@blamejs/pki 0.9.5 → 0.9.7

package/lib/cms-digest.js

@@ -51,7 +51,7 @@ var _DIGEST_OPTS = intrinsic.assign(intrinsic.create(null), {
 var _VERIFY_DIGEST_OPTS = intrinsic.assign(intrinsic.create(null), { content: 1 });
 
 function _digestName(opts) {
-  var name = opts.digestAlgorithm === undefined ? "sha256" : opts.digestAlgorithm;
+  var name = opts.digestAlgorithm == null ? "sha256" : opts.digestAlgorithm;
   var key = guard.text.keyOf(name);
   if (!NODE_DIGEST[key]) {
     throw _err("cms/unsupported-algorithm", "unsupported digest algorithm " + guard.text.showValue(name) +
@@ -101,7 +101,7 @@ async function _digest(content, opts) {
     "pki.cms.digest opts.detached");
   var raw = guard.bytes.source(content, CmsError, "cms/bad-input", "content");
   var alg = _digestName(opts);
-  var ctName = opts.contentType === undefined ? "data" : opts.contentType;
+  var ctName = opts.contentType == null ? "data" : opts.contentType;
   var ctOid = O(ctName);
   if (!ctOid) throw _err("cms/bad-input", "opts.contentType is not a known OID name: " + guard.text.showValue(ctName));
 
@@ -169,7 +169,7 @@ async function _verifyDigest(input, opts) {
   guard.der.assertParams(parsed.digestAlgorithm.parameters, "absentOrNull", _err,
     "cms/unsupported-algorithm", parsed.digestAlgorithm.name + " digest algorithm (RFC 5754 sec. 2)");
   var embedded = parsed.encapContentInfo.eContent;
-  var supplied = opts.content === undefined ? null
+  var supplied = opts.content == null ? null
     : guard.bytes.snapshotSource(opts.content, CmsError, "cms/bad-input", "opts.content");
   if (embedded != null && supplied != null) {
     throw _err("cms/bad-input", "the DigestedData carries its own content, so opts.content is redundant");

package/lib/cms-verify.js

@@ -761,6 +761,7 @@ async function _verifyOneTimestamp(attr, targetSig, claimedSigningTime, opts) {
       trustAnchors: opts.timestampTrustAnchors,
       revocationChecker: opts.timestampRevocationChecker,
       allowWeakDigests: opts.allowWeakDigests === true,
+      distrustedKeys: opts.distrustedKeys,
     });
   } catch (e) {
     return guard.verdict.of({ valid: false, trusted: false, genTime: null,
@@ -975,6 +976,10 @@ async function _verifyOneCountersig(vDer, targetSig, parsedCerts, allowWeakDiges
  *                 trust decision from the signer: an operator may anchor one and not the other.
  * @opts  timestampRevocationChecker  A revocation checker for the TSA chain, as `pki.path.validate`
  *                 takes one. Each row reports what it established in `revocationChecked`.
+ * @opts  distrustedKeys  SHA-256 digests of SubjectPublicKeyInfo DER (64 hexadecimal characters or
+ *                 32 bytes each, see `pki.trust.spkiDigest`), applied to the signer chain and to the
+ *                 TSA chain of every timestamp row. A listed key on a chain, the anchor included,
+ *                 reports that signer or that row as not trusted.
  * @opts  requireAlgorithmProtection  Fail a signer that carries no RFC 6211
  *                 `CMSAlgorithmProtection` attribute, with `cms/missing-algorithm-protection`. Off
  *                 by default: RFC 6211 says nothing about absence and RFC 8933 sec. 4.1 makes
@@ -1026,7 +1031,7 @@ var _VERIFY_OPTS = intrinsic.assign(intrinsic.create(null), { certs: 1, content:
    *  leaving the signer unanchored, or the reverse, and one `trustAnchors` for both would make those
    *  two answers one. */
   timestampCerts: 1, timestampTrustAnchors: 1, timestampRevocationChecker: 1,
-  requireAlgorithmProtection: 1 });
+  requireAlgorithmProtection: 1, distrustedKeys: 1 });
 
 function verify(input, opts) {
   return guard.async.deferred(function () { return _verify(input, opts); });
@@ -1043,12 +1048,15 @@ async function _verify(input, opts) {
   var allowWeakDigests = opts.allowWeakDigests === true;
   var requireProtection = guard.identifier.booleanOption(opts.requireAlgorithmProtection, _err,
     "cms/bad-input", "pki.cms.verify opts.requireAlgorithmProtection");
+  /** @internal Typed here, before any signer is judged: the signer chain is built only for a signer
+   *  that verified, and every throw from a timestamp verify becomes a row. One list serves both. */
+  var distrustedKeys = guard.distrust.keys(opts.distrustedKeys, _err, "cms/bad-input", "pki.cms.verify opts.distrustedKeys");
   var parsed = guard.parsed.acceptDerived(input, "cms", function (bytes) {
     return cms.parse(_snapshotIfBytes(bytes, "pki.cms.verify"));
   }, _err, "cms/bad-input", "the SignedData");
   if (!Array.isArray(parsed.signerInfos)) throw _err("cms/bad-input", "input is not a CMS SignedData");
-  var trustCfg = _snapshotTrust(opts);
-  var tsTrustCfg = _snapshotTimestampTrust(opts, allowWeakDigests);
+  var trustCfg = _snapshotTrust(opts, distrustedKeys);
+  var tsTrustCfg = _snapshotTimestampTrust(opts, allowWeakDigests, distrustedKeys);
   var parsedCerts = [];
   (parsed.certificates || []).forEach(function (c) { _addCert(parsedCerts, c && c.bytes ? c.bytes : c); });
   (opts.certs || []).forEach(function (c) { _addCert(parsedCerts, c); });
@@ -1130,7 +1138,7 @@ function _cloneAnchorValue(v, depth) {
   }
   return out;
 }
-function _snapshotTrust(opts) {
+function _snapshotTrust(opts, distrustedKeys) {
   var raw = opts.trustAnchors;
   var anchors = null;
   if (raw != null) {
@@ -1140,9 +1148,10 @@ function _snapshotTrust(opts) {
   }
   return {
     trustAnchors: anchors,
-    time: guard.time.isDate(opts.time) ? new intrinsic.Date(guard.time.instantOf(opts.time)) : (opts.time === undefined ? new intrinsic.Date() : opts.time),
+    time: guard.time.isDate(opts.time) ? new intrinsic.Date(guard.time.instantOf(opts.time)) : (opts.time == null ? new intrinsic.Date() : opts.time),
     requiredEku: Array.isArray(opts.requiredEku) ? guard.list.snapshot(opts.requiredEku) : opts.requiredEku,
     checkPurpose: opts.checkPurpose,
+    distrustedKeys: distrustedKeys,
   };
 }
 
