@blamejs/pki 0.9.0 → 0.9.3

package/lib/mime.js

@@ -26,6 +26,9 @@ var _push = guard.list.append;
 var CRLF = Buffer.from("\r\n");
 
 function _buf(v, E, code, label) { return guard.bytes.view(v, E, code, label); }
+/** @internal `guard.limits.counter` throws `E(code, ...)`, and every consumer of this module hands in
+ *  its error CLASS. */
+function _factory(E) { return function (c, m) { return new E(c, m); }; }
 
 function _splitPoint(bytes) {
   for (var i = 0; i < bytes.length; i++) {
@@ -57,27 +60,83 @@ function _stripLeadingHtab(s) {
   return s.slice(i);
 }
 
-function _unfoldHeaders(headerText) {
-  var lines = _toLf(headerText).split("\n");
+/** @internal The end of the line starting at `from`, and where the next one starts. A line is ended by
+ *  CRLF, by a lone CR or by LF, which is the separator set `_toLf` followed by a split produces. */
+function _lineEnd(s, from) {
+  for (var i = from; i < s.length; i++) {
+    var c = s.charCodeAt(i);
+    if (c === 0x0a) return { end: i, next: i + 1 };
+    if (c === 0x0d) return { end: i, next: (s.charCodeAt(i + 1) === 0x0a) ? i + 2 : i + 1 };
+  }
+  return { end: s.length, next: s.length };
+}
+
+/** @internal One line is cut at a time and EVERY line is charged, folded continuations and empty lines
+ *  included, so the refusal costs the cap rather than the input. Splitting the whole header area first
+ *  and counting fields afterwards read a 16 MiB area of 2,097,150 one-line fields in 1114 ms and
+ *  653 MiB of resident memory before the count refused it, and charging only fields left a 16 MiB area
+ *  of 1,864,130 continuation lines folding into one 13 MB value in 1648 ms without the count ever
+ *  reaching two. */
+function _unfoldHeaders(headerText, counted) {
   var out = [];
-  for (var i = 0; i < lines.length; i++) {
-    var ln = lines[i];
+  for (var at = 0; at < headerText.length;) {
+    var cut = _lineEnd(headerText, at);
+    var ln = headerText.slice(at, cut.end);
+    at = cut.next;
+    counted.tick();
     if (ln === "") continue;
-    if ((ln[0] === " " || ln[0] === "\t") && out.length) out[out.length - 1] += " " + _stripLeadingHtab(ln);
-    else _push(out,ln);
+    if ((ln.charAt(0) === " " || ln.charAt(0) === "\t") && out.length) {
+      out[out.length - 1] += " " + _stripLeadingHtab(ln);
+    } else {
+      _push(out, ln);
+    }
   }
   return out;
 }
 
-function _parseStructured(headerValue) {
-  var parts = _splitSemicolons(headerValue);
+/**
+ * @internal
+ * RFC 2045 sec. 5.1 gives a parameter one occurrence, so a header naming one twice has no value this
+ * function can resolve: reading the last occurrence and reading the first are both conforming, and they
+ * disagree. These values decide what a signature covers (`boundary` sets where the parts begin),
+ * whether the entity is accepted (`protocol`, `smime-type`) and which digest is reported (`micalg`), so
+ * a repeat is refused here, where the record is built, rather than per parameter at each reader. An
+ * occurrence counts whether or not it carries a value, which is the `hp; hp="clear"` form; a single
+ * bare attribute still reaches the reader that owns it.
+ *
+ * What is refused is two readings that produce DIFFERENT VALUES, which is why the two RFC 2231
+ * spellings are not treated alike. A plain occurrence beside a starred one of the same attribute,
+ * `boundary*=us-ascii''DECOY; boundary=REAL`, gives this reader REAL and an RFC 2231 reader DECOY, so
+ * it is refused. Continuation segments alone, `name*0=a; name*1=b`, give this reader NO value for that
+ * attribute, so a consumer sees it as absent and the one place absence matters already fails closed:
+ * `splitMultipart` refuses an entity with no boundary. Refusing those would reject a conforming
+ * message over a parameter that cannot change what the signature covers.
+ */
+function _parseStructured(headerValue, E, code, label) {
+  var counted = guard.limits.counter(C.LIMITS.MIME_MAX_PARAMS, _factory(E), code, label + " parameter");
+  var parts = _splitSemicolons(headerValue, counted);
   var type = _stripComments(parts[0]).trim().toLowerCase();
   var params = Object.create(null);
+  var seenExact = Object.create(null), seenPlain = Object.create(null), seenStarred = Object.create(null);
   for (var i = 1; i < parts.length; i++) {
     var p = _stripComments(parts[i]);
     var eq = p.indexOf("=");
+    var name = (eq < 0 ? p : p.slice(0, eq)).trim().toLowerCase();
+    if (name === "") continue;
+    var base = _baseAttribute(name);
+    var starred = base !== name;
+    if (seenExact[name] === true) {
+      throw new E(code, label + " declares the " + JSON.stringify(name) +
+        " parameter more than once, so its value is ambiguous (RFC 2045 sec. 5.1)");
+    }
+    if (starred ? seenPlain[base] === true : seenStarred[base] === true) {
+      throw new E(code, label + " spells the " + JSON.stringify(base) +
+        " parameter both plainly and as an RFC 2231 extended or continued value, and the two spellings " +
+        "carry different values (RFC 2231 sec. 7)");
+    }
+    seenExact[name] = true;
+    if (starred) seenStarred[base] = true; else seenPlain[base] = true;
     if (eq < 0) continue;
-    var name = p.slice(0, eq).trim().toLowerCase();
     var val = p.slice(eq + 1).trim();
     if (val.length >= 2 && val[0] === '"' && val[val.length - 1] === '"') val = val.slice(1, -1);
     params[name] = val;
@@ -99,7 +158,28 @@ function _stripComments(s) {
   return out;
 }
 
