubs.map(function (c) { return _certRaw(c, "cmp/bad-cert-rep", "a caPubs entry"); }))));
+    _push(children,b.explicit(1, b.sequence(spec.caPubs.map(function (c) { return _certRaw(c, "cmp/bad-cert-rep", "a caPubs entry"); }))));
   }
-  children.push(b.sequence(spec.response.map(function (cr) { return _encodeCertResponse(cr, state); })));
+  _push(children,b.sequence(spec.response.map(function (cr) { return _encodeCertResponse(cr, state); })));
   return b.sequence(children);
 }
 
@@ -468,11 +470,11 @@ function _encodeRevRepContent(spec) {
   var children = [b.sequence(spec.status.map(function (si) { return _encodePkiStatusInfo(si, "cmp/bad-rev-rep"); }))];
   if (spec.revCerts != null) {
     if (!Array.isArray(spec.revCerts) || !spec.revCerts.length) throw _err("cmp/bad-rev-rep", "rp.revCerts must be a non-empty array of CertId");
-    children.push(b.explicit(0, b.sequence(spec.revCerts.map(_encodeCertIdRr))));
+    _push(children,b.explicit(0, b.sequence(spec.revCerts.map(_encodeCertIdRr))));
   }
   if (spec.crls != null) {
     if (!Array.isArray(spec.crls) || !spec.crls.length) throw _err("cmp/bad-rev-rep", "rp.crls must be a non-empty array of CertificateList DERs");
-    children.push(b.explicit(1, b.sequence(spec.crls.map(function (c) {
+    _push(children,b.explicit(1, b.sequence(spec.crls.map(function (c) {
       var der = _b.reqDerSequence(c, "crls entry (a CertificateList DER)");
       try { crl.parse(der); }
       catch (e) { if (e instanceof CmpError) throw e; throw _err("cmp/bad-rev-rep", "a crls entry is not a valid CRL (CertificateList)", e); }
@@ -486,8 +488,8 @@ function _encodeErrorMsgContent(spec) {
   if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("cmp/bad-error", "error must be an object { pKIStatusInfo, errorCode?, errorDetails? }");
   if (spec.pKIStatusInfo == null) throw _err("cmp/bad-error", "error.pKIStatusInfo is required");
   var children = [_encodePkiStatusInfo(spec.pKIStatusInfo, "cmp/bad-error")];
-  if (spec.errorCode != null) children.push(b.integer(_reqIdInt(spec.errorCode, "cmp/bad-error", "error.errorCode")));
-  if (spec.errorDetails != null) children.push(_encodePkiFreeText(spec.errorDetails, "cmp/bad-error", "error.errorDetails"));
+  if (spec.errorCode != null) _push(children,b.integer(_reqIdInt(spec.errorCode, "cmp/bad-error", "error.errorCode")));
+  if (spec.errorDetails != null) _push(children,_encodePkiFreeText(spec.errorDetails, "cmp/bad-error", "error.errorDetails"));
   return b.sequence(children);
 }
 
