@blamejs/pki 0.8.7 → 0.8.9

package/lib/key.js

@@ -25,6 +25,8 @@ var constants = require("./constants");
 var oid = require("./oid");
 var pbes2 = require("./pbes2");
 var pkcs8 = require("./schema-pkcs8");
+var schemaPkcs1 = require("./schema-pkcs1");
+var schemaSec1 = require("./schema-sec1");
 var pkix = require("./schema-pkix");
 var schema = require("./schema-engine");
 var webcrypto = require("./webcrypto");
@@ -64,6 +66,60 @@ var INFER_ALG = _create(null);
 function _isCryptoKey(x) { return webcrypto.isCryptoKeyLike(x); }
 function _algName(a) { return typeof a === "string" ? a : (a && a.name); }
 
+/** @internal The curve each SEC1 registry name is known by in WebCrypto, which names its curves
+ * the way RFC 5480 sec. 2.1.1.1 writes them and not the way the ASN.1 registry does. A curve with
+ * no row is one the engine cannot take, and saying so names the curve. */
+var WEBCRYPTO_CURVE = _assign(_create(null), {
+  "prime256v1": "P-256", "secp384r1": "P-384", "secp521r1": "P-521",
+});
+
+/** @internal The byte doors the two named formats come in through. Each keeps its own PEM label,
+ * so an `EC PRIVATE KEY` block handed in as `pkcs1` is refused by label before it is read. */
+var _PKCS1_ENTRY = _assign(_create(null), { pemLabel: "RSA PRIVATE KEY", PemError: PemError, ErrorClass: KeyError, prefix: "key" });
+var _SEC1_ENTRY = _assign(_create(null), { pemLabel: "EC PRIVATE KEY", PemError: PemError, ErrorClass: KeyError, prefix: "key" });
+var _PKCS1_PUBLIC_ENTRY = _assign(_create(null), { pemLabel: "RSA PUBLIC KEY", PemError: PemError, ErrorClass: KeyError, prefix: "key" });
+
+/** @internal RFC 8017 App. A.1 gives the PKCS#1 encoding two structures, `RSAPrivateKey` and
+ * `RSAPublicKey`, with an armor label each. `opts.format` names the encoding, so both labels are
+ * that encoding: the one on the armor says which structure to expect, and the structure the bytes
+ * carry has to agree, so a key armored under the label of the half it is not is refused instead of
+ * being read as the other half. Bare DER carries no label and is classified by its structure. */
+function _pkcs1Der(input) {
+  var armored = typeof input === "string" ||
+    (guard.bytes.isByteSource(input) && pkix.isPemArmor(guard.bytes.source(input, KeyError, "key/bad-input", "import")));
+  if (!armored) return pkix.coerceToDer(input, _PKCS1_ENTRY);
+  var der, saidPublic;
+  try { der = pkix.coerceToDer(input, _PKCS1_ENTRY); saidPublic = false; }
+  catch (e) {
+    if (!e || e.code !== "pem/label-mismatch") throw e;
+    der = pkix.coerceToDer(input, _PKCS1_PUBLIC_ENTRY);
+    saidPublic = true;
+  }
+  if (_looksLikeRsaPublic(der) !== saidPublic) {
+    throw _err("key/bad-input", "the PEM label says this is an RSA " + (saidPublic ? "PUBLIC" : "PRIVATE") +
+      " KEY and the bytes carry the other half (RFC 8017 App. A.1)");
+  }
+  return der;
+}
+
+/** @internal PKCS#1 and SEC1 both carry a key and no algorithm identifier, so importing one means
+ * wrapping it in the structure that does. RFC 5958 sec. 2 for the private half, RFC 5280
+ * sec. 4.1.2.7 for the public one. The inner bytes are carried through unchanged: what the caller
+ * handed in is what the engine reads. */
+function _pkcs1ToPkcs8(der) {
+  return b.sequence([b.integer(0n),
+    b.sequence([b.oid(O("rsaEncryption")), b.nullValue()]),
+    b.octetString(der)]);
+}
+function _pkcs1ToSpki(der) {
+  return b.sequence([b.sequence([b.oid(O("rsaEncryption")), b.nullValue()]), b.bitString(der, 0)]);
+}
+function _sec1ToPkcs8(der, curveOid) {
+  return b.sequence([b.integer(0n),
+    b.sequence([b.oid(O("ecPublicKey")), b.oid(curveOid)]),
+    b.octetString(der)]);
+}
+
 async function _toPrivateKeyDer(input) {
   if (_isCryptoKey(input)) {
     if (input.type !== "private") throw _err("key/bad-input", "a private CryptoKey is required (got a " + input.type + " key)");
@@ -210,8 +266,15 @@ function _decryptPbes2(encAlg, ciphertext, password, opts) {
  * A key created non-extractable is refused with that as the reason,
  * as is one whose implementation keeps its material out of this process's reach entirely.