-function _splitSemicolons(s) {
+/** @internal The attribute an RFC 2231 name belongs to. Sections 3 and 4 spell one parameter three
+ *  ways, `name`, `name*` for an extended value and `name*0` / `name*1` for a continuation, and
+ *  section 7 makes them the same logical parameter. This module assembles neither starred form, so a
+ *  reader that does takes a different value from the same bytes: measured, `boundary*=us-ascii''DECOY;
+ *  boundary=REAL` verified here while an RFC 2231 reader splits the body on DECOY. Comparing the
+ *  attribute rather than the spelling is what makes the two the same occurrence. A leading asterisk
+ *  is a name in its own right and keeps it. */
+function _baseAttribute(name) {
+  var star = name.indexOf("*");
+  return star > 0 ? name.slice(0, star) : name;
+}
+
+/** @internal The first segment is the media type rather than a parameter, so it is not charged. The
+ *  charge comes BEFORE the segment is stored, so the refusal costs the cap and not the input: charging
+ *  the segments after the split instead read a 3.8 MiB Content-Type of 1,000,000 parameters in 192 ms
+ *  and 73 MiB of resident memory before the same cap refused it. */
+function _pushSegment(out, seg, counted) {
+  if (counted !== undefined && out.length > 0) counted.tick();
+  _push(out, seg);
+}
+
+function _splitSemicolons(s, counted) {
   var out = [], cur = "", inQ = false, depth = 0;
   for (var i = 0; i < s.length; i++) {
     var ch = s[i];
@@ -107,21 +187,29 @@ function _splitSemicolons(s) {
     else if (ch === '"' && depth === 0) { inQ = !inQ; cur += ch; }
     else if (ch === "(" && !inQ) { depth++; cur += ch; }
     else if (ch === ")" && !inQ && depth > 0) { depth--; cur += ch; }
-    else if (ch === ";" && !inQ && depth === 0) { _push(out,cur); cur = ""; }
+    else if (ch === ";" && !inQ && depth === 0) { _pushSegment(out, cur, counted); cur = ""; }
     else cur += ch;
   }
-  _push(out,cur);
+  _pushSegment(out, cur, counted);
   return out;
 }
 
 function parse(input, E, code) {
-  var bytes = _buf(input, E, code, "the MIME entity");
-  if (bytes.length > C.LIMITS.MIME_MAX_BYTES) throw new E(code, "MIME entity exceeds the size cap");
+  /** @internal A snapshot, not a view: the record below holds `subarray`s of these bytes and a caller
+   *  reads them back after the parse returns, so a view would let the caller's own later write change
+   *  what the record says the entity was. Measured on the shipped verb: `pki.smime.verify` returned
+   *  `valid: true` with `content` sharing the caller's store, and a write into that store afterwards
+   *  changed the bytes the caller read as verified. The copy is byte-identical, so the octets a
+   *  signature covers are unchanged. */
+  var viewed = _buf(input, E, code, "the MIME entity");
+  guard.limits.byteCap(viewed, C.LIMITS.MIME_MAX_BYTES, _factory(E), code, "the MIME entity");
+  var bytes = guard.bytes.snapshot(viewed, E, code, "the MIME entity");
   var sp = _splitPoint(bytes);
   var headerBytes = sp ? bytes.subarray(0, sp.headerEnd) : bytes;
   var bodyBytes = sp ? bytes.subarray(sp.bodyStart) : Buffer.alloc(0);
   var headerText = guard.text.decode(headerBytes, C.LIMITS.MIME_MAX_BYTES, E, { charset: "latin1", tooLarge: code, badInput: code, label: "the MIME headers" });
-  var rawHeaders = _unfoldHeaders(headerText);
+  var countedHeaders = guard.limits.counter(C.LIMITS.MIME_MAX_HEADERS, _factory(E), code, "the MIME header line");
+  var rawHeaders = _unfoldHeaders(headerText, countedHeaders);
   var headers = [];
   for (var i = 0; i < rawHeaders.length; i++) {
     var colon = rawHeaders[i].indexOf(":");
@@ -130,12 +218,29 @@ function parse(input, E, code) {
     var body = rawHeaders[i].slice(colon + 1);
     _push(headers,{ name: nm, lname: nm.toLowerCase(), value: body.trim(), rawValue: body.charAt(0) === " " ? body.slice(1) : body });
   }
-  function header(name) { var l = name.toLowerCase(); for (var j = 0; j < headers.length; j++) if (headers[j].lname === l) return headers[j].value; return null; }
+  /** @internal Resolving a field that occurs more than once means choosing an occurrence, and reading
+   *  the first and reading the last are both conforming (RFC 5322 sec. 3.6 gives a singleton field one
+   *  occurrence). The media type decides which reader a body goes to and the transfer encoding decides
+   *  how its octets are recovered, so a repeat is refused rather than resolved by position. Every
+   *  occurrence stays in `headers`, where a field that may legally repeat, such as `Received`, is
+   *  read instead. */
+  function header(name) {
+    var l = name.toLowerCase(), found = null;
+    for (var j = 0; j < headers.length; j++) {
+      if (headers[j].lname !== l) continue;
+      if (found !== null) {
+        throw new E(code, "the entity declares the " + JSON.stringify(headers[j].name) +
+          " field more than once, so resolving it to a single value is ambiguous (RFC 5322 sec. 3.6)");
+      }
+      found = headers[j];
+    }
+    return found === null ? null : found.value;
+  }
   var ctv = header("content-type");
   var cte = (header("content-transfer-encoding") || "").trim().toLowerCase() || "7bit";
   return {
     headers: headers, header: header,
-    contentType: ctv != null ? _parseStructured(ctv) : { value: "text/plain", type: "text/plain", params: Object.create(null) },
+    contentType: ctv != null ? _parseStructured(ctv, E, code, "the Content-Type") : { value: "text/plain", type: "text/plain", params: Object.create(null) },
     cte: cte,
     headerBytes: headerBytes, bodyBytes: bodyBytes, body: bodyBytes, bytes: bytes,
   };
@@ -158,7 +263,9 @@ function splitMultipart(bodyBytes, boundary, E, code) {
   if (idx < 0) throw new E(code, "no boundary delimiter found in the multipart body");
   var pos = _afterLine(body, idx + delim.length, E, code);
   var parts = [];
+  var counted = guard.limits.counter(C.LIMITS.MIME_MAX_PARTS, _factory(E), code, "the multipart body part");
   while (true) {
+    counted.tick();
     var next = _findDelim(body, delim, pos);
     if (next < 0) throw new E(code, "an unterminated multipart body part (no closing boundary)");
     var partEnd = next;

