@blamejs/pki 0.8.59 → 0.8.61

package/lib/cbor-det.js

@@ -40,6 +40,12 @@ var constants = require("./constants");
 var frameworkError = require("./framework-error");
 var asn1 = require("./asn1-der");
 var guard = require("./guard-all");
+/** @internal The append every list in this module is built with. `push` STORES at the index, and a
+ *  store walks the prototype chain for a setter, so an accessor inherited at an array index receives
+ *  each element as it is appended and the index then reads back whatever its getter answers. The
+ *  decoded children below are what every C509 field is read out of, so a replaced element there is a
+ *  field this codec never decoded. */
+var _push = guard.list.append;
 
 var CborError = frameworkError.CborError;
 
@@ -141,7 +147,7 @@ function _decodeItem(buf, start, limit, depth, maxD, rules, state) {
     var cp = contentStart;
     for (var i = 0n; i < argument; i++) {
       var el = _decodeItem(buf, cp, limit, depth + 1, maxD, rules, state);
-      children.push(el.node);
+      _push(children, el.node);
       cp = el.end;
     }
     end = cp;
@@ -158,7 +164,7 @@ function _decodeItem(buf, start, limit, depth, maxD, rules, state) {
         if (cmp > 0) throw new CborError("cbor/unsorted-map-keys", "map keys are not in bytewise-ascending order");
         if (cmp === 0) throw new CborError("cbor/duplicate-map-key", "duplicate map key");
       }
-      children.push([k.node, v.node]);
+      _push(children, [k.node, v.node]);
     }
     end = mp;
   } else if (mt === 6) {
@@ -682,7 +688,7 @@ var build = Object.assign(Object.create(null), {
     enc = guard.list.sortedCopy(enc, function (a, b) { return guard.bytes.compare(a[0], b[0]); });
     for (var i = 1; i < enc.length; i++) { if (guard.bytes.compare(enc[i - 1][0], enc[i][0]) === 0) throw new CborError("cbor/duplicate-map-key", "build.map: duplicate map key"); }
     var flat = [_head(5, pairs.length, "build.map")];
-    enc.forEach(function (p) { flat.push(p[0], p[1]); });
+    enc.forEach(function (p) { _push(flat, p[0]); _push(flat, p[1]); });
     return _assertDecodes(Buffer.concat(flat), "build.map");
   },
   tag: function (tagNum, inner) { return _assertDecodes(Buffer.concat([_head(6, tagNum, "build.tag"), _cbItem(inner, "build.tag content")]), "build.tag"); },

package/lib/cmc-build.js

@@ -22,6 +22,9 @@ var key = require("./key");
 var _createPublicKey = nodeCrypto.createPublicKey;
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+/** @internal The append every list here is built with: `push` stores at the index and a store
+ *  consults a setter inherited there, and these lists become the controls a request carries. */
+var _push = intrinsic.append;
 var _hasOwn = intrinsic.hasOwn;
 var _isArray = intrinsic.isArray;
 var _isBuffer = intrinsic.isBuffer;
@@ -449,7 +452,7 @@ function _assertSecret(secret, what) {
 }
 
 function _ownSecret(buf, owned) {
-  owned.push(buf);
+  _push(owned,buf);
   return buf;
 }
 
@@ -467,8 +470,8 @@ function identityProofV2(secret, reqSequenceBytes, identity) {
         _ownSecret(Buffer.from(identity, "utf8"), owned),
       ]), owned);
     }
-    key = nodeCrypto.createHash("sha256").update(material).digest();
-    var witness = nodeCrypto.createHmac("sha256", key).update(reqSequenceBytes).digest();
+    key = guard.crypto.digest("sha256", material);
+    var witness = guard.crypto.hmac("sha256", key, reqSequenceBytes);
     return b.sequence([algId(OID_SHA256), algId(OID_HMAC_SHA256), b.octetString(witness)]);
   } finally {
     if (key) guard.secret.zeroize(key, CmcError, "cmc/bad-input", "the Identity Proof MAC key");
@@ -538,7 +541,7 @@ function _provesRequestKey(opening, outgoing) {
     /** @internal Keys of different types are never the same key, and comparing them through the
      * runtime's equality leaves a fault queued in the crypto library that surfaces on the next
      * unrelated key import in the process, so the type decides that case first. */
-    if (requested.asymmetricKeyType !== opening.key.asymmetricKeyType) return false;
+    if (guard.crypto.keyType(requested) !== guard.crypto.keyType(opening.key)) return false;
     return intrinsic.keyEquals(requested, opening.key);
   }
   /** @internal A key the runtime engine cannot read has no KeyObject to compare, and a composite
@@ -604,7 +607,7 @@ async function _recoverProofValue(decoded, recipient, witnessHash) {
       continue;   // allow:swallow-unverified this recipient is not addressed to the supplied key; the witness decides
     }
     var candidate = opened.content;
-    var computed = nodeCrypto.createHash(witnessHash).update(candidate).digest();
+    var computed = guard.crypto.digest(witnessHash, candidate);
     var matches = computed.length === decoded.witness.length &&
       guard.crypto.constantTimeEqual(computed, decoded.witness);
     guard.secret.zeroize(computed, CmcError, "cmc/bad-input", "the computed witness");
@@ -671,7 +674,7 @@ async function answerPopChallenge(popChallenge, ids) {
      * in the challenge at all: neither side re-encodes it. */
     macKey = _bufferFrom(proofValue.length > POP_MAC_KEY_MAX_BYTES
       ? _subarray(proofValue, 0, POP_MAC_KEY_MAX_BYTES) : proofValue);
-    var thePOP = nodeCrypto.createHmac(macHash, macKey).update(decoded.requestBytes).digest();
+    var thePOP = guard.crypto.hmac(macHash, macKey, decoded.requestBytes);
     return { algBytes: decoded.thePOPAlgID.bytes, thePOP: thePOP, ids: ids,
       recipientSpki: await _openingPublicKey(recipient, recovered.recipientType),
       challengedRequest: _requestIdentity(decoded.request) };
@@ -685,13 +688,18 @@ async function answerPopChallenge(popChallenge, ids) {
 
