@blamejs/pki 0.9.4 → 0.9.6

package/lib/lint.js

@@ -3908,9 +3908,8 @@ function _isMlKem(cert) {
  *  MUST NOT be present. The row runs in the rfc5280 profile because that is the profile whose own
  *  clause delegates the question, and the profile every authoring call is held to.
  *
- *  Only the id-ecPublicKey arm is here. Sec. 3's other two arms govern id-ecDH and id-ecMQV, which
- *  this registry does not name, so a row keyed on them could never fire; registering them as
- *  subject-key algorithms is adding surface rather than closing this. There is no RSA row: RFC 3279
+ *  Only the id-ecPublicKey arm is here; no row is keyed on id-ecDH or id-ecMQV, the identifiers
+ *  sec. 3's other two arms govern. There is no RSA row: RFC 3279
  *  sec. 2.3.1 states a MAY list and no prohibition, so an error-severity finding there would promote
  *  a MAY-list omission to a MUST NOT and stop the signer emitting a certificate a caller may want. */
 var EC_FORBIDDEN_KU_BITS = ["keyEncipherment", "dataEncipherment"];
@@ -3938,6 +3937,64 @@ var RFC5480_RULES = [
   },
 ];
 
+/** @internal The curves the small-scalar table is built for, and the scalar bound. Each table holds
+ *  the x-coordinates of d*G for d from 1 to the bound minus one, built once per curve on first use
+ *  (measured on Node 26: 4 ms for P-256, 138 ms for P-384, 321 ms for P-521). The points d*G and
+ *  (n-d)*G share an x-coordinate, so one comparison covers both. */
+var SMALL_SCALAR_WIDTH = intrinsic.assign(intrinsic.create(null), { prime256v1: 32, secp384r1: 48, secp521r1: 66, secp256k1: 32 });
+var SMALL_SCALAR_BOUND = 256;
+var _smallScalarTables = intrinsic.create(null);
+function _smallScalarTable(curve) {
+  if (_smallScalarTables[curve]) return _smallScalarTables[curve];
+  var width = SMALL_SCALAR_WIDTH[curve];
+  var table = intrinsic.create(null);
+  var scalar = intrinsic.bufferAlloc(width);
+  for (var d = 1; d < SMALL_SCALAR_BOUND; d++) {
+    scalar[width - 1] = d;
+    var point = guard.crypto.ecPointFromScalar(curve, scalar);
+    table[intrinsic.bufToString(point, "hex", 1, 1 + width)] = true;
+  }
+  _smallScalarTables[curve] = table;
+  return table;
+}
+/** @internal The JWK curve names the table covers, mapped to the curve names this file reports. */
+var SMALL_SCALAR_JWK_CURVES = intrinsic.assign(intrinsic.create(null), {
+  "P-256": "prime256v1", "P-384": "secp384r1", "P-521": "secp521r1", "secp256k1": "secp256k1",
+});
+/** @internal The curve and the x-coordinate of an elliptic curve subject key, read through node's own
+ *  import, or null. The import accepts a named or explicit curve and an uncompressed, compressed or
+ *  hybrid point, and it refuses a point that is not on the curve, so a key that is not one reports
+ *  nothing here. */
+function _ecKeyCoordinate(spki) {
+  try {
+    var jwk = guard.crypto.exportKey(guard.crypto.publicKey({ key: spki.bytes, format: "der", type: "spki" }), { format: "jwk" });
+    var curve = SMALL_SCALAR_JWK_CURVES[jwk.crv];
+    if (curve === undefined || typeof jwk.x !== "string") return null;
+    return { curve: curve, x: intrinsic.bufToString(intrinsic.bufferFrom(jwk.x, "base64url"), "hex") };
+  } catch (_e) {
+    // allow:swallow-unverified a subject key node does not import is not an elliptic curve point this row can judge
+    return null;
+  }
+}
+function _isEcSubjectKey(cert) {
+  var spki = cert.subjectPublicKeyInfo;
+  return !!spki && !!spki.algorithm && spki.algorithm.name === "ecPublicKey" && intrinsic.isBuffer(spki.bytes);
+}
+
+var KEY_COMPROMISE_RULES = [
+  {
+    id: "lint/key-compromise/small-ec-private-key", severity: "error", source: "key-compromise",
+    citation: "CABF TLS BR 6.1.1.3 (4)",
+    message: "the elliptic curve private key is a small integer, so anyone can recover it from the public key",
+    appliesTo: _isEcSubjectKey,
+    check: function (cert) {
+      var key = _ecKeyCoordinate(cert.subjectPublicKeyInfo);
+      if (key === null) return null;
+      return _smallScalarTable(key.curve)[key.x] === true ? { context: { curve: key.curve, scalarBelow: SMALL_SCALAR_BOUND } } : null;
+    },
+  },
+];
+
 var RFC9935_RULES = [
   {
     id: "lint/rfc9935/kem-key-usage", severity: "error", source: "rfc9935", citation: "RFC 9935 5",
@@ -6129,7 +6186,7 @@ function _nistKindOf(alg) {
   /** @internal A key-agreement scheme names a key-derivation function for CMS rather than an algorithm
    * a certificate declares, and its name opens with the family word. */
   if (name.indexOf("dhSinglePass-") === 0) return undefined;
-  if (name === "ecPublicKey" || name.indexOf("ecdsaWith") === 0 ||
+  if (name === "ecPublicKey" || name === "ecDH" || name === "ecMQV" || name.indexOf("ecdsaWith") === 0 ||
     name === "X25519" || name === "X448") return "ecc";
   if (name === "Ed25519" || name === "Ed448") return "eddsa";
   if (name === "dsa" || name.indexOf("dsaWith") === 0 ||
@@ -6719,6 +6776,7 @@ var PROFILES = Object.assign(Object.create(null), {
    *  from a rule that quietly replaced the other. */
   "cnsa-2.0": CNSA2_RULES.concat(RFC9881_RULES).concat(RFC9935_RULES)
     .concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  "key-compromise": intrinsic.concatList(KEY_COMPROMISE_RULES, RFC5280_EXTENSION_SYNTAX_RULES),
 });
 var ALL_RULES = RFC5280_RULES.concat(RFC9881_RULES).concat(RFC9909_RULES).concat(RFC9935_RULES)
   .concat(RFC9763_RULES).concat(RFC7633_RULES).concat(X509_ALTSIG_RULES)
@@ -6732,6 +6790,7 @@ var ALL_RULES = RFC5280_RULES.concat(RFC9881_RULES).concat(RFC9909_RULES).concat
  *  operand and builds through ArraySpeciesCreate, so a replacement decides which rows the default
  *  set holds. The pre-existing chain above is counted in the conversion budget. */
 ALL_RULES = intrinsic.concatList(ALL_RULES, RFC5480_RULES);
+ALL_RULES = intrinsic.concatList(ALL_RULES, KEY_COMPROMISE_RULES);
 