package/lib/ocsp-verify.js

@@ -25,7 +25,7 @@ var OID_OCSP_NOCHECK = oid.byName("ocspNoCheck");
 var OID_EKU = oid.byName("extKeyUsage");
 var OID_KEY_USAGE = oid.byName("keyUsage");
 
-function ocspDigest(alg, buf) { return subtle.digest(alg, buf).then(function (h) { return _bufferFrom(h); }); }
+function ocspDigest(alg, buf) { return intrinsic.chain(subtle.digest(alg, buf), function (h) { return _bufferFrom(h); }); }
 
 function ocspKeyValue(spkiDer) {
   return asn1.read.bitString(asn1.decode(spkiDer).children[1]).bytes;

package/lib/pki-build.js

@@ -522,6 +522,20 @@ function makeBuilder(ctx) {
   }
   function encodeName(spec) {
     if (guard.bytes.isByteSource(spec)) { var _nd = guard.bytes.snapshotSource(spec, ErrorClass, ctx.prefix + "/bad-name", "raw Name DER"); assertValidNameDer(_nd); return _nd; }
+    /** @internal A bare string is the common-name shorthand, and a caller who writes a distinguished
+     *  name here gets one commonName holding the whole text: measured, `"CN=Example CA, O=Example"`
+     *  certified the single RDN `CN=CN=Example CA\, O=Example`, the doubled `CN=` being the caller's
+     *  own attribute type read as part of the value. Only one of the two readings can be what was
+     *  meant, so the distinguished-name one is refused rather than certified as a name nobody asked
+     *  for, and the caller says which by passing `pki.x509.parseDn(s).bytes` or the RDN array. A
+     *  common name that contains an `=` further along does not open as a distinguished name
+     *  and is untouched. OpenSSL refuses the same string for the same reason, naming the form it
+     *  wants; Go has no string form and .NET reads a string as the distinguished name. */
+    if (typeof spec === "string" && guard.name.opensAsDnString(spec)) {
+      throw E("bad-name", "a bare name string is a common name, and " + guard.text.showValue(spec) +
+        " opens as a distinguished name. Pass pki.x509.parseDn(s).bytes for the distinguished name, " +
+        "or [{ commonName: s }] to certify it as one common name");
+    }
     if (typeof spec === "string") spec = [{ commonName: spec }];
     if (!_isArray(spec)) throw E("bad-name", "a name must be a string, an array of RDNs, or raw Name DER");
     /** @internal Held to the same density every other authoring list is held to. Mapping over a

