@blamejs/pki 0.8.59 → 0.8.61

package/lib/cms-encrypt.js

@@ -4,7 +4,6 @@
 // @internal
 // @primitive pki.cms.encrypt block live in cms-verify.js, which re-exports this function (the
 
-var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
 var pkiBuild = require("./pki-build");
 var oid = require("./oid");
@@ -14,6 +13,10 @@ var webcrypto = require("./webcrypto");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+/** @internal The append every list here is built with: `push` stores at the index and a store
+ *  consults a setter inherited there. These lists become a recipient info and the key-derivation
+ *  input beside it. */
+var _push = intrinsic.append;
 var pbes2 = require("./pbes2");
 var compositeKem = require("./composite-kem");
 var b = asn1.build;
@@ -66,7 +69,7 @@ function _wrapOidForKek(keyBytes) {
 
 function _gcmParams(nonce, icvLen) {
   var kids = [b.octetString(nonce)];
-  if (icvLen !== 12) kids.push(b.integer(BigInt(icvLen)));
+  if (icvLen !== 12) _push(kids,b.integer(BigInt(icvLen)));
   return b.sequence(kids);
 }
 
@@ -124,12 +127,12 @@ MONT_KA[O("X448")] = { name: "X448", hkdf: "SHA-512", scheme: "dhSinglePass-stdD
 
 function _eccSharedInfo(wrapName, ukm, kekBytes) {
   var kids = [_algId(wrapName, "absent")];
-  if (ukm) kids.push(b.explicit(0, b.octetString(ukm)));
+  if (ukm) _push(kids,b.explicit(0, b.octetString(ukm)));
   /** @internal The SuppPubInfo key length is written with the capture. It is KDF input, so it is part
    *  of what the key-encryption key derives from, and a replaced write derives a different KEK from
    *  the same shared secret. */
   var supp = Buffer.alloc(4); intrinsic.writeUInt32BE(supp, kekBytes * 8, 0);
-  kids.push(b.explicit(2, b.octetString(supp)));
+  _push(kids,b.explicit(2, b.octetString(supp)));
   return b.sequence(kids);
 }
 async function _buildKari(cek, cert, opts) {
@@ -179,8 +182,9 @@ async function _buildKari(cek, cert, opts) {
     var rek = b.sequence([b.sequence([ridNode, b.octetString(encryptedKey)])]);
     var kekAlg = b.sequence([b.oid(O(origKeyAlgId.scheme)), _algId(wrapName, "absent")]);
     var kariKids = [b.integer(3n), b.explicit(0, originatorKey)];
-    if (ukm) kariKids.push(b.explicit(1, b.octetString(ukm)));
-    kariKids.push(kekAlg, rek);
+    if (ukm) _push(kariKids,b.explicit(1, b.octetString(ukm)));
+    _push(kariKids,kekAlg);
+    _push(kariKids,rek);
     return { tag: 1, node: b.sequence(kariKids) };
   } finally {
     guard.secret.zeroizeAll([z, mz, kek], CmsError, "cms/bad-input", "the key-agreement shared secret");
@@ -198,7 +202,7 @@ async function _buildKekri(cek, desc) {
 
 async function _buildPwri(cek, desc) {
   var iterations = pbes2.assertIterations(desc.iterations == null ? 600000 : desc.iterations, _err, "cms");
-  var salt = desc.salt ? pbes2.assertSalt(guard.bytes.view(desc.salt, CmsError, "cms/bad-input", "salt"), _err, "cms") : nodeCrypto.randomBytes(16);
+  var salt = desc.salt ? pbes2.assertSalt(guard.bytes.view(desc.salt, CmsError, "cms/bad-input", "salt"), _err, "cms") : guard.crypto.randomBytes(16);
   var prf = desc.prf || "hmacWithSHA256";
   _prfHash(prf);
   var innerKeyBytes = 32;
@@ -208,7 +212,7 @@ async function _buildPwri(cek, desc) {
   var kek = Buffer.from(await subtle.deriveBits({ name: "PBKDF2", hash: _prfHash(prf), salt: salt, iterations: iterations }, kekKey, innerKeyBytes * 8));
   if (pwOwn.owned) guard.secret.zeroize(password, CmsError, "cms/bad-input", "the password encoding");
   try {
-    var iv = nodeCrypto.randomBytes(16);
+    var iv = guard.crypto.randomBytes(16);
     var encryptedKey = _pwriWrapIv(kek, cek, iv);
     var kdfParams = pbes2.pbkdf2ParamsSeq(salt, iterations, prf);
     var kdfAlg = b.contextConstructed(0, Buffer.concat([b.oid(O("pbkdf2")), kdfParams]));
@@ -227,7 +231,7 @@ var KEM_WC = intrinsic.create(null); KEM_WC[O("id-ml-kem-512")] = "ML-KEM-512";
 