@@ -497,7 +499,7 @@ function _encodePollRepContent(list) {
     if (!pr || typeof pr !== "object" || Buffer.isBuffer(pr)) throw _err("cmp/bad-poll-rep", "each pollRep entry must be an object");
     if (typeof pr.checkAfter !== "number" || !Number.isInteger(pr.checkAfter) || pr.checkAfter < 0 || pr.checkAfter > 0x7fffffff) throw _err("cmp/bad-poll-rep", "pollRep checkAfter must be a non-negative uint31 delay in seconds (RFC 9810 sec. 5.3.22)");
     var kids = [b.integer(_reqIdInt(pr.certReqId, "cmp/bad-poll-rep", "pollRep certReqId")), b.integer(BigInt(pr.checkAfter))];
-    if (pr.reason != null) kids.push(_encodePkiFreeText(pr.reason, "cmp/bad-poll-rep", "pollRep reason"));
+    if (pr.reason != null) _push(kids,_encodePkiFreeText(pr.reason, "cmp/bad-poll-rep", "pollRep reason"));
     return b.sequence(kids);
   }));
 }
@@ -506,14 +508,14 @@ function _encodeKeyRecRepContent(spec, state) {
   if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("cmp/bad-key-rec-rep", "krp must be an object { status, newSigCert?, caCerts?, keyPairHist? }");
   if (spec.status == null) throw _err("cmp/bad-key-rec-rep", "krp.status is required");
   var children = [_encodePkiStatusInfo(spec.status, "cmp/bad-key-rec-rep")];
-  if (spec.newSigCert != null) children.push(b.explicit(0, _certRaw(spec.newSigCert, "cmp/bad-key-rec-rep", "krp.newSigCert")));
+  if (spec.newSigCert != null) _push(children,b.explicit(0, _certRaw(spec.newSigCert, "cmp/bad-key-rec-rep", "krp.newSigCert")));
   if (spec.caCerts != null) {
     if (!Array.isArray(spec.caCerts) || !spec.caCerts.length) throw _err("cmp/bad-key-rec-rep", "krp.caCerts must be a non-empty array of certificate DERs");
-    children.push(b.explicit(1, b.sequence(spec.caCerts.map(function (c) { return _certRaw(c, "cmp/bad-key-rec-rep", "a krp.caCerts entry"); }))));
+    _push(children,b.explicit(1, b.sequence(spec.caCerts.map(function (c) { return _certRaw(c, "cmp/bad-key-rec-rep", "a krp.caCerts entry"); }))));
   }
   if (spec.keyPairHist != null) {
     if (!Array.isArray(spec.keyPairHist) || !spec.keyPairHist.length) throw _err("cmp/bad-key-rec-rep", "krp.keyPairHist must be a non-empty array of CertifiedKeyPair");
-    children.push(b.explicit(2, b.sequence(spec.keyPairHist.map(function (ckp) { return _encodeCertifiedKeyPair(ckp, state); }))));
+    _push(children,b.explicit(2, b.sequence(spec.keyPairHist.map(function (ckp) { return _encodeCertifiedKeyPair(ckp, state); }))));
   }
   return b.sequence(children);
 }
@@ -891,7 +893,7 @@ async function _build(message, opts) {
   var protectionBits = await prot.computeBits(protectedPartDer);
   var msgChildren = [headerTLV, bodyTLV, b.explicit(0, protectionBits)];
   var extraCertsDers = _collectExtraCerts(opts, prot.certDer);
-  if (extraCertsDers.length) msgChildren.push(b.explicit(1, b.sequence(extraCertsDers)));
+  if (extraCertsDers.length) _push(msgChildren,b.explicit(1, b.sequence(extraCertsDers)));
   var der = b.sequence(msgChildren);
 
   cmp.parse(der);
@@ -905,14 +907,14 @@ async function _build(message, opts) {
 
 function _collectExtraCerts(opts, protCertDer) {
   var out = [];
-  if (protCertDer != null) out.push(b.raw(protCertDer));
+  if (protCertDer != null) _push(out,b.raw(protCertDer));
   if (opts.extraCerts != null) {
     if (!Array.isArray(opts.extraCerts)) throw _err("cmp/bad-extra-certs", "opts.extraCerts must be an array of certificate DERs");
     opts.extraCerts.forEach(function (c) {
       var der = _b.reqDerSequence(c, "extraCerts entry (a Certificate DER)");
       try { x509.parse(der); }
       catch (e) { if (e instanceof CmpError) throw e; throw _err("cmp/bad-extra-certs", "an extraCerts entry is not a valid X.509 certificate", e); }
-      out.push(b.raw(der));
+      _push(out,b.raw(der));
     });
   }
   return out;