 function popLinkWitnessV2(secret, R) {
   _assertSecret(secret, "a POP Link Witness V2 control");
-  var key = nodeCrypto.createHash("sha256").update(secret, "utf8").digest();
+  /** @internal The secret's octets, held so the finally can wipe them. Handing the string and an
+   *  encoding to a digest instead leaves the copy inside the provider, where nothing clears it. */
+  var material = _bufferFrom(secret, "utf8");
+  var key = null;
   try {
+    key = guard.crypto.digest("sha256", material);
     /** @internal Inside the try, so a MAC that faults on its message still wipes the key above it. */
-    var witness = nodeCrypto.createHmac("sha256", key).update(R).digest();
+    var witness = guard.crypto.hmac("sha256", key, R);
     return b.sequence([algId(OID_SHA256), algId(OID_HMAC_SHA256), b.octetString(witness)]);
   } finally {
-    guard.secret.zeroize(key, CmcError, "cmc/bad-input", "the POP Link MAC key");
+    guard.secret.zeroize(material, CmcError, "cmc/bad-input", "the POP Link secret");
+    if (key !== null) guard.secret.zeroize(key, CmcError, "cmc/bad-input", "the POP Link MAC key");
   }
 }
 
@@ -804,15 +812,15 @@ async function _build(spec, signer, opts) {
 
   _assertNoDuplicateBinding(callerControls, spec);
   if (spec.transactionId != null) {
-    controls.push(encodeControl(OID_TRANSACTION_ID,
+    _push(controls,encodeControl(OID_TRANSACTION_ID,
       [b.integer(_asBigInt(spec.transactionId, "spec.transactionId"))], ids));
   }
   if (spec.senderNonce != null) {
-    controls.push(encodeControl(OID_SENDER_NONCE,
+    _push(controls,encodeControl(OID_SENDER_NONCE,
       [b.octetString(_der(spec.senderNonce, "spec.senderNonce"))], ids));
   }
   if (spec.dataReturn != null) {
-    controls.push(encodeControl(OID_DATA_RETURN,
+    _push(controls,encodeControl(OID_DATA_RETURN,
       [b.octetString(_der(spec.dataReturn, "spec.dataReturn"))], ids));
   }
 
@@ -839,8 +847,8 @@ async function _build(spec, signer, opts) {
     if (identity != null && typeof identity !== "string") {
       throw E("cmc/bad-input", "identityProof.identity is the UTF8String the Identification control carries");
     }
-    if (identity != null) controls.push(encodeControl(OID_IDENTIFICATION, [b.utf8(identity)], ids));
-    controls.push(encodeControl(OID_IDENTITY_PROOF_V2,
+    if (identity != null) _push(controls,encodeControl(OID_IDENTIFICATION, [b.utf8(identity)], ids));
+    _push(controls,encodeControl(OID_IDENTITY_PROOF_V2,
       [identityProofV2(spec.identityProof.secret, reqSequenceBytes, carriedIdentity)], ids));
   }
 
@@ -932,9 +940,9 @@ async function _build(spec, signer, opts) {
     if (typeof rBytes !== "number" || !Number.isInteger(rBytes) || rBytes < 1) {
       throw E("cmc/bad-input", "popLinkRandomBytes must be a positive integer");
     }
-    var R = nodeCrypto.randomBytes(rBytes);
-    controls.push(encodeControl(OID_POP_LINK_RANDOM, [b.octetString(R)], ids));
-    controls.push(encodeControl(O("id-cmc-popLinkWitnessV2"),
+    var R = guard.crypto.randomBytes(rBytes);
+    _push(controls,encodeControl(OID_POP_LINK_RANDOM, [b.octetString(R)], ids));
+    _push(controls,encodeControl(O("id-cmc-popLinkWitnessV2"),
       [popLinkWitnessV2(spec.popLink.secret, R)], ids));
   }
 
@@ -1016,7 +1024,7 @@ function _copySigners(signer, owned) {
     return c;
   }
   function _own(buf, isSecret) {
-    if (isSecret && owned) owned.push(buf);
+    if (isSecret && owned) _push(owned,buf);
     return buf;
   }
   return Array.isArray(signer) ? guard.list.copyMap(signer, one) : one(signer);

package/lib/cmp-build.js

@@ -56,7 +56,9 @@ var _bufferConcat = intrinsic.bufferConcat;
 var _map = intrinsic.map;
 var _keys = intrinsic.keys;
 var _forEach = intrinsic.forEach;
-var _push = intrinsic.push;
+/** @internal `append`, not a captured `push`: a store at an index walks the prototype chain for a
+ *  setter, so an accessor there takes the element being appended. `append` defines it. */
+var _push = intrinsic.append;
 var _stringify = intrinsic.stringify;
 var _bigInt = intrinsic.BigInt;
 var _Date = intrinsic.Date;
@@ -167,7 +169,7 @@ function _encodeInfoTypeAndValue(itav) {
   if (typeof itav.infoType !== "string" || O(itav.infoType) == null) throw _err("cmp/bad-name", "unknown infoType " + guard.text.showValue(itav.infoType));
   var children = [b.oid(O(itav.infoType))];
   var val = _encodeInfoValue(itav);
-  if (val != null) children.push(val);
+  if (val != null) _push(children,val);
   return b.sequence(children);
 }
 