@@ -1153,7 +1162,7 @@ function _snapshotTrust(opts) {
  *  authorities. The certificates are copied by value, since a caller holding the array could swap an
  *  entry after the row that read it. The checker is a function and is captured as the one reference
  *  every row calls. */
-function _snapshotTimestampTrust(opts, allowWeakDigests) {
+function _snapshotTimestampTrust(opts, allowWeakDigests, distrustedKeys) {
   var certs = opts.timestampCerts;
   var anchors = opts.timestampTrustAnchors;
   return {
@@ -1167,6 +1176,7 @@ function _snapshotTimestampTrust(opts, allowWeakDigests) {
       }),
     timestampRevocationChecker: opts.timestampRevocationChecker,
     allowWeakDigests: allowWeakDigests,
+    distrustedKeys: distrustedKeys,
   };
 }
 
@@ -1200,7 +1210,7 @@ async function _applyTrust(res, parsedCerts, cfg) {
   if (!anchors.length) {
     throw _err("cms/bad-input", "opts.trustAnchors is empty -- name at least one root, or omit it to state that the signer is not being anchored");
   }
-  if (cfg.time !== undefined) guard.time.assertValid(cfg.time, _err, "cms/bad-input", "opts.time");
+  if (cfg.time != null) guard.time.assertValid(cfg.time, _err, "cms/bad-input", "opts.time");
   var purposes = _engine.resolvePurposeOpts({ requiredEku: cfg.requiredEku, checkPurpose: cfg.checkPurpose });
   intrinsic.forEach(anchors, function (a) {
     _engine.toAnchor(a);
@@ -1210,7 +1220,7 @@ async function _applyTrust(res, parsedCerts, cfg) {
     var s = res.signers[_si];
     {
       if (s.ok !== true || !s.cert) { s.trusted = false; continue; }
-      var buildOpts = { trustAnchors: anchors, intermediates: pool, validate: true, time: at };
+      var buildOpts = { trustAnchors: anchors, intermediates: pool, validate: true, time: at, distrustedKeys: cfg.distrustedKeys };
       if (cfg.requiredEku != null) buildOpts.requiredEku = cfg.requiredEku;
       if (cfg.checkPurpose != null) buildOpts.checkPurpose = cfg.checkPurpose;
       if (!_keyUsagePermitsSigning(parsedCerts, s.cert)) { s.trusted = false; continue; }

