@blamejs/pki 0.9.1 → 0.9.4

package/lib/related-cert.js

@@ -99,6 +99,33 @@ function _certIdParts(der) {
 var DIGEST_LENGTHS = pkix.digestLengths();
 var SIG_OID_DIGEST = pkix.signatureDigestNames(oid);
 
+/** @internal Whether the related certificate's key may make this one signature. RFC 5280 sec. 4.2.1.3
+ *  confines a key to the purposes a present keyUsage asserts, so a certificate issued only to sign
+ *  certificates or CRLs does not authorize a proof of possession over a certification request.
+ *
+ *  The set is NOT `pki.possession`'s. RFC 9763 sec. 3.1 states that "if the related certificate is a
+ *  key establishment certificate (e.g., using RSA key transport or Elliptic Curve Cryptography (ECC)
+ *  key agreement), the private key is used to sign one time for proof of possession (POP)", so
+ *  keyEncipherment and keyAgreement authorize this signature where they authorize no other, and
+ *  holding the proof to possession's signing-only set would refuse a request the document admits.
+ *  What is left to refuse is a certificate confined to keyCertSign, cRLSign, or the two modifier bits
+ *  that carry no meaning without keyAgreement. An absent keyUsage constrains nothing.
+ *
+ *  Which establishment bit counts comes from the SUBJECT KEY, because the sentence admits a key
+ *  establishment CERTIFICATE and a bit the key's own family cannot perform does not make one. The
+ *  union of both bits admitted a certificate that is not an establishment certificate under any
+ *  reading: measured, an EC certificate asserting only keyEncipherment, which RFC 8813 sec. 3 makes a
+ *  MUST NOT for id-ecPublicKey, and an RSA certificate asserting only keyAgreement, which RFC 3279
+ *  sec. 2.3.1 does not list, both reported signerMaySign and a valid proof. A family the shared table
+ *  places in neither column admits neither bit, so a signature usage is what authorizes it. */
+var SIGNATURE_USAGE_BITS = ["digitalSignature", "nonRepudiation"];
+var _estabBit = pkix.keyEstablishmentBit(NS);
+var _maySign = pkix.keyUsagePermits(NS, function (parsedCert) {
+  var spki = parsedCert && parsedCert.subjectPublicKeyInfo;
+  var bit = _estabBit(spki && spki.algorithm ? spki.algorithm.oid : null);
+  return bit === null ? SIGNATURE_USAGE_BITS : [bit, "digitalSignature", "nonRepudiation"];
+});
+
 /** @internal The digests this module will bind a certificate identity to. sha1 is registered and
  *  decodable, and is absent here: a chosen-prefix collision on a certificate is a demonstrated
  *  attack, so a value naming it is refused before anything is computed. A caller reading a hashValue a
@@ -392,7 +419,7 @@ function _parseCert(certDer, what) {
  * @example
  *   var kp = await pki.key.generate({ name: "ECDSA", namedCurve: "P-256" });
  *   var spki = await pki.key.export(kp.publicKey, { format: "der" });
- *   var related = await pki.x509.sign({ subject: "CN=Held", subjectPublicKey: spki, serialNumber: 42n,
+ *   var related = await pki.x509.sign({ subject: "Held", subjectPublicKey: spki, serialNumber: 42n,
  *     notBefore: new Date("2027-01-01T00:00:00Z"), notAfter: new Date("2028-01-01T00:00:00Z") }, { key: kp.privateKey });
  *   pki.relatedCert.certificateHash(related).hashAlgorithm;          // -> "sha256", from this certificate's signature OID
  *   pki.relatedCert.certificateHash(related, "sha512").hashValue.length;   // -> 64
@@ -455,9 +482,9 @@ function digestValue(hashAlgorithm, hashValue) {
  * @example
  *   var kp = await pki.key.generate({ name: "ECDSA", namedCurve: "P-256" });
  *   var spki = await pki.key.export(kp.publicKey, { format: "der" });
- *   var related = await pki.x509.sign({ subject: "CN=Held", subjectPublicKey: spki, serialNumber: 42n,
+ *   var related = await pki.x509.sign({ subject: "Held", subjectPublicKey: spki, serialNumber: 42n,
  *     notBefore: new Date("2027-01-01T00:00:00Z"), notAfter: new Date("2028-01-01T00:00:00Z") }, { key: kp.privateKey });
- *   var leaf = await pki.x509.sign({ subject: "CN=New Key", subjectPublicKey: spki, serialNumber: 43n,
+ *   var leaf = await pki.x509.sign({ subject: "New Key", subjectPublicKey: spki, serialNumber: 43n,
  *     notBefore: new Date("2027-01-01T00:00:00Z"), notAfter: new Date("2028-01-01T00:00:00Z"),
  *     extensions: { relatedCertificate: { relatedCertificate: related } } }, { key: kp.privateKey });
  *   var ext = pki.schema.x509.parse(leaf).extensions
@@ -563,7 +590,7 @@ function _namedAlgorithm(value) {
 