@@ -238,16 +240,16 @@ function _encodeHeader(headerSpec, protectionAlgDer, pvno) {
   ];
   if (headerSpec.messageTime != null) {
     guard.time.assertEncodable(headerSpec.messageTime, _err, "cmp/bad-input", "header.messageTime");
-    children.push(b.explicit(0, b.generalizedTime(headerSpec.messageTime)));
+    _push(children,b.explicit(0, b.generalizedTime(headerSpec.messageTime)));
   }
-  if (protectionAlgDer != null) children.push(b.explicit(1, b.raw(protectionAlgDer)));
-  if (headerSpec.senderKID != null) children.push(b.explicit(2, _reqOctets(headerSpec.senderKID, "header.senderKID")));
-  if (headerSpec.recipKID != null) children.push(b.explicit(3, _reqOctets(headerSpec.recipKID, "header.recipKID")));
-  if (headerSpec.transactionID != null) children.push(b.explicit(4, _reqOctets(headerSpec.transactionID, "header.transactionID")));
-  if (headerSpec.senderNonce != null) children.push(b.explicit(5, _reqOctets(headerSpec.senderNonce, "header.senderNonce")));
-  if (headerSpec.recipNonce != null) children.push(b.explicit(6, _reqOctets(headerSpec.recipNonce, "header.recipNonce")));
-  if (headerSpec.freeText != null) children.push(b.explicit(7, _encodePkiFreeText(headerSpec.freeText, "cmp/bad-freetext", "header.freeText")));
-  if (headerSpec.generalInfo != null) children.push(b.explicit(8, _encodeGeneralInfo(headerSpec.generalInfo, "cmp/bad-general-info", "header.generalInfo")));
+  if (protectionAlgDer != null) _push(children,b.explicit(1, b.raw(protectionAlgDer)));
+  if (headerSpec.senderKID != null) _push(children,b.explicit(2, _reqOctets(headerSpec.senderKID, "header.senderKID")));
+  if (headerSpec.recipKID != null) _push(children,b.explicit(3, _reqOctets(headerSpec.recipKID, "header.recipKID")));
+  if (headerSpec.transactionID != null) _push(children,b.explicit(4, _reqOctets(headerSpec.transactionID, "header.transactionID")));
+  if (headerSpec.senderNonce != null) _push(children,b.explicit(5, _reqOctets(headerSpec.senderNonce, "header.senderNonce")));
+  if (headerSpec.recipNonce != null) _push(children,b.explicit(6, _reqOctets(headerSpec.recipNonce, "header.recipNonce")));
+  if (headerSpec.freeText != null) _push(children,b.explicit(7, _encodePkiFreeText(headerSpec.freeText, "cmp/bad-freetext", "header.freeText")));
+  if (headerSpec.generalInfo != null) _push(children,b.explicit(8, _encodeGeneralInfo(headerSpec.generalInfo, "cmp/bad-general-info", "header.generalInfo")));
   return b.sequence(children);
 }
 
@@ -267,8 +269,8 @@ function _encodePkiStatusInfo(si, code) {
   if (!si || typeof si !== "object" || Buffer.isBuffer(si)) throw _err(code, "a PKIStatusInfo must be an object { status, statusString?, failInfo? }");
   if (typeof si.status !== "number" || !Number.isInteger(si.status) || si.status < 0 || si.status > 6) throw _err(code, "statusInfo.status must be a PKIStatus 0..6 (RFC 9810 sec. 5.2.3)");
   var children = [b.integer(BigInt(si.status))];
-  if (si.statusString != null) children.push(_encodePkiFreeText(si.statusString, code, "statusInfo.statusString"));
-  if (si.failInfo != null) children.push(_encodeFailInfo(si.failInfo, code));
+  if (si.statusString != null) _push(children,_encodePkiFreeText(si.statusString, code, "statusInfo.statusString"));
+  if (si.failInfo != null) _push(children,_encodeFailInfo(si.failInfo, code));
   return b.sequence(children);
 }
 
@@ -278,10 +280,10 @@ function _encodeCertStatus(cs, state) {
     _reqOctets(cs.certHash, "certConf certHash"),
     b.integer(_reqIdInt(cs.certReqId, "cmp/bad-cert-status", "CertStatus certReqId")),
   ];
-  if (cs.statusInfo != null) children.push(_encodePkiStatusInfo(cs.statusInfo, "cmp/bad-cert-status"));
+  if (cs.statusInfo != null) _push(children,_encodePkiStatusInfo(cs.statusInfo, "cmp/bad-cert-status"));
   if (cs.hashAlg != null) {
     if (typeof cs.hashAlg !== "string" || !CERT_CONF_HASH_ALGS[cs.hashAlg]) throw _err("cmp/bad-name", "certConf hashAlg must be a hash algorithm (sha256 / sha384 / sha512 / sha3-256 / sha3-512 / sha1); got " + guard.text.showValue(cs.hashAlg));
-    children.push(b.explicit(0, _algIdNoParams(cs.hashAlg)));
+    _push(children,b.explicit(0, _algIdNoParams(cs.hashAlg)));
     state.usesCmp2021 = true;
   }
   return b.sequence(children);
@@ -317,7 +319,7 @@ function _encodeRevDetails(rd) {
     certDetails = b.raw(crmf.buildCertTemplate(rd.certDetails));
   }
   var children = [certDetails];
-  if (rd.crlEntryDetails != null) children.push(b.raw(_encodeCrlEntryDetails(rd.crlEntryDetails)));
+  if (rd.crlEntryDetails != null) _push(children,b.raw(_encodeCrlEntryDetails(rd.crlEntryDetails)));
   return b.sequence(children);
 }
 
@@ -419,12 +421,12 @@ function _encodeCertifiedKeyPair(ckp, state) {
   var children = [_encodeCertOrEncCert(ckp, state)];
   if (ckp.privateKey != null) {
     var pk = _b.reqDer(ckp.privateKey, "certifiedKeyPair.privateKey (a pre-encoded EncryptedKey DER)");
-    children.push(b.explicit(0, b.raw(pk)));
+    _push(children,b.explicit(0, b.raw(pk)));
     var pkNode;
     try { pkNode = asn1.decode(pk); } catch (e) { throw _err("cmp/bad-cert-response", "certifiedKeyPair.privateKey is not valid DER", e); }
     if (pkNode.tagClass === "context" && pkNode.tagNumber === 0) state.usesCmp2021 = true;
   }
-  if (ckp.publicationInfo != null) children.push(b.explicit(1, b.raw(_b.reqDer(ckp.publicationInfo, "certifiedKeyPair.publicationInfo (a pre-encoded DER)"))));
+  if (ckp.publicationInfo != null) _push(children,b.explicit(1, b.raw(_b.reqDer(ckp.publicationInfo, "certifiedKeyPair.publicationInfo (a pre-encoded DER)"))));
   return b.sequence(children);
 }
 