package/lib/compromised-keys.js

@@ -0,0 +1,114 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+// @internal
+
+/** @internal The keys every verifier in this toolkit refuses: certificate keys whose private key is
+ *  public, whether published or derivable from the public key. Each entry is the SHA-256 digest of
+ *  the key's SubjectPublicKeyInfo in canonical form (the value `pki.trust.spkiDigest` returns), the
+ *  subject common name of a certificate that carries it (the product's CA name for a key published
+ *  without a certificate), why the private key is public, and where that is recorded. An entry is added only when its private key has been recovered or obtained and
+ *  checked against the public key. `pki.trust.knownCompromisedKeys()` returns a copy. */
+var _freeze = require("./guard-intrinsic").freeze;
+
+function _entry(digest, name, reason, sources) {
+  return _freeze({ spkiSha256: digest, name: name, reason: reason, sources: _freeze(sources) });
+}
+
+var EMUDHRA_SOURCES = [
+  "https://bugzilla.mozilla.org/show_bug.cgi?id=2083449",
+  "https://blog.cloudflare.com/emudhra-certificate-compromise/",
+];
+var EMUDHRA_REASON = "the P-384 private key is an integer below 256, which anyone can recover from the public " +
+  "key by trying each candidate; eMudhra and Sectigo both issued CA certificates for the key";
+function _emudhra(digest, name) { return _entry(digest, name, EMUDHRA_REASON, EMUDHRA_SOURCES); }
+
+var KOMODIA_SOURCES = [
+  "https://gist.github.com/Wack0/17c56b77a90073be81d3",
+  "https://www.kb.cert.org/vuls/id/529496",
+  "https://github.com/hannob/superfishy/tree/afbad9c2635bfd5c4bfa2630c27263f59efecd86/certificates",
+];
+function _komodia(digest, name, product) {
+  return _entry(digest, name, product + " uses the Komodia interception library and installs this root with one " +
+    "private key built into the software; the key was published in February 2015", KOMODIA_SOURCES);
+}
+
+var ADGUARD_SOURCES = [
+  "https://blog.hboeck.de/archives/874-More-TLS-Man-in-the-Middle-failures-Adguard,-Privdog-again-and-ProtocolFilters.dll.html",
+  "https://github.com/hannob/superfishy/tree/afbad9c2635bfd5c4bfa2630c27263f59efecd86/certificates",
+];
+function _adguard(digest, n) {
+  return _entry(digest, n === 3 ? "Adguard CA R73" : "Adguard CA", "Adguard ships ten CA private keys in ProtocolFilters.dll and certifies one of " +
+    "them as its root on each installation; this is key " + n + " of the ten, and all ten were published in 2015", ADGUARD_SOURCES);
+}
+
+var DELL_SOURCES = [
+  "https://blog.hboeck.de/archives/876-Superfish-2.0-Dangerous-Certificate-on-Dell-Laptops-breaks-encrypted-HTTPS-Connections.html",
+  "https://bugzilla.mozilla.org/show_bug.cgi?id=1227258",
+];
+
+var KEYS = _freeze([
+  _emudhra("ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105", "EM DV TLS CA - G3B"),
+  _emudhra("43bffa19d6ef651451f6841e019931e96f6f2eaeff28ab4b6f1ce4576de2717b", "EM OV TLS CA - G3B"),
+  _emudhra("e0254c7fcdc265e2f0f8a428dabb75ab4ae039b4872d62f5ee57f0877d5a8a41", "EM EV TLS CA - G3B"),
+  _emudhra("49dd353dc2b919a3770645117d0e60c16115e7d1bc259eefe734b00ea434fe5f", "EM DV TLS CA - G3C"),
+  _emudhra("63ecefee431d49523bc1136c4e72d0206a477086caf606cd5cf025686c109cf8", "EM OV TLS CA - G3C"),
+  _emudhra("5c0660a2b164910d8ff589c18e14552e9e0ec237dcefe2cb736d41a4811f81a0", "EM EV TLS CA - G3C"),
+  _emudhra("ec4ffa1ad0ac88081314b7aaffef6a91f97cd57291bb5ba686c5415f5eb4f6b6", "EM OV CS CA - G3B"),
+  _emudhra("92c063d67e8f14db71d288e11266ffdaf69cbf115f7bab14f3bc2f68d25e0e30", "EM OV CS CA - G3C"),
+
+  _entry("4bb8f35ba1e126f8dde1b0c420625ed86dce61a7bddadbdea9aba578ff13145e", "Superfish, Inc.",
+    "Superfish Visual Discovery, preinstalled on Lenovo consumer laptops, installs this root with one private key " +
+    "built into the software; the key and its password were published in February 2015", [
+      "https://blog.erratasec.com/2015/02/extracting-superfish-certificate.html",
+      "https://www.kb.cert.org/vuls/id/529496",
+      "https://github.com/hannob/superfishy/tree/afbad9c2635bfd5c4bfa2630c27263f59efecd86/certificates",
+    ]),
+  _komodia("2698846608c82e14834b0a99da116097801ae712b1637897c8d305ee1f29b9ce", "KeepMyFamilySecure", "Keep My Family Secure"),
+  _komodia("c35169fdc7781d149081f60d6e81f259bd504ce19b53a0370d1dbabecb195437", "Qustodio", "Qustodio for Windows"),
+  _komodia("0ab38aff3afae30102ee3713bade6b83c9d27cd78045a9a0372b92031274b48b", "Qustodio CA", "Qustodio for macOS"),
+  _komodia("338124a8fdeef46002656293c677a0f73c69b664f847915d20fd6431851df423", "Kurupira.NET", "Kurupira WebFilter"),
+  _komodia("eb6aaaedf0a08c2e20a07f5d97125ba66c97f52994f1791462791f4f98af6baa", "AtomPark Software Inc", "StaffCop"),
+  _komodia("163b33dd8ee4f658fbbd681cef3abb091d890b39f0fc78289a1d1f7b8d39000f", "EasyTech", "Easy Hide IP Classic"),
+  _komodia("aabf9d9003d73799f3c6cc1577ab2b109dbcbf6371eef1e633b9e36bea563db0", "Lavasoft Limited", "Ad-Aware Web Companion"),
+  _komodia("5305c2c7f001e9c18269be5d914bc0c767e953d5f8540f2f0db27244c010ff37", "Sendori, Inc", "Sendori and PureLeads"),
+  _komodia("6a743e1ff94f445184971182955d919232085a0276e5c6dd9dfff22b367cb7e5", "InfoWeise", "SecureTeen"),
+  _komodia("30f397f1523cdd1c1511144ea2c37638ba779b8c49c30d08f682f878bc0c8cbf", "ImpresX OU", "DiscountCow"),
+  _komodia("86d8efafc3ede0edaa22a99ea8bd78e0decbae6585da94b438a2af1632e52a83", "Objectify Media Inc", "WebProtect"),
+  _komodia("37f8ccfa97ee243ff7ba4e799899bd6524355ee72a0ec9d90ae7cefb81409174", "Covenant Eyes", "Covenant Eyes"),
+
+  _entry("10900ceb22cbcef9e431f6801225df3755f7a75eae0e22f164cae1cbbc81424c", "PrivDog Secure Connection Inspector CA",
+    "PrivDog installs this root with the same private key on every installation; the key was published in 2015", [
+      "https://blog.hboeck.de/archives/874-More-TLS-Man-in-the-Middle-failures-Adguard,-Privdog-again-and-ProtocolFilters.dll.html",
+      "https://github.com/hannob/superfishy/tree/afbad9c2635bfd5c4bfa2630c27263f59efecd86/certificates",
+    ]),
+  _adguard("f2971080d115de5d766fcf121561a591b20aa053846dc5a45f201080016c69db", 0),
+  _adguard("ddeb6f867663dc1e2d298f4abfad1f5e79a5021a2f8930c28e20b45b4bd1ccb1", 1),
+  _adguard("acbfc3190dd8588904410d746ba9f1f26727ea722718c3ffd5999f924d50cecf", 2),
+  _adguard("ade08a07590eabeac543e87b992d23f11022023d8ecd29c46a16e4082a0e7d96", 3),
+  _adguard("bf10a7a8ecacac2f33f65b255eda3f64633557683b604324cfe04ef0cdfe3e5e", 4),
+  _adguard("3bf92d4350bab7f85c7eb94c625d7e4101c3750b1f7ea0ccb2107db542486f78", 5),
+  _adguard("14b8d90aa31112c29773362edae7b4815f3af4329fa7780d5fc96eba6c78a0e7", 6),
+  _adguard("1fd5924ce5b7565b752a6ce8edfe783e04a9bae76fa60da744ca673b0991f528", 7),
+  _adguard("1732ba84e3ec722470e3a5166f04825db6e66c6b85ec2648aedbefbef4ed9d81", 8),
+  _adguard("cc9ce8160876312f0b510ab58ebd6782675bf595e8d14e1ffe6ce81efa27b3ea", 9),
+
+  _entry("cdee9f3305572a677e1a6c82dc1e02a35b11cae6a684338c9f37fe1ac8daec23", "eDellRoot",
+    "Dell installed this root with its private key on Dell computers in 2015; the key was extracted and published", DELL_SOURCES),
+  _entry("130ad4e0633521290531b6651f5759b0bc7bc656709ff8f365c2143b0389b6f6", "DSDTestProvider",
+    "Dell System Detect installs this root with its private key; the key was extracted and published in 2015", DELL_SOURCES),
+  _entry("8ebf425f93b2c7ef59edb0fa840aae95f689503fa2e38a447a0d87975ea0ff75", "bealocalhost.de",
+    "the German Federal Bar told lawyers to trust this root in December 2017, and its private key shipped inside the " +
+    "beA Client Security software", [
+      "https://www.feistyduck.com/newsletter/issue_36_private_keys_in_software",
+      "https://dserver.bundestag.de/btd/19/008/1900898.pdf",
+    ]),
+  _entry("b72c2308eb6129308900bd53995fdb6025aa72c30e43f3527254b3ec87c236db", "DO NOT TRUST - AMI Test PK",
+    "the AMI test UEFI Secure Boot platform key (PKfail, CVE-2024-8105); its private key was committed to a public " +
+    "repository with its password, and the certificate shipped in production firmware", [
+      "https://github.com/binarly-io/Vulnerability-REsearch/blob/main/PKfail/BRLY-2024-005.md",
+      "https://www.cve.org/CVERecord?id=CVE-2024-8105",
+    ]),
+]);
+
+module.exports = _freeze({ KEYS: KEYS });