 /**
  * @primitive pki.relatedCert.verifyRequest
- * @signature pki.relatedCert.verifyRequest(requesterCertificate, certificate, opts?) -> Promise<boolean>
+ * @signature pki.relatedCert.verifyRequest(requesterCertificate, certificate, opts?) -> Promise<verdict>
  * @since 0.8.42
  * @status stable
  * @spec RFC 9763 sec. 3.1
@@ -572,9 +599,18 @@ function _namedAlgorithm(value) {
  *
  * Verify the proof of possession in a `relatedCertRequest` CSR attribute. `requesterCertificate` is
  * the value `pki.schema.csr.parse` carries on that attribute, and `certificate` is the DER of the
- * certificate its `certID` names. Returns `true` when the signature over the bytes
- * `pki.relatedCert.requestSignedData` describes verifies under that certificate's subject key, and
- * `false` when a signature was checked and did not verify.
+ * certificate its `certID` names.
+ *
+ * Returns `{ valid, verified, signerMaySign, signatureAlgorithm }`, plus `code` and `reason` when it
+ * did not pass. `verified` is the signature over the bytes
+ * `pki.relatedCert.requestSignedData` describes, checked under that certificate's subject key.
+ * `signerMaySign` is whether the certificate's keyUsage authorizes that signature at all, and
+ * `valid` is both together. They are separate because a key the certificate never authorized for
+ * signing and a signature that does not verify are different facts, and a caller acting on one as
+ * if it were the other acts on the wrong one. RFC 5280 sec. 4.2.1.3 confines a key to the purposes a
+ * present keyUsage asserts; a certificate carrying none is unconstrained. A key-establishment
+ * certificate still passes, because RFC 9763 sec. 3.1 has such a key "sign one time for proof of
+ * possession", so keyEncipherment and keyAgreement authorize this signature and no other.
  *
  * The certificate handed in must be the one `certID` names: an issuer and serial that do not match
  * throw `relatedcert/cert-mismatch`, since verifying a proof against a certificate the request did
@@ -614,7 +650,7 @@ function _namedAlgorithm(value) {
  * @example
  *   var kp = await pki.key.generate({ name: "ECDSA", namedCurve: "P-256" });
  *   var spki = await pki.key.export(kp.publicKey, { format: "der" });
- *   var held = await pki.x509.sign({ subject: "CN=Held", subjectPublicKey: spki, serialNumber: 42n,
+ *   var held = await pki.x509.sign({ subject: "Held", subjectPublicKey: spki, serialNumber: 42n,
  *     notBefore: new Date("2027-01-01T00:00:00Z"), notAfter: new Date("2028-01-01T00:00:00Z") }, { key: kp.privateKey });
  *   var parsed = pki.schema.x509.parse(held);
  *   var certID = { issuer: parsed.issuer.bytes, serialNumber: parsed.serialNumber };
@@ -627,7 +663,7 @@ function _namedAlgorithm(value) {
  *     pki.asn1.build.integer(BigInt("0x" + raw.subarray(0, half).toString("hex"))),
  *     pki.asn1.build.integer(BigInt("0x" + raw.subarray(half).toString("hex"))),
  *   ]);
- *   var csr = await pki.csr.sign({ subject: "CN=New Key", subjectPublicKey: spki,
+ *   var csr = await pki.csr.sign({ subject: "New Key", subjectPublicKey: spki,
  *     relatedCertRequest: { certID: certID, requestTime: 1800000000,
  *       locationInfo: ["https://certs.example/held.cer"], signature: proof } }, { key: kp.privateKey });
  *   var attr = pki.schema.csr.parse(csr).attributes
@@ -635,7 +671,7 @@ function _namedAlgorithm(value) {
  *   // The window is the certification authority's policy, so it is named: five minutes here, judged
  *   // against the instant the request was made, which is what a CA reading a recorded request does.
  *   await pki.relatedCert.verifyRequest(attr.relatedCertRequest, held,
- *     { maxAge: 300, at: new Date(1800000060 * 1000) });   // -> true
+ *     { maxAge: 300, at: new Date(1800000060 * 1000) });   // -> { valid: true, verified: true, ... }
  */
 function verifyRequest(requesterCertificate, certificate, opts) {
   /** @internal Every refusal reaches the caller as a rejection, so a verb that returns a promise never
@@ -680,6 +716,8 @@ function _verifyRequest(requesterCertificate, certificate, opts) {
       "the certificate given is not the one certID names (RFC 9763 sec. 3.2)");
   }
 