 var CABF_TLS_CSR_RULES = CABF_TLS_RULES.filter(function (r) {
   return CABF_TLS_CSR_RULE_IDS.indexOf(r.id) !== -1;
@@ -6820,8 +6879,9 @@ var CSR_PROFILES = Object.assign(Object.create(null), {
   "rfc2986": CSR_STRUCTURAL_RULES,
   "cabf-tls": CSR_STRUCTURAL_RULES.concat(CABF_TLS_CSR_RULES),
   "rfc9883": RFC9883_CSR_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  "key-compromise": intrinsic.concatList(KEY_COMPROMISE_RULES, RFC5280_EXTENSION_SYNTAX_RULES),
 });
-var ALL_CSR_RULES = CSR_STRUCTURAL_RULES.concat(RFC9883_CSR_RULES);
+var ALL_CSR_RULES = intrinsic.concatList(CSR_STRUCTURAL_RULES.concat(RFC9883_CSR_RULES), KEY_COMPROMISE_RULES);
 
 function _subjectIsNonEmpty(csr) {
   var rdns = csr.subject && csr.subject.rdns;
@@ -7751,8 +7811,8 @@ function rules(profile, artifact) {
  *   // -> ["rfc5280", "rfc5480", "rfc9881", "rfc9909", "rfc9935", "rfc9763", "rfc7633",
  *   //     "x509-altsig", "cabf-tls", "cabf-smime", "cabf-cs", "etsi-qc", "mozilla-root",
  *   //     "chrome-root", "microsoft-root", "apple-root", "nist-pqc-transition", "cnsa-2.0",
- *   //     "rfc2986", "rfc9883", "rfc5280-crl", "rfc6960", "rfc5019", "rfc5652", "rfc8933",
- *   //     "rfc3161", "rfc5755"]
+ *   //     "key-compromise", "rfc2986", "rfc9883", "rfc5280-crl", "rfc6960", "rfc5019",
+ *   //     "rfc5652", "rfc8933", "rfc3161", "rfc5755"]
  */
 /** @internal `cabf-tls` names the certificate profile in this list and is not repeated for the
  *  request form: `pki.lint.csr` takes the same name and runs those rows against what a request

package/lib/ocsp-verify.js

@@ -74,7 +74,12 @@ function makeOcspVerify(deps) {
     return false;
   }
 
-  async function ocspAuthorizeResponder(basicResponse, cert, issuer, issuerKeyBits, time) {
+  /** @internal `distrusted` is a list `guard.distrust.keys` returned, or null. A responder whose key
+   * is on it is not an authorized responder. A listed issuing CA authorizes no responder at all: its
+   * own answer is refused, and so is a delegate it certified, since the holder of the listed key can
+   * certify one. */
+  async function ocspAuthorizeResponder(basicResponse, cert, issuer, issuerKeyBits, time, distrusted) {
+    if (guard.distrust.has(distrusted, issuer.workingPublicKey)) return null;
     var rid = basicResponse.responderID;
     var matchesIssuer = false;
     try {
@@ -93,6 +98,7 @@ function makeOcspVerify(deps) {
         else if (rid.byKey) identifies = _bytesEqual(rid.byKey, await ocspDigest("SHA-1", ocspKeyValue(rc.subjectPublicKeyInfo.bytes)));
       } catch (_e) { identifies = false; }
       if (!identifies) continue;
+      if (guard.distrust.has(distrusted, rc.subjectPublicKeyInfo.bytes) || guard.distrust.has(distrusted, ocspResponderSpki(rc, issuer))) continue;
       var issuedByCa;
       try { issuedByCa = dnEqual(rc.issuer.rdns, cert.issuer.rdns); }
       catch (_e) { continue; }
@@ -141,11 +147,11 @@ function makeOcspVerify(deps) {
     }, extras);
   }
 
-  async function evaluateResponse(resp, cert, issuer, issuerKeyBits, issuerNameCandidates, time, historical) {
+  async function evaluateResponse(resp, cert, issuer, issuerKeyBits, issuerNameCandidates, time, historical, distrusted) {
     if (resp.responseStatus.code !== 0) return _evaluation({ reason: "non-successful OCSP responseStatus (" + resp.responseStatus.code + ")" });
     var br = resp.basicResponse;
     if (!br) return _evaluation({ reason: "successful OCSP response carries no BasicOCSPResponse" });
-    var signerSpki = await ocspAuthorizeResponder(br, cert, issuer, issuerKeyBits, time);
+    var signerSpki = await ocspAuthorizeResponder(br, cert, issuer, issuerKeyBits, time, distrusted || null);
     if (!signerSpki) return _evaluation({ applicable: true, reason: "no authorized OCSP responder signs this response (RFC 6960 sec. 4.2.2.2)" });
     if (!(await verifyWithSpki(br.signatureAlgorithm, br.signature, signerSpki, br.tbsResponseDataBytes))) {
       return _evaluation({ applicable: true, responderAuthorized: true, reason: "the OCSP response signature does not verify over tbsResponseData" });