 function _kemOtherInfo(wrapName, kekBytes, ukm) {
   var kids = [_algId(wrapName, "absent"), b.integer(BigInt(kekBytes))];
-  if (ukm) kids.push(b.explicit(0, b.octetString(ukm)));
+  if (ukm) _push(kids,b.explicit(0, b.octetString(ukm)));
   return b.sequence(kids);
 }
 async function _kemEncapsulate(keyOid, cert) {
@@ -258,8 +262,9 @@ async function _buildKemri(cek, cert, opts) {
     var encryptedKey = await _aesKwWrap(kek, cek);
     var rid = _rid(cert, opts.keyIdentifier);
     var kemriKids = [b.integer(0n), rid.node, _algId(oid.name(keyOid), "absent"), b.octetString(kemct), _algId("hkdfWithSha256", "absent"), b.integer(BigInt(kekBytes))];
-    if (ukm) kemriKids.push(b.explicit(0, b.octetString(ukm)));
-    kemriKids.push(_algId(wrapName, "absent"), b.octetString(encryptedKey));
+    if (ukm) _push(kemriKids,b.explicit(0, b.octetString(ukm)));
+    _push(kemriKids,_algId(wrapName, "absent"));
+    _push(kemriKids,b.octetString(encryptedKey));
     var kemri = b.sequence(kemriKids);
     return { tag: 4, node: b.sequence([b.oid(O("kem")), kemri]) };
   } finally {
@@ -282,17 +287,17 @@ function _pwriFormat(cek) {
   var blk = 16;
   var padLen = body.length % blk === 0 ? 0 : blk - (body.length % blk);
   if (body.length + padLen < 2 * blk) padLen += (2 * blk - (body.length + padLen));
-  var wrapped = Buffer.concat([body, nodeCrypto.randomBytes(padLen)]);
+  var wrapped = Buffer.concat([body, guard.crypto.randomBytes(padLen)]);
   guard.secret.zeroizeAll([check, body], CmsError, "cms/bad-input", "a PWRI formatting intermediate");
   return wrapped;
 }
 function _pwriWrapIv(kek, cek, iv) {
   var wk = _pwriFormat(cek);
   try {
-    var c1 = nodeCrypto.createCipheriv("aes-256-cbc", kek, iv); c1.setAutoPadding(false);
+    var c1 = guard.crypto.cipher("aes-256-cbc", kek, iv); guard.crypto.transformNoPadding(c1);
     var pass1 = guard.secret.cipherFinish(c1, wk, CmsError, "cms/bad-input", "the PWRI first-pass ciphertext");
     var iv2 = pass1.subarray(pass1.length - 16);
-    var c2 = nodeCrypto.createCipheriv("aes-256-cbc", kek, iv2); c2.setAutoPadding(false);
+    var c2 = guard.crypto.cipher("aes-256-cbc", kek, iv2); guard.crypto.transformNoPadding(c2);
     return guard.secret.cipherFinish(c2, pass1, CmsError, "cms/bad-input", "the PWRI wrapped key");
   } finally {
     guard.secret.zeroize(wk, CmsError, "cms/bad-input", "the PWRI plaintext block");
@@ -438,7 +443,7 @@ async function _encryptImpl(content, recipients, opts) {
    *  them. */
   var contentBytes = contentStream ? null : guard.bytes.view(content, CmsError, "cms/bad-input", "content");
   var contentType = opts.contentType || "data";
-  var cek = nodeCrypto.randomBytes(ca.keyBits / 8);
+  var cek = guard.crypto.randomBytes(ca.keyBits / 8);
 
   try {
     if (!Array.isArray(recipients)) return await _encryptedData(contentBytes, contentStream, recipients, ca, contentType, opts, cek);
@@ -446,7 +451,7 @@ async function _encryptImpl(content, recipients, opts) {
     if (!recipients.length) throw _err("cms/bad-input", "at least one recipient is required (RFC 5652 sec. 6.1)");
     var recips = [];
     var consumed = intrinsic.create(null);
-    for (var i = 0; i < recipients.length; i++) recips.push(await _buildRecipient(cek, recipients[i], opts, consumed));
+    for (var i = 0; i < recipients.length; i++) _push(recips,await _buildRecipient(cek, recipients[i], opts, consumed));
     _assertDefaultsConsumed(opts, consumed);
     var riNodes = recips.map(_taggedRecipient);
 
@@ -471,7 +476,7 @@ async function _encStream(spec, stream) {
 }
 
 async function _envelopedData(contentBytes, contentStream, cek, ca, contentType, riNodes, recips) {
-  var iv = nodeCrypto.randomBytes(16);
+  var iv = guard.crypto.randomBytes(16);
   var enc = contentStream
     ? (await _encStream({ algNode: "aes-" + ca.keyBits + "-cbc", key: cek, iv: iv }, contentStream)).ciphertext
     : pbes2.cbcEncrypt(cek, iv, contentBytes, ca.keyBits, CmsError, "cms/bad-input");
@@ -516,7 +521,7 @@ var AUTH_ENVELOPED_FORBIDDEN = intrinsic.assign(intrinsic.create(null), {
 });
 