package/lib/possession.js

@@ -160,12 +160,12 @@ function _namesCertificate(signer, certParsed) {
  *   var kemSpki = await pki.key.export(kem.publicKey, { format: "der" });
  *   var sigSpki = await pki.key.export(sig.publicKey, { format: "der" });
  *   var sigCert = await pki.x509.sign({
- *     subject: "CN=kem.example", subjectPublicKey: sigSpki, serialNumber: 34n,
+ *     subject: "kem.example", subjectPublicKey: sigSpki, serialNumber: 34n,
  *     notBefore: new Date("2027-01-01T00:00:00Z"), notAfter: new Date("2028-01-01T00:00:00Z"),
  *   }, { key: sig.privateKey });
  *   var parsedCert = pki.schema.x509.parse(sigCert);
  *   var csr = await pki.csr.sign({
- *     subject: "CN=kem.example", subjectPublicKey: kemSpki,
+ *     subject: "kem.example", subjectPublicKey: kemSpki,
  *     privateKeyPossessionStatement: {
  *       signer: { issuer: parsedCert.issuer.bytes, serialNumber: parsedCert.serialNumber },
  *       certificate: sigCert,
@@ -354,18 +354,18 @@ var _isSignatureOnlyKey = pkix.signatureOnlyKeyOid(NS);
  *   var ca = await pki.key.generate({ name: "ECDSA", namedCurve: "P-256" });
  *   var caSpki = await pki.key.export(ca.publicKey, { format: "der" });
  *   var caCert = await pki.x509.sign({
- *     subject: "CN=Possession CA", subjectPublicKey: caSpki, serialNumber: 1n,
+ *     subject: "Possession CA", subjectPublicKey: caSpki, serialNumber: 1n,
  *     notBefore: new Date("2027-01-01T00:00:00Z"), notAfter: new Date("2028-01-01T00:00:00Z"),
  *     extensions: { basicConstraints: { cA: true }, keyUsage: ["keyCertSign"] },
  *   }, { key: ca.privateKey });
  *   var sigCert = await pki.x509.sign({
- *     subject: "CN=kem.example", subjectPublicKey: sigSpki, serialNumber: 34n,
+ *     subject: "kem.example", subjectPublicKey: sigSpki, serialNumber: 34n,
  *     notBefore: new Date("2027-01-01T00:00:00Z"), notAfter: new Date("2028-01-01T00:00:00Z"),
  *     extensions: { keyUsage: ["digitalSignature"] },
  *   }, { cert: caCert, key: ca.privateKey });
  *   var p = pki.schema.x509.parse(sigCert);
  *   var csr = await pki.csr.sign({
- *     subject: "CN=kem.example", subjectPublicKey: kemSpki,
+ *     subject: "kem.example", subjectPublicKey: kemSpki,
  *     privateKeyPossessionStatement: {
  *       signer: { issuer: p.issuer.bytes, serialNumber: p.serialNumber }, certificate: sigCert,
  *     },
@@ -522,13 +522,15 @@ function _verifyRequest(request, opts) {
       "authorize a certification request (RFC 5280 sec. 4.2.1.3)");
   }
 
-  return _promiseResolve(_Promise, _validatePath(chain, { trustAnchors: o.trustAnchors, time: at }))
-    .then(function (pathResult) {
+  return intrinsic.chain(
+    _promiseResolve(_Promise, _validatePath(chain, { trustAnchors: o.trustAnchors, time: at })),
+    function (pathResult) {
       var pathValidated = pathResult.valid === true;
       if (!pathValidated) _push(reasons, "the signature certificate's certification path is not valid, and RFC 9883 sec. 4 makes that a MUST");
-      return _seam.verify(parsed.signatureAlgorithm, parsed.signatureValue,
-        sigCert.subjectPublicKeyInfo.bytes, parsed.certificationRequestInfoBytes)
-        .then(function (verified) {
+      return intrinsic.chain(
+        _seam.verify(parsed.signatureAlgorithm, parsed.signatureValue,
+          sigCert.subjectPublicKeyInfo.bytes, parsed.certificationRequestInfoBytes),
+        function (verified) {
           if (verified !== true) _push(reasons, "the request signature does not verify under the signature certificate's public key, and RFC 9883 sec. 4 makes that a MUST");
           return guard.verdict.of({}, {
             valid: verified === true && pathValidated && signerMaySign && !requestsSignatureCertificate &&
@@ -543,15 +545,19 @@ function _verifyRequest(request, opts) {
             requestsSignatureCertificate: requestsSignatureCertificate,
             reason: reasons.length ? _join(reasons, "; ") : undefined,
           });
-        });
-    });
+        }
+      );
+    }
+  );
 }
 
 /** @internal Whether the signature certificate's key may make this signature at all. A certificate confined
  *  to `keyAgreement` does not authorize a signature over a certification request, and accepting one lets a
  *  key never issued for signing authorize issuance. The accepted set is `pki.cms`'s: a signature over
- *  content is authorized by digitalSignature, contentCommitment or nonRepudiation alike. */
-var _maySign = pkix.keyUsagePermits(NS, ["digitalSignature", "contentCommitment", "nonRepudiation"]);
+ *  content is authorized by digitalSignature or nonRepudiation alike. The decoder emits the
+ *  RFC 5280 sec. 4.2.1.3 bit name `nonRepudiation`, never the X.509 spelling `contentCommitment`,
+ *  so naming the latter here asked for a name nothing defines. */
+var _maySign = pkix.keyUsagePermits(NS, ["digitalSignature", "nonRepudiation"]);
 
 /** @internal The subjectAltName a request asks for, or null when it asks for none. */
 function _requestedSan(parsedCsr) {

package/lib/related-cert.js

@@ -99,6 +99,33 @@ function _certIdParts(der) {
 var DIGEST_LENGTHS = pkix.digestLengths();
 var SIG_OID_DIGEST = pkix.signatureDigestNames(oid);
 