  *
+ * `format` also writes the encodings an operator's other tools read: `pkcs1` for the RFC 8017 App. A.1
+ * `RSAPrivateKey` or `RSAPublicKey`, `sec1` for the RFC 5915 `ECPrivateKey`, and `jwk` for an RFC 7517
+ * JSON Web Key. The two DER forms are pulled out of the wrapper the engine wrote, so the inner bytes are
+ * the engine's own; a SEC1 key is given the `[0] parameters` field the standalone form needs, which
+ * RFC 5915 sec. 3 omits while the key sits inside a PKCS#8. A key whose algorithm the encoding does not
+ * describe, an Ed25519 key asked for as PKCS#1 for instance, is refused with `key/bad-input`.
+ *
  * @opts
- *   - `format` (string) -- `der` (default) or `pem`.
+ *   - `format` (string) -- `der` (default), `pem`, `pkcs1`, `sec1` or `jwk`.
  *   - `label` (string) -- the PEM label (defaults `PRIVATE KEY` / `PUBLIC KEY` by key type).
  * @example
  *   var pair = await pki.key.generate("Ed25519");
@@ -229,11 +292,21 @@ async function export_(key, opts) {
   if (key.type === "private") defaultLabel = "PRIVATE KEY";
   else if (key.type === "public") defaultLabel = "PUBLIC KEY";
   else throw _err("key/bad-input", "export supports asymmetric (private / public) CryptoKeys only");
-  var der = await webcrypto.exportAnyKey(key, _err, "key/bad-input");
   var fmt = opts.format || "der";
+  if (fmt === "jwk") {
+    try {
+      return await webcrypto.exportAnyKey(key, _err, "key/bad-input", "jwk");
+    } catch (e) {
+      if (e && e.isPkiError) throw e;
+      throw _err("key/bad-input", "exporting the key as a JWK failed", e);
+    }
+  }
+  var der = await webcrypto.exportAnyKey(key, _err, "key/bad-input");
   if (fmt === "der") return der;
   if (fmt === "pem") return pkix.pemEncode(der, opts.label || defaultLabel, PemError);
-  throw _err("key/bad-input", "unsupported format " + guard.text.showValue(opts.format) + " (der / pem)");
+  if (fmt === "pkcs1") return _toPkcs1(der, key);
+  if (fmt === "sec1") return _toSec1(der, key);
+  throw _err("key/bad-input", "unsupported format " + guard.text.showValue(opts.format) + " (der / pem / pkcs1 / sec1 / jwk)");
 }
 
 /**
@@ -250,8 +323,16 @@ async function export_(key, opts) {
  * SLH-DSA); RSA and EC are ambiguous between signing and key agreement, so `opts.algorithm` must be supplied
  * for them (without it the import fails closed). Default key usages follow the algorithm and key type.