+  var signerMaySign = _maySign(c.parsed);
+
   var sigAlg = o.signatureAlgorithm !== undefined && o.signatureAlgorithm !== null
     ? _namedAlgorithm(o.signatureAlgorithm)
     : _proofAlgorithm(c.parsed, o.digestAlgorithm);
@@ -694,7 +732,30 @@ function _verifyRequest(requesterCertificate, certificate, opts) {
   }
   if (sig.bytes.length === 0) throw _err("relatedcert/bad-input", "the proof signature must not be empty");
 
-  return _seam.verify(sigAlg, sig, c.parsed.subjectPublicKeyInfo.bytes, preimage);
+  /** @internal The two facts are reported apart. A bare boolean could not say which check failed, so
+   *  a key the certificate never authorized for signing and a signature that simply does not verify
+   *  read the same, and a caller acting on one as if it were the other acts on the wrong fact. */
+  return intrinsic.chain(_seam.verify(sigAlg, sig, c.parsed.subjectPublicKeyInfo.bytes, preimage), function (verified) {
+    var ok = verified === true && signerMaySign;
+    /** @internal The verdict carries what this verb DETERMINED, not an echo of what it was handed.
+     *  The caller already holds `certID` and `requestTime` on the request it passed in, and copying
+     *  the decoded issuer onto the result would invite a byte comparison against a name this verb
+     *  judged equal under the RFC 5280 sec. 7.1 folding: two names that compare equal here are
+     *  routinely different bytes, and there is no public comparison a caller could use instead.
+     *  `signatureAlgorithm` is kept because it is derived rather than supplied, so without it a
+     *  caller cannot tell which digest the proof was actually checked under. */
+    return guard.verdict.of({
+      valid: ok,
+      verified: verified === true,
+      signerMaySign: signerMaySign,
+      signatureAlgorithm: sigAlg,
+    }, ok ? null : {
+      code: !signerMaySign ? "relatedcert/signer-may-not-sign" : "relatedcert/bad-signature",
+      reason: !signerMaySign
+        ? "the related certificate's keyUsage does not authorize a proof-of-possession signature (RFC 5280 sec. 4.2.1.3)"
+        : "the proof signature does not verify under the key of the certificate certID names",
+    });
+  });
 }
 
 module.exports = {

package/lib/schema-attrcert.js

@@ -293,7 +293,7 @@ var ATTRIBUTE_CERTIFICATE = pkix.signedEnvelope(NS, ACINFO, {
  *   var aaCert = await pki.x509.sign({ subject: "Attribute Authority", subjectPublicKey: await pki.key.export(pair.publicKey),
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
  *   var der = await pki.attrcert.sign(
- *     { holder: { entityName: { directoryName: "CN=Alice" } },
+ *     { holder: { entityName: { directoryName: "Alice" } },
  *       notBeforeTime: new Date("2026-01-01T00:00:00Z"), notAfterTime: new Date("2027-01-01T00:00:00Z"),
  *       attributes: { role: { roleName: { uniformResourceIdentifier: "urn:role:admin" } } } },
  *     { cert: aaCert, key: key });
@@ -350,7 +350,7 @@ function parseV1(input, callerOpts) {
  *   var aaCert = await pki.x509.sign({ subject: "Attribute Authority", subjectPublicKey: await pki.key.export(pair.publicKey),
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
  *   var pemText = await pki.attrcert.sign(
- *     { holder: { entityName: { directoryName: "CN=Alice" } },
+ *     { holder: { entityName: { directoryName: "Alice" } },
  *       notBeforeTime: new Date("2026-01-01T00:00:00Z"), notAfterTime: new Date("2027-01-01T00:00:00Z"),
  *       attributes: { role: { roleName: { uniformResourceIdentifier: "urn:role:admin" } } } },
  *     { cert: aaCert, key: key }, { pem: true });
@@ -375,7 +375,7 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label === null ? n
  *   var aaCert = await pki.x509.sign({ subject: "Attribute Authority", subjectPublicKey: await pki.key.export(pair.publicKey),
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
  *   var der = await pki.attrcert.sign(
- *     { holder: { entityName: { directoryName: "CN=Alice" } },
+ *     { holder: { entityName: { directoryName: "Alice" } },
  *       notBeforeTime: new Date("2026-01-01T00:00:00Z"), notAfterTime: new Date("2027-01-01T00:00:00Z"),
  *       attributes: { role: { roleName: { uniformResourceIdentifier: "urn:role:admin" } } } },
  *     { cert: aaCert, key: key });
@@ -700,7 +700,7 @@ var DOOR = pkix.extensionDoor({
  *   var key = await pki.key.export(pair.privateKey);
  *   var aaCert = await pki.x509.sign({ subject: "Example AA", subjectPublicKey: await pki.key.export(pair.publicKey),
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
- *   var acDer = await pki.attrcert.sign({ holder: { entityName: [{ directoryName: "CN=Holder" }] },
+ *   var acDer = await pki.attrcert.sign({ holder: { entityName: [{ directoryName: "Holder" }] },
  *     attributes: { role: { roleName: "https://example.test/role/admin" } }, serialNumber: 1n,
  *     notBeforeTime: new Date("2026-01-01T00:00:00Z"), notAfterTime: new Date("2027-01-01T00:00:00Z"),
  *     extensions: { noRevAvail: true } }, { cert: aaCert, key: key });
@@ -729,7 +729,7 @@ var decodeExtensions = DOOR.decodeExtensions;
  *   var key = await pki.key.export(pair.privateKey);
  *   var aaCert = await pki.x509.sign({ subject: "Example AA", subjectPublicKey: await pki.key.export(pair.publicKey),
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
- *   var acDer = await pki.attrcert.sign({ holder: { entityName: [{ directoryName: "CN=Holder" }] },
+ *   var acDer = await pki.attrcert.sign({ holder: { entityName: [{ directoryName: "Holder" }] },
  *     attributes: { role: { roleName: "https://example.test/role/admin" } }, serialNumber: 1n,
  *     notBeforeTime: new Date("2026-01-01T00:00:00Z"), notAfterTime: new Date("2027-01-01T00:00:00Z"),
  *     extensions: { noRevAvail: true } }, { cert: aaCert, key: key });