+/** @internal Whether the related certificate's key may make this one signature. RFC 5280 sec. 4.2.1.3
+ *  confines a key to the purposes a present keyUsage asserts, so a certificate issued only to sign
+ *  certificates or CRLs does not authorize a proof of possession over a certification request.
+ *
+ *  The set is NOT `pki.possession`'s. RFC 9763 sec. 3.1 states that "if the related certificate is a
+ *  key establishment certificate (e.g., using RSA key transport or Elliptic Curve Cryptography (ECC)
+ *  key agreement), the private key is used to sign one time for proof of possession (POP)", so
+ *  keyEncipherment and keyAgreement authorize this signature where they authorize no other, and
+ *  holding the proof to possession's signing-only set would refuse a request the document admits.
+ *  What is left to refuse is a certificate confined to keyCertSign, cRLSign, or the two modifier bits
+ *  that carry no meaning without keyAgreement. An absent keyUsage constrains nothing.
+ *
+ *  Which establishment bit counts comes from the SUBJECT KEY, because the sentence admits a key
+ *  establishment CERTIFICATE and a bit the key's own family cannot perform does not make one. The
+ *  union of both bits admitted a certificate that is not an establishment certificate under any
+ *  reading: measured, an EC certificate asserting only keyEncipherment, which RFC 8813 sec. 3 makes a
+ *  MUST NOT for id-ecPublicKey, and an RSA certificate asserting only keyAgreement, which RFC 3279
+ *  sec. 2.3.1 does not list, both reported signerMaySign and a valid proof. A family the shared table
+ *  places in neither column admits neither bit, so a signature usage is what authorizes it. */
+var SIGNATURE_USAGE_BITS = ["digitalSignature", "nonRepudiation"];
+var _estabBit = pkix.keyEstablishmentBit(NS);
+var _maySign = pkix.keyUsagePermits(NS, function (parsedCert) {
+  var spki = parsedCert && parsedCert.subjectPublicKeyInfo;
+  var bit = _estabBit(spki && spki.algorithm ? spki.algorithm.oid : null);
+  return bit === null ? SIGNATURE_USAGE_BITS : [bit, "digitalSignature", "nonRepudiation"];
+});
+
 /** @internal The digests this module will bind a certificate identity to. sha1 is registered and
  *  decodable, and is absent here: a chosen-prefix collision on a certificate is a demonstrated
  *  attack, so a value naming it is refused before anything is computed. A caller reading a hashValue a
@@ -392,7 +419,7 @@ function _parseCert(certDer, what) {
  * @example
  *   var kp = await pki.key.generate({ name: "ECDSA", namedCurve: "P-256" });
  *   var spki = await pki.key.export(kp.publicKey, { format: "der" });
- *   var related = await pki.x509.sign({ subject: "CN=Held", subjectPublicKey: spki, serialNumber: 42n,
+ *   var related = await pki.x509.sign({ subject: "Held", subjectPublicKey: spki, serialNumber: 42n,
  *     notBefore: new Date("2027-01-01T00:00:00Z"), notAfter: new Date("2028-01-01T00:00:00Z") }, { key: kp.privateKey });
  *   pki.relatedCert.certificateHash(related).hashAlgorithm;          // -> "sha256", from this certificate's signature OID
  *   pki.relatedCert.certificateHash(related, "sha512").hashValue.length;   // -> 64
@@ -455,9 +482,9 @@ function digestValue(hashAlgorithm, hashValue) {
  * @example
  *   var kp = await pki.key.generate({ name: "ECDSA", namedCurve: "P-256" });
  *   var spki = await pki.key.export(kp.publicKey, { format: "der" });
- *   var related = await pki.x509.sign({ subject: "CN=Held", subjectPublicKey: spki, serialNumber: 42n,
+ *   var related = await pki.x509.sign({ subject: "Held", subjectPublicKey: spki, serialNumber: 42n,
  *     notBefore: new Date("2027-01-01T00:00:00Z"), notAfter: new Date("2028-01-01T00:00:00Z") }, { key: kp.privateKey });
- *   var leaf = await pki.x509.sign({ subject: "CN=New Key", subjectPublicKey: spki, serialNumber: 43n,
+ *   var leaf = await pki.x509.sign({ subject: "New Key", subjectPublicKey: spki, serialNumber: 43n,
  *     notBefore: new Date("2027-01-01T00:00:00Z"), notAfter: new Date("2028-01-01T00:00:00Z"),
  *     extensions: { relatedCertificate: { relatedCertificate: related } } }, { key: kp.privateKey });
  *   var ext = pki.schema.x509.parse(leaf).extensions
@@ -563,7 +590,7 @@ function _namedAlgorithm(value) {
 