  *
+ * `opts.format` reads an encoding that is not PKCS#8 or SubjectPublicKeyInfo: `pkcs1` for the RFC 8017
+ * App. A.1 `RSA PRIVATE KEY` and `RSA PUBLIC KEY`, `sec1` for the RFC 5915 `EC PRIVATE KEY`, and `jwk`
+ * for an RFC 7517 JSON Web Key. Neither DER encoding names an algorithm, so `opts.algorithm` is required
+ * with both and nothing is inferred; the key is wrapped in the structure that does name one and handed to
+ * the engine with its bytes unchanged. A multi-prime RSA key reads as a structure through
+ * `pki.schema.pkcs1.parse` and is refused here with `key/unsupported-key`.
+ *
  * @opts
- *   - `algorithm` (string | object) -- the WebCrypto algorithm (required for RSA / EC; overrides inference).
+ *   - `algorithm` (string | object) -- the WebCrypto algorithm (required for RSA / EC / pkcs1 / sec1 / jwk; overrides inference).
+ *   - `format` (string) -- `pkcs1`, `sec1` or `jwk`; omit to read PKCS#8 or SubjectPublicKeyInfo.
  *   - `usages` (string[]) -- key usages (default derived from the algorithm and public/private type).
  *   - `extractable` (boolean) -- default false.
  *   - `password` (string | Buffer) -- decrypt an `ENCRYPTED PRIVATE KEY` first.
@@ -260,12 +341,26 @@ async function export_(key, opts) {
  *   var spki = await pki.key.export(pair.publicKey);
  *   var pub = await pki.key.import(spki);                       // Ed25519 -- algorithm inferred
  */
-var _IMPORT_OPTS = _assign(_create(null), { algorithm: 1, extractable: 1, password: 1, usages: 1 });
+var _IMPORT_OPTS = _assign(_create(null), { algorithm: 1, extractable: 1, password: 1, usages: 1, format: 1 });
+var _IMPORT_FORMATS = _assign(_create(null), { pkcs1: 1, sec1: 1, jwk: 1 });
+
+/** @internal Which named encoding the caller asked for, or null when they named none and the door
+ * detects PKCS#8 or SubjectPublicKeyInfo as it always has. A value outside the set is refused
+ * here, before any byte of the input is read. */
+function _namedImportFormat(value) {
+  if (value == null) return null;
+  var name = typeof value === "string" ? guard.text.keyOf(value) : null;
+  if (name === null || _IMPORT_FORMATS[name] !== 1) {
+    throw _err("key/bad-input", "opts.format is pkcs1, sec1 or jwk; leave it out to read PKCS#8 or SubjectPublicKeyInfo. Got " + guard.text.showValue(value));
+  }
+  return name;
+}
 
 async function import_(input, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.import options");
   guard.identifier.assertKnownKeys(opts, _IMPORT_OPTS, _err, "key/bad-input",
     "pki.key.import has an unknown option: ");
+  if (_namedImportFormat(opts.format) !== null) return await _importNamedFormat(input, opts);
   var detected = _detectKeyInput(input);
   if (detected.format === "encrypted") {
     if (opts.password == null) throw _err("key/bad-input", "an ENCRYPTED PRIVATE KEY requires opts.password to import");
@@ -1014,6 +1109,156 @@ function _inferAlgorithm(detected) {
     " (RSA and EC are ambiguous between signing and key agreement -- pass opts.algorithm)");
 }
 
+/** @internal Import from an encoding the caller named. PKCS#1 and SEC1 carry no algorithm, so
+ * `opts.algorithm` is required for both and there is no inference to fall back on. JWK carries its
+ * own key type and goes to the engine as it arrived. */
+async function _importNamedFormat(input, opts) {
+  var fmt = guard.text.keyOf(opts.format);
+  var extractable = opts.extractable != null ? opts.extractable : false;
+  if (fmt === "jwk") {
+    if (input === null || typeof input !== "object" || _isArray(input)) {