package/lib/schema-c509.js

@@ -1590,6 +1590,12 @@ function _reconstructDer(r, sigNode) {
  * reached by an explicit call and is not auto-routed by pki.schema.parse. The type-2 signedData and the
  * raw signature are surfaced as-is (a native verifier hashes them without re-serialization).
  *
+ * A type-3 ECDSA signature is a fixed-width `r || s` that names no curve, so the same pair padded to a
+ * wider accepted width reconstructs byte-identical DER: 64, 96 and 132 are three spellings of one
+ * certificate. `signatureValueMinimalWidth` reports the narrowest width that represents the value, and
+ * does not fail the parse. A reader that deduplicates, caches or blocklists by encoded form compares it
+ * against `signatureValue.length`, and re-narrows to it for a key that is the same for every spelling.
+ *
  * @example
  *   // the RFC 7925 profiled certificate from draft-ietf-cose-cbor-encoded-cert Appendix A.1 (type 3)
  *   var bytes = Buffer.from(
@@ -1703,7 +1709,10 @@ function _finishParse(f, root, nested, fields) {
   result._fieldBytes = root.bytes.subarray(1, root.bytes.length - f[10].bytes.length);
   if (type === 2) result.signedData = result._fieldBytes;
 
-  if (type === 3) result.reconstructedDer = _reconstructDer(result, f[10]);
+  if (type === 3) {
+    result.reconstructedDer = _reconstructDer(result, f[10]);
+    result.signatureValueMinimalWidth = _minimalSigWidth(signatureValue);
+  }
   return result;
 }
 