 /**
  * @primitive pki.relatedCert.verifyRequest
- * @signature pki.relatedCert.verifyRequest(requesterCertificate, certificate, opts?) -> Promise<boolean>
+ * @signature pki.relatedCert.verifyRequest(requesterCertificate, certificate, opts?) -> Promise<verdict>
  * @since 0.8.42
  * @status stable
  * @spec RFC 9763 sec. 3.1
@@ -572,9 +599,18 @@ function _namedAlgorithm(value) {
  *
  * Verify the proof of possession in a `relatedCertRequest` CSR attribute. `requesterCertificate` is
  * the value `pki.schema.csr.parse` carries on that attribute, and `certificate` is the DER of the
- * certificate its `certID` names. Returns `true` when the signature over the bytes
- * `pki.relatedCert.requestSignedData` describes verifies under that certificate's subject key, and
- * `false` when a signature was checked and did not verify.
+ * certificate its `certID` names.
+ *
+ * Returns `{ valid, verified, signerMaySign, signatureAlgorithm }`, plus `code` and `reason` when it
+ * did not pass. `verified` is the signature over the bytes
+ * `pki.relatedCert.requestSignedData` describes, checked under that certificate's subject key.
+ * `signerMaySign` is whether the certificate's keyUsage authorizes that signature at all, and
+ * `valid` is both together. They are separate because a key the certificate never authorized for
+ * signing and a signature that does not verify are different facts, and a caller acting on one as
+ * if it were the other acts on the wrong one. RFC 5280 sec. 4.2.1.3 confines a key to the purposes a
+ * present keyUsage asserts; a certificate carrying none is unconstrained. A key-establishment
+ * certificate still passes, because RFC 9763 sec. 3.1 has such a key "sign one time for proof of
+ * possession", so keyEncipherment and keyAgreement authorize this signature and no other.
  *
  * The certificate handed in must be the one `certID` names: an issuer and serial that do not match
  * throw `relatedcert/cert-mismatch`, since verifying a proof against a certificate the request did
@@ -614,7 +650,7 @@ function _namedAlgorithm(value) {
  * @example
  *   var kp = await pki.key.generate({ name: "ECDSA", namedCurve: "P-256" });
  *   var spki = await pki.key.export(kp.publicKey, { format: "der" });
- *   var held = await pki.x509.sign({ subject: "CN=Held", subjectPublicKey: spki, serialNumber: 42n,
+ *   var held = await pki.x509.sign({ subject: "Held", subjectPublicKey: spki, serialNumber: 42n,
  *     notBefore: new Date("2027-01-01T00:00:00Z"), notAfter: new Date("2028-01-01T00:00:00Z") }, { key: kp.privateKey });
  *   var parsed = pki.schema.x509.parse(held);
  *   var certID = { issuer: parsed.issuer.bytes, serialNumber: parsed.serialNumber };
@@ -627,7 +663,7 @@ function _namedAlgorithm(value) {
  *     pki.asn1.build.integer(BigInt("0x" + raw.subarray(0, half).toString("hex"))),
  *     pki.asn1.build.integer(BigInt("0x" + raw.subarray(half).toString("hex"))),
  *   ]);
- *   var csr = await pki.csr.sign({ subject: "CN=New Key", subjectPublicKey: spki,
+ *   var csr = await pki.csr.sign({ subject: "New Key", subjectPublicKey: spki,
  *     relatedCertRequest: { certID: certID, requestTime: 1800000000,
  *       locationInfo: ["https://certs.example/held.cer"], signature: proof } }, { key: kp.privateKey });
  *   var attr = pki.schema.csr.parse(csr).attributes
@@ -635,7 +671,7 @@ function _namedAlgorithm(value) {
  *   // The window is the certification authority's policy, so it is named: five minutes here, judged
  *   // against the instant the request was made, which is what a CA reading a recorded request does.
  *   await pki.relatedCert.verifyRequest(attr.relatedCertRequest, held,
- *     { maxAge: 300, at: new Date(1800000060 * 1000) });   // -> true
+ *     { maxAge: 300, at: new Date(1800000060 * 1000) });   // -> { valid: true, verified: true, ... }
  */
 function verifyRequest(requesterCertificate, certificate, opts) {
   /** @internal Every refusal reaches the caller as a rejection, so a verb that returns a promise never
@@ -680,6 +716,8 @@ function _verifyRequest(requesterCertificate, certificate, opts) {
       "the certificate given is not the one certID names (RFC 9763 sec. 3.2)");
   }
 
+  var signerMaySign = _maySign(c.parsed);
+
   var sigAlg = o.signatureAlgorithm !== undefined && o.signatureAlgorithm !== null
     ? _namedAlgorithm(o.signatureAlgorithm)
     : _proofAlgorithm(c.parsed, o.digestAlgorithm);
@@ -694,7 +732,30 @@ function _verifyRequest(requesterCertificate, certificate, opts) {
   }
   if (sig.bytes.length === 0) throw _err("relatedcert/bad-input", "the proof signature must not be empty");
 
-  return _seam.verify(sigAlg, sig, c.parsed.subjectPublicKeyInfo.bytes, preimage);
+  /** @internal The two facts are reported apart. A bare boolean could not say which check failed, so
+   *  a key the certificate never authorized for signing and a signature that simply does not verify
+   *  read the same, and a caller acting on one as if it were the other acts on the wrong fact. */
+  return intrinsic.chain(_seam.verify(sigAlg, sig, c.parsed.subjectPublicKeyInfo.bytes, preimage), function (verified) {
+    var ok = verified === true && signerMaySign;
+    /** @internal The verdict carries what this verb DETERMINED, not an echo of what it was handed.
+     *  The caller already holds `certID` and `requestTime` on the request it passed in, and copying
+     *  the decoded issuer onto the result would invite a byte comparison against a name this verb
+     *  judged equal under the RFC 5280 sec. 7.1 folding: two names that compare equal here are
+     *  routinely different bytes, and there is no public comparison a caller could use instead.
+     *  `signatureAlgorithm` is kept because it is derived rather than supplied, so without it a
+     *  caller cannot tell which digest the proof was actually checked under. */
+    return guard.verdict.of({
+      valid: ok,
+      verified: verified === true,
+      signerMaySign: signerMaySign,
+      signatureAlgorithm: sigAlg,
+    }, ok ? null : {
+      code: !signerMaySign ? "relatedcert/signer-may-not-sign" : "relatedcert/bad-signature",
+      reason: !signerMaySign
+        ? "the related certificate's keyUsage does not authorize a proof-of-possession signature (RFC 5280 sec. 4.2.1.3)"
+        : "the proof signature does not verify under the key of the certificate certID names",
+    });
+  });
 }
 