 async function _authEnvelopedData(contentBytes, contentStream, cek, ca, contentType, opts, riNodes, recips) {
-  var nonce = nodeCrypto.randomBytes(12);
+  var nonce = guard.crypto.randomBytes(12);
   var authAttrsDer = null, aad = Buffer.alloc(0);
   if (contentType !== "data" && !(opts.authAttrs && opts.authAttrs.length)) {
     throw _err("cms/bad-input", "AuthEnvelopedData with a non-data contentType requires authAttrs (RFC 5083 sec. 2.1)");
@@ -535,8 +540,8 @@ async function _authEnvelopedData(contentBytes, contentStream, cek, ca, contentT
   }
   var eci = b.sequence([b.oid(O(contentType)), b.sequence([b.oid(O(ca.oid)), _gcmParams(nonce, 16)]), b.contextPrimitive(0, g.ct)]);
   var kids = [b.integer(0n), b.setOf(riNodes), eci];
-  if (authAttrsDer) kids.push(authAttrsDer);
-  kids.push(b.octetString(g.tag));
+  if (authAttrsDer) _push(kids,authAttrsDer);
+  _push(kids,b.octetString(g.tag));
   void recips;
   return b.sequence(kids);
 }
@@ -555,7 +560,7 @@ async function _encryptedData(contentBytes, contentStream, desc, ca, contentType
         " EncryptedData descriptor; that field is not read for this arm";
     });
   }
-  var iv = nodeCrypto.randomBytes(16);
+  var iv = guard.crypto.randomBytes(16);
   var contentAlgNode, encKey;
   if (desc && desc.cek != null) {
     encKey = guard.bytes.view(desc.cek, CmsError, "cms/bad-input", "cek");
@@ -578,9 +583,9 @@ async function _encryptedDataPbes2(contentBytes, contentStream, desc, ca, conten
   var pwOwn2 = pbes2.passwordBytesOwned(desc.password, _err, "cms");
   var password = pwOwn2.bytes;
   var iterations = pbes2.assertIterations(desc.iterations == null ? 600000 : desc.iterations, _err, "cms");
-  var salt = desc.salt ? pbes2.assertSalt(guard.bytes.view(desc.salt, CmsError, "cms/bad-input", "salt"), _err, "cms") : nodeCrypto.randomBytes(16);
+  var salt = desc.salt ? pbes2.assertSalt(guard.bytes.view(desc.salt, CmsError, "cms/bad-input", "salt"), _err, "cms") : guard.crypto.randomBytes(16);
   var prf = desc.prf || "hmacWithSHA256";
-  var key = nodeCrypto.pbkdf2Sync(password, salt, iterations, ca.keyBits / 8, pbes2.prfNodeByName(prf, _err, "cms"));
+  var key = guard.crypto.pbkdf2(password, salt, iterations, ca.keyBits / 8, pbes2.prfNodeByName(prf, _err, "cms"));
   if (pwOwn2.owned) guard.secret.zeroize(password, CmsError, "cms/bad-input", "the password encoding");
   try {
     var enc = contentStream
@@ -596,10 +601,10 @@ async function _encryptedDataPbes2(contentBytes, contentStream, desc, ca, conten
 }
 
 function _gcmEncrypt(key, nonce, plaintext, aad, keyBits, tagLen) {
-  var c = nodeCrypto.createCipheriv("aes-" + keyBits + "-gcm", key, nonce, { authTagLength: tagLen });
-  if (aad && aad.length) c.setAAD(aad);
+  var c = guard.crypto.cipher("aes-" + keyBits + "-gcm", key, nonce, { authTagLength: tagLen });
+  if (aad && aad.length) guard.crypto.transformSetAAD(c, aad);
   var ct = guard.secret.cipherFinish(c, plaintext, CmsError, "cms/bad-input", "a content-encryption intermediate");
-  return { ct: ct, tag: c.getAuthTag() };
+  return { ct: ct, tag: guard.crypto.cipherAuthTag(c) };
 }
 
 function _tlvHeaderLen(der) {
@@ -676,11 +681,11 @@ async function _authenticateImpl(content, recipients, opts) {
   var contentType = opts.contentType || "data";
   if (contentType !== "data" && !withAttrs) throw _err("cms/bad-input", "AuthenticatedData with a non-data contentType requires authenticated attributes (RFC 5652 sec. 9.1)");
 
-  var macKey = nodeCrypto.randomBytes(MAC_KEY_OCTETS);
+  var macKey = guard.crypto.randomBytes(MAC_KEY_OCTETS);
   try {
     var recips = [];
     var consumedAuth = {};
-    for (var i = 0; i < recipients.length; i++) recips.push(await _buildRecipient(macKey, recipients[i], opts, consumedAuth));
+    for (var i = 0; i < recipients.length; i++) _push(recips,await _buildRecipient(macKey, recipients[i], opts, consumedAuth));
     _assertDefaultsConsumed(opts, consumedAuth);
     var riNodes = recips.map(_taggedRecipient);
 