package/lib/cmp-session.js

@@ -15,6 +15,10 @@ var crmfSign = require("./crmf-sign");
 var cmpBuild = require("./cmp-build");
 var csr = require("./schema-csr");
 var guard = require("./guard-all");
+/** @internal The append every list here is built with: `push` stores at the index and a store
+ *  consults a setter inherited there, and one of these lists is the accumulated CA certificates a
+ *  later leg is authenticated against. */
+var _push = guard.list.append;
 var compositeSig = require("./composite-sig");
 var constants = require("./constants");
 var webcrypto = require("./webcrypto");
@@ -34,7 +38,7 @@ function setEngine(engine) { _engine = engine; }
 var HASHLESS_SIG_OIDS = Object.create(null);
 (function () {
   var names = ["Ed25519", "Ed448", "id-ml-dsa-44", "id-ml-dsa-65", "id-ml-dsa-87"];
-  ["sha2", "shake"].forEach(function (h) { ["128s", "128f", "192s", "192f", "256s", "256f"].forEach(function (s) { names.push("id-slh-dsa-" + h + "-" + s); }); });
+  ["sha2", "shake"].forEach(function (h) { ["128s", "128f", "192s", "192f", "256s", "256f"].forEach(function (s) { _push(names,"id-slh-dsa-" + h + "-" + s); }); });
   names.forEach(function (n) { var o = oid.byName(n); if (o) HASHLESS_SIG_OIDS[o] = 1; });
 })();
 var SIG_OID_TO_HASH = Object.create(null);
@@ -136,11 +140,11 @@ function _asCertList(v) { return v == null ? [] : (Array.isArray(v) ? guard.list
 function _boundedPool(base, added) {
   var ceiling = constants.LIMITS.PATH_BUILD_MAX_CANDIDATES;
   var seen = Object.create(null), distinctBase = [];
-  base.forEach(function (c) { var k = _certIdentity(c); if (k == null) { distinctBase.push(c); return; } if (!seen[k]) { seen[k] = 1; distinctBase.push(c); } });
+  base.forEach(function (c) { var k = _certIdentity(c); if (k == null) { _push(distinctBase,c); return; } if (!seen[k]) { seen[k] = 1; _push(distinctBase,c); } });
   var room = ceiling - distinctBase.length;
   if (room <= 0) return distinctBase;
   var useful = [];
-  added.forEach(function (c) { var k = _certIdentity(c); if (k != null && seen[k]) return; if (k != null) seen[k] = 1; useful.push(c); });
+  added.forEach(function (c) { var k = _certIdentity(c); if (k != null && seen[k]) return; if (k != null) seen[k] = 1; _push(useful,c); });
   return distinctBase.concat(useful.slice(0, room));
 }
 function _certIdentity(cert) {
@@ -228,7 +232,7 @@ function _responseExtraCerts(responseBytes) {
     seen[key] = true;
     try { x509.parse(c); }
     catch (_e) { continue; }
-    out.push(Buffer.from(c));
+    _push(out,Buffer.from(c));
   }
   return out;
 }
@@ -682,7 +686,13 @@ function session(opts) {
         if (!Buffer.isBuffer(c)) return;