@@ -1960,11 +1969,37 @@ function _keyUsageBitsFromDer(extnValue, ctx) {
 var _NO_EXPIRY = C.TIME.seconds(Number(NO_EXPIRY_SECONDS));
 var NODE_TO_WEBCRYPTO = Object.assign(Object.create(null), { "prime256v1": "P-256", "secp384r1": "P-384", "secp521r1": "P-521" });
 var WEBCRYPTO_FIELD_BYTES = Object.assign(Object.create(null), { "P-256": 32, "P-384": 48, "P-521": 66 });
+/** @internal The accepted fixed-width `r || s` lengths, derived from the field sizes above rather
+ *  than written a fourth time. */
+var EC_SIG_WIDTHS = Object.keys(WEBCRYPTO_FIELD_BYTES).map(function (n) { return WEBCRYPTO_FIELD_BYTES[n] * 2; });
 var SIG_ALG_TO_CURVE = Object.assign(Object.create(null), { "ecdsaWithSHA256": "P-256", "ecdsaWithSHA384": "P-384", "ecdsaWithSHA512": "P-521" });
-function _magBytes(intNode) {
-  var c = intNode.content, i = 0;
-  while (i < c.length - 1 && c[i] === 0x00) i++;
-  return c.length - i;
+/** @internal The significant byte count of a big-endian magnitude in `buf[from, to)`: the leading
+ *  zero bytes do not change the value they encode. Taken as a range so the fixed-width halves of an
+ *  r||s signature and a decoded INTEGER's content are measured by the one scan. */
+function _magBytes(buf, from, to) {
+  var i = from;
+  while (i < to - 1 && buf[i] === 0x00) i++;
+  return to - i;
+}
+
+/** @internal The narrowest accepted r||s width that encodes the same (r, s) as `sig`. A fixed-width
+ *  r||s carries no curve, so padding each half of a 64-byte signature to 32 more bytes reconstructs
+ *  byte-identical DER: 64, 96 and 132 are three spellings of one certificate, which makes a C509 byte
+ *  string something other than a unique identifier for what it encodes. Neither the width nor the
+ *  issuer's curve is recoverable from the bytes, and `parse` takes no option to be told, so this is
+ *  reported and the caller judges. The widths come from the field-size table rather than a fourth
+ *  copy of 32/48/66. */
+function _minimalSigWidth(sig) {
+  var half = sig.length / 2;
+  var need = _magBytes(sig, 0, half);
+  var other = _magBytes(sig, half, sig.length);
+  if (other > need) need = other;
+  var narrowest = sig.length;
+  for (var i = 0; i < EC_SIG_WIDTHS.length; i++) {
+    var width = EC_SIG_WIDTHS[i];
+    if (width >= need * 2 && width <= sig.length && width < narrowest) narrowest = width;
+  }
+  return narrowest;
 }
 function _sigMagWidth(derSig) {
   var n;
@@ -1975,7 +2010,8 @@ function _sigMagWidth(derSig) {
     var ch = n.children[i];
     if (ch.tagNumber !== asn1.TAGS.INTEGER || ch.tagClass !== "universal" || ch.constructed) throw _err("c509/bad-signature", "the ECDSA issuer signature r and s must be universal INTEGERs");
   }
-  return Math.max(_magBytes(n.children[0]), _magBytes(n.children[1]));
+  var r0 = n.children[0].content, s0 = n.children[1].content;
+  return Math.max(_magBytes(r0, 0, r0.length), _magBytes(s0, 0, s0.length));
 }
 var CURVE_ORDER = ["P-256", "P-384", "P-521"];
 function _minCurveForMag(mag) {

package/lib/schema-cmp.js

@@ -803,7 +803,7 @@ var readName = _valueParser("Name", pkix.name(NS));
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
  *   var csrDer = await pki.csr.sign({ subject: "client", subjectPublicKey: await pki.key.export(pair.publicKey) }, { key: key });
  *   var der = await pki.cmp.build(
- *     { header: { sender: { directoryName: "CN=client" }, recipient: { directoryName: "CN=CA" } },
+ *     { header: { sender: { directoryName: "client" }, recipient: { directoryName: "CA" } },
  *       body: { p10cr: csrDer } }, { key: key, cert: cert });
  *   var m = pki.schema.cmp.parse(der);
  *   m.body.arm;             // "ir", "ip", "error", ...
@@ -837,7 +837,7 @@ var parse = pkix.makeParser({
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
  *   var csrDer = await pki.csr.sign({ subject: "client", subjectPublicKey: await pki.key.export(pair.publicKey) }, { key: key });
  *   var msg = await pki.cmp.build(
- *     { header: { sender: { directoryName: "CN=client" }, recipient: { directoryName: "CN=CA" } },
+ *     { header: { sender: { directoryName: "client" }, recipient: { directoryName: "CA" } },
  *       body: { p10cr: csrDer } }, { key: key, cert: cert });
  *   var pemText = pki.schema.cmp.pemEncode(msg);
  *   var der = pki.schema.cmp.pemDecode(pemText);
@@ -861,7 +861,7 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || "CMP", Pe
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
  *   var csrDer = await pki.csr.sign({ subject: "client", subjectPublicKey: await pki.key.export(pair.publicKey) }, { key: key });
  *   var der = await pki.cmp.build(
- *     { header: { sender: { directoryName: "CN=client" }, recipient: { directoryName: "CN=CA" } },
+ *     { header: { sender: { directoryName: "client" }, recipient: { directoryName: "CA" } },
  *       body: { p10cr: csrDer } }, { key: key, cert: cert });
  *   var pem = pki.schema.cmp.pemEncode(der);
  */