package/lib/ocsp.js

@@ -316,6 +316,8 @@ function _normCertDer(cert, what) {
  *   extendedRevoke  emit the id-pkix-ocsp-extended-revoke extension (RFC 6960 sec. 4.4.8); implied
  *                   by a non-issued response, where `false` is refused.
  *   embedCert       `false` to omit certs [0] (a direct-CA response the client already trusts).
+ *                   For both switches, a value other than `true`, `false`, `null` or an absent
+ *                   option is refused `ocsp/bad-input`.
  *   pem             emit a PEM `OCSP RESPONSE` string instead of DER.
  * @example
  *   var ca = await pki.key.generate("Ed25519");
@@ -350,6 +352,12 @@ function _sign(responseData, responder, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "ocsp/bad-input", "pki.ocsp.sign options");
   guard.identifier.assertKnownKeys(opts, _SIGN_OPTS, _err, "ocsp/bad-input",
     "pki.ocsp.sign has an unknown option (the nonce to echo back is `nonce`): ");
+  /** @internal Both switches are read below against one boolean each, which answered for a value
+   *  of any other type as the opposite of what the caller asked: `embedCert: "false"` carried the
+   *  responder certificate a direct-CA response leaves out, and `extendedRevoke: "false"` placed
+   *  the extension while escaping the sec. 2.2 refusal that reads the same option. */
+  guard.identifier.booleanOptionDefaultOn(opts.embedCert, _err, "ocsp/bad-input", "pki.ocsp.sign opts.embedCert");
+  guard.identifier.booleanOption(opts.extendedRevoke, _err, "ocsp/bad-input", "pki.ocsp.sign opts.extendedRevoke");
   responseData = responseData || _ocspIntrinsic.create(null);
   if (typeof responseData !== "object") throw _err("ocsp/bad-input", "the responseData must be an object { responderID, responses, producedAt? }");
   guard.identifier.assertKnownKeys(responseData, _RESPONSE_DATA_KEYS, _err, "ocsp/bad-input", "unknown responseData field (accepted: responderID, responses, producedAt): ");
@@ -674,6 +682,9 @@ function buildErrorResponse(status) {
  *   time            the validation instant (default: now).
  *   requestNonce    the nonce the client sent; when given, the response MUST echo it (constant-time).
  *   historicalMode  defer a strictly-future revocation (report good) instead of revoking on skew.
+ *   distrustedKeys  SHA-256 digests of SubjectPublicKeyInfo values (64 hex characters or 32 bytes each, see
+ *                   `pki.trust.spkiDigest`); a response signed by a listed key, the issuing CA's or a
+ *                   delegate's, has no authorized responder and is `"unknown"`.
  * @example
  *   var ca = await pki.key.generate("Ed25519");
  *   var caKey = await pki.key.export(ca.privateKey);
@@ -691,7 +702,7 @@ function buildErrorResponse(status) {
  *   var res = await pki.ocsp.verify(responseDer, { cert: leafDer, issuer: caDer });
  *   res.status;   // "good" | "revoked" | "unknown"
  */
-var _VERIFY_OPTS = Object.assign(Object.create(null), { cert: 1, historicalMode: 1, issuer: 1, requestNonce: 1, time: 1 });
+var _VERIFY_OPTS = Object.assign(Object.create(null), { cert: 1, distrustedKeys: 1, historicalMode: 1, issuer: 1, requestNonce: 1, time: 1 });
 
 function verify(response, opts) {
   try {
@@ -700,8 +711,9 @@ function verify(response, opts) {
       "pki.ocsp.verify has an unknown option (the request nonce to bind against is `requestNonce`): ");
   } catch (e) { return _promiseReject(_Promise, e); }
   if (opts.cert == null || opts.issuer == null) return _promiseReject(_Promise, _err("ocsp/bad-input", "verify requires opts.cert and opts.issuer"));
-  var parsed, cert, issuerCert, time;
+  var parsed, cert, issuerCert, time, distrusted;
   try {
+    distrusted = guard.distrust.keys(opts.distrustedKeys, _err, "ocsp/bad-input", "opts.distrustedKeys");
     parsed = _responseFromBytes(response);
     cert = _certOf(opts.cert, "the target certificate");
     issuerCert = _certOf(opts.issuer, "the issuer certificate");
@@ -720,7 +732,7 @@ function verify(response, opts) {
   /** @internal Captured: this continuation is where the response's status becomes the verdict a
    * caller reads, so a settled value in place of it reports a status nothing evaluated. */
   var evaluated = pathValidate.verifyOcspResponse(parsed, cert, issuerCert, time,
-    { historicalMode: opts.historicalMode === true, requestNonce: reqNonce });
+    { historicalMode: opts.historicalMode === true, requestNonce: reqNonce, distrustedKeys: distrusted });
   return _ocspIntrinsic.chain(evaluated, function (verdict) {
     return guard.verdict.of(verdict, { valid: verdict.status === "good" });
   });
@@ -941,7 +953,7 @@ function httpRequest(der, responderUrl, opts) {
   if (!guard.encoding.isAsciiText(responderUrl)) {
     throw E("ocsp/bad-input", "httpRequest: the responder URL must be US-ASCII (RFC 3986 sec. 2); percent-encode the rest before passing it, since the RFC 5019 sec. 5 size bound counts the bytes that go on the wire");
   }
-  var asked = opts.method === undefined ? null : opts.method;
+  var asked = opts.method == null ? null : opts.method;
   if (asked !== null && asked !== "GET" && asked !== "POST") {
     throw E("ocsp/bad-input", "httpRequest: opts.method must be \"GET\" or \"POST\"");
   }

package/lib/oid.js

@@ -351,6 +351,10 @@ var FAMILIES = Object.assign(Object.create(null), {
     sect233k1: 26, sect233r1: 27, secp192k1: 31, secp224k1: 32, secp224r1: 33,
     secp384r1: 34, secp521r1: 35, sect409k1: 36, sect409r1: 37, sect571k1: 38, sect571r1: 39 } },
 
+  /** @internal RFC 5480 sec. 2.1.2: the two algorithm identifiers that restrict an elliptic curve key to
+   *  key agreement. The key itself is an ecPublicKey key, which is how a distrust list reads it. */
+  secgSchemes: { base: [1, 3, 132, 1], of: { ecDH: 12, ecMQV: 13 } },
+
   brainpool: { base: [1, 3, 36, 3, 3, 2, 8, 1, 1], of: {
     brainpoolP160r1: 1, brainpoolP160t1: 2, brainpoolP192r1: 3, brainpoolP192t1: 4,
     brainpoolP224r1: 5, brainpoolP224t1: 6, brainpoolP256r1: 7, brainpoolP256t1: 8,