         var k = c.toString("base64");
         if (caPubsSeen[k]) {
-          if (isGrantLeg) { for (var pi = 0; pi < caPubsAccum.length; pi++) { if (caPubsAccum[pi].toString("base64") === k) { guard.list.append(caPubsAccum, caPubsAccum.splice(pi, 1)[0]); if (pi < caPubsWaitingCount) caPubsWaitingCount--; break; } } }
+          /** @internal The entry is read, removed and appended as three steps rather than through
+           * `splice`. `splice` RETURNS what it removed, so it builds that result through
+           * `ArraySpeciesCreate`, which reads the receiver's `constructor` and then its
+           * `Symbol.species`: a getter installed on `Array.prototype.constructor` is handed this
+           * accumulator as its `this` while the move is in progress, and the list holds the CA
+           * certificates a later leg is authenticated against. */
+          if (isGrantLeg) { for (var pi = 0; pi < caPubsAccum.length; pi++) { if (caPubsAccum[pi].toString("base64") === k) { var moved = caPubsAccum[pi]; guard.list.removeAt(caPubsAccum, pi); guard.list.append(caPubsAccum, moved); if (pi < caPubsWaitingCount) caPubsWaitingCount--; break; } } }
           return;
         }
         try { x509.parse(c); } catch (e) { throw _err("cmp/bad-cert-response", "an authenticated caPubs entry is not a valid X.509 certificate", e); }
@@ -963,10 +973,10 @@ function session(opts) {
   async function _validateLeaf(leaf, caPubs) {
     if (_engine == null || opts.trustAnchors == null) return;
     var caPubsList = [];
-    if (Array.isArray(caPubs)) caPubs.forEach(function (c) { if (Buffer.isBuffer(c)) caPubsList.push(c); });
+    if (Array.isArray(caPubs)) caPubs.forEach(function (c) { if (Buffer.isBuffer(c)) _push(caPubsList,c); });
     var added = _asCertList(opts.intermediates);
-    if (Buffer.isBuffer(cachedSignerCert)) added.push(cachedSignerCert);
-    cachedChain.forEach(function (c) { if (Buffer.isBuffer(c)) added.push(c); });
+    if (Buffer.isBuffer(cachedSignerCert)) _push(added,cachedSignerCert);
+    cachedChain.forEach(function (c) { if (Buffer.isBuffer(c)) _push(added,c); });
     var pool = _boundedPool(caPubsList, added);
     var res;
     try { res = await _engine.build(leaf, { trustAnchors: _asCertList(opts.trustAnchors), intermediates: pool, validate: true, time: opts.time != null ? opts.time : new Date() }); }
@@ -1395,7 +1405,7 @@ function session(opts) {
       if (limit.total !== null && total > limit.total) {
         throw _err("cmp/bad-input", "the resumeToken " + name + " exceeds the " + limit.total + "-byte pool a transaction holds");
       }
-      out.push(der);
+      _push(out,der);
     }
     return out;
   }