package/lib/schema-pkix.js

@@ -1811,6 +1811,12 @@ function _acceptExtensionRecord(ext, E, code, key) {
 function keyUsagePermits(ns, allowed) {
   var kuOid = ns.oid.byName("keyUsage");
   var decoders = certExtensionDecoders(ns).byOid;
+  /** @internal `allowed` may be a FUNCTION of the certificate, for a caller whose permitted set
+   *  depends on the subject key: an establishment bit authorizes nothing where the key's own family
+   *  cannot perform that establishment mechanism, and the certificate is the only place that says
+   *  which family it is. Every name the set names must be one the KeyUsage decoder defines, since
+   *  the record it answers from inherits nothing. */
+  var perCert = typeof allowed === "function";
   return function (parsedCert) {
     var exts = (parsedCert && parsedCert.extensions) || [];
     for (var i = 0; i < exts.length; i++) {
@@ -1818,13 +1824,60 @@ function keyUsagePermits(ns, allowed) {
       var ku;
       try { ku = decoders[kuOid](exts[i].value); }
       catch (e) { void e; return false; }
-      for (var a = 0; a < allowed.length; a++) if (ku[allowed[a]] === true) return true;
+      var names = perCert ? allowed(parsedCert) : allowed;
+      for (var a = 0; a < names.length; a++) if (ku[names[a]] === true) return true;
       return false;
     }
     return true;
   };
 }
 
+/** @internal Which key-establishment bit a subject key's own family can carry, as one table the
+ *  callers that read an establishment usage share. The governing documents state it per family:
+ *  RFC 3279 sec. 2.3.1 lists keyEncipherment for an RSA key and does not list keyAgreement; RFC 5480
+ *  sec. 3 lists keyAgreement for id-ecPublicKey, id-ecDH and id-ecMQV, and RFC 8813 sec. 3 makes
+ *  keyEncipherment and dataEncipherment a MUST NOT for all three; RFC 8410 sec. 5 makes keyAgreement
+ *  a MUST for id-X25519 and id-X448; and RFC 9935 sec. 5 has an ML-KEM certificate assert
+ *  keyEncipherment as its only usage.
+ *
+ *  A family in NEITHER column answers null, which is the refusing direction: an establishment bit
+ *  then authorizes nothing, and a signature bit is what the certificate has to assert. */
+var KEY_TRANSPORT_KEY_NAMES = ["rsaEncryption", "rsaesOaep"];
+/** @internal The three FIPS 203 sets and the composite KEM arms, matched by the prefix the registry
+ *  files them under rather than listed one at a time, so a set the registry gains later belongs to
+ *  this rule without a second edit. */
+var KEY_TRANSPORT_KEY_PREFIXES = ["id-ml-kem-", "id-MLKEM"];
+var KEY_AGREEMENT_KEY_NAMES = ["ecPublicKey", "X25519", "X448", "dhpublicnumber"];
+
+var _estabBitByNs = new _WeakMapI();
+
+function keyEstablishmentBit(ns) {
+  var table = _weakGet(_estabBitByNs, ns.oid);
+  if (table === undefined) {
+    table = _assign(_create(null), {});
+    var put = function (bit) {
+      return function (n) {
+        var dotted = ns.oid.byName(n);
+        if (dotted !== undefined && dotted !== null) table[dotted] = bit;
+      };
+    };
+    _forEach(KEY_TRANSPORT_KEY_NAMES, put("keyEncipherment"));
+    _forEach(KEY_AGREEMENT_KEY_NAMES, put("keyAgreement"));
+    var registry = ns.oid.all();
+    _forEach(intrinsic.keys(registry), function (dotted) {
+      var n = registry[dotted];
+      if (typeof n !== "string") return;
+      _forEach(KEY_TRANSPORT_KEY_PREFIXES, function (p) {
+        if (_strIndexOf(n, p) === 0) table[dotted] = "keyEncipherment";
+      });
+    });
+    _weakSet(_estabBitByNs, ns.oid, table);
+  }
+  return function (dotted) {
+    return typeof dotted === "string" && _hasOwn(table, dotted) ? table[dotted] : null;
+  };
+}
+
 /** @internal The subject-key algorithms that can only ever SIGN, as one table the linter and the verifier
  *  share. RFC 9883 sec. 6 states "The privateKeyPossessionStatement attribute MUST NOT be used to obtain a
  *  signature certificate", and sec. 4 states the same requirement as a property of the request: "the
@@ -1912,8 +1965,13 @@ function certExtensionDecoders(ns) {
     for (var z = 0; z < bs.bytes.length; z++) { if (bs.bytes[z] !== 0) { anyBit = true; break; } }
     if (!anyBit) throw ns.E(C, "KeyUsage must assert at least one bit (RFC 5280 sec. 4.2.1.3)");
     schema.assertMinimalNamedBits(bs.unusedBits, bs.bytes, function (m) { throw ns.E(C, m); });
-    // allow:registry-table-inherits-object-prototype -- the decoded KeyUsage record, whose keys are the fixed KU_BITS names the schema declares; the certificate supplies none of them
-    var out = {};
+    /** @internal The record inherits nothing. The exemption this carried rested on its keys being
+     *  the fixed KU_BITS names, and `keyUsagePermits` is called with a name that is NOT one of them:
+     *  `contentCommitment` is the X.509 spelling of the nonRepudiation bit and the BUILDER accepts
+     *  it, so an authorization gate asked for a name this decoder never defines and whatever
+     *  answered for it decided. Measured: a certificate confined to cRLSign went from maySign=false
+     *  to maySign=true under one assignment to `Object.prototype.contentCommitment`. */
+    var out = _create(null);
     _forEach(KU_BITS, function (nm, bit) {
       var byte = bit >> 3, mask = 0x80 >> (bit & 7);
       out[nm] = byte < bs.bytes.length && (bs.bytes[byte] & mask) !== 0;
@@ -2725,6 +2783,7 @@ module.exports = intrinsic.freeze({
   crlEntryFixedCriticality: crlEntryFixedCriticality,
   certExtensionDecoders: certExtensionDecoders,
   keyUsagePermits: keyUsagePermits,
+  keyEstablishmentBit: keyEstablishmentBit,
   signatureOnlyKeyOid: signatureOnlyKeyOid,
   scopedCertDecoder: scopedCertDecoder,
   crlExtensionDecoders: crlExtensionDecoders,