+      throw _err("key/bad-input", "a JWK is a JSON object (RFC 7517 sec. 4)");
+    }
+    if (typeof input.kty !== "string" || input.kty === "") {
+      throw _err("key/bad-input", "a JWK carries a kty naming its key type (RFC 7517 sec. 4.1)");
+    }
+    if (opts.algorithm == null) throw _err("key/bad-input", "importing a JWK needs opts.algorithm");
+    var jwkPublic = input.d === undefined && input.priv === undefined;
+    var jwkUsages = opts.usages || _importUsages(_algName(opts.algorithm), jwkPublic);
+    try {
+      return await subtle.importKey("jwk", input, opts.algorithm, extractable, jwkUsages);
+    } catch (e) {
+      if (e && e.isPkiError) throw e;
+      throw _err("key/bad-input", "importing the JWK failed", e);
+    }
+  }
+
+  if (opts.algorithm == null) {
+    throw _err("key/bad-input", "a " + (fmt === "pkcs1" ? "PKCS#1" : "SEC1") +
+      " key names no algorithm (RFC 8017 App. A.1, RFC 5915 sec. 3), so opts.algorithm says what it is");
+  }
+  /** @internal `opts.format` names the ENCODING, and RFC 8017 App. A.1 gives that encoding two
+   * structures with an armor label each. So both labels are read, and the structure the bytes
+   * carry decides which half arrived; a label naming the half the bytes are not is refused
+   * rather than read as the other. SEC1 has one structure and keeps its single label. */
+  var der;
+  if (fmt === "pkcs1") {
+    der = _pkcs1Der(input);
+  } else {
+    der = pkix.coerceToDer(input, _SEC1_ENTRY);
+  }
+  var wrapped, isPublic = false;
+  if (fmt === "pkcs1") {
+    var isPub = _looksLikeRsaPublic(der);
+    isPublic = isPub;
+    if (isPub) {
+      schemaPkcs1.parsePublic(der);
+      wrapped = _pkcs1ToSpki(der);
+    } else {
+      var rsa = schemaPkcs1.parse(der);
+      if (rsa.otherPrimeInfos.length > 0) {
+        throw _err("key/unsupported-key", "a multi-prime RSA key is readable as a structure and has no arm in this toolkit's crypto engine (RFC 8017 App. A.1.2)");
+      }
+      wrapped = _pkcs1ToPkcs8(der);
+    }
+  } else {
+    var ec = schemaSec1.parse(der);
+    var named = WEBCRYPTO_CURVE[ec.curve];
+    if (named === undefined) {
+      throw _err("key/unsupported-key", "the curve " + ec.curve + " has no WebCrypto name in this toolkit");
+    }
+    var wanted = opts.algorithm && opts.algorithm.namedCurve;
+    if (wanted != null && wanted !== named) {
+      throw _err("key/bad-input", "the key names the curve " + named + " and opts.algorithm names " + guard.text.showValue(wanted));
+    }
+    wrapped = _sec1ToPkcs8(der, ec.curveOid);
+  }
+  var usages = opts.usages || _importUsages(_algName(opts.algorithm), isPublic);
+  try {
+    return await subtle.importKey(isPublic ? "spki" : "pkcs8", wrapped, opts.algorithm, extractable, usages);
+  } catch (e) {
+    if (e && e.isPkiError) throw e;
+    throw _err("key/bad-input", "importKey failed", e);
+  }
+}
+
+/** @internal The inverse of the wrap: pull the inner key out of the PKCS#8 or SPKI the engine
+ * wrote. The bytes come back as they went in, since the engine carries the inner structure
+ * unchanged and this reads it rather than re-encoding it. */
+function _toPkcs1(der, key) {
+  var algOid = _wrappedAlgorithmOid(der, key);
+  if (algOid !== O("rsaEncryption")) {
+    throw _err("key/bad-input", "PKCS#1 is an RSA encoding (RFC 8017 App. A.1) and this key is " + _algName(key.algorithm));
+  }
+  var node = asn1.decode(der);
+  if (key.type === "public") {
+    var bits = asn1.read.bitString(node.children[1]);