@@ -435,8 +437,8 @@ function _encodeCertResponse(cr, state) {
   if (hasCkp && cr.status.failInfo != null) throw _err("cmp/bad-cert-response", "a CertResponse must not carry both failInfo and certifiedKeyPair");
   if (hasCkp && cr.status.status !== 0 && cr.status.status !== 1) throw _err("cmp/bad-cert-response", "a CertResponse certifiedKeyPair is allowed only under a granting status (accepted / grantedWithMods)");
   var children = [b.integer(_reqIdInt(cr.certReqId, "cmp/bad-cert-response", "CertResponse certReqId")), _encodePkiStatusInfo(cr.status, "cmp/bad-cert-response")];
-  if (hasCkp) children.push(_encodeCertifiedKeyPair(cr.certifiedKeyPair, state));
-  if (cr.rspInfo != null) children.push(_reqOctets(cr.rspInfo, "CertResponse.rspInfo"));
+  if (hasCkp) _push(children,_encodeCertifiedKeyPair(cr.certifiedKeyPair, state));
+  if (cr.rspInfo != null) _push(children,_reqOctets(cr.rspInfo, "CertResponse.rspInfo"));
   return b.sequence(children);
 }
 
@@ -446,9 +448,9 @@ function _encodeCertRepMessage(spec, state, arm) {
   var children = [];
   if (spec.caPubs != null) {
     if (!Array.isArray(spec.caPubs) || !spec.caPubs.length) throw _err("cmp/bad-cert-rep", arm + ".caPubs must be a non-empty array of certificate DERs");
-    children.push(b.explicit(1, b.sequence(spec.caPubs.map(function (c) { return _certRaw(c, "cmp/bad-cert-rep", "a caPubs entry"); }))));
+    _push(children,b.explicit(1, b.sequence(spec.caPubs.map(function (c) { return _certRaw(c, "cmp/bad-cert-rep", "a caPubs entry"); }))));
   }
-  children.push(b.sequence(spec.response.map(function (cr) { return _encodeCertResponse(cr, state); })));
+  _push(children,b.sequence(spec.response.map(function (cr) { return _encodeCertResponse(cr, state); })));
   return b.sequence(children);
 }
 
@@ -468,11 +470,11 @@ function _encodeRevRepContent(spec) {
   var children = [b.sequence(spec.status.map(function (si) { return _encodePkiStatusInfo(si, "cmp/bad-rev-rep"); }))];
   if (spec.revCerts != null) {
     if (!Array.isArray(spec.revCerts) || !spec.revCerts.length) throw _err("cmp/bad-rev-rep", "rp.revCerts must be a non-empty array of CertId");
-    children.push(b.explicit(0, b.sequence(spec.revCerts.map(_encodeCertIdRr))));
+    _push(children,b.explicit(0, b.sequence(spec.revCerts.map(_encodeCertIdRr))));
   }
   if (spec.crls != null) {
     if (!Array.isArray(spec.crls) || !spec.crls.length) throw _err("cmp/bad-rev-rep", "rp.crls must be a non-empty array of CertificateList DERs");
-    children.push(b.explicit(1, b.sequence(spec.crls.map(function (c) {
+    _push(children,b.explicit(1, b.sequence(spec.crls.map(function (c) {
       var der = _b.reqDerSequence(c, "crls entry (a CertificateList DER)");
       try { crl.parse(der); }
       catch (e) { if (e instanceof CmpError) throw e; throw _err("cmp/bad-rev-rep", "a crls entry is not a valid CRL (CertificateList)", e); }
@@ -486,8 +488,8 @@ function _encodeErrorMsgContent(spec) {
   if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("cmp/bad-error", "error must be an object { pKIStatusInfo, errorCode?, errorDetails? }");
   if (spec.pKIStatusInfo == null) throw _err("cmp/bad-error", "error.pKIStatusInfo is required");
   var children = [_encodePkiStatusInfo(spec.pKIStatusInfo, "cmp/bad-error")];
-  if (spec.errorCode != null) children.push(b.integer(_reqIdInt(spec.errorCode, "cmp/bad-error", "error.errorCode")));
-  if (spec.errorDetails != null) children.push(_encodePkiFreeText(spec.errorDetails, "cmp/bad-error", "error.errorDetails"));
+  if (spec.errorCode != null) _push(children,b.integer(_reqIdInt(spec.errorCode, "cmp/bad-error", "error.errorCode")));
+  if (spec.errorDetails != null) _push(children,_encodePkiFreeText(spec.errorDetails, "cmp/bad-error", "error.errorDetails"));
   return b.sequence(children);
 }
 