package/lib/constants.js

@@ -165,6 +165,7 @@ var LIMITS = Object.assign(Object.create(null), {
   MERKLE_MAX_PROOF_NODES: 65,
   MERKLE_MAX_LEAVES: 1048576,
   PROXY_MAX_TLS_ANCHORS: 256,
+  DISTRUSTED_KEYS_MAX: 4096,
   PATH_MAX_CERTS: 100,
   PATH_MAX_POLICY_NODES: 4096,
   PATH_BUILD_MAX_DEPTH: 20,

package/lib/crl-sign.js

@@ -770,16 +770,16 @@ function isRevoked(crl, serialNumber, opts) {
     return "pki.crl.isRevoked has an unknown option " + JSON.stringify(k) +
       "; it takes `time` and `historicalMode`";
   });
-  if (o.historicalMode !== undefined && o.time === undefined) {
+  if (o.historicalMode != null && o.time == null) {
     throw _err("crl/bad-input", "pki.crl.isRevoked opts.historicalMode says how to read an entry " +
       "against the instant asked about, so it needs opts.time as well");
   }
-  if (o.historicalMode !== undefined && typeof o.historicalMode !== "boolean") {
+  if (o.historicalMode != null && typeof o.historicalMode !== "boolean") {
     throw _err("crl/bad-input", "pki.crl.isRevoked opts.historicalMode must be a boolean");
   }
   var parsed = _coerceCrl(crl);
   var hex = _serialHexOf(serialNumber);
-  if (o.time !== undefined) {
+  if (o.time != null) {
     guard.time.assertValid(o.time, _err, "crl/bad-input", "pki.crl.isRevoked opts.time");
     var at = guard.time.instantOf(o.time);
     if (at < guard.time.instantOf(parsed.thisUpdate)) {

package/lib/crmf-sign.js

@@ -1177,6 +1177,7 @@ function _buildCertReqMsg(spec, key, opts) {
 
   var signingKey = (key && typeof key === "object" && !_isBuffer(key) && !(key instanceof Uint8Array) && key.type == null && "key" in key) ? key.key : key;
   var template = _encodeCertTemplate(spec.certTemplate);
+  if (template.spki !== null) guard.distrust.refuseCompromised(template.spki, _err, "crmf/compromised-key", "certTemplate.publicKey");
   var certReqChildren = [b.integer(_certReqId(spec.certReqId)), template.der];
   var encodedControls = [];
   if (spec.controls != null) guard.list.append(certReqChildren, _buildAttrTypeAndValues(spec.controls, "crmf/bad-controls", "controls", CONTROL_VALUE, encodedControls));
@@ -1203,6 +1204,7 @@ function _buildCertReqMsg(spec, key, opts) {
      *  second walk over the same bytes, and read back through the one statement reader. */
     possessionSpki = _encodedPossessionSpki(encodedControls);
   }
+  if (possessionSpki !== null) guard.distrust.refuseCompromised(possessionSpki, _err, "crmf/compromised-key", "the key of the statementOfPossession certificate");
 
   var popoP = _promiseResolve(_Promise,
     _buildProofOfPossession(spec.pop, certReqDer, template, signingKey, opts, possessionSpki));

package/lib/csr-sign.js

@@ -114,7 +114,7 @@ function _possessionStatement(spec) {
       "privateKeyPossessionStatement needs the certificate: this verb resolves the signature algorithm from its key and checks the signature against it. Pass includeCertificate: false to leave it off the wire, which RFC 9883 sec. 3 allows");
   }
   var certDer = _b.reqDer(spec.certificate, "privateKeyPossessionStatement certificate");
-  var include = spec.includeCertificate === undefined ? true : spec.includeCertificate;
+  var include = spec.includeCertificate == null ? true : spec.includeCertificate;
   if (include !== true && include !== false) {
     throw _err("csr/bad-input", "privateKeyPossessionStatement includeCertificate is a flag, so it is true, false or omitted");
   }
@@ -188,6 +188,8 @@ function _relatedCertRequest(spec) {
  *
  * Before the key is used, the request the spec describes is linted against the RFC 2986 profile and
  * refused with `csr/profile-violation` if any rule grades it `error`, naming the rule and its clause.
+ * A `subjectPublicKey`, or the key of a possession statement's certificate, whose private key is
+ * public (see `pki.trust.knownCompromisedKeys`) is refused with `csr/compromised-key`.
  *
  * @opts
  *   - `pem` (boolean) -- return a PEM `CERTIFICATE REQUEST` string instead of DER.
@@ -225,6 +227,7 @@ function _sign(spec, key, opts) {
 