package/lib/cms-decrypt.js

@@ -121,10 +121,10 @@ function _selectCandidates(recips, km, opts) {
   for (var k = 0; k < recips.length; k++) {
     var r = recips[k];
     if (want === "asym" && (r.type === "ktri" || r.type === "kari" || r.type === "ori")) {
-      if (cert && _ridMatches(r, cert)) out.push({ ri: r, index: k });
-    } else if (want === "pwri" && r.type === "pwri") { out.push({ ri: r, index: k }); }
+      if (cert && _ridMatches(r, cert)) intrinsic.append(out, { ri: r, index: k });
+    } else if (want === "pwri" && r.type === "pwri") { intrinsic.append(out, { ri: r, index: k }); }
     else if (want === "kekri" && r.type === "kekri") {
-      if (km.kekId == null || _kekIdMatches(r, km.kekId)) out.push({ ri: r, index: k });
+      if (km.kekId == null || _kekIdMatches(r, km.kekId)) intrinsic.append(out, { ri: r, index: k });
     }
   }
   if (!out.length) throw _err("cms/no-matching-recipient", "no recipient matches the supplied key material");
@@ -563,19 +563,23 @@ async function _aesKwUnwrap(kek, wrapped) {
     guard.secret.zeroize(new Uint8Array(rawAb), CmsError, "cms/bad-input", "the unwrapped content key");
   }
 }
+/** @internal Both KDF-input structures APPEND by defining the index. A store at an index the list
+ *  has no own property at consults a setter inherited from the array prototype, so an accessor there
+ *  would decide the SharedInfo these bytes become and derive a different KEK from the same shared
+ *  secret. */
 function _eccSharedInfo(wrapName, ukm, kekBytes) {
   var kids = [b.sequence([b.oid(O(wrapName))])];
-  if (ukm) kids.push(b.explicit(0, b.octetString(ukm)));
+  if (ukm) intrinsic.append(kids, b.explicit(0, b.octetString(ukm)));
   /** @internal The SuppPubInfo key length is written with the capture, for the same reason the
    *  encrypt side does it: this is KDF input, and a replaced write derives a different KEK from the
    *  same shared secret. */
   var supp = Buffer.alloc(4); intrinsic.writeUInt32BE(supp, kekBytes * 8, 0);
-  kids.push(b.explicit(2, b.octetString(supp)));
+  intrinsic.append(kids, b.explicit(2, b.octetString(supp)));
   return b.sequence(kids);
 }
 function _kemOtherInfo(wrapName, kekBytes, ukm) {
   var kids = [b.sequence([b.oid(O(wrapName))]), b.integer(BigInt(kekBytes))];
-  if (ukm) kids.push(b.explicit(0, b.octetString(ukm)));
+  if (ukm) intrinsic.append(kids, b.explicit(0, b.octetString(ukm)));
   return b.sequence(kids);
 }
 function _pwriUnwrap(kek, wrapped, iv, keyBits) {
@@ -648,7 +652,7 @@ function _originatorSpki(originator) {
   if (!originator || originator.form !== "originatorKey") throw _err("cms/unsupported-algorithm", "kari requires an originatorKey (ephemeral-static ECDH)");
   var v = originator.value;
   var algKids = [b.oid(v.algorithm.oid)];
-  if (v.algorithm.parameters != null) algKids.push(b.raw(v.algorithm.parameters));
+  if (v.algorithm.parameters != null) intrinsic.append(algKids, b.raw(v.algorithm.parameters));
   return b.sequence([b.sequence(algKids), b.bitString(v.publicKey.bytes, v.publicKey.unusedBits)]);
 }
 var MONT = intrinsic.create(null); MONT[O("X25519")] = { name: "X25519", hkdf: "SHA-256" }; MONT[O("X448")] = { name: "X448", hkdf: "SHA-512" };
@@ -710,7 +714,17 @@ async function _verifyAuthenticatedData(parsed, km, opts, requireProtection) {
     guard.der.assertParams(parsed.digestAlgorithm.parameters, "absentOrNull", _err,
       "cms/unsupported-algorithm", parsed.digestAlgorithm.name + " digestAlgorithm (RFC 5754 sec. 2)");
     preimage = _explicitSetOf(parsed.authAttrsBytes);
-    var mdAttr = (parsed.authAttrs || []).filter(function (a) { return a.type === O("messageDigest"); })[0];
+    /** @internal The selection returns the first matching attribute or null. `filter(...)[0]` indexes
+     *  a result that is EMPTY when the attribute is absent, and index 0 of an empty array answers
+     *  from the array prototype, so a value installed there would supply the digest this comparison
+     *  is made against. The refusal restates an invariant the parse already holds: an
+     *  AuthenticatedData with authAttrs is walked through the content-binding check, which requires
+     *  the message-digest attribute (`cms/missing-message-digest`), so this is not reachable from a
+     *  message and is here so the read below cannot be made on something that is not an attribute. */
+    var mdAttr = guard.list.firstMatch(parsed.authAttrs || [], function (a) { return a.type === O("messageDigest"); });
+    if (!mdAttr || mdAttr.values.length !== 1) {
+      throw _err("cms/bad-auth-attrs", "authenticated attributes must carry exactly one message-digest attribute (RFC 5652 sec. 9.2)");
+    }
     mdCheck = { hash: dHash, declared: asn1.read.octetString(asn1.decode(mdAttr.values[0])) };
     /** @internal RFC 6211 sec. 3.2 on this content type: the two comparisons are what make the
      *  outer `digestAlgorithm` and `macAlgorithm` fields mean anything, since the MAC input is the