 module.exports = {

package/lib/schema-attrcert.js

@@ -293,7 +293,7 @@ var ATTRIBUTE_CERTIFICATE = pkix.signedEnvelope(NS, ACINFO, {
  *   var aaCert = await pki.x509.sign({ subject: "Attribute Authority", subjectPublicKey: await pki.key.export(pair.publicKey),
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
  *   var der = await pki.attrcert.sign(
- *     { holder: { entityName: { directoryName: "CN=Alice" } },
+ *     { holder: { entityName: { directoryName: "Alice" } },
  *       notBeforeTime: new Date("2026-01-01T00:00:00Z"), notAfterTime: new Date("2027-01-01T00:00:00Z"),
  *       attributes: { role: { roleName: { uniformResourceIdentifier: "urn:role:admin" } } } },
  *     { cert: aaCert, key: key });
@@ -350,7 +350,7 @@ function parseV1(input, callerOpts) {
  *   var aaCert = await pki.x509.sign({ subject: "Attribute Authority", subjectPublicKey: await pki.key.export(pair.publicKey),
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
  *   var pemText = await pki.attrcert.sign(
- *     { holder: { entityName: { directoryName: "CN=Alice" } },
+ *     { holder: { entityName: { directoryName: "Alice" } },
  *       notBeforeTime: new Date("2026-01-01T00:00:00Z"), notAfterTime: new Date("2027-01-01T00:00:00Z"),
  *       attributes: { role: { roleName: { uniformResourceIdentifier: "urn:role:admin" } } } },
  *     { cert: aaCert, key: key }, { pem: true });
@@ -375,7 +375,7 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label === null ? n
  *   var aaCert = await pki.x509.sign({ subject: "Attribute Authority", subjectPublicKey: await pki.key.export(pair.publicKey),
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
  *   var der = await pki.attrcert.sign(
- *     { holder: { entityName: { directoryName: "CN=Alice" } },
+ *     { holder: { entityName: { directoryName: "Alice" } },
  *       notBeforeTime: new Date("2026-01-01T00:00:00Z"), notAfterTime: new Date("2027-01-01T00:00:00Z"),
  *       attributes: { role: { roleName: { uniformResourceIdentifier: "urn:role:admin" } } } },
  *     { cert: aaCert, key: key });
@@ -700,7 +700,7 @@ var DOOR = pkix.extensionDoor({
  *   var key = await pki.key.export(pair.privateKey);
  *   var aaCert = await pki.x509.sign({ subject: "Example AA", subjectPublicKey: await pki.key.export(pair.publicKey),
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
- *   var acDer = await pki.attrcert.sign({ holder: { entityName: [{ directoryName: "CN=Holder" }] },
+ *   var acDer = await pki.attrcert.sign({ holder: { entityName: [{ directoryName: "Holder" }] },
  *     attributes: { role: { roleName: "https://example.test/role/admin" } }, serialNumber: 1n,
  *     notBeforeTime: new Date("2026-01-01T00:00:00Z"), notAfterTime: new Date("2027-01-01T00:00:00Z"),
  *     extensions: { noRevAvail: true } }, { cert: aaCert, key: key });
@@ -729,7 +729,7 @@ var decodeExtensions = DOOR.decodeExtensions;
  *   var key = await pki.key.export(pair.privateKey);
  *   var aaCert = await pki.x509.sign({ subject: "Example AA", subjectPublicKey: await pki.key.export(pair.publicKey),
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
- *   var acDer = await pki.attrcert.sign({ holder: { entityName: [{ directoryName: "CN=Holder" }] },
+ *   var acDer = await pki.attrcert.sign({ holder: { entityName: [{ directoryName: "Holder" }] },
  *     attributes: { role: { roleName: "https://example.test/role/admin" } }, serialNumber: 1n,
  *     notBeforeTime: new Date("2026-01-01T00:00:00Z"), notAfterTime: new Date("2027-01-01T00:00:00Z"),
  *     extensions: { noRevAvail: true } }, { cert: aaCert, key: key });

package/lib/schema-c509.js

@@ -1590,6 +1590,12 @@ function _reconstructDer(r, sigNode) {
  * reached by an explicit call and is not auto-routed by pki.schema.parse. The type-2 signedData and the
  * raw signature are surfaced as-is (a native verifier hashes them without re-serialization).
  *
+ * A type-3 ECDSA signature is a fixed-width `r || s` that names no curve, so the same pair padded to a
+ * wider accepted width reconstructs byte-identical DER: 64, 96 and 132 are three spellings of one
+ * certificate. `signatureValueMinimalWidth` reports the narrowest width that represents the value, and
+ * does not fail the parse. A reader that deduplicates, caches or blocklists by encoded form compares it
+ * against `signatureValue.length`, and re-narrows to it for a key that is the same for every spelling.
+ *
  * @example
  *   // the RFC 7925 profiled certificate from draft-ietf-cose-cbor-encoded-cert Appendix A.1 (type 3)
  *   var bytes = Buffer.from(
@@ -1703,7 +1709,10 @@ function _finishParse(f, root, nested, fields) {
   result._fieldBytes = root.bytes.subarray(1, root.bytes.length - f[10].bytes.length);
   if (type === 2) result.signedData = result._fieldBytes;
 
-  if (type === 3) result.reconstructedDer = _reconstructDer(result, f[10]);
+  if (type === 3) {
+    result.reconstructedDer = _reconstructDer(result, f[10]);
+    result.signatureValueMinimalWidth = _minimalSigWidth(signatureValue);
+  }
   return result;
 }
 