   var subjectSpki = _b.reqDer(spec.subjectPublicKey, "spec.subjectPublicKey (the SPKI DER of the requested key)");
   _b.assertValidSpki(subjectSpki, "spec.subjectPublicKey");
+  guard.distrust.refuseCompromised(subjectSpki, _err, "csr/compromised-key", "spec.subjectPublicKey");
   var subjectDer = _b.encodeName(spec.subject == null ? [] : spec.subject);
 
   var attrs = [], seenAttr = Object.create(null);
@@ -245,6 +248,7 @@ function _sign(spec, key, opts) {
     var statement = _possessionStatement(spec.privateKeyPossessionStatement);
     addAttr(O("statementOfPossession"), b.raw(statement.der));
     possessionCertSpki = x509Schema.parse(statement.certificate).subjectPublicKeyInfo.bytes;
+    guard.distrust.refuseCompromised(possessionCertSpki, _err, "csr/compromised-key", "the key of the possession statement's certificate");
   }
   if (spec.attributes != null) {
     if (!Array.isArray(spec.attributes)) throw _err("csr/bad-input", "spec.attributes must be an array of pre-encoded Attribute DER");

package/lib/ct.js

@@ -1216,6 +1216,9 @@ function _trustValue(v, field) {
   return v;
 }
 
+/** @internal The settings `_tlsForFetch` reads. A setting not on the list is refused at the door. */
+var _TLS_KNOWN = intrinsic.freeze(guard.identifier.pickSettings(null, ["anchors", "useSystemStore", "cert", "key",
+  "minVersion", "servername", "checkServerIdentity", "distrustedKeys"]));
 function _tlsForFetch(opts) {
   /** @internal A record with NO prototype where the caller supplied no TLS at all, because the empty
    *  object a literal gives inherits from `Object.prototype` and every field below is then answerable
@@ -1232,9 +1235,12 @@ function _tlsForFetch(opts) {
   anchors = intrinsic.isArray(anchors)
     ? guard.list.copyMap(anchors, function (a, i) { return _trustValue(a, "opts.tls.anchors[" + i + "]"); })
     : _trustValue(anchors, "opts.tls.anchors");
+  /** @internal The distrust list is typed into a frozen copy. `guard.distrust.keys` reads each entry
+   *  through its descriptor and refuses an accessor, a hole and a Proxy, so no caller code runs. */
+  var distrustedKeys = guard.distrust.keys(t.distrustedKeys, _ctErr, "ct/bad-input", "opts.tls.distrustedKeys");
   return { anchors: anchors, useSystemStore: t.useSystemStore, cert: _trustValue(t.cert, "opts.tls.cert"),
     key: _trustValue(t.key, "opts.tls.key"), minVersion: t.minVersion, servername: t.servername,
-    checkServerIdentity: t.checkServerIdentity };
+    checkServerIdentity: t.checkServerIdentity, distrustedKeys: distrustedKeys };
 }
 
 function _sameOrigin(a, b) { return _urlOrigin(new _URL(a)) === _urlOrigin(new _URL(b)); }
@@ -1418,6 +1424,7 @@ function _settleDecisive(o, keyName) {
     guard.identifier.refuseAccessorFields(o.tls,
       guard.identifier.readableNames(o.tls, _ctErr, "ct/bad-input", "opts.tls"),
       _ctErr, "ct/bad-input", "opts.tls");
+    guard.identifier.assertKnownKeys(o.tls, _TLS_KNOWN, _ctErr, "ct/bad-input", "unknown opts.tls setting ");
     /** @internal And the ELEMENTS of the anchor list, which refusing accessors on `tls` itself does not
      *  reach. An accessor on `anchors[0]` runs when the list is copied, and one that overwrote
      *  `sth.rootHash` with the leaf being proven had an empty audit path verify. The refusal has to go
@@ -1652,11 +1659,17 @@ async function verifySth(sth, logKey) {
  *
  * `treeSize` and `timestamp` come back as `BigInt`, since both are uint64 on the wire.
  *
+ * `opts.tls.distrustedKeys` lists SHA-256 SubjectPublicKeyInfo digests (see pki.trust.spkiDigest). A
+ * log server whose chain carries a listed key is refused with `ct/server-key-distrusted`, and a
+ * malformed list is `ct/bad-input`. A `tls` setting other than `anchors`, `useSystemStore`, `cert`,
+ * `key`, `minVersion`, `servername`, `checkServerIdentity` and `distrustedKeys` is refused
+ * `ct/bad-input`. The other sec. 4 messages read it the same way.
+ *
  * @opts
  *   url:              string,    // the log's base URL, with or without the ct/v1/ prefix
  *   logKey:           BufferSource, // the log's SubjectPublicKeyInfo, pinned by the caller
  *   transport:        function,  // optional (request) => Promise<{ status, headers, body }>
- *   tls:              object,    // optional { anchors, useSystemStore, ... } when no transport is given
+ *   tls:              object,    // optional { anchors, useSystemStore, distrustedKeys, ... } when no transport is given
  *   headers:          object,    // optional extra request headers
  *   timeout:          number,    // optional per-request timeout in milliseconds
  *   maxResponseBytes: number,    // optional response cap
@@ -2194,7 +2207,7 @@ function _b64Array(obj, name, code, label, exactLen, maxCount) {
  * @opts signerKey REQUIRED and caller-pinned -- the distributor SubjectPublicKeyInfo as a DER Buffer; no baked-in key.
  * @opts sigUrl OPTIONAL -- the detached `log_list.sig` URL (https, must share the log-list URL's origin); default `url` with `.json` -> `.sig` (a non-.json url requires an explicit sigUrl).
  * @opts transport OPTIONAL injectable `transport(request) -> Promise<{status,headers,body}>` (default `pki.transport.https`); the test seam.
- * @opts tls OPTIONAL `{ anchors, useSystemStore, cert, key, minVersion, servername, checkServerIdentity }` threaded to the default transport (ignored when a transport is injected); `rejectUnauthorized` is always on.
+ * @opts tls OPTIONAL `{ anchors, useSystemStore, cert, key, minVersion, servername, checkServerIdentity, distrustedKeys }` threaded to the default transport (ignored when a transport is injected); `rejectUnauthorized` is always on. `distrustedKeys` lists SHA-256 SubjectPublicKeyInfo digests (see pki.trust.spkiDigest): a distributor whose chain carries a listed key is refused with `ct/server-key-distrusted`, and a malformed list is `ct/bad-input`. A setting not named in that list is refused `ct/bad-input`.
  * @opts headers OPTIONAL extra request headers (the request-framing headers are stripped; the verb owns the GET method).
  * @opts timeout OPTIONAL ms budget, default 30s (cap-validated).
  * @opts maxResponseBytes OPTIONAL per-GET size cap, default 4 MiB, tightenable DOWNWARD only.