package/lib/cms-encrypt.js

@@ -14,6 +14,10 @@ var webcrypto = require("./webcrypto");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+/** @internal The append every list here is built with: `push` stores at the index and a store
+ *  consults a setter inherited there. These lists become a recipient info and the key-derivation
+ *  input beside it. */
+var _push = intrinsic.append;
 var pbes2 = require("./pbes2");
 var compositeKem = require("./composite-kem");
 var b = asn1.build;
@@ -66,7 +70,7 @@ function _wrapOidForKek(keyBytes) {
 
 function _gcmParams(nonce, icvLen) {
   var kids = [b.octetString(nonce)];
-  if (icvLen !== 12) kids.push(b.integer(BigInt(icvLen)));
+  if (icvLen !== 12) _push(kids,b.integer(BigInt(icvLen)));
   return b.sequence(kids);
 }
 
@@ -124,12 +128,12 @@ MONT_KA[O("X448")] = { name: "X448", hkdf: "SHA-512", scheme: "dhSinglePass-stdD
 
 function _eccSharedInfo(wrapName, ukm, kekBytes) {
   var kids = [_algId(wrapName, "absent")];
-  if (ukm) kids.push(b.explicit(0, b.octetString(ukm)));
+  if (ukm) _push(kids,b.explicit(0, b.octetString(ukm)));
   /** @internal The SuppPubInfo key length is written with the capture. It is KDF input, so it is part
    *  of what the key-encryption key derives from, and a replaced write derives a different KEK from
    *  the same shared secret. */
   var supp = Buffer.alloc(4); intrinsic.writeUInt32BE(supp, kekBytes * 8, 0);
-  kids.push(b.explicit(2, b.octetString(supp)));
+  _push(kids,b.explicit(2, b.octetString(supp)));
   return b.sequence(kids);
 }
 async function _buildKari(cek, cert, opts) {
@@ -179,8 +183,9 @@ async function _buildKari(cek, cert, opts) {
     var rek = b.sequence([b.sequence([ridNode, b.octetString(encryptedKey)])]);
     var kekAlg = b.sequence([b.oid(O(origKeyAlgId.scheme)), _algId(wrapName, "absent")]);
     var kariKids = [b.integer(3n), b.explicit(0, originatorKey)];
-    if (ukm) kariKids.push(b.explicit(1, b.octetString(ukm)));
-    kariKids.push(kekAlg, rek);
+    if (ukm) _push(kariKids,b.explicit(1, b.octetString(ukm)));
+    _push(kariKids,kekAlg);
+    _push(kariKids,rek);
     return { tag: 1, node: b.sequence(kariKids) };
   } finally {
     guard.secret.zeroizeAll([z, mz, kek], CmsError, "cms/bad-input", "the key-agreement shared secret");
@@ -227,7 +232,7 @@ var KEM_WC = intrinsic.create(null); KEM_WC[O("id-ml-kem-512")] = "ML-KEM-512";
 
 function _kemOtherInfo(wrapName, kekBytes, ukm) {
   var kids = [_algId(wrapName, "absent"), b.integer(BigInt(kekBytes))];
-  if (ukm) kids.push(b.explicit(0, b.octetString(ukm)));
+  if (ukm) _push(kids,b.explicit(0, b.octetString(ukm)));
   return b.sequence(kids);
 }
 async function _kemEncapsulate(keyOid, cert) {
@@ -258,8 +263,9 @@ async function _buildKemri(cek, cert, opts) {
     var encryptedKey = await _aesKwWrap(kek, cek);
     var rid = _rid(cert, opts.keyIdentifier);
     var kemriKids = [b.integer(0n), rid.node, _algId(oid.name(keyOid), "absent"), b.octetString(kemct), _algId("hkdfWithSha256", "absent"), b.integer(BigInt(kekBytes))];
-    if (ukm) kemriKids.push(b.explicit(0, b.octetString(ukm)));
-    kemriKids.push(_algId(wrapName, "absent"), b.octetString(encryptedKey));
+    if (ukm) _push(kemriKids,b.explicit(0, b.octetString(ukm)));
+    _push(kemriKids,_algId(wrapName, "absent"));
+    _push(kemriKids,b.octetString(encryptedKey));
     var kemri = b.sequence(kemriKids);
     return { tag: 4, node: b.sequence([b.oid(O("kem")), kemri]) };
   } finally {
@@ -446,7 +452,7 @@ async function _encryptImpl(content, recipients, opts) {
     if (!recipients.length) throw _err("cms/bad-input", "at least one recipient is required (RFC 5652 sec. 6.1)");
     var recips = [];
     var consumed = intrinsic.create(null);
-    for (var i = 0; i < recipients.length; i++) recips.push(await _buildRecipient(cek, recipients[i], opts, consumed));
+    for (var i = 0; i < recipients.length; i++) _push(recips,await _buildRecipient(cek, recipients[i], opts, consumed));
     _assertDefaultsConsumed(opts, consumed);
     var riNodes = recips.map(_taggedRecipient);
 