@@ -497,7 +499,7 @@ function _encodePollRepContent(list) {
     if (!pr || typeof pr !== "object" || Buffer.isBuffer(pr)) throw _err("cmp/bad-poll-rep", "each pollRep entry must be an object");
     if (typeof pr.checkAfter !== "number" || !Number.isInteger(pr.checkAfter) || pr.checkAfter < 0 || pr.checkAfter > 0x7fffffff) throw _err("cmp/bad-poll-rep", "pollRep checkAfter must be a non-negative uint31 delay in seconds (RFC 9810 sec. 5.3.22)");
     var kids = [b.integer(_reqIdInt(pr.certReqId, "cmp/bad-poll-rep", "pollRep certReqId")), b.integer(BigInt(pr.checkAfter))];
-    if (pr.reason != null) kids.push(_encodePkiFreeText(pr.reason, "cmp/bad-poll-rep", "pollRep reason"));
+    if (pr.reason != null) _push(kids,_encodePkiFreeText(pr.reason, "cmp/bad-poll-rep", "pollRep reason"));
     return b.sequence(kids);
   }));
 }
@@ -506,14 +508,14 @@ function _encodeKeyRecRepContent(spec, state) {
   if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("cmp/bad-key-rec-rep", "krp must be an object { status, newSigCert?, caCerts?, keyPairHist? }");
   if (spec.status == null) throw _err("cmp/bad-key-rec-rep", "krp.status is required");
   var children = [_encodePkiStatusInfo(spec.status, "cmp/bad-key-rec-rep")];
-  if (spec.newSigCert != null) children.push(b.explicit(0, _certRaw(spec.newSigCert, "cmp/bad-key-rec-rep", "krp.newSigCert")));
+  if (spec.newSigCert != null) _push(children,b.explicit(0, _certRaw(spec.newSigCert, "cmp/bad-key-rec-rep", "krp.newSigCert")));
   if (spec.caCerts != null) {
     if (!Array.isArray(spec.caCerts) || !spec.caCerts.length) throw _err("cmp/bad-key-rec-rep", "krp.caCerts must be a non-empty array of certificate DERs");
-    children.push(b.explicit(1, b.sequence(spec.caCerts.map(function (c) { return _certRaw(c, "cmp/bad-key-rec-rep", "a krp.caCerts entry"); }))));
+    _push(children,b.explicit(1, b.sequence(spec.caCerts.map(function (c) { return _certRaw(c, "cmp/bad-key-rec-rep", "a krp.caCerts entry"); }))));
   }
   if (spec.keyPairHist != null) {
     if (!Array.isArray(spec.keyPairHist) || !spec.keyPairHist.length) throw _err("cmp/bad-key-rec-rep", "krp.keyPairHist must be a non-empty array of CertifiedKeyPair");
-    children.push(b.explicit(2, b.sequence(spec.keyPairHist.map(function (ckp) { return _encodeCertifiedKeyPair(ckp, state); }))));
+    _push(children,b.explicit(2, b.sequence(spec.keyPairHist.map(function (ckp) { return _encodeCertifiedKeyPair(ckp, state); }))));
   }
   return b.sequence(children);
 }
@@ -891,7 +893,7 @@ async function _build(message, opts) {
   var protectionBits = await prot.computeBits(protectedPartDer);
   var msgChildren = [headerTLV, bodyTLV, b.explicit(0, protectionBits)];
   var extraCertsDers = _collectExtraCerts(opts, prot.certDer);
-  if (extraCertsDers.length) msgChildren.push(b.explicit(1, b.sequence(extraCertsDers)));
+  if (extraCertsDers.length) _push(msgChildren,b.explicit(1, b.sequence(extraCertsDers)));
   var der = b.sequence(msgChildren);
 
   cmp.parse(der);
@@ -905,14 +907,14 @@ async function _build(message, opts) {
 
 function _collectExtraCerts(opts, protCertDer) {
   var out = [];
-  if (protCertDer != null) out.push(b.raw(protCertDer));
+  if (protCertDer != null) _push(out,b.raw(protCertDer));
   if (opts.extraCerts != null) {
     if (!Array.isArray(opts.extraCerts)) throw _err("cmp/bad-extra-certs", "opts.extraCerts must be an array of certificate DERs");
     opts.extraCerts.forEach(function (c) {
       var der = _b.reqDerSequence(c, "extraCerts entry (a Certificate DER)");
       try { x509.parse(der); }
       catch (e) { if (e instanceof CmpError) throw e; throw _err("cmp/bad-extra-certs", "an extraCerts entry is not a valid X.509 certificate", e); }
-      out.push(b.raw(der));
+      _push(out,b.raw(der));
     });
   }
   return out;