@@ -705,7 +710,7 @@ async function _authenticateImpl(content, recipients, opts) {
        *  MAC algorithm substitution attack, which is difficult because the attacker does not know
        *  the authentication key". Built from the same values the two outer fields are built from. */
       if (protectionOid) {
-        intrinsic.push(pairs, b.sequence([
+        intrinsic.append(pairs, b.sequence([
           b.oid(protectionOid),
           b.setOf([b.sequence([_algId(digestName), b.implicit(2, _algId(mac.oid))])]),
         ]));
@@ -732,10 +737,10 @@ async function _authenticateImpl(content, recipients, opts) {
 
     var eci = b.sequence([b.oid(O(contentType)), b.explicit(0, b.octetString(contentBytes))]);
     var kids = [b.integer(0n), b.setOf(riNodes), _algId(mac.oid)];
-    if (digestAlgTagged) kids.push(digestAlgTagged);
-    kids.push(eci);
-    if (authAttrsDer) kids.push(authAttrsDer);
-    kids.push(b.octetString(macValue));
+    if (digestAlgTagged) _push(kids,digestAlgTagged);
+    _push(kids,eci);
+    if (authAttrsDer) _push(kids,authAttrsDer);
+    _push(kids,b.octetString(macValue));
     var ci = b.sequence([b.oid(O("authData")), b.explicit(0, b.sequence(kids))]);
     try { schemaCms.parse(ci); } catch (e) { throw (e instanceof CmsError) ? e : _err("cms/bad-input", "the supplied authenticated attributes produced an invalid AuthenticatedData", e); }
     return opts.pem ? schemaCms.pemEncode(ci, "CMS") : ci;

package/lib/cms-sign.js

@@ -15,6 +15,12 @@ var webcrypto = require("./webcrypto");
 var signScheme = require("./sign-scheme");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+/** @internal `append`, not a captured `push`: appending with `push` STORES at the index, and a store
+ *  walks the prototype chain for a setter, so an accessor installed at an array index receives each
+ *  element as it is appended and can define something else in its place. The lists built here become
+ *  a message's signed attributes, its certificate set and its signer infos. `append` defines the
+ *  index on the array itself. */
+var _push = intrinsic.append;
 /** @internal `resolve` and `all` build their promise from the RECEIVER, so reading the global binding
  *  at the call hands the construction to whatever that binding holds. Each signer's digest and
  *  signature are awaited through one of these, and a replacement that settles without awaiting emits a
@@ -73,7 +79,11 @@ function _digest(digestName, content) {
 
 
 function _skiValue(cert) {
-  var ext = (cert.extensions || []).filter(function (e) { return e.oid === OID_SKI; })[0];
+  /** @internal The selection returns the first matching row or null, because `filter(...)[0]` indexes
+   *  a result that is EMPTY when the extension is absent, and index 0 of an empty array answers from
+   *  the array prototype: the refusal below would then not be reached for a certificate that carries
+   *  no SKI. */
+  var ext = guard.list.firstMatch(cert.extensions || [], function (e) { return e.oid === OID_SKI; });
   if (!ext) throw _err("cms/no-ski", "a subjectKeyIdentifier signer identifier requires the signer certificate to carry an SKI extension");
   try { return asn1.read.octetString(asn1.decode(ext.value)); }
   catch (e) { throw _err("cms/no-ski", "the signer certificate's subjectKeyIdentifier extension value is not an OCTET STRING", e); }
@@ -216,10 +226,10 @@ async function _finishSignerInfo(rc, md, content, eContentType, opts) {
       { type: O("contentType"), values: [b.oid(eContentType)] },
       { type: O("messageDigest"), values: [b.octetString(md)] },
     ];
-    if (opts.signingTime !== false) intrinsic.push(pairs, { type: O("signingTime"), values: [_timeValue(opts.signingTime)] });
+    if (opts.signingTime !== false) _push(pairs, { type: O("signingTime"), values: [_timeValue(opts.signingTime)] });
     var apOid = cms.algorithmProtectionOid(opts.algorithmProtection, _err);
     if (apOid) {
-      intrinsic.push(pairs, _algorithmProtectionPair(apOid,
+      _push(pairs, _algorithmProtectionPair(apOid,
         rc.scheme.digestAlgId, rc.scheme.sigAlgId, 1));
     }
     pairs = intrinsic.concat(pairs, _resolveAttrPairs(opts.additionalSignedAttributes, "a signed attribute value"));
@@ -230,10 +240,13 @@ async function _finishSignerInfo(rc, md, content, eContentType, opts) {
   var sig = await signScheme.signOverTbs(rc.scheme, rc.soKey, signedBytes, _signE);
   await _assertKeyMatchesSpki(rc.keyOnly, rc.soKey, rc.soSpki, rc.scheme, sig, signedBytes, rc.cert);
   var fields = [b.integer(BigInt(rc.version)), rc.sid, rc.scheme.digestAlgId];
-  if (toSign.wire) intrinsic.push(fields, toSign.wire);
-  intrinsic.push(fields, rc.scheme.sigAlgId, b.octetString(sig));
+  if (toSign.wire) _push(fields, toSign.wire);
+  /** @internal Two appends, because `append` takes one value where `push` took many: the algorithm
+   *  identifier and the signature it describes are adjacent fields of the same SignerInfo. */
+  _push(fields, rc.scheme.sigAlgId);
+  _push(fields, b.octetString(sig));
   var ua = _buildUnsignedAttrs(opts.unsignedAttributes);
-  if (ua) intrinsic.push(fields, ua);
+  if (ua) _push(fields, ua);
   return { si: b.sequence(fields), digestAlgId: rc.scheme.digestAlgId, version: rc.version, certDer: rc.certDer };
 }
 