+    if (bits.unusedBits !== 0) throw _err("key/bad-input", "the exported public key does not hold whole octets");
+    schemaPkcs1.parsePublic(bits.bytes);
+    return bits.bytes;
+  }
+  var inner = asn1.read.octetString(node.children[2]);
+  schemaPkcs1.parse(inner);
+  return inner;
+}
+function _toSec1(der, key) {
+  var algOid = _wrappedAlgorithmOid(der, key);
+  if (algOid !== O("ecPublicKey")) {
+    throw _err("key/bad-input", "SEC1 is an elliptic-curve private-key encoding (RFC 5915 sec. 3) and this key is " + _algName(key.algorithm));
+  }
+  if (key.type !== "private") {
+    throw _err("key/bad-input", "SEC1 encodes a private key; export the public half as SubjectPublicKeyInfo");
+  }
+  var node = asn1.decode(der);
+  var inner = asn1.read.octetString(node.children[2]);
+  /** @internal RFC 5915 sec. 3 says the [0] parameters field SHOULD be omitted when the key sits
+   * inside a PKCS#8, whose AlgorithmIdentifier already names the curve, and SHOULD be present when
+   * the key stands alone. So the curve is carried across from the wrapper here: without it the
+   * standalone key would not say which curve its scalar belongs to. */
+  var curveOid = asn1.read.oid(node.children[1].children[1]);
+  var innerNode = asn1.decode(inner);
+  var hasParams = false;
+  for (var i = 0; i < innerNode.children.length; i++) {
+    if (innerNode.children[i].tagClass === "context" && innerNode.children[i].tagNumber === 0) hasParams = true;
+  }
+  if (!hasParams) {
+    var stored;
+    for (var j = 0; j < innerNode.children.length; j++) {
+      var c = innerNode.children[j];
+      if (c.tagClass === "context" && c.tagNumber === 1) stored = asn1.read.bitString(c.children[0]);
+    }
+    inner = schemaSec1.encode({
+      version: 1,
+      privateKey: asn1.read.octetString(innerNode.children[1]),
+      curveOid: curveOid,
+      publicKey: stored === undefined ? null : stored.bytes,
+    });
+  }
+  schemaSec1.parse(inner);
+  return inner;
+}
+
+/** @internal The algorithm the wrapper names, read from whichever wrapper the key type produced:
+ * a PrivateKeyInfo names it second, a SubjectPublicKeyInfo first. */
+function _wrappedAlgorithmOid(der, key) {
+  var node;
+  try { node = asn1.decode(der); } catch (e) { throw _err("key/bad-input", "the exported key is not DER", e); }
+  var algSeq = key.type === "public" ? node.children[0] : node.children[1];
+  if (!algSeq || !algSeq.children || algSeq.children.length === 0) {
+    throw _err("key/bad-input", "the exported key names no algorithm");
+  }
+  return asn1.read.oid(algSeq.children[0]);
+}
+
+/** @internal An RSAPublicKey is two INTEGERs and an RSAPrivateKey is nine or ten, so the two
+ * encodings are told apart by counting the children of the top-level SEQUENCE. Neither door reads
+ * the other's structure, and the count decides which one this is before either runs. */
+function _looksLikeRsaPublic(der) {
+  var node;
+  try { node = asn1.decode(der); } catch (e) { throw _err("key/bad-input", "the input is not DER", e); }
+  return !!(node && node.children && node.children.length === 2);
+}
+
 function _importUsages(name, isPublic) {
   var n = _toUpperCase(_String(name == null ? "" : name));
   if (n === "X25519" || n === "X448" || n === "ECDH") return isPublic ? [] : ["deriveBits", "deriveKey"];

package/lib/ocsp.js

@@ -39,6 +39,7 @@ var subtle = webcrypto.webcrypto.subtle;
 var guard = require("./guard-all");
 var constants = require("./constants");
 var frameworkError = require("./framework-error");
+var E = _err;
 
 var OcspError = frameworkError.OcspError;