package/lib/cmp-session.js

@@ -15,6 +15,10 @@ var crmfSign = require("./crmf-sign");
 var cmpBuild = require("./cmp-build");
 var csr = require("./schema-csr");
 var guard = require("./guard-all");
+/** @internal The append every list here is built with: `push` stores at the index and a store
+ *  consults a setter inherited there, and one of these lists is the accumulated CA certificates a
+ *  later leg is authenticated against. */
+var _push = guard.list.append;
 var compositeSig = require("./composite-sig");
 var constants = require("./constants");
 var webcrypto = require("./webcrypto");
@@ -34,7 +38,7 @@ function setEngine(engine) { _engine = engine; }
 var HASHLESS_SIG_OIDS = Object.create(null);
 (function () {
   var names = ["Ed25519", "Ed448", "id-ml-dsa-44", "id-ml-dsa-65", "id-ml-dsa-87"];
-  ["sha2", "shake"].forEach(function (h) { ["128s", "128f", "192s", "192f", "256s", "256f"].forEach(function (s) { names.push("id-slh-dsa-" + h + "-" + s); }); });
+  ["sha2", "shake"].forEach(function (h) { ["128s", "128f", "192s", "192f", "256s", "256f"].forEach(function (s) { _push(names,"id-slh-dsa-" + h + "-" + s); }); });
   names.forEach(function (n) { var o = oid.byName(n); if (o) HASHLESS_SIG_OIDS[o] = 1; });
 })();
 var SIG_OID_TO_HASH = Object.create(null);
@@ -136,11 +140,11 @@ function _asCertList(v) { return v == null ? [] : (Array.isArray(v) ? guard.list
 function _boundedPool(base, added) {
   var ceiling = constants.LIMITS.PATH_BUILD_MAX_CANDIDATES;
   var seen = Object.create(null), distinctBase = [];
-  base.forEach(function (c) { var k = _certIdentity(c); if (k == null) { distinctBase.push(c); return; } if (!seen[k]) { seen[k] = 1; distinctBase.push(c); } });
+  base.forEach(function (c) { var k = _certIdentity(c); if (k == null) { _push(distinctBase,c); return; } if (!seen[k]) { seen[k] = 1; _push(distinctBase,c); } });
   var room = ceiling - distinctBase.length;
   if (room <= 0) return distinctBase;
   var useful = [];
-  added.forEach(function (c) { var k = _certIdentity(c); if (k != null && seen[k]) return; if (k != null) seen[k] = 1; useful.push(c); });
+  added.forEach(function (c) { var k = _certIdentity(c); if (k != null && seen[k]) return; if (k != null) seen[k] = 1; _push(useful,c); });
   return distinctBase.concat(useful.slice(0, room));
 }
 function _certIdentity(cert) {
@@ -228,7 +232,7 @@ function _responseExtraCerts(responseBytes) {
     seen[key] = true;
     try { x509.parse(c); }
     catch (_e) { continue; }
-    out.push(Buffer.from(c));
+    _push(out,Buffer.from(c));
   }
   return out;
 }
@@ -682,7 +686,13 @@ function session(opts) {
         if (!Buffer.isBuffer(c)) return;
         var k = c.toString("base64");
         if (caPubsSeen[k]) {
-          if (isGrantLeg) { for (var pi = 0; pi < caPubsAccum.length; pi++) { if (caPubsAccum[pi].toString("base64") === k) { guard.list.append(caPubsAccum, caPubsAccum.splice(pi, 1)[0]); if (pi < caPubsWaitingCount) caPubsWaitingCount--; break; } } }
+          /** @internal The entry is read, removed and appended as three steps rather than through
+           * `splice`. `splice` RETURNS what it removed, so it builds that result through
+           * `ArraySpeciesCreate`, which reads the receiver's `constructor` and then its
+           * `Symbol.species`: a getter installed on `Array.prototype.constructor` is handed this
+           * accumulator as its `this` while the move is in progress, and the list holds the CA
+           * certificates a later leg is authenticated against. */
+          if (isGrantLeg) { for (var pi = 0; pi < caPubsAccum.length; pi++) { if (caPubsAccum[pi].toString("base64") === k) { var moved = caPubsAccum[pi]; guard.list.removeAt(caPubsAccum, pi); guard.list.append(caPubsAccum, moved); if (pi < caPubsWaitingCount) caPubsWaitingCount--; break; } } }
           return;
         }
         try { x509.parse(c); } catch (e) { throw _err("cmp/bad-cert-response", "an authenticated caPubs entry is not a valid X.509 certificate", e); }
@@ -963,10 +973,10 @@ function session(opts) {
   async function _validateLeaf(leaf, caPubs) {
     if (_engine == null || opts.trustAnchors == null) return;
     var caPubsList = [];
-    if (Array.isArray(caPubs)) caPubs.forEach(function (c) { if (Buffer.isBuffer(c)) caPubsList.push(c); });
+    if (Array.isArray(caPubs)) caPubs.forEach(function (c) { if (Buffer.isBuffer(c)) _push(caPubsList,c); });
     var added = _asCertList(opts.intermediates);
-    if (Buffer.isBuffer(cachedSignerCert)) added.push(cachedSignerCert);
-    cachedChain.forEach(function (c) { if (Buffer.isBuffer(c)) added.push(c); });
+    if (Buffer.isBuffer(cachedSignerCert)) _push(added,cachedSignerCert);
+    cachedChain.forEach(function (c) { if (Buffer.isBuffer(c)) _push(added,c); });
     var pool = _boundedPool(caPubsList, added);
     var res;
     try { res = await _engine.build(leaf, { trustAnchors: _asCertList(opts.trustAnchors), intermediates: pool, validate: true, time: opts.time != null ? opts.time : new Date() }); }
@@ -1395,7 +1405,7 @@ function session(opts) {
       if (limit.total !== null && total > limit.total) {
         throw _err("cmp/bad-input", "the resumeToken " + name + " exceeds the " + limit.total + "-byte pool a transaction holds");
       }
-      out.push(der);
+      _push(out,der);
     }
     return out;
   }

package/lib/cms-decrypt.js

@@ -4,7 +4,6 @@
 // @internal
 // @primitive pki.cms.decrypt block live in cms-verify.js, which re-exports this function.
 
-var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
@@ -121,10 +120,10 @@ function _selectCandidates(recips, km, opts) {
   for (var k = 0; k < recips.length; k++) {
     var r = recips[k];
     if (want === "asym" && (r.type === "ktri" || r.type === "kari" || r.type === "ori")) {
-      if (cert && _ridMatches(r, cert)) out.push({ ri: r, index: k });
-    } else if (want === "pwri" && r.type === "pwri") { out.push({ ri: r, index: k }); }
+      if (cert && _ridMatches(r, cert)) intrinsic.append(out, { ri: r, index: k });
+    } else if (want === "pwri" && r.type === "pwri") { intrinsic.append(out, { ri: r, index: k }); }
     else if (want === "kekri" && r.type === "kekri") {
-      if (km.kekId == null || _kekIdMatches(r, km.kekId)) out.push({ ri: r, index: k });
+      if (km.kekId == null || _kekIdMatches(r, km.kekId)) intrinsic.append(out, { ri: r, index: k });
     }
   }
   if (!out.length) throw _err("cms/no-matching-recipient", "no recipient matches the supplied key material");
@@ -235,8 +234,8 @@ async function _ktriCek(ri, km) {
       return Buffer.from(await subtle.decrypt({ name: "RSA-OAEP" }, pub, ri.encryptedKey));
     }
     if (kea.oid === O("rsaEncryption")) {
-      var keyObj = nodeCrypto.createPrivateKey({ key: k.der, format: "der", type: "pkcs8" });
-      try { return nodeCrypto.privateDecrypt({ key: keyObj, padding: guard.crypto.padding.RSA_PKCS1 }, ri.encryptedKey); }
+      var keyObj = guard.crypto.privateKey({ key: k.der, format: "der", type: "pkcs8" });
+      try { return guard.crypto.privateDecrypt({ key: keyObj, padding: guard.crypto.padding.RSA_PKCS1 }, ri.encryptedKey); }
       catch (_e) {
         return null;
       }
@@ -339,7 +338,7 @@ async function _pwriCek(ri, km, opts) {
   var iv = asn1.read.octetString(inner.children[1]);
   var pw = pbes2.passwordBytesOwned(km.password, _err, "cms");
   var kek;
-  try { kek = nodeCrypto.pbkdf2Sync(pw.bytes, pb.salt, pb.iterations, innerBits / 8, pb.prfNode); }
+  try { kek = guard.crypto.pbkdf2(pw.bytes, pb.salt, pb.iterations, innerBits / 8, pb.prfNode); }
   finally { if (pw.owned) guard.secret.zeroize(pw.bytes, CmsError, "cms/bad-input", "the password encoding"); }
   try {
     return _pwriUnwrap(kek, ri.encryptedKey, iv, innerBits);
@@ -421,7 +420,7 @@ async function _openContent(parsed, eci, cek, ct, streamMode) {
   }
   if (eci.encryptedContent == null) throw _err("cms/no-encrypted-content", "the message has no encryptedContent (detached; supply it out of band)");
   var substitute = null;
-  if (cek == null || cek.length !== keyBits / 8) { substitute = nodeCrypto.randomBytes(keyBits / 8); cek = substitute; }
+  if (cek == null || cek.length !== keyBits / 8) { substitute = guard.crypto.randomBytes(keyBits / 8); cek = substitute; }
   try {
     if (ct === "authEnvelopedData") {
       var aad = parsed.authAttrsBytes != null ? _explicitSetOf(parsed.authAttrsBytes) : Buffer.alloc(0);
@@ -461,9 +460,9 @@ async function _openContent(parsed, eci, cek, ct, streamMode) {
 }
 function _gcmOpen(cek, nonce, ct, tag, aad, keyBits, icvLen) {
   if (!tag || tag.length !== icvLen) throw _fail();
-  var d = nodeCrypto.createDecipheriv("aes-" + keyBits + "-gcm", cek, nonce, { authTagLength: icvLen });
-  d.setAuthTag(tag);
-  if (aad && aad.length) d.setAAD(aad);
+  var d = guard.crypto.decipher("aes-" + keyBits + "-gcm", cek, nonce, { authTagLength: icvLen });
+  guard.crypto.decipherSetAuthTag(d, tag);
+  if (aad && aad.length) guard.crypto.transformSetAAD(d, aad);
   return guard.secret.cipherFinish(d, ct, CmsError, "cms/decrypt-failed", "the recovered content");
 }
 