package/lib/path-validate.js

@@ -1023,8 +1023,8 @@ function _initialState(certs, params, seeds, anchor, n, ta, policySwitches) {
     validPolicyGraph: graphRoot(),
     policyIndex: intrinsic.create(null),
     policyNodeCount: 1,
-    maxPolicyNodes: params.maxPolicyNodes !== undefined ? params.maxPolicyNodes : constants.LIMITS.PATH_MAX_POLICY_NODES,
-    minRsaModulusBits: params.minRsaModulusBits !== undefined ? params.minRsaModulusBits : constants.LIMITS.RSA_MIN_MODULUS_BITS,
+    maxPolicyNodes: params.maxPolicyNodes != null ? params.maxPolicyNodes : constants.LIMITS.PATH_MAX_POLICY_NODES,
+    minRsaModulusBits: params.minRsaModulusBits != null ? params.minRsaModulusBits : constants.LIMITS.RSA_MIN_MODULUS_BITS,
     permittedGenerations: intrinsic.selectList(seeds.permittedGenerations, function (g) { return g.length > 0; }),
     excludedSubtrees: seeds.excluded,
     explicitPolicy: _flagSet(policySwitches.initialExplicitPolicy, ta.policyFlags, "requireExplicitPolicy") ? 0 : n + 1,
@@ -1129,6 +1129,17 @@ function spliceSpkiParameters(spki, algOid, paramsBytes) {
   ]);
 }
 
+/** @internal The certificate's key with the parameters it inherits from its issuer spliced in, the
+ *  way `updateWorkingKey` builds the key the next signature is verified under, or null when the
+ *  certificate states its own parameters or inherits none. Read before `updateWorkingKey` runs for
+ *  this certificate, while `state` still holds the issuer's working key. */
+function _inheritedSpki(state, cert) {
+  var keyAlg = cert.subjectPublicKeyInfo.algorithm;
+  if (!isNullOrAbsentParams(keyAlg.parameters)) return null;
+  if (keyAlg.oid !== state.workingPublicKeyAlgorithm || !state.workingPublicKeyParameters) return null;
+  return spliceSpkiParameters(cert.subjectPublicKeyInfo, keyAlg.oid, state.workingPublicKeyParameters);
+}
+
 function updateWorkingKey(state, cert) {
   var keyAlg = cert.subjectPublicKeyInfo.algorithm;
   if (!isNullOrAbsentParams(keyAlg.parameters)) {
@@ -1370,7 +1381,7 @@ function _revocationRow(row, rv) {
  * (`initialExplicitPolicy`, `initialAnyPolicyInhibit`,
  * `initialPolicyMappingInhibit`) each take `true`, `false`, `null` or an absent
  * option, and any other value throws `path/bad-input` for the same reason. Returns `{ valid, revocationChecked, anchorConstraints,
- * path, results, workingPublicKey, workingPublicKeyAlgorithm,
+ * distrustedKeysApplied, path, results, workingPublicKey, workingPublicKeyAlgorithm,
  * workingPublicKeyParameters, validPolicyGraph, userConstrainedPolicySet }` where `results[i].checks`
  * carries a per-check reason code (`path/*`) for every step. Pure and
  * re-entrant: no input object is mutated. An empty path or a missing anchor
@@ -1422,6 +1433,19 @@ function _revocationRow(row, rv) {
  * `softFail` says. `softFail` opts into an undetermined answer; the built-in
  * checkers report one as `{ status: "unknown" }` and do not throw.
  *
+ * `distrustedKeys` is a list of SHA-256 digests of DER SubjectPublicKeyInfo values, each 64
+ * hexadecimal characters or 32 bytes (`pki.trust.spkiDigest` computes one from a certificate). A
+ * certificate on the path whose key is listed fails with `path/distrusted-key` in its
+ * `distrustedKey` row, and a listed trust anchor key fails the path with the same code in the
+ * `distrustedIssuerKey` row of the certificate the anchor issued. A key matches when the digest of
+ * the SubjectPublicKeyInfo as the certificate encodes it, or as node re-encodes the key (an
+ * uncompressed EC point, RSA parameters with NULL), is listed, so one entry refuses a CA certificate
+ * and every cross-certificate for the same key. No revocation status is asked for a certificate at
+ * or below a distrusted key, and a standalone `crlChecker`, `ocspChecker` or `fetchingChecker` given
+ * the list in its context answers `"unknown"` for an issuer whose key is listed.
+ * `distrustedKeysApplied` reports whether a non-empty list was supplied. A malformed list is
+ * `path/bad-input`.
+ *
  * `anchorConstraints` reports what the anchor's own trust metadata decided:
  * the `checkedPurpose` it was judged under, and whether the `distrustAfter`
  * date, the `purposes` delegator map and the `nameConstraints` namespace each
@@ -1461,7 +1485,7 @@ function _revocationRow(row, rv) {
  *   res.valid;  // boolean; res.results[0].checks carries the per-check codes
  */
 var _VALIDATE_OPTS = intrinsic.assign(intrinsic.create(null), {
-  checkPurpose: 1, ctLogList: 1, ctPolicy: 1, historicalMode: 1, identity: 1, initialAnyPolicyInhibit: 1,
+  checkPurpose: 1, ctLogList: 1, ctPolicy: 1, distrustedKeys: 1, historicalMode: 1, identity: 1, initialAnyPolicyInhibit: 1,
   initialExcludedSubtrees: 1, initialExplicitPolicy: 1, initialPermittedSubtrees: 1,
   initialPolicyMappingInhibit: 1, maxPathCerts: 1, maxPolicyNodes: 1, minRsaModulusBits: 1, requireRevocation: 1,
   requiredEku: 1, revocationChecker: 1, softFail: 1, time: 1, trustAnchors: 1,
@@ -1516,8 +1540,12 @@ async function validate(path, opts) {
   if (suppliedVerifier !== null && typeof suppliedVerify !== "function") {
     throw E("path/bad-input", "validate: opts.verifier must carry a verify(args) function");
   }
+  /** @internal The distrust list is read and copied here, once, and every anchor attempt reads the
+   * copy: the attempts run after awaits, and a list re-read from the caller's array there could have
+   * been emptied by a revocation checker that ran in between. */
+  var distrusted = guard.distrust.keys(checked.distrustedKeys, E, "path/bad-input", "validate: opts.distrustedKeys");
   var scope = intrinsic.freeze(intrinsic.assign(intrinsic.create(null), {
-    verifier: suppliedVerifier, verify: suppliedVerify,
+    verifier: suppliedVerifier, verify: suppliedVerify, distrusted: distrusted,
   }));
   return _validate(path, checked, intrinsic.freeze(intrinsic.create(null)), scope);
 }
@@ -1670,6 +1698,13 @@ async function _validate(path, opts, run, scope) {
   var revocationRan = false, revocationWaived = false, revocationUndetermined = false;
   var prefixAuthentic = true;
   var anchorDistrustApplied = false, anchorPurposeApplied = false;
+  var distrusted = scope.distrusted;
+  var anchorKeyDistrusted = guard.distrust.has(distrusted, anchor.publicKey);
+  /** @internal The first path index whose issuer chain holds a distrusted key: the anchor's key
+   * makes it 0, a certificate's own key makes it that certificate. From there down, no revocation
+   * status is asked for. The path fails either way, and a checker that fetches would open a
+   * connection on behalf of certificates issued under a key the caller refuses. */
+  var distrustedFrom = anchorKeyDistrusted ? 0 : -1;
   if (!checkPurpose && _hasPurposeScopedMetadata(anchor)) {
     throw E("path/bad-input", "validate: the trust anchor carries purpose-scoped metadata (distrustAfter / purposes), which is keyed by key purpose -- supply opts.checkPurpose to say which purpose this validation is for, or the constraint cannot be applied");
   }
@@ -1705,6 +1740,19 @@ async function _validate(path, opts, run, scope) {
      * no certificate under it is authenticated however its own check reads. */
     if (!sigRes.ok) prefixAuthentic = false;
 