package/lib/est.js

@@ -918,10 +918,23 @@ function _parseUrl(urlStr) {
   return url;
 }
 
-/** @internal The settings this client forwards to its transport. */
-var TLS_SETTINGS = ["anchors", "useSystemStore", "cert", "key", "minVersion", "servername", "checkServerIdentity"];
-function _tlsForRequest(opts) {
-  return guard.identifier.pickSettings(opts.tls, TLS_SETTINGS);
+/** @internal The settings this client forwards to its transport. The distrust list is typed here, once
+ *  per verb, and the frozen copy is the one every hop carries. A setting not on the list is refused. */
+var TLS_SETTINGS = ["anchors", "useSystemStore", "cert", "key", "minVersion", "servername", "checkServerIdentity", "distrustedKeys"];
+var TLS_KNOWN = intrinsic.freeze(guard.identifier.pickSettings(null, TLS_SETTINGS));
+function _tlsForRequest(tls) {
+  guard.identifier.assertKnownKeys(tls, TLS_KNOWN, E, "est/bad-input", "unknown opts.tls setting ");
+  var t = guard.identifier.pickSettings(tls, TLS_SETTINGS);
+  t.distrustedKeys = guard.distrust.keys(t.distrustedKeys, E, "est/bad-input", "opts.tls.distrustedKeys");
+  return t;
+}
+/** @internal The proxy and the tls settings, taken at the synchronous verb door. Every request and
+ *  redirect hop of the verb uses this record. */
+function _doorSnapshot(opts) {
+  var proxy, tls;
+  try { proxy = _snapProxy(opts); tls = opts.tls; }
+  catch (_pe) { throw E("est/bad-input", "the options object could not be read", _pe); }
+  return { proxy: proxy, tls: _tlsForRequest(tls) };
 }
 
 function _redirectTarget(current, location, method, opts) {
@@ -980,7 +993,7 @@ function _authScheme(opts) {
     if (sc !== "basic" && sc !== "digest") throw E("est/bad-input", "opts.auth.scheme must be \"basic\" or \"digest\"");
     return sc;
   }
-  if (opts.username !== undefined || opts.password !== undefined) return "basic";
+  if (opts.username != null || opts.password != null) return "basic";
   return null;
 }
 function _authUser(opts) { return opts.auth && opts.auth.username !== undefined ? opts.auth.username : opts.username; }
@@ -1095,7 +1108,7 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
 /** @internal `checked` is the transport the verb already took at its door. Taking it again here
  * would ask the caller's options a second time, and anything read in between could change the
  * answer, so a verb that holds one passes it and this reads the option only when none was held. */
-function _client(op, method, baseUrl, body, headers, opts, proxySnap, onAttempt, checked) {
+function _client(op, method, baseUrl, body, headers, opts, snap, onAttempt, checked) {
   var base;
   try { base = new _URL(_stringOf(baseUrl)); }
   catch (e) { throw E("est/bad-url", "the EST base URL did not parse: " + guard.text.showValue(baseUrl), e); }
@@ -1103,14 +1116,14 @@ function _client(op, method, baseUrl, body, headers, opts, proxySnap, onAttempt,
   var url = _parseUrl(paths(baseUrl, { label: opts.label })[op]);
   var transport = checked !== undefined ? checked : _assertTransport(opts);
   if (!transport) {
-    var t = opts.tls != null ? opts.tls : intrinsic.create(null);
+    var t = snap.tls;
     var hasAnchors = t.anchors !== undefined && t.anchors !== null && !(Array.isArray(t.anchors) && t.anchors.length === 0);
     if (!hasAnchors && t.useSystemStore !== true) throw E("est/no-trust-anchors", "no explicit trust anchor and tls.useSystemStore not set to true -- refusing an unpinned server (RFC 7030 sec. 3.6)");
     transport = httpTransport.https({ E: E, errPrefix: "est" });
   }
   var budgets = {
-    tls: _tlsForRequest(opts),
-    proxy: proxySnap,
+    tls: snap.tls,
+    proxy: snap.proxy,
     timeout: guard.limits.cap(opts.timeout, "timeout", DEFAULT_TIMEOUT, { E: E, code: "est/bad-input", min: 1, max: MAX_TIMEOUT }),
     maxResponseBytes: guard.limits.cap(opts.maxResponseBytes, "maxResponseBytes", constants.LIMITS.HTTP_MAX_RESPONSE_BYTES, { E: E, code: "est/bad-input", min: 1, max: constants.LIMITS.HTTP_MAX_RESPONSE_BYTES }),
     maxRedirects: guard.limits.cap(opts.maxRedirects, "maxRedirects", 5, { E: E, code: "est/bad-input", min: 0, max: 32 }),
@@ -1241,18 +1254,19 @@ function fullcmc(baseUrl, request, opts) {
      * caller's nested objects, and one of those reads must not be able to change which transport
      * the request goes out on, so the value that was checked is the value carried below. */
     var carriedTransport = opts.transport;
-    var proxySnap;
-    try { proxySnap = _snapProxy(opts); } catch (_pe) { throw E("est/bad-input", "the options object could not be read", _pe); }
+    /** @internal Taken before the own-property copy below, so a tls a defaults bag carries on its
+     *  prototype is the one the request uses. */
+    var snap = _doorSnapshot(opts);
     der = _cmcRequestDer(request);
     wanted = _requestedPublicKeys(der);
     sent = _cmcSent(opts, der);
     /** @internal The copy below keeps own properties only, and a defaults bag holds its options on
      * a prototype, so the transport is put back from the value held at the door. */
     opts = _shallowCopy(opts);
-    if (carriedTransport !== undefined) opts.transport = carriedTransport;
+    if (carriedTransport != null) opts.transport = carriedTransport;
     var body = transferEncode(der);
     return _client("fullcmc", "POST", baseUrl, body,
-      { accept: "application/pkcs7-mime", "content-type": "application/pkcs7-mime; smime-type=CMC-request" }, opts, proxySnap, undefined, carriedTransport)
+      { accept: "application/pkcs7-mime", "content-type": "application/pkcs7-mime; smime-type=CMC-request" }, opts, snap, undefined, carriedTransport)
       .then(function (res) { return _fullcmcResult(res, opts, wanted, sent); });
   } catch (e) {
     return _rej(e);
@@ -1571,7 +1585,7 @@ function _causedBy(e, target) {
 
