@blamejs/pki 0.9.5 → 0.9.7

package/lib/jose.js

@@ -373,7 +373,7 @@ async function verify(jws, opts) {
    *  `snapshotDeep` refuses an accessor-backed member rather than reading it once, which is the stronger