+    /** @internal The digest covers the SubjectPublicKeyInfo as the certificate encodes it, not the
+     * working key, which carries parameters inherited from the issuer. A cross-signed certificate
+     * carries the same encoded key as the certificate it duplicates, so one entry refuses both. */
+    if (idx === 0 && anchorKeyDistrusted) {
+      guard.list.append(checks, { name: "distrustedIssuerKey", ok: false, code: "path/distrusted-key" });
+      failed = true;
+    }
+    if (guard.distrust.has(distrusted, cert.subjectPublicKeyInfo.bytes) || guard.distrust.has(distrusted, _inheritedSpki(state, cert))) {
+      guard.list.append(checks, { name: "distrustedKey", ok: false, code: "path/distrusted-key" });
+      failed = true;
+      if (distrustedFrom === -1) distrustedFrom = idx;
+    }
+
     if (compositeSig.COMPOSITE_ALGS[cert.subjectPublicKeyInfo.algorithm.oid]) {
       var cku = compositeKeyUsageCheck(cert);
       guard.list.append(checks,{ name: "compositeKeyUsage", ok: cku.ok, code: cku.ok ? undefined : cku.code });
@@ -1760,7 +1808,13 @@ async function _validate(path, opts, run, scope) {
      * socket, so asking anyway lets an unauthenticated certificate choose a destination and spend
      * the fetch budget. The row says the status was not asked for, which is an undetermined
      * outcome and not a checked one. */
-    if (revocationChecker && !prefixAuthentic) {
+    if (revocationChecker && distrustedFrom !== -1 && idx >= distrustedFrom) {
+      guard.list.append(checks, { name: "revocation", ok: false, status: "unknown",
+        code: "path/revocation-undetermined",
+        reason: "a key at or above this certificate on the path is distrusted, so no revocation status was asked for" });
+      revocationUndetermined = true;
+      revocationRan = true;
+    } else if (revocationChecker && !prefixAuthentic) {
       guard.list.append(checks, { name: "revocation", ok: false, status: "unknown",
         code: "path/revocation-undetermined",
         reason: sigRes.ok
@@ -1771,7 +1825,7 @@ async function _validate(path, opts, run, scope) {
     } else if (revocationChecker) {
       var issuerCert = idx > 0 ? certs[idx - 1] : null;
       var rv, rvError = null;
-      try { rv = await revocationChecker.check(cert, { workingIssuerName: state.workingIssuerName, workingPublicKey: state.workingPublicKey, workingPublicKeyAlgorithm: state.workingPublicKeyAlgorithm, issuerCert: issuerCert }, { time: opts.time, historicalMode: opts.historicalMode === true, run: run }); }
+      try { rv = await revocationChecker.check(cert, { workingIssuerName: state.workingIssuerName, workingPublicKey: state.workingPublicKey, workingPublicKeyAlgorithm: state.workingPublicKeyAlgorithm, issuerCert: issuerCert }, { time: opts.time, historicalMode: opts.historicalMode === true, run: run, distrustedKeys: distrusted }); }
       catch (e) { rv = { status: "error" }; rvError = e; }
       var rvStatus = (rv && typeof rv.status === "string") ? rv.status : "unknown";
       if (rv && rv.status === "good") { guard.list.append(checks, _revocationRow({ name: "revocation", ok: true, status: "good" }, rv)); }
@@ -1894,6 +1948,7 @@ async function _validate(path, opts, run, scope) {
   return guard.verdict.of({
     valid: !failed,
     identityChecked: identityChecked,
+    distrustedKeysApplied: distrusted !== null && distrusted.length > 0,
     revocationChecked: !revocationRan ? false
       : revocationUndetermined ? "undetermined"
         : revocationWaived ? "waived" : "determined",
@@ -2147,7 +2202,9 @@ function selectDelta(candidates) {
  * revocationDate.
  *
  * @opts
- *   useDeltas  boolean  merge delta CRLs onto their base (RFC 5280 sec. 6.3.1(b)).
+ *   useDeltas  boolean  merge delta CRLs onto their base (RFC 5280 sec. 6.3.1(b)). Default `true`;
+ *              a value other than `true`, `false`, `null` or an absent option is refused
+ *              `path/bad-input`.
  *                       Default true. When false a delta is never merged; it is
  *                       still consulted for revocation.
  *
@@ -2171,11 +2228,20 @@ function crlChecker(crls, opts) {
     return guard.parsed.acceptDerived(c, "crl", crl.parse, E, "path/bad-input",
       "crlChecker: crls[" + ci + "]");
   });
-  var useDeltas = !(opts && opts.useDeltas === false);
+  /** @internal The sec. 6.3.1(b) merge, read as the boolean it documents: the comparison this
+   * replaces answered for a value of any other type by merging deltas the caller turned off. */
+  var useDeltas = guard.identifier.booleanOptionDefaultOn(opts && opts.useDeltas, E,
+    "path/bad-input", "crlChecker: opts.useDeltas");
   return {
     check: async function (cert, issuer, ctx) {
       var time = ctx.time;
       var historical = ctx.historicalMode === true;
+      /** @internal Every CRL this checker takes is verified under the issuer's key, so a listed
+       * issuer key leaves no CRL that can answer. */
+      var distrusted = guard.distrust.keys(ctx.distrustedKeys, E, "path/bad-input", "crlChecker: ctx.distrustedKeys");
+      if (guard.distrust.has(distrusted, issuer.workingPublicKey)) {
+        return guard.verdict.of({ status: "unknown", reason: "the issuer's key is listed in distrustedKeys, so no CRL it signs is an answer" });
+      }
       var certIsCa = null, certScopeFault = null;
       try {
         var bc = decodeExt(cert, OID.basicConstraints);
@@ -2468,6 +2534,7 @@ function ocspChecker(responses) {
     check: async function (cert, issuer, ctx) {
       var time = ctx.time;
       var historical = ctx.historicalMode === true;
+      var distrusted = guard.distrust.keys(ctx.distrustedKeys, E, "path/bad-input", "ocspChecker: ctx.distrustedKeys");
       var issuerNameCandidates = [cert.issuer.bytes];
       function addNameCandidate(nm) {
         if (nm && nm.bytes && !guard.list.anyMatches(issuerNameCandidates, function (e) { return e.equals(nm.bytes); })) guard.list.append(issuerNameCandidates, nm.bytes);
@@ -2483,7 +2550,7 @@ function ocspChecker(responses) {
       var sawUnknownStatus = false;
 