 var ENROLL_HEADERS = intrinsic.assign(intrinsic.create(null), { accept: "application/pkcs7-mime", "content-type": "application/pkcs10" });
 
-function _enrollBound(op, baseUrl, builder, opts, proxySnap) {
+function _enrollBound(op, baseUrl, builder, opts, snap) {
   /** @internal Held before anything else the caller supplied is read, and carried to the client:
    * the builder runs during the handshake, so a later read could answer with a different value. */
   var checkedTransport = opts.transport;
@@ -1601,7 +1615,7 @@ function _enrollBound(op, baseUrl, builder, opts, proxySnap) {
         .then(null, function (e) { attempt.error = e; attempt.done = true; throw e; });
     };
   }
-  return _client(op, "POST", baseUrl, hopBody, ENROLL_HEADERS, opts, proxySnap, hopBody, checkedTransport)
+  return _client(op, "POST", baseUrl, hopBody, ENROLL_HEADERS, opts, snap, hopBody, checkedTransport)
     .then(function (res) {
       if (current && current.error) throw current.error;
       if (!current || !current.done) {
@@ -1617,13 +1631,13 @@ function _enrollBound(op, baseUrl, builder, opts, proxySnap) {
     });
 }
 
-function _enroll(op, baseUrl, csrInput, opts, proxySnap) {
-  if (typeof csrInput === "function") return _enrollBound(op, baseUrl, csrInput, opts, proxySnap);
+function _enroll(op, baseUrl, csrInput, opts, snap) {
+  if (typeof csrInput === "function") return _enrollBound(op, baseUrl, csrInput, opts, snap);
   var checkedTransport = opts.transport;
   var csrDer = _csrDer(csrInput);
   var spki = csr.parse(csrDer).subjectPublicKeyInfo;
   var body = transferEncode(csrDer);
-  return _client(op, "POST", baseUrl, body, ENROLL_HEADERS, opts, proxySnap, undefined, checkedTransport)
+  return _client(op, "POST", baseUrl, body, ENROLL_HEADERS, opts, snap, undefined, checkedTransport)
     .then(function (res) { return _certsResult(op, res, opts, spki); });
 }
 
@@ -1646,7 +1660,7 @@ function _enroll(op, baseUrl, csrInput, opts, proxySnap) {
  *
  * @opts
  *   - `transport`: an injected `transport(request) -> Promise<{status, headers, body, tls}>`; default pki.transport.https. It must return a promise of the response; anything else is `est/bad-input`.
- *   - `tls` -- { anchors, useSystemStore, cert, key, minVersion, servername, checkServerIdentity }.
+ *   - `tls` -- { anchors, useSystemStore, cert, key, minVersion, servername, checkServerIdentity, distrustedKeys }. `distrustedKeys` lists SHA-256 SubjectPublicKeyInfo digests (see pki.trust.spkiDigest); a server whose chain carries a listed key is refused with `est/server-key-distrusted`, on every hop including a cross-origin redirect, and a malformed list is `est/bad-input`. A setting not named in that list is refused `est/bad-input`. The verb reads `tls` when it is called, so a change the caller makes to it afterward does not reach the request.
  *   - `label` -- an OPTIONAL CA label path segment; `timeout` / `maxResponseBytes` / `maxRedirects` -- budgets.
  *   - `proxy` -- reach the CA through a forward HTTP proxy (`{ url, auth?, tls? }`; see pki.transport).
  *   - `now` -- receipt time (epoch ms) to render a 202 Retry-After HTTP-date as seconds.
@@ -1664,10 +1678,10 @@ function _enroll(op, baseUrl, csrInput, opts, proxySnap) {
  */
 function cacerts(baseUrl, opts) {
   opts = opts || intrinsic.create(null);
-  var proxySnap; try { proxySnap = _snapProxy(opts); } catch (_pe) { return _rej(E("est/bad-input", "the options object could not be read", _pe)); }
+  var snap; try { snap = _doorSnapshot(opts); } catch (e) { return _rej(e); }
   return _promiseResolve(_Promise, undefined).then(function () {
     opts = _knownOpts(opts, CACERTS_OPTS, "cacerts");
-    return _client("cacerts", "GET", baseUrl, null, { accept: "application/pkcs7-mime" }, opts, proxySnap, undefined, opts.transport);
+    return _client("cacerts", "GET", baseUrl, null, { accept: "application/pkcs7-mime" }, opts, snap, undefined, opts.transport);
   }).then(function (res) { return _certsResult("cacerts", res, opts, null); });
 }
 