package/lib/schema-trustanchor.js

@@ -359,7 +359,7 @@ var TRUST_ANCHOR_LIST = schema.seqOf(TRUST_ANCHOR_CHOICE, {
  *   var pair = await pki.key.generate("Ed25519");
  *   var spki = await pki.key.export(pair.publicKey);
  *   var der = pki.trustanchor.build({ anchors: [{ taInfo: {
- *     pubKey: spki, keyId: Buffer.alloc(20, 1), certPath: { taName: "CN=Example Root" } } }] });
+ *     pubKey: spki, keyId: Buffer.alloc(20, 1), certPath: { taName: "Example Root" } } }] });
  *   pki.schema.trustanchor.parse(der).anchors[0].kind;   // -> "taInfo"
  */
 var parse = pkix.makeParser({
@@ -385,7 +385,7 @@ var parse = pkix.makeParser({
  *   var pair = await pki.key.generate("Ed25519");
  *   var spki = await pki.key.export(pair.publicKey);
  *   var list = pki.schema.trustanchor.parse(pki.trustanchor.build({ anchors: [{ taInfo: {
- *     pubKey: spki, keyId: Buffer.alloc(20, 1), certPath: { taName: "CN=Example Root" } } }] }));
+ *     pubKey: spki, keyId: Buffer.alloc(20, 1), certPath: { taName: "Example Root" } } }] }));
  *   list.anchors[0].taInfo.certPath.taName.dn;   // -> "CN=Example Root"
  */
 var parseInfo = pkix.makeParser({
@@ -407,7 +407,7 @@ var parseInfo = pkix.makeParser({
  *   var pair = await pki.key.generate("Ed25519");
  *   var der = pki.trustanchor.build({ anchors: [{ taInfo: {
  *     pubKey: await pki.key.export(pair.publicKey), keyId: Buffer.alloc(20, 1),
- *     certPath: { taName: "CN=Example Root" } } }] });
+ *     certPath: { taName: "Example Root" } } }] });
  *   pki.schema.trustanchor.pemDecode(pki.schema.trustanchor.pemEncode(der)).equals(der);  // -> true
  */
 function pemDecode(text, label) { return pkix.pemDecode(text, label || "TRUST ANCHOR LIST", PemError); }
@@ -426,7 +426,7 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || "TRUST AN
  *   var pair = await pki.key.generate("Ed25519");
  *   var der = pki.trustanchor.build({ anchors: [{ taInfo: {
  *     pubKey: await pki.key.export(pair.publicKey), keyId: Buffer.alloc(20, 1),
- *     certPath: { taName: "CN=Example Root" } } }] });
+ *     certPath: { taName: "Example Root" } } }] });
  *   pki.schema.trustanchor.pemEncode(der).indexOf("-----BEGIN TRUST ANCHOR LIST-----");  // -> 0
  */
 function pemEncode(der, label) { return pkix.pemEncode(der, label || "TRUST ANCHOR LIST", PemError); }

package/lib/sigstore.js

@@ -1383,7 +1383,7 @@ async function _verifyEmbeddedScts(leaf, leafDer, issuer, logs, timeMs, atMs) {
 /** @internal A receipt the verifier refuses structurally counted as verified would be the whole leg
  * lost, so a fault is an unverified receipt and the next one is still tried. */
 function _sctVerifies(entry, sct, spki) {
-  return _ctVerifySct(entry, sct, spki).then(function (ok) { return ok === true; }, function () { return false; });
+  return intrinsic.chain(_ctVerifySct(entry, sct, spki), function (ok) { return ok === true; }, function () { return false; });
 }
 