       for (var k = 0; k < parsed.length; k++) {
-        var v = await ocspCore.evaluateResponse(parsed[k], cert, issuer, issuerKeyBits, issuerNameCandidates, time, historical);
+        var v = await ocspCore.evaluateResponse(parsed[k], cert, issuer, issuerKeyBits, issuerNameCandidates, time, historical, distrusted);
         if (v.revoked && !revokedResult) {
           revokedResult = guard.verdict.of({ status: "revoked", revocationReason: v.revoked.revocationReason, revocationTime: v.revoked.revocationTime, reason: v.revoked.reason });
         }
@@ -2531,6 +2598,11 @@ function ocspChecker(responses) {
  * `time` either way. `time` must be a valid `Date`. A malformed response's parse
  * fault surfaces as the parser's typed `ocsp/*` / `asn1/*` error.
  *
+ * `opts.distrustedKeys` lists SHA-256 SubjectPublicKeyInfo digests (see `pki.trust.spkiDigest`). A
+ * response signed by a listed key, whether the issuing CA's or a delegated responder's, has no
+ * authorized responder and is `"unknown"` with `responderAuthorized: false`. `pki.path.ocspChecker`
+ * and `pki.path.fetchingChecker` apply the list `pki.path.validate` was given.
+ *
  * `opts.requestNonce` is the nonce bytes the request carried. Given one, the response must echo it
  * (RFC 9654 sec. 2.1, RFC 6960 sec. 4.4.1), compared in constant time, and `nonceMatched` reports
  * the outcome: `true`, `false`, or `null` when no nonce was sent. An unechoed nonce takes a `good`
@@ -2566,7 +2638,7 @@ function ocspChecker(responses) {
  *   var v = await pki.path.verifyOcspResponse(der, cert, issuerCert, new Date());
  *   v.status;   // "good" | "revoked" | "unknown"
  */
-var _VERIFY_OCSP_OPTS = intrinsic.assign(intrinsic.create(null), { historicalMode: 1, requestNonce: 1 });
+var _VERIFY_OCSP_OPTS = intrinsic.assign(intrinsic.create(null), { distrustedKeys: 1, historicalMode: 1, requestNonce: 1 });
 
 async function verifyOcspResponse(response, cert, issuerCert, time, opts) {
   var parsedResponse, subject, issuer, checkedOpts;
@@ -2578,11 +2650,13 @@ async function verifyOcspResponse(response, cert, issuerCert, time, opts) {
     checkedOpts = guard.identifier.optionsObject(opts, E, "path/bad-input", "verifyOcspResponse: opts");
     guard.identifier.assertKnownKeys(checkedOpts, _VERIFY_OCSP_OPTS, E, "path/bad-input",
       "pki.path.verifyOcspResponse has an unknown option (the request nonce to bind against is `requestNonce`). The unknown option was: ");
+    var distrusted = guard.distrust.keys(checkedOpts.distrustedKeys, E, "path/bad-input", "verifyOcspResponse: opts.distrustedKeys");
     parsedResponse = _ocspFromBytes(response);
     subject = coerceCert(cert, "the certificate");
     issuer = coerceCert(issuerCert, "the issuer certificate");
   } catch (e) { return _reject(_Promise, e); }
-  var v = await _verifyOcspParsed(parsedResponse, subject, issuer, time, checkedOpts);
+  var v = await _verifyOcspParsed(parsedResponse, subject, issuer, time,
+    { historicalMode: checkedOpts.historicalMode, requestNonce: checkedOpts.requestNonce, distrustedKeys: distrusted });
   var out = guard.verdict.of(v);
   return guard.verdict.of(out, { valid: out.status === "good" });
 }
@@ -2641,7 +2715,7 @@ function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
     try { issuerKeyBits = ocspVerify.ocspKeyValue(issuerCert.subjectPublicKeyInfo.bytes); }
     catch (_e) { return unbound("the issuer public key could not be read to recompute the OCSP CertID"); }
     return intrinsic.chain(ocspCore.evaluateResponse(parsedResponse, cert, issuerCtx, issuerKeyBits,
-      issuerNameCandidates, time, opts.historicalMode === true), function (v) {
+      issuerNameCandidates, time, opts.historicalMode === true, opts.distrustedKeys || null), function (v) {
       if (v.revoked) return _withNonceRule(guard.verdict.of({ status: "revoked", responderAuthorized: true, signatureValid: true, matched: true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, revocationReason: v.revoked.revocationReason, revocationTime: v.revoked.revocationTime, reason: v.revoked.reason }), parsedResponse, wantNonce, nonce);
       if (v.sawGood) return _withNonceRule(guard.verdict.of({ status: "good", responderAuthorized: true, signatureValid: true, matched: true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, reason: "good" }), parsedResponse, wantNonce, nonce);
       return _withNonceRule(guard.verdict.of({ status: "unknown", responderAuthorized: v.responderAuthorized === true, signatureValid: v.signatureValid === true, matched: v.matched === true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, reason: v.reason }), parsedResponse, wantNonce, nonce);
@@ -2709,6 +2783,7 @@ function assertAnchorConstraints(ta, checkPurpose) {
 