@@ -1960,11 +1969,37 @@ function _keyUsageBitsFromDer(extnValue, ctx) {
 var _NO_EXPIRY = C.TIME.seconds(Number(NO_EXPIRY_SECONDS));
 var NODE_TO_WEBCRYPTO = Object.assign(Object.create(null), { "prime256v1": "P-256", "secp384r1": "P-384", "secp521r1": "P-521" });
 var WEBCRYPTO_FIELD_BYTES = Object.assign(Object.create(null), { "P-256": 32, "P-384": 48, "P-521": 66 });
+/** @internal The accepted fixed-width `r || s` lengths, derived from the field sizes above rather
+ *  than written a fourth time. */
+var EC_SIG_WIDTHS = Object.keys(WEBCRYPTO_FIELD_BYTES).map(function (n) { return WEBCRYPTO_FIELD_BYTES[n] * 2; });
 var SIG_ALG_TO_CURVE = Object.assign(Object.create(null), { "ecdsaWithSHA256": "P-256", "ecdsaWithSHA384": "P-384", "ecdsaWithSHA512": "P-521" });
-function _magBytes(intNode) {
-  var c = intNode.content, i = 0;
-  while (i < c.length - 1 && c[i] === 0x00) i++;
-  return c.length - i;
+/** @internal The significant byte count of a big-endian magnitude in `buf[from, to)`: the leading
+ *  zero bytes do not change the value they encode. Taken as a range so the fixed-width halves of an
+ *  r||s signature and a decoded INTEGER's content are measured by the one scan. */
+function _magBytes(buf, from, to) {
+  var i = from;
+  while (i < to - 1 && buf[i] === 0x00) i++;
+  return to - i;
+}
+
+/** @internal The narrowest accepted r||s width that encodes the same (r, s) as `sig`. A fixed-width
+ *  r||s carries no curve, so padding each half of a 64-byte signature to 32 more bytes reconstructs
+ *  byte-identical DER: 64, 96 and 132 are three spellings of one certificate, which makes a C509 byte
+ *  string something other than a unique identifier for what it encodes. Neither the width nor the
+ *  issuer's curve is recoverable from the bytes, and `parse` takes no option to be told, so this is
+ *  reported and the caller judges. The widths come from the field-size table rather than a fourth
+ *  copy of 32/48/66. */
+function _minimalSigWidth(sig) {
+  var half = sig.length / 2;
+  var need = _magBytes(sig, 0, half);
+  var other = _magBytes(sig, half, sig.length);
+  if (other > need) need = other;
+  var narrowest = sig.length;
+  for (var i = 0; i < EC_SIG_WIDTHS.length; i++) {
+    var width = EC_SIG_WIDTHS[i];
+    if (width >= need * 2 && width <= sig.length && width < narrowest) narrowest = width;
+  }
+  return narrowest;
 }
 function _sigMagWidth(derSig) {
   var n;
@@ -1975,7 +2010,8 @@ function _sigMagWidth(derSig) {
     var ch = n.children[i];
     if (ch.tagNumber !== asn1.TAGS.INTEGER || ch.tagClass !== "universal" || ch.constructed) throw _err("c509/bad-signature", "the ECDSA issuer signature r and s must be universal INTEGERs");
   }
-  return Math.max(_magBytes(n.children[0]), _magBytes(n.children[1]));
+  var r0 = n.children[0].content, s0 = n.children[1].content;
+  return Math.max(_magBytes(r0, 0, r0.length), _magBytes(s0, 0, s0.length));
 }
 var CURVE_ORDER = ["P-256", "P-384", "P-521"];
 function _minCurveForMag(mag) {

package/lib/schema-cmp.js

@@ -803,7 +803,7 @@ var readName = _valueParser("Name", pkix.name(NS));
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
  *   var csrDer = await pki.csr.sign({ subject: "client", subjectPublicKey: await pki.key.export(pair.publicKey) }, { key: key });
  *   var der = await pki.cmp.build(
- *     { header: { sender: { directoryName: "CN=client" }, recipient: { directoryName: "CN=CA" } },
+ *     { header: { sender: { directoryName: "client" }, recipient: { directoryName: "CA" } },
  *       body: { p10cr: csrDer } }, { key: key, cert: cert });
  *   var m = pki.schema.cmp.parse(der);
  *   m.body.arm;             // "ir", "ip", "error", ...
@@ -837,7 +837,7 @@ var parse = pkix.makeParser({
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
  *   var csrDer = await pki.csr.sign({ subject: "client", subjectPublicKey: await pki.key.export(pair.publicKey) }, { key: key });
  *   var msg = await pki.cmp.build(
- *     { header: { sender: { directoryName: "CN=client" }, recipient: { directoryName: "CN=CA" } },
+ *     { header: { sender: { directoryName: "client" }, recipient: { directoryName: "CA" } },
  *       body: { p10cr: csrDer } }, { key: key, cert: cert });
  *   var pemText = pki.schema.cmp.pemEncode(msg);
  *   var der = pki.schema.cmp.pemDecode(pemText);
@@ -861,7 +861,7 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || "CMP", Pe
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
  *   var csrDer = await pki.csr.sign({ subject: "client", subjectPublicKey: await pki.key.export(pair.publicKey) }, { key: key });
  *   var der = await pki.cmp.build(
- *     { header: { sender: { directoryName: "CN=client" }, recipient: { directoryName: "CN=CA" } },
+ *     { header: { sender: { directoryName: "client" }, recipient: { directoryName: "CA" } },
  *       body: { p10cr: csrDer } }, { key: key, cert: cert });
  *   var pem = pki.schema.cmp.pemEncode(der);
  */