@@ -367,7 +380,7 @@ async function _signStream(stream, signers, opts) {
   if (opts.signingTime != null && opts.signingTime !== false) guard.time.assertEncodable(opts.signingTime, _err, "cms/bad-input", "signingTime");
   var rcs = intrinsic.map(list, function (s) { return _resolveSignerContext(s, opts); });
   var digestNames = [], seenDigest = intrinsic.create(null);
-  intrinsic.forEach(rcs, function (r) { if (!seenDigest[r.scheme.digest]) { seenDigest[r.scheme.digest] = 1; intrinsic.push(digestNames, r.scheme.digest); } });
+  intrinsic.forEach(rcs, function (r) { if (!seenDigest[r.scheme.digest]) { seenDigest[r.scheme.digest] = 1; _push(digestNames, r.scheme.digest); } });
   var wcNames = intrinsic.map(digestNames, function (n) { return DIGEST_HASH[n]; });
   var digests;
   try {
@@ -379,7 +392,7 @@ async function _signStream(stream, signers, opts) {
   intrinsic.forEach(digestNames, function (n, i) { byName[n] = intrinsic.bufferFrom(digests[i]); });
   var built = [];
   for (var _ip = 0; _ip < rcs.length; _ip++) {
-    intrinsic.push(built, await _finishSignerInfo(rcs[_ip], byName[rcs[_ip].scheme.digest], null, eContentType, opts));
+    _push(built, await _finishSignerInfo(rcs[_ip], byName[rcs[_ip].scheme.digest], null, eContentType, opts));
   }
   return _assembleSignedData(built, eContentType, opts, null);
 }
@@ -420,19 +433,19 @@ function _sign(content, signers, opts) {
 
 function _assembleSignedData(built, eContentType, opts, contentBuf) {
   var seen = intrinsic.create(null), digestAlgs = [];
-  intrinsic.forEach(built, function (x) { var k = intrinsic.bufToString(x.digestAlgId, "hex"); if (!seen[k]) { seen[k] = 1; intrinsic.push(digestAlgs, x.digestAlgId); } });
+  intrinsic.forEach(built, function (x) { var k = intrinsic.bufToString(x.digestAlgId, "hex"); if (!seen[k]) { seen[k] = 1; _push(digestAlgs, x.digestAlgId); } });
   var v3 = intrinsic.some(built, function (x) { return x.version === 3; }) || eContentType !== OID_DATA;
   var version = v3 ? 3 : 1;
   var encapFields = [b.oid(eContentType)];
-  if (!opts.detached) intrinsic.push(encapFields, b.explicit(0, b.octetString(contentBuf)));
+  if (!opts.detached) _push(encapFields, b.explicit(0, b.octetString(contentBuf)));
   var encap = b.sequence(encapFields);
   var sdFields = [b.integer(BigInt(version)), b.set(digestAlgs), encap];
   if (opts.certificates !== false) {
     var certDers = intrinsic.sort(_dedupe(intrinsic.filter(intrinsic.map(built, function (x) { return x.certDer; }),
       function (d) { return d != null; })), intrinsic.compare);
-    if (certDers.length) intrinsic.push(sdFields, b.contextConstructed(0, intrinsic.bufferConcat(certDers)));
+    if (certDers.length) _push(sdFields, b.contextConstructed(0, intrinsic.bufferConcat(certDers)));
   }
-  intrinsic.push(sdFields, b.set(intrinsic.map(built, function (x) { return x.si; })));
+  _push(sdFields, b.set(intrinsic.map(built, function (x) { return x.si; })));
   var signedData = b.sequence(sdFields);
   var contentInfo = b.sequence([b.oid(OID_SIGNED_DATA), b.explicit(0, signedData)]);
   return opts.pem ? pkix.pemEncode(contentInfo, "CMS", frameworkError.PemError) : contentInfo;
@@ -450,7 +463,7 @@ function _digestAlgIdentifier(der) {
 
 function _dedupe(ders) {
   var seen = intrinsic.create(null), out = [];
-  intrinsic.forEach(ders, function (d) { var k = intrinsic.bufToString(d, "hex"); if (!seen[k]) { seen[k] = 1; intrinsic.push(out, d); } });
+  intrinsic.forEach(ders, function (d) { var k = intrinsic.bufToString(d, "hex"); if (!seen[k]) { seen[k] = 1; _push(out, d); } });
   return out;
 }
 