 var b = asn1.build;
@@ -651,30 +652,21 @@ function verify(response, opts) {
     issuerCert = _certOf(opts.issuer, "the issuer certificate");
     time = opts.time == null ? new Date() : _asDate(opts.time);
   } catch (e) { return Promise.reject(e); }
-  return pathValidate.verifyOcspResponse(parsed, cert, issuerCert, time, { historicalMode: opts.historicalMode === true }).then(function (verdict) {
-    var out;
-    if (opts.requestNonce == null) {
-      out = guard.verdict.of(verdict, { nonceMatched: null });
-    } else {
-      var respNonce = _responseNonce(parsed);
-      var reqNonce = guard.bytes.isByteSource(opts.requestNonce)
-        ? guard.bytes.snapshotSource(opts.requestNonce, OcspError, "ocsp/bad-input", "opts.requestNonce") : null;
-      var matched = respNonce != null && reqNonce != null && guard.crypto.constantTimeEqual(respNonce, reqNonce);
-      out = guard.verdict.of(verdict, { nonceMatched: matched });
-      if (!matched && out.status === "good") {
-        out = guard.verdict.of(out, { status: "unknown", reason: "the OCSP response nonce does not echo the request nonce (RFC 9654)" });
-      }
-    }
-    return guard.verdict.of(out, { valid: out.status === "good" });
+  /** @internal The nonce rule is applied by the acceptance gate rather than restated here, so this
+   * door and every other consumer of that gate answer alike. The bytes are snapshotted here so a
+   * fault in them carries this door's own code; a value that is not bytes is passed through for the
+   * gate to fail closed on, which is what a caller asking for a nonce with something that cannot be
+   * one has earned. */
+  var reqNonce = opts.requestNonce;
+  if (guard.bytes.isByteSource(reqNonce)) {
+    try { reqNonce = guard.bytes.snapshotSource(reqNonce, OcspError, "ocsp/bad-input", "opts.requestNonce"); }
+    catch (e) { return Promise.reject(e); }
+  }
+  return pathValidate.verifyOcspResponse(parsed, cert, issuerCert, time,
+    { historicalMode: opts.historicalMode === true, requestNonce: reqNonce }).then(function (verdict) {
+    return guard.verdict.of(verdict, { valid: verdict.status === "good" });
   });
 }
-function _responseNonce(parsed) {
-  var br = parsed && parsed.basicResponse;
-  var exts = (br && br.responseExtensions) || [];
-  for (var i = 0; i < exts.length; i++) if (exts[i].oid === OID_OCSP_NONCE) return exts[i].nonce || null;
-  return null;
-}
-
 var _VERIFY_REQUEST_OPTS = Object.assign(Object.create(null), { certs: 1 });
 function _requestFromBytes(request) {
   if (guard.bytes.isByteSource(request)) request = guard.bytes.snapshotSource(request, OcspError, "ocsp/bad-input", "the OCSP request");
@@ -828,8 +820,119 @@ async function verifyRequest(request, opts) {
     "the OCSP request signature does not verify over tbsRequest under any opts.certs entry");
 }
 
+/** @internal RFC 5019 sec. 5 measures the GET decision over "the scheme and delimiters (http://),
+ * server name and base64-encoded OCSPRequest structure", which is the whole encoded URL. */
+var HTTP_GET_MAX_URL_BYTES = 255;
+
+/**
+ * @primitive  pki.ocsp.httpRequest
+ * @signature  pki.ocsp.httpRequest(der, responderUrl, opts?) -> { method, url, headers, body }
+ * @since      0.8.8
+ * @status     stable
+ * @spec       RFC 6960, RFC 5019
+ * @related    pki.ocsp.buildRequest, pki.path.fetchingChecker
+ *
+ * Shape a DER `OCSPRequest` into the HTTP request RFC 6960 Appendix A.1 defines, without
+ * opening a socket: the result is the method, the URL, the headers and the body a caller
+ * hands to its own transport.