 function resolvePurposeOpts(opts) {
   var requiredEku = null;
+  // allow:caller-option-presence-tested-against-undefined -- absence means no EKU is required, so a null must be refused rather than drop the restriction
   if (opts.requiredEku !== undefined) {
     if (!intrinsic.isArray(opts.requiredEku) || opts.requiredEku.length === 0) {
       throw E("path/bad-input", "validate: opts.requiredEku must be a non-empty array of key-purpose OID names or dotted OID strings");
@@ -2722,6 +2797,7 @@ function resolvePurposeOpts(opts) {
     });
   }
   var checkPurpose = null;
+  // allow:caller-option-presence-tested-against-undefined -- absence means no purpose is checked, so a null must be refused rather than drop the check
   if (opts.checkPurpose !== undefined) {
     if (typeof opts.checkPurpose !== "string" || opts.checkPurpose.length === 0) {
       throw E("path/bad-input", "validate: opts.checkPurpose must be a key-purpose OID name or dotted OID string");
@@ -3494,6 +3570,7 @@ async function _fetchAiaIssuers(current, aia) {
  * @opts  maxAiaPerCert          Cap on caIssuers URLs tried per certificate (default `C.LIMITS.PATH_AIA_MAX_PER_CERT`).
  * @opts  aiaTimeout             Per-fetch timeout in ms, forwarded to the transport.
  * @opts  maxResponseBytes       Per-fetch response size cap, forwarded to the transport (tightenable downward only).
+ * @opts  distrustedKeys         SHA-256 SubjectPublicKeyInfo digests refused on every path `validate` is handed (see `pki.path.validate`). It is read once at this door, refused with `path/bad-input` when malformed even if no path assembles, and refused alongside `validate: false`. A path through a distrusted intermediate or anchor fails, so the search backtracks to another, such as a cross-certificate to a different root.
  * @opts  (validate options)     Every `pki.path.validate` option (`requiredEku`, `revocationChecker`, `checkPurpose`, the initial policy inputs, ...) is forwarded unchanged. `requireRevocation` and the three policy inputs are typed at this door as well as at `validate`'s, because a build reaches an AIA fetch before it reaches `validate` and a build that assembles no path never calls it. When `userInitialPolicySet` is supplied, build returns the accepted path whose user-constrained policy set best satisfies it (RFC 4158 sec. 4 forward policy chaining) rather than the first accepted path; `validate` still gates every path, so this changes only which valid path is chosen. The ranking explores more of the candidate graph than a first-accept build, so it is bounded by `maxCandidatesConsidered` like the rest of the search. Reaching that cap means stop looking, not nothing found: if a valid path was already accepted, build returns the best-policy one of those; it reaches `path/build-limit` only when the cap is hit before any valid path is accepted. An `anyPolicy` entry makes the set unconstrained, so ranking is skipped and the first accepted path is returned.
  * @example
  *   var pair = await pki.key.generate("Ed25519");
@@ -3518,6 +3595,21 @@ var _BUILD_OPTS = (function () {
   return o;
 })();
 
+/** @internal The TLS policy for the AIA host, checked and copied at the build door. An AIA fetch fault
+ *  is a silent skip, so a misspelled key or a malformed distrust list that reached the transport
+ *  would only ever show as an intermediate that was not fetched. */
+function _aiaTls(tls) {
+  if (tls == null) return intrinsic.create(null);
+  guard.identifier.assertKnownKeys(tls, httpTransport.TLS_KEYS, E, "path/bad-input", "build: opts.tls has an unknown option ");
+  /** @internal Each setting the transport reads is taken by value, inherited or own, as the transport
+   *  reads the bag. */
+  var copy = guard.identifier.pickSettings(tls, intrinsic.keys(httpTransport.TLS_KEYS));
+  if (copy.distrustedKeys != null) {
+    copy.distrustedKeys = guard.distrust.keys(copy.distrustedKeys, E, "path/bad-input", "build: opts.tls.distrustedKeys");
+  }
+  return copy;
+}
+
 async function build(leaf, opts) {
   opts = guard.identifier.optionsObject(opts, E, "path/bad-input", "build: opts");
   guard.identifier.assertKnownKeys(opts, _BUILD_OPTS, E, "path/bad-input",
@@ -3560,11 +3652,19 @@ async function build(leaf, opts) {
       }
     });
   }
+  /** @internal Typed and copied at this door for the reason the switches are: a build that
+   * assembles no path never reaches `validate`, and every path it does assemble is validated after
+   * an await. Every `validate` call is handed this copy. */
+  var buildDistrusted = guard.distrust.keys(opts.distrustedKeys, E, "path/bad-input", "build: opts.distrustedKeys");
+  if (!doValidateOpt && buildDistrusted !== null && buildDistrusted.length > 0) {
+    throw E("path/bad-input", "build: opts.distrustedKeys refuses keys during validation, and opts.validate is false, " +
+      "which returns the ordered path without validating; drop one of the two");
+  }
   var leafCert;
   try { leafCert = coerceCert(leaf); }
   catch (e) { throw E("path/bad-input", "build: the leaf certificate did not parse", e); }
 
-  var poolInput = opts.candidates !== undefined ? opts.candidates : opts.intermediates;
+  var poolInput = opts.candidates != null ? opts.candidates : opts.intermediates;
   if (poolInput === undefined) poolInput = [];
   if (!intrinsic.isArray(poolInput)) throw E("path/bad-input", "build: opts.candidates must be an array of certificates");
   var poolCeiling = constants.LIMITS.PATH_BUILD_MAX_CANDIDATES;
@@ -3599,7 +3699,7 @@ async function build(leaf, opts) {
   var maxConsidered = guard.limits.cap(opts.maxCandidatesConsidered, "build: opts.maxCandidatesConsidered", poolCeiling, { E: E, code: "path/bad-input", min: 1 });
   var doValidate = doValidateOpt;
 