@@ -535,8 +541,8 @@ async function _authEnvelopedData(contentBytes, contentStream, cek, ca, contentT
   }
   var eci = b.sequence([b.oid(O(contentType)), b.sequence([b.oid(O(ca.oid)), _gcmParams(nonce, 16)]), b.contextPrimitive(0, g.ct)]);
   var kids = [b.integer(0n), b.setOf(riNodes), eci];
-  if (authAttrsDer) kids.push(authAttrsDer);
-  kids.push(b.octetString(g.tag));
+  if (authAttrsDer) _push(kids,authAttrsDer);
+  _push(kids,b.octetString(g.tag));
   void recips;
   return b.sequence(kids);
 }
@@ -680,7 +686,7 @@ async function _authenticateImpl(content, recipients, opts) {
   try {
     var recips = [];
     var consumedAuth = {};
-    for (var i = 0; i < recipients.length; i++) recips.push(await _buildRecipient(macKey, recipients[i], opts, consumedAuth));
+    for (var i = 0; i < recipients.length; i++) _push(recips,await _buildRecipient(macKey, recipients[i], opts, consumedAuth));
     _assertDefaultsConsumed(opts, consumedAuth);
     var riNodes = recips.map(_taggedRecipient);
 
@@ -705,7 +711,7 @@ async function _authenticateImpl(content, recipients, opts) {
        *  MAC algorithm substitution attack, which is difficult because the attacker does not know
        *  the authentication key". Built from the same values the two outer fields are built from. */
       if (protectionOid) {
-        intrinsic.push(pairs, b.sequence([
+        intrinsic.append(pairs, b.sequence([
           b.oid(protectionOid),
           b.setOf([b.sequence([_algId(digestName), b.implicit(2, _algId(mac.oid))])]),
         ]));
@@ -732,10 +738,10 @@ async function _authenticateImpl(content, recipients, opts) {
 
     var eci = b.sequence([b.oid(O(contentType)), b.explicit(0, b.octetString(contentBytes))]);
     var kids = [b.integer(0n), b.setOf(riNodes), _algId(mac.oid)];
-    if (digestAlgTagged) kids.push(digestAlgTagged);
-    kids.push(eci);
-    if (authAttrsDer) kids.push(authAttrsDer);
-    kids.push(b.octetString(macValue));
+    if (digestAlgTagged) _push(kids,digestAlgTagged);
+    _push(kids,eci);
+    if (authAttrsDer) _push(kids,authAttrsDer);
+    _push(kids,b.octetString(macValue));
     var ci = b.sequence([b.oid(O("authData")), b.explicit(0, b.sequence(kids))]);
     try { schemaCms.parse(ci); } catch (e) { throw (e instanceof CmsError) ? e : _err("cms/bad-input", "the supplied authenticated attributes produced an invalid AuthenticatedData", e); }
     return opts.pem ? schemaCms.pemEncode(ci, "CMS") : ci;