+ *
+ * A GET carries the request in the URL, as the base64 of the DER percent-encoded into one
+ * path segment appended to the responder URI. RFC 5019 sec. 5 requires GET when the whole
+ * encoded URL is 255 bytes or fewer, counting the scheme, the delimiters, the server name and
+ * the encoded request, and that is what is measured; anything longer is a POST carrying
+ * `Content-Type: application/ocsp-request` and the DER as its body. The base64 carries no CR
+ * and no LF, which that section also requires.
+ *
+ * The encoding escapes every byte outside RFC 3986 sec. 2.3's unreserved set, so the `+`, `/`
+ * and `=` of base64 become triplets and a request cannot reach past the segment it was placed
+ * in. A responder URL carrying a query or a fragment is refused, since a path segment appended
+ * after either would not be part of the path.
+ *
+ * @opts  method  `"GET"` or `"POST"` to override the sec. 5 measurement. A GET asked for on a
+ *                request too long to carry that way is refused rather than truncated.
+ * @example
+ *   var ca = await pki.key.generate("Ed25519");
+ *   var caDer = await pki.x509.sign({ subject: "Example CA", subjectPublicKey: await pki.key.export(ca.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z"),
+ *     extensions: { basicConstraints: { cA: true }, keyUsage: ["keyCertSign"], subjectKeyIdentifier: true } },
+ *     { key: await pki.key.export(ca.privateKey) });
+ *   var req = await pki.ocsp.buildRequest({ cert: caDer, issuer: caDer }, { profile: "lightweight" });
+ *   var http = pki.ocsp.httpRequest(req, "http://ocsp.example/");
+ *   console.log(http.method, http.url.length <= 255);
+ */
+function httpRequest(der, responderUrl, opts) {
+  opts = guard.identifier.optionsObject(opts, E, "ocsp/bad-input", "httpRequest: opts");
+  guard.identifier.assertKnownKeys(opts, HTTP_REQUEST_OPTS, E, "ocsp/bad-input",
+    "pki.ocsp.httpRequest has an unknown option (the only option is `method`). The unknown option was: ");
+  var body = guard.bytes.snapshotSource(der, OcspError, "ocsp/bad-input", "httpRequest: the OCSPRequest DER");
+  if (body.length === 0) throw E("ocsp/bad-input", "httpRequest: the OCSPRequest DER is empty");
+  if (typeof responderUrl !== "string" || responderUrl === "") {
+    throw E("ocsp/bad-input", "httpRequest: the responder URL must be a non-empty string");
+  }
+  var parts = guard.name.uriParts(responderUrl);
+  if (parts === null || !parts.hasAuthority || parts.host === null) {
+    throw E("ocsp/bad-input", "httpRequest: the responder URL must carry a scheme and a host (RFC 5280 sec. 4.2.2.1)");
+  }
+  if (responderUrl.indexOf("?") !== -1 || responderUrl.indexOf("#") !== -1) {
+    throw E("ocsp/bad-input", "httpRequest: the responder URL carries a query or a fragment, and a path segment appended after either would not be part of the path (RFC 3986 sec. 3.3)");
+  }
+  /** @internal The bound below is a byte count, and a character is not a byte above US-ASCII. A
+   * URI is US-ASCII by RFC 3986 sec. 2; a responder URL carrying more than that is an IRI, whose
+   * conversion to a URI is RFC 3987 work this toolkit does not do, so it is refused rather than
+   * measured as though the two were the same length. */
+  if (!guard.encoding.isAsciiText(responderUrl)) {
+    throw E("ocsp/bad-input", "httpRequest: the responder URL must be US-ASCII (RFC 3986 sec. 2); percent-encode the rest before passing it, since the RFC 5019 sec. 5 size bound counts the bytes that go on the wire");