@@ -543,7 +542,7 @@ async function _decryptPbes2(parsed, eci, km, opts) {
   if (!keyBits) throw _err("cms/unsupported-algorithm", "unsupported PBES2 content cipher " + encOid);
   var pwE = pbes2.passwordBytesOwned(km.password, _err, "cms");
   var key;
-  try { key = nodeCrypto.pbkdf2Sync(pwE.bytes, pb.salt, pb.iterations, keyBits / 8, pb.prfNode); }
+  try { key = guard.crypto.pbkdf2(pwE.bytes, pb.salt, pb.iterations, keyBits / 8, pb.prfNode); }
   finally { if (pwE.owned) guard.secret.zeroize(pwE.bytes, CmsError, "cms/bad-input", "the password encoding"); }
   try { return _originFields({ content: opts.stream === true ? _cbcStream(key, iv, eci.encryptedContent, keyBits) : pbes2.cbcDecrypt(key, iv, eci.encryptedContent, keyBits, CmsError, "cms/decrypt-failed"), contentType: eci.contentType, contentTypeName: oid.name(eci.contentType) || eci.contentType, recipientType: "password", recipientIndex: -1, contentEncryptionAlgorithm: oid.name(encOid) || encOid, authenticated: false }, null, null); }
   catch (_e) { throw _fail(); }
@@ -563,19 +562,23 @@ async function _aesKwUnwrap(kek, wrapped) {
     guard.secret.zeroize(new Uint8Array(rawAb), CmsError, "cms/bad-input", "the unwrapped content key");
   }
 }
+/** @internal Both KDF-input structures APPEND by defining the index. A store at an index the list
+ *  has no own property at consults a setter inherited from the array prototype, so an accessor there
+ *  would decide the SharedInfo these bytes become and derive a different KEK from the same shared
+ *  secret. */
 function _eccSharedInfo(wrapName, ukm, kekBytes) {
   var kids = [b.sequence([b.oid(O(wrapName))])];
-  if (ukm) kids.push(b.explicit(0, b.octetString(ukm)));
+  if (ukm) intrinsic.append(kids, b.explicit(0, b.octetString(ukm)));
   /** @internal The SuppPubInfo key length is written with the capture, for the same reason the
    *  encrypt side does it: this is KDF input, and a replaced write derives a different KEK from the
    *  same shared secret. */
   var supp = Buffer.alloc(4); intrinsic.writeUInt32BE(supp, kekBytes * 8, 0);
-  kids.push(b.explicit(2, b.octetString(supp)));
+  intrinsic.append(kids, b.explicit(2, b.octetString(supp)));
   return b.sequence(kids);
 }
 function _kemOtherInfo(wrapName, kekBytes, ukm) {
   var kids = [b.sequence([b.oid(O(wrapName))]), b.integer(BigInt(kekBytes))];
-  if (ukm) kids.push(b.explicit(0, b.octetString(ukm)));
+  if (ukm) intrinsic.append(kids, b.explicit(0, b.octetString(ukm)));
   return b.sequence(kids);
 }
 function _pwriUnwrap(kek, wrapped, iv, keyBits) {
@@ -584,13 +587,13 @@ function _pwriUnwrap(kek, wrapped, iv, keyBits) {
   var n = wrapped.length;
   var lastDec = null, pass1 = null, body = null;
   try {
-    var ecb = nodeCrypto.createDecipheriv("aes-" + keyBits + "-ecb", kek, Buffer.alloc(0)); ecb.setAutoPadding(false);
+    var ecb = guard.crypto.decipher("aes-" + keyBits + "-ecb", kek, Buffer.alloc(0)); guard.crypto.transformNoPadding(ecb);
     lastDec = guard.secret.cipherFinish(ecb, wrapped.subarray(n - blk), CmsError, "cms/decrypt-failed", "the recovered CBC last block");
     var iv2 = Buffer.alloc(blk);
     for (var i = 0; i < blk; i++) iv2[i] = lastDec[i] ^ wrapped[n - 2 * blk + i];
-    var d1 = nodeCrypto.createDecipheriv(alg, kek, iv2); d1.setAutoPadding(false);
+    var d1 = guard.crypto.decipher(alg, kek, iv2); guard.crypto.transformNoPadding(d1);
     pass1 = guard.secret.cipherFinish(d1, wrapped, CmsError, "cms/decrypt-failed", "the PWRI first-pass plaintext");
-    var d2 = nodeCrypto.createDecipheriv(alg, kek, iv); d2.setAutoPadding(false);
+    var d2 = guard.crypto.decipher(alg, kek, iv); guard.crypto.transformNoPadding(d2);
     body = guard.secret.cipherFinish(d2, pass1, CmsError, "cms/decrypt-failed", "the PWRI plaintext block");
     var count = body[0];
     if (count < 1 || count + 4 > body.length) throw _fail();
@@ -648,7 +651,7 @@ function _originatorSpki(originator) {
   if (!originator || originator.form !== "originatorKey") throw _err("cms/unsupported-algorithm", "kari requires an originatorKey (ephemeral-static ECDH)");
   var v = originator.value;
   var algKids = [b.oid(v.algorithm.oid)];
-  if (v.algorithm.parameters != null) algKids.push(b.raw(v.algorithm.parameters));
+  if (v.algorithm.parameters != null) intrinsic.append(algKids, b.raw(v.algorithm.parameters));
   return b.sequence([b.sequence(algKids), b.bitString(v.publicKey.bytes, v.publicKey.unusedBits)]);
 }
 var MONT = intrinsic.create(null); MONT[O("X25519")] = { name: "X25519", hkdf: "SHA-256" }; MONT[O("X448")] = { name: "X448", hkdf: "SHA-512" };
@@ -666,8 +669,9 @@ function _ecCurveFromCert(cert) {
 function _ecCurveFromPrivateKey(keyDer) {
   var spki;
   try {
-    spki = nodeCrypto.createPublicKey({ key: keyDer, format: "der", type: "pkcs8" })
-      .export({ format: "der", type: "spki" });
+    spki = guard.crypto.exportKey(
+      guard.crypto.publicKey({ key: keyDer, format: "der", type: "pkcs8" }),
+      { format: "der", type: "spki" });
   } catch (_e) { return null; } // allow:swallow-unverified a key this runtime cannot read names no curve
   var alg = asn1.decode(spki).children[0];
   if (asn1.read.oid(alg.children[0]) !== O("ecPublicKey") || alg.children.length < 2) return null;
@@ -710,7 +714,17 @@ async function _verifyAuthenticatedData(parsed, km, opts, requireProtection) {
     guard.der.assertParams(parsed.digestAlgorithm.parameters, "absentOrNull", _err,
       "cms/unsupported-algorithm", parsed.digestAlgorithm.name + " digestAlgorithm (RFC 5754 sec. 2)");
     preimage = _explicitSetOf(parsed.authAttrsBytes);
-    var mdAttr = (parsed.authAttrs || []).filter(function (a) { return a.type === O("messageDigest"); })[0];
+    /** @internal The selection returns the first matching attribute or null. `filter(...)[0]` indexes
+     *  a result that is EMPTY when the attribute is absent, and index 0 of an empty array answers
+     *  from the array prototype, so a value installed there would supply the digest this comparison
+     *  is made against. The refusal restates an invariant the parse already holds: an
+     *  AuthenticatedData with authAttrs is walked through the content-binding check, which requires
+     *  the message-digest attribute (`cms/missing-message-digest`), so this is not reachable from a
+     *  message and is here so the read below cannot be made on something that is not an attribute. */
+    var mdAttr = guard.list.firstMatch(parsed.authAttrs || [], function (a) { return a.type === O("messageDigest"); });
+    if (!mdAttr || mdAttr.values.length !== 1) {
+      throw _err("cms/bad-auth-attrs", "authenticated attributes must carry exactly one message-digest attribute (RFC 5652 sec. 9.2)");
+    }
     mdCheck = { hash: dHash, declared: asn1.read.octetString(asn1.decode(mdAttr.values[0])) };
     /** @internal RFC 6211 sec. 3.2 on this content type: the two comparisons are what make the
      *  outer `digestAlgorithm` and `macAlgorithm` fields mean anything, since the MAC input is the
@@ -742,7 +756,7 @@ async function _verifyAuthenticatedData(parsed, km, opts, requireProtection) {
       _assertSupported(candidates[ci].ri, km);
       var macKey = await _acquireCek(candidates[ci].ri, km, opts);
       var macSubstitute = null;
-      if (macKey == null || macKey.length < MAC_KEY_MIN_OCTETS) macSubstitute = nodeCrypto.randomBytes(MAC_KEY_MIN_OCTETS);
+      if (macKey == null || macKey.length < MAC_KEY_MIN_OCTETS) macSubstitute = guard.crypto.randomBytes(MAC_KEY_MIN_OCTETS);
       try {
         var key = await subtle.importKey("raw", macSubstitute || macKey, { name: "HMAC", hash: hash }, false, ["verify"]);
         if (!(await _subtleVerify(subtle, { name: "HMAC" }, key, Buffer.from(parsed.mac), preimage))) throw _fail();