@@ -496,9 +509,9 @@ function certsOnly(certs, opts) {
   var crlDers = intrinsic.sort(_dedupe(intrinsic.map(crlList, function (c) { return _normEntityDer(c, "a CRL", "X509 CRL", _parseCrl); })), intrinsic.compare);
   var encap = b.sequence([b.oid(OID_DATA)]);
   var sdFields = [b.integer(1n), b.set([]), encap];
-  if (certDers.length) intrinsic.push(sdFields, b.contextConstructed(0, intrinsic.bufferConcat(certDers)));
-  if (crlDers.length) intrinsic.push(sdFields, b.contextConstructed(1, intrinsic.bufferConcat(crlDers)));
-  intrinsic.push(sdFields, b.set([]));
+  if (certDers.length) _push(sdFields, b.contextConstructed(0, intrinsic.bufferConcat(certDers)));
+  if (crlDers.length) _push(sdFields, b.contextConstructed(1, intrinsic.bufferConcat(crlDers)));
+  _push(sdFields, b.set([]));
   var signedData = b.sequence(sdFields);
   var contentInfo = b.sequence([b.oid(OID_SIGNED_DATA), b.explicit(0, signedData)]);
   return opts.pem ? pkix.pemEncode(contentInfo, "CMS", frameworkError.PemError) : contentInfo;
@@ -512,7 +525,7 @@ function _toBuf(v, what) {
 
 function _resolveSignerIndices(spec, n) {
   if (spec == null) { if (n < 1) throw _err("cms/bad-input", "the SignedData carries no SignerInfo to countersign"); return [0]; }
-  if (spec === "all") { var all = []; for (var i = 0; i < n; i++) all.push(i); return all; }
+  if (spec === "all") { var all = []; for (var i = 0; i < n; i++) _push(all, i); return all; }
   var arr = Array.isArray(spec) ? spec : [spec];
   if (!arr.length) throw _err("cms/bad-input", "signerIndex must select at least one signer");
   arr.forEach(function (i) { if (typeof i !== "number" || !Number.isInteger(i) || i < 0 || i >= n) throw _err("cms/bad-input", "signerIndex out of range: " + i); });
@@ -534,10 +547,10 @@ function _buildCountersignature(targetSigOctets, countersigner, opts) {
     if (opts.signedAttributes === false) return null;
     return intrinsic.chain(_digest(scheme.digest, targetSigOctets), function (md) {
       var pairs = [{ type: O("messageDigest"), values: [b.octetString(md)] }];
-      if (opts.signingTime !== false) pairs.push({ type: O("signingTime"), values: [_timeValue(opts.signingTime)] });
+      if (opts.signingTime !== false) _push(pairs, { type: O("signingTime"), values: [_timeValue(opts.signingTime)] });
       var csApOid = cms.algorithmProtectionOid(opts.algorithmProtection, _err);
       if (csApOid) {
-        intrinsic.push(pairs, _algorithmProtectionPair(csApOid, scheme.digestAlgId, scheme.sigAlgId, 1));
+        _push(pairs, _algorithmProtectionPair(csApOid, scheme.digestAlgId, scheme.sigAlgId, 1));
       }
       var extra = _resolveAttrPairs(opts.additionalSignedAttributes, "a countersignature signed attribute value");
       extra.forEach(function (p) { if (p.type === O("contentType")) throw _err("cms/bad-input", "a countersignature must not carry a content-type attribute (RFC 5652 sec. 11.4)"); });
@@ -556,8 +569,9 @@ function _buildCountersignature(targetSigOctets, countersigner, opts) {
       });
       return intrinsic.chain(selfChecked, function () {
         var fields = [b.integer(BigInt(sidv.version)), sidv.sid, scheme.digestAlgId];
-        if (attrs) fields.push(attrs.wire);
-        fields.push(scheme.sigAlgId, b.octetString(sig));
+        if (attrs) _push(fields, attrs.wire);
+        _push(fields, scheme.sigAlgId);
+        _push(fields, b.octetString(sig));
         return { value: b.sequence(fields), certDer: certDer, digestAlgId: scheme.digestAlgId };
       });
     });
@@ -568,13 +582,17 @@ function _mergeCountersig(uaNode, newCsValues) {
   var CS = O("countersignature");
   var others = [], csValues = [];
   if (uaNode) uaNode.children.forEach(function (attr) {
-    if (asn1.read.oid(attr.children[0]) === CS) attr.children[1].children.forEach(function (v) { csValues.push(v.bytes); });
-    else others.push(attr.bytes);
+    if (asn1.read.oid(attr.children[0]) === CS) intrinsic.forEach(attr.children[1].children, function (v) { _push(csValues, v.bytes); });
+    else _push(others, attr.bytes);
   });
-  newCsValues.forEach(function (v) { csValues.push(v); });
+  intrinsic.forEach(newCsValues, function (v) { _push(csValues, v); });
   var csAttr = b.sequence([b.oid(CS), b.set(csValues)]);
-  var setOf = b.set(others.concat([csAttr]));
-  var wire = Buffer.from(setOf); wire[0] = 0xA1;
+  /** @internal `concatList`, not `concat`: `Array.prototype.concat` builds its result through the
+   *  species constructor, so a species answering with a Proxy intercepted the countersignature
+   *  attribute as it was inserted and the merged value went out without it. `concatList` copies own
+   *  indexes into an array it made itself. */
+  var setOf = b.set(intrinsic.concatList(others, [csAttr]));
+  var wire = intrinsic.bufferFrom(setOf); wire[0] = 0xA1;
   return wire;
 }
 
@@ -583,7 +601,7 @@ function _appendCountersigs(siNode, newCsValues) {
   var last = kids[kids.length - 1];
   var hasUa = last.tagClass === "context" && last.tagNumber === 1;
   var base = (hasUa ? kids.slice(0, kids.length - 1) : kids).map(function (k) { return k.bytes; });
-  base.push(_mergeCountersig(hasUa ? last : null, newCsValues));
+  _push(base, _mergeCountersig(hasUa ? last : null, newCsValues));
   return b.sequence(base);
 }
 