-  var direction = opts.direction !== undefined ? opts.direction : "forward";
+  var direction = opts.direction != null ? opts.direction : "forward";
   if (direction !== "forward" && direction !== "reverse" && direction !== "auto") {
     throw E("path/bad-input", "build: opts.direction must be \"forward\", \"reverse\", or \"auto\", got " + guard.text.showValue(opts.direction));
   }
@@ -3608,7 +3708,7 @@ async function build(leaf, opts) {
 
   var aiaCtx = null;
   if (opts.fetchAia === true) {
-    if (opts.aiaTimeout !== undefined) {
+    if (opts.aiaTimeout != null) {
       guard.limits.cap(opts.aiaTimeout, "build: opts.aiaTimeout", 1, { E: E, code: "path/bad-input", min: 1, max: httpTransport.MAX_TIMEOUT });
     }
     var aiaTransport = checkedTransport || httpTransport.https({ E: E, errPrefix: "path" });
@@ -3620,7 +3720,7 @@ async function build(leaf, opts) {
        * hostname taken from a certificate would be opened on that promise.
        * @guard-via guard.identifier.declaresOwn */
       transportGuardsAddresses: guard.identifier.declaresOwn(aiaTransport, "blocksPrivateAddresses"),
-      tls: opts.tls != null ? opts.tls : intrinsic.create(null),
+      tls: _aiaTls(opts.tls),
       timeout: opts.aiaTimeout,
       maxResponseBytes: guard.limits.cap(opts.maxResponseBytes, "build: opts.maxResponseBytes", constants.LIMITS.PATH_AIA_MAX_RESPONSE_BYTES, { E: E, code: "path/bad-input", min: 1, max: constants.LIMITS.PATH_AIA_MAX_RESPONSE_BYTES }),
       maxPerCert: guard.limits.cap(opts.maxAiaPerCert, "build: opts.maxAiaPerCert", constants.LIMITS.PATH_AIA_MAX_PER_CERT, { E: E, code: "path/bad-input", min: 0 }),
@@ -3640,7 +3740,7 @@ async function build(leaf, opts) {
    * @guard-via guard.identifier.snapshotPresentOptions */
   var FORWARD_BY_VALUE = intrinsic.create(null);
   intrinsic.forEach(intrinsic.keys(_VALIDATE_OPTS), function (k) {
-    if (intrinsic.hasOwn(BUILD_ONLY_OPT, k) || intrinsic.hasOwn(forwardedSwitches, k)) return;
+    if (intrinsic.hasOwn(BUILD_ONLY_OPT, k) || intrinsic.hasOwn(forwardedSwitches, k) || k === "distrustedKeys") return;
     FORWARD_BY_VALUE[k] = 1;
   });
   var forwarded = guard.identifier.snapshotPresentOptions(opts, FORWARD_BY_VALUE);
@@ -3654,6 +3754,7 @@ async function build(leaf, opts) {
   });
   if (buildPermRaw != null) forwarded.initialPermittedSubtrees = buildPermSeeds;
   if (buildExclRaw != null) forwarded.initialExcludedSubtrees = buildExclSeeds;
+  if (buildDistrusted !== null) forwarded.distrustedKeys = buildDistrusted;
   function validateOpts(anchor) {
     var vo = Object.create(null);
     intrinsic.forEach(intrinsic.keys(forwarded), function (f) { vo[f] = forwarded[f]; });

package/lib/pkcs12-build.js

@@ -532,7 +532,7 @@ function _normalizeSpec(spec, opts, form) {
  * @opts
  *   - `password` -- the shared privacy + integrity password (string / Buffer / Uint8Array).
  *   - `mac` -- `false` for a MAC-less store, or `{ algorithm: 'hmac'(default)|'pbmac1', hash: 'sha256'(default)|'sha1'|'sha384'|'sha512', salt?, iterations?, password? }`. `password` overrides the shared integrity password for the MAC. `keyLength` is a `pbmac1` field: the classic Appendix B derivation produces a key at the hash's own output length, and naming one under `hmac` is refused.
- *   - `integrity` -- `{ mode: 'public-key', signer: { cert, key, digestAlgorithm?, pss? } | signers: [ ... ], sid?, signingTime?, certificates? }` for public-key integrity (a CMS SignedData authSafe over any `pki.cms.sign` signer algorithm, no MacData). Combining it with a truthy `mac` is rejected.
+ *   - `integrity` -- `{ mode: 'public-key', signer: { cert, key, digestAlgorithm?, pss? } | signers: [ ... ], sid?, signingTime?, certificates? }` for public-key integrity (a CMS SignedData authSafe over any `pki.cms.sign` signer algorithm, no MacData). Combining it with a truthy `mac` is rejected. `certificates` embeds the signer certificates in the authSafe, default true; a value other than `true`, `false`, `null` or an absent option is refused `pkcs12/bad-input`.
  *   - `recipientCerts` -- (public-key privacy convenience) `[certDer|PEM, ...]`; the convenience-form cert + key are placed in one recipient-enveloped safe (a plaintext keyBag). For the full form, set per-`safeContents` `recipients: [{ cert }, ...]` -- CERTIFICATE recipients only (RSA-OAEP / ECDH / X25519 / X448 / ML-KEM, dispatched off the cert key); a password or KEK recipient is not public-key privacy and is rejected -- with an optional `contentEncryptionAlgorithm` (`aes-128|192|256-cbc`, default 256; GCM/AEAD rejected). `encrypt` (password) and `recipients` (public-key) on the same safe is rejected; privacy is independent of integrity.
  *   - `pem` (boolean) -- return a PEM `PKCS12` string instead of DER.
  * @example
@@ -572,6 +572,11 @@ async function _build(spec, opts) {
   if (opts.integrity != null) {
     if (typeof opts.integrity !== "object" || Array.isArray(opts.integrity)) throw _err("pkcs12/bad-input", "opts.integrity must be an object { mode, signer|signers, ... }");
     guard.identifier.assertKnownKeys(opts.integrity, _INTEGRITY_OPTS, _err, "pkcs12/bad-input", "opts.integrity has an unknown option ");
+    /** @internal Forwarded to `pki.cms.sign` below by comparing it to `false`, which answered for a
+     *  value of any other type by embedding the signer certificates the caller asked to leave out
+     *  of the authSafe. */
+    guard.identifier.booleanOptionDefaultOn(opts.integrity.certificates, _err, "pkcs12/bad-input",
+      "opts.integrity.certificates");
     if (opts.integrity.mode !== "public-key") {
       throw _err("pkcs12/bad-integrity-mode", "opts.integrity.mode must be \"public-key\" (the only mode it selects); omit opts.integrity for password integrity, got " + guard.text.showValue(opts.integrity.mode));
     }