+  }
+  var asked = opts.method === undefined ? null : opts.method;
+  if (asked !== null && asked !== "GET" && asked !== "POST") {
+    throw E("ocsp/bad-input", "httpRequest: opts.method must be \"GET\" or \"POST\"");
+  }
+  /** @internal The base64 goes through the buffer encoder, which emits one line and therefore no
+   * CR and no LF, which RFC 5019 sec. 5 states as a MUST NOT. */
+  var b64 = body.toString("base64");
+  var segment = guard.encoding.uriPathSegment(b64, E, "ocsp/bad-input", "the encoded OCSPRequest");
+  /** @internal The URL is handed to a transport, which parses it before opening a socket, and RFC
+   * 3986 sec. 5.2.4 removes a `.` or `..` segment during that parse. Appending to an unnormalized
+   * path would therefore build one URL and send another, at a path the responder was never named
+   * at. Normalizing the base first makes what this returns what goes on the wire, which is also
+   * the string the sec. 5 size bound has to be measured on. The appended segment is base64 under
+   * the sec. 2.3 unreserved set, which holds no `.`, so it cannot become a dot segment itself. */
+  var normalized;
+  try { normalized = new URL(responderUrl).href; }
+  catch (e) { throw E("ocsp/bad-input", "httpRequest: the responder URL does not parse as a URL: " + guard.text.describeThrown(e), e); }
+  var base = normalized.charAt(normalized.length - 1) === "/"
+    ? normalized : normalized + "/";
+  var getUrl = base + segment;
+  /** @internal Both parts are US-ASCII by the checks above, so a character is a byte and the
+   * count is the one RFC 5019 sec. 5 states. */
+  var getUrlBytes = Buffer.byteLength(getUrl, "ascii");
+  var fitsGet = getUrlBytes <= HTTP_GET_MAX_URL_BYTES;
+  if (asked === "GET" && !fitsGet) {
+    throw E("ocsp/bad-input", "httpRequest: the encoded GET URL is " + getUrlBytes +
+      " bytes, over the " + HTTP_GET_MAX_URL_BYTES + " RFC 5019 sec. 5 allows; send this request as a POST");
+  }
+  var useGet = asked === "GET" || (asked === null && fitsGet);
+  if (useGet) {
+    return guard.verdict.of({ method: "GET", url: getUrl, headers: _frozenHeaders({ accept: "application/ocsp-response" }), body: null });
+  }
+  return guard.verdict.of({
+    method: "POST", url: normalized,
+    headers: _frozenHeaders({ "content-type": "application/ocsp-request", accept: "application/ocsp-response" }),
+    body: body,
+  });
+}
+
+var HTTP_REQUEST_OPTS = Object.assign(Object.create(null), { method: 1 });
+
+function _frozenHeaders(h) {
+  var out = Object.create(null), k;
+  for (k in h) { if (Object.prototype.hasOwnProperty.call(h, k)) out[k] = h[k]; }
+  return Object.freeze(out);
+}
+
 module.exports = {
   buildRequest: buildRequest,
+  httpRequest: httpRequest,
   sign: sign,
   buildErrorResponse: buildErrorResponse,
   verify: verify,

package/lib/oid.js

@@ -116,7 +116,7 @@ var FAMILIES = Object.assign(Object.create(null), {
     "id-cct-PKIData": 2, "id-cct-PKIResponse": 3,
   } },
 
-  pkixOn: { base: [1, 3, 6, 1, 5, 5, 7, 8], of: { hardwareModuleName: 4, smtpUtf8Mailbox: 9, macAddress: 12 } },
+  pkixOn: { base: [1, 3, 6, 1, 5, 5, 7, 8], of: { hardwareModuleName: 4, dnsSRV: 7, smtpUtf8Mailbox: 9, macAddress: 12 } },
 
   cabfPolicy: { base: [2, 23, 140, 1], of: {
     "ev-guidelines": 1, "domain-validated": [2, 1], "organization-validated": [2, 2], "individual-validated": [2, 3] } },