@@ -603,7 +621,7 @@ function _spliceNested(siNode, j, newCsValues) {
   if (!found) throw _err("cms/bad-input", "the target signer carries no countersignature to countersign");
   var setOf = b.set(attrs); var wire = Buffer.from(setOf); wire[0] = 0xA1;
   var base = kids.slice(0, kids.length - 1).map(function (k) { return k.bytes; });
-  base.push(wire);
+  _push(base, wire);
   return b.sequence(base);
 }
 
@@ -619,7 +637,11 @@ function _targetPreimage(siNode, opts) {
   var last = siNode.children[siNode.children.length - 1];
   var CS = O("countersignature");
   if (!last || last.tagClass !== "context" || last.tagNumber !== 1) throw _err("cms/bad-input", "the target signer carries no countersignature to countersign");
-  var attr = last.children.filter(function (a) { return asn1.read.oid(a.children[0]) === CS; })[0];
+  /** @internal The selection returns the first matching attribute or null, because `filter(...)[0]`
+   *  indexes a result that is EMPTY when the signer carries no countersignature attribute, and index
+   *  0 of an empty array answers from the array prototype: the refusal below would then not be
+   *  reached and the signature bytes would be taken from whatever the accessor answered with. */
+  var attr = guard.list.firstMatch(last.children, function (a) { return asn1.read.oid(a.children[0]) === CS; });
   if (!attr) throw _err("cms/bad-input", "the target signer carries no countersignature to countersign");
   var values = attr.children[1].children;
   var j = opts.countersignatureOf;
@@ -653,15 +675,15 @@ function _countersign(cmsInput, signers, opts) {
   var jobs = [];
   targets.forEach(function (t) {
     var preimage = _targetPreimage(siSet.children[t], opts);
-    list.forEach(function (cs) { jobs.push({ t: t, p: _buildCountersignature(preimage, cs, opts) }); });
+    intrinsic.forEach(list, function (cs) { _push(jobs, { t: t, p: _buildCountersignature(preimage, cs, opts) }); });
   });
   return intrinsic.chain(intrinsic.allOf(intrinsic.mapList(jobs, function (j) { return j.p; })), function (built) {
     var byTarget = intrinsic.create(null), certDers = [], csDigestAlgs = [];
     intrinsic.forEach(built, function (res, i) {
       var slot = byTarget[jobs[i].t] || (byTarget[jobs[i].t] = []);
-      intrinsic.push(slot, res.value);
-      intrinsic.push(certDers, res.certDer);
-      intrinsic.push(csDigestAlgs, res.digestAlgId);
+      _push(slot, res.value);
+      _push(certDers, res.certDer);
+      _push(csDigestAlgs, res.digestAlgId);
     });
 
     var newSiSet = b.set(siSet.children.map(function (siNode, idx) {
@@ -675,8 +697,8 @@ function _countersign(cmsInput, signers, opts) {
       else if (sdKids[i].tagClass === "context" && sdKids[i].tagNumber === 1) crlsNode = sdKids[i];
     }
     var existing = [];
-    if (certsNode) certsNode.children.forEach(function (c) { existing.push(c.bytes); });
-    if (opts.certificates !== false) certDers.forEach(function (d) { existing.push(d); });
+    if (certsNode) intrinsic.forEach(certsNode.children, function (c) { _push(existing, c.bytes); });
+    if (opts.certificates !== false) intrinsic.forEach(certDers, function (d) { _push(existing, d); });
     /** @internal The DER SET ordering through the captured copy, sort AND comparator: read off its own
      * home, any of the three decides which certificate lands where in the set this message carries. */
     var allCerts = guard.list.sortedCopy(_dedupe(existing), intrinsic.compare);
@@ -693,20 +715,20 @@ function _countersign(cmsInput, signers, opts) {
      * comparison would list it a second time. */
     var listed = [];
     intrinsic.forEach(intrinsic.isArray(parsed.digestAlgorithms) ? parsed.digestAlgorithms : [],
-      function (a) { intrinsic.push(listed, a); });
+      function (a) { _push(listed, a); });
     var digestAlgs = intrinsic.map(sdKids[1].children, function (d) { return d.bytes; });
     intrinsic.forEach(csDigestAlgs, function (der) {
       var info = _digestAlgIdentifier(der);
       var already = false;
       intrinsic.forEach(listed, function (alg) { if (cms.sameDigestAlgorithm(alg, info)) already = true; });
       if (already) return;
-      intrinsic.push(listed, info);
-      intrinsic.push(digestAlgs, der);
+      _push(listed, info);
+      _push(digestAlgs, der);
     });
     var newSdFields = [sdKids[0].bytes, b.set(digestAlgs), sdKids[2].bytes];
-    if (allCerts.length) newSdFields.push(b.contextConstructed(0, Buffer.concat(allCerts)));
-    if (crlsNode) newSdFields.push(crlsNode.bytes);
-    newSdFields.push(newSiSet);
+    if (allCerts.length) _push(newSdFields, b.contextConstructed(0, intrinsic.bufferConcat(allCerts)));
+    if (crlsNode) _push(newSdFields, crlsNode.bytes);
+    _push(newSdFields, newSiSet);
     var newCi = b.sequence([root.children[0].bytes, b.explicit(0, b.sequence(newSdFields))]);
     return opts.pem ? pkix.pemEncode(newCi, "CMS", frameworkError.PemError) : newCi;
   });
@@ -732,7 +754,7 @@ function _appendUnsignedAttr(siNode, attrDer) {
   var existing = hasUa ? intrinsic.map(last.children, function (a) { return a.bytes; }) : [];
   var setOf = b.set(intrinsic.concat(existing, [attrDer]));
   var wire = intrinsic.bufferFrom(setOf); wire[0] = 0xA1;
-  intrinsic.push(base, wire);
+  _push(base, wire);
   return b.sequence(base);
 }
 