@@ -1732,10 +1746,10 @@ function cacerts(baseUrl, opts) {
  */
 function simpleenroll(baseUrl, csrInput, opts) {
   opts = opts || intrinsic.create(null);
-  var proxySnap; try { proxySnap = _snapProxy(opts); } catch (_pe) { return _rej(E("est/bad-input", "the options object could not be read", _pe)); }
+  var snap; try { snap = _doorSnapshot(opts); } catch (e) { return _rej(e); }
   return _promiseResolve(_Promise, undefined).then(function () {
     opts = _knownOpts(opts, SIMPLEENROLL_OPTS, "simpleenroll");
-    return _enroll("simpleenroll", baseUrl, csrInput, opts, proxySnap);
+    return _enroll("simpleenroll", baseUrl, csrInput, opts, snap);
   });
 }
 
@@ -1772,12 +1786,12 @@ function simpleenroll(baseUrl, csrInput, opts) {
  */
 function simplereenroll(baseUrl, csrInput, opts) {
   opts = opts || intrinsic.create(null);
-  var proxySnap; try { proxySnap = _snapProxy(opts); } catch (_pe) { return _rej(E("est/bad-input", "the options object could not be read", _pe)); }
+  var snap; try { snap = _doorSnapshot(opts); } catch (e) { return _rej(e); }
   return _promiseResolve(_Promise, undefined).then(function () {
     opts = _knownOpts(opts, SIMPLEREENROLL_OPTS, "simplereenroll");
     if (!opts.oldCert) throw E("est/bad-input", "simplereenroll requires opts.oldCert (the certificate being renewed, RFC 7030 sec. 4.2.2)");
     if (typeof csrInput !== "function") reenrollGuard(opts.oldCert, _csrDer(csrInput));
-    return _enroll("simplereenroll", baseUrl, csrInput, opts, proxySnap);
+    return _enroll("simplereenroll", baseUrl, csrInput, opts, snap);
   });
 }
 
@@ -1944,7 +1958,7 @@ async function _serverkeygenResult(res, opts, derived) {
  */
 function serverkeygen(baseUrl, csrInput, opts) {
   opts = opts || intrinsic.create(null);
-  var proxySnap; try { proxySnap = _snapProxy(opts); } catch (_pe) { return _rej(E("est/bad-input", "the options object could not be read", _pe)); }
+  var snap; try { snap = _doorSnapshot(opts); } catch (e) { return _rej(e); }
   return _promiseResolve(_Promise, undefined).then(function () {
     opts = _knownOpts(opts, SERVERKEYGEN_OPTS, "serverkeygen");
     var checkedTransport = opts.transport;
@@ -1955,6 +1969,7 @@ function serverkeygen(baseUrl, csrInput, opts) {
      * coerced to `false` and contradicted a CSR the caller never disagreed with. The value is a
      * boolean by the time it reaches here, so it is compared rather than coerced. */
     if (opts.requestedEncryption != null && opts.requestedEncryption !== derived.requestedEncryption) throw E("est/bad-input", "opts.requestedEncryption (" + opts.requestedEncryption + ") contradicts the CSR's advertised key-encryption attribute (" + derived.requestedEncryption + ") (RFC 7030 sec. 4.4.1)");
+    // allow:caller-option-presence-tested-against-undefined -- absence means the recipient is not checked against the CSR, so a null must be refused
     if (opts.expectedRecipientKeyId !== undefined) {
       if (!Buffer.isBuffer(opts.expectedRecipientKeyId)) throw E("est/bad-input", "opts.expectedRecipientKeyId must be a Buffer");
       if (derived.expectedRecipientKeyId && !opts.expectedRecipientKeyId.equals(derived.expectedRecipientKeyId)) throw E("est/bad-input", "opts.expectedRecipientKeyId contradicts the key identifier the CSR advertised (RFC 7030 sec. 4.4.1)");
@@ -1968,7 +1983,7 @@ function serverkeygen(baseUrl, csrInput, opts) {
     if ((opts.expectedRecipientKeyId !== undefined || opts.expectedRecipientIssuerSerial != null) && !derived.requestedEncryption) {
       throw E("est/bad-input", "a recipient expectation (expectedRecipientKeyId / expectedRecipientIssuerSerial) implies an encrypted key, but the CSR advertised no DecryptKeyIdentifier / AsymmetricDecryptKeyIdentifier attribute (RFC 7030 sec. 4.4.1)");
     }
-    return _client("serverkeygen", "POST", baseUrl, transferEncode(csrDer), { accept: "multipart/mixed", "content-type": "application/pkcs10" }, opts, proxySnap, undefined, checkedTransport)
+    return _client("serverkeygen", "POST", baseUrl, transferEncode(csrDer), { accept: "multipart/mixed", "content-type": "application/pkcs10" }, opts, snap, undefined, checkedTransport)
       .then(function (res) { return _serverkeygenResult(res, opts, derived); });
   });
 }
@@ -2010,10 +2025,10 @@ function _csrattrsResult(res, opts) {
  */
 function csrattrs(baseUrl, opts) {
   opts = opts || intrinsic.create(null);
-  var proxySnap; try { proxySnap = _snapProxy(opts); } catch (_pe) { return _rej(E("est/bad-input", "the options object could not be read", _pe)); }
+  var snap; try { snap = _doorSnapshot(opts); } catch (e) { return _rej(e); }
   return _promiseResolve(_Promise, undefined).then(function () {
     opts = _knownOpts(opts, CSRATTRS_OPTS, "csrattrs");
-    return _client("csrattrs", "GET", baseUrl, null, { accept: "application/csrattrs" }, opts, proxySnap, undefined, opts.transport);
+    return _client("csrattrs", "GET", baseUrl, null, { accept: "application/csrattrs" }, opts, snap, undefined, opts.transport);
   }).then(function (res) { return _csrattrsResult(res, opts); });
 }