package/lib/cms-digest.js

@@ -26,7 +26,6 @@
  *   attached or detached, constant-time comparison, fail-closed.
  */
 
-var nodeCrypto = require("node:crypto");
 var oid = require("./oid");
 var schemaCms = require("./schema-cms");
 var frameworkError = require("./framework-error");
@@ -101,7 +100,7 @@ async function _digest(content, opts) {
   var ctOid = O(ctName);
   if (!ctOid) throw _err("cms/bad-input", "opts.contentType is not a known OID name: " + guard.text.showValue(ctName));
 
-  var value = nodeCrypto.createHash(NODE_DIGEST[alg]).update(raw).digest();
+  var value = guard.crypto.digest(NODE_DIGEST[alg], raw);
   var eciChildren = opts.detached === true
     ? [b.oid(ctOid)]
     : [b.oid(ctOid), b.explicit(0, b.octetString(raw))];
@@ -176,7 +175,7 @@ async function _verifyDigest(input, opts) {
   var covered = embedded != null
     ? guard.bytes.snapshotSource(embedded, CmsError, "cms/bad-input", "the encapsulated content")
     : supplied;
-  var recomputed = nodeCrypto.createHash(NODE_DIGEST[alg]).update(covered).digest();
+  var recomputed = guard.crypto.digest(NODE_DIGEST[alg], covered);
   var matched = guard.crypto.constantTimeEqual(recomputed, parsed.digest);
   return guard.verdict.of({
     valid: matched,