@@ -955,7 +977,7 @@ function _attachTimestamp(input, token, opts) {
   }));
   var sdKids = t.sd.children;
   var newSdFields = intrinsic.map(intrinsic.arraySlice(sdKids, 0, sdKids.length - 1), function (k) { return k.bytes; });
-  intrinsic.push(newSdFields, newSiSet);
+  _push(newSdFields, newSiSet);
   var out = b.sequence([t.root.children[0].bytes, b.explicit(0, b.sequence(newSdFields))]);
   return opts.pem ? pkix.pemEncode(out, "CMS", frameworkError.PemError) : out;
 }

package/lib/cms-verify.js

@@ -203,7 +203,11 @@ function _preferBoundCandidate(si, candidates) {
 }
 
 function _certSki(cert) {
-  var ext = (cert.extensions || []).filter(function (e) { return e.oid === oid.byName("subjectKeyIdentifier"); })[0];
+  /** @internal The selection returns the first matching row or null. `filter(...)[0]` indexes a
+   *  result that is EMPTY when the extension is absent, and index 0 of an empty array answers from
+   *  the array prototype, so a value installed there reads at the test below as an extension the
+   *  certificate does not carry. */
+  var ext = guard.list.firstMatch(cert.extensions || [], function (e) { return e.oid === oid.byName("subjectKeyIdentifier"); });
   if (!ext) return null;
   try {
     return asn1.read.octetString(asn1.decode(ext.value));
@@ -359,7 +363,7 @@ async function _computeCountersigBytes(si, csTarget) {
     attrs = _decodeSignedAttrs(reTagged);
   } catch (e) { if (e instanceof CmsError) throw e; throw _err("cms/bad-signed-attrs", "the countersignature signedAttrs is not a valid SET OF Attribute", e); }
   if (intrinsic.filter(attrs, function (a) { return a.type === OID_CONTENT_TYPE; }).length) throw _err("cms/misplaced-attr", "a countersignature must not carry a content-type attribute (RFC 5652 sec. 11.4)");
-  var mdAttr = intrinsic.filter(attrs, function (a) { return a.type === OID_MESSAGE_DIGEST; })[0];
+  var mdAttr = guard.list.firstMatch(attrs, function (a) { return a.type === OID_MESSAGE_DIGEST; });
   if (!mdAttr || mdAttr.values.length !== 1) throw _err("cms/bad-signed-attrs", "a countersignature's signedAttrs must carry exactly one message-digest attribute (RFC 5652 sec. 11.4)");
   var declared;
   try {
@@ -402,7 +406,7 @@ async function _computeSignedBytes(si, content, eContentType, digestByName) {
     ctOid = asn1.read.oid(ctAttr[0].values[0]);
   } catch (e) { throw _err("cms/bad-signed-attrs", "the content-type attribute value is not an OBJECT IDENTIFIER", e); }
   if (ctOid !== eContentType) return { mismatch: { code: "cms/content-type-mismatch", message: "the content-type signed attribute does not match the SignedData eContentType (RFC 5652 sec. 5.3)" } };
-  var mdAttr = intrinsic.filter(attrs, function (a) { return a.type === OID_MESSAGE_DIGEST; })[0];
+  var mdAttr = guard.list.firstMatch(attrs, function (a) { return a.type === OID_MESSAGE_DIGEST; });
   if (!mdAttr || mdAttr.values.length !== 1) throw _err("cms/bad-signed-attrs", "signedAttrs must carry exactly one message-digest attribute (RFC 5652 sec. 5.4)");
   var declared;
   try {
@@ -1172,7 +1176,7 @@ var _permitsSigning = pkix.keyUsagePermits(pkix.makeNS("cms", CmsError, oid),
   ["digitalSignature", "contentCommitment", "nonRepudiation"]);
 
 function _keyUsagePermitsSigning(parsedCerts, der) {
-  var entry = intrinsic.filter(parsedCerts, function (c) { return intrinsic.bufferEquals(c.der, der); })[0];
+  var entry = guard.list.firstMatch(parsedCerts, function (c) { return intrinsic.bufferEquals(c.der, der); });
   if (!entry) return true;
   return _permitsSigning(entry.cert);
 }