 /** @internal A receipt's own instant, in milliseconds. The parser's `timestampMs` is this same value

package/lib/smime.js

@@ -457,8 +457,24 @@ function _readDescriptor(s, position) {
       var names = Object.getOwnPropertyNames(proto);
       for (var n = 0; n < names.length; n++) {
         var name = names[n];
-        if ((name === "constructor" && proto !== s) || seen[name] === 1) continue;
-        if (proto !== s && _isMethod(proto, name)) continue;
+        if (seen[name] === 1) continue;
+        /** @internal The three names this walk declines: a prototype level's `constructor`, which is
+         * the class rather than a field; a prototype level's method, likewise; and a callable
+         * descriptor's own function machinery, which `guard.identifier` knows the names of and which
+         * copying turned a legitimate callable into a descriptor `pki.cms.sign`'s own unknown-field
+         * door then refused.
+         *
+         * A declined name is marked SEEN, because the value `s[name]` reads is the one the NEAREST
+         * level holds and a deeper property of that name is shadowed and unreadable. Measured before
+         * the marking: a derived class's own `length` was declined and then read off the base class
+         * as a field; a generator's own `prototype` was declined and then its generator-prototype
+         * OBJECT was walked, which read as a signer nested too deeply to copy; and a prototype-level
+         * method was declined and then a data property of the same name one level up was copied,
+         * which set the field to the method shadowing it and reached the digest resolver as
+         * `unsupported RSA digest algorithm undefined`. */
+        if ((name === "constructor" && proto !== s) ||
+            (proto !== s && _isMethod(proto, name)) ||
+            (proto === s && guard.identifier.isOwnMachineryName(s, name))) { seen[name] = 1; continue; }
         seen[name] = 1;
         if (++fields > DESCRIPTOR_MAX_FIELDS) throw _err("smime/bad-input", "signer " + position + " carries more than " + DESCRIPTOR_MAX_FIELDS + " fields");
         copy[name] = s[name];

package/lib/trust.js

@@ -1156,7 +1156,7 @@ function _subtreeOf(st) { return { tag: st.base.tagNumber, base: st.base.value }
  *   var pair = await pki.key.generate("Ed25519");
  *   var der = pki.trustanchor.build({ anchors: [{ taInfo: {
  *     pubKey: await pki.key.export(pair.publicKey), keyId: Buffer.alloc(20, 1),
- *     certPath: { taName: "CN=Example Root" } } }] });
+ *     certPath: { taName: "Example Root" } } }] });
  *   pki.trust.parseTrustAnchorList(der).anchors.length;   // -> 1
  */
 function parseTrustAnchorList(input, opts) {

package/lib/trustanchor-build.js

@@ -249,7 +249,7 @@ function _anchorDer(spec, i) {
  *     pubKey: await pki.key.export(pair.publicKey),
  *     keyId: Buffer.alloc(20, 1),
  *     taTitle: "Example Root CA",
- *     certPath: { taName: "CN=Example Root", pathLenConstraint: 2 } } }] });
+ *     certPath: { taName: "Example Root", pathLenConstraint: 2 } } }] });
  *   pki.schema.trustanchor.parse(der).anchors[0].taInfo.certPath.pathLenConstraint;  // -> 2
  */
 function build(spec, opts) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.9.1",
+  "version": "0.9.4",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:c9865553-89a9-487f-aef1-fe53df25b0ea",
+  "serialNumber": "urn:uuid:9f1767af-18a9-4a06-85fd-6273c947d9b9",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-08T04:38:54.565Z",
+    "timestamp": "2026-10-12T04:46:50.282Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.9.1",
+      "bom-ref": "@blamejs/pki@0.9.4",
       "type": "application",
       "name": "pki",
-      "version": "0.9.1",
+      "version": "0.9.4",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.9.1",
+      "purl": "pkg:npm/%40blamejs/pki@0.9.4",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.9.1",
+      "ref": "@blamejs/pki@0.9.4",
       "dependsOn": []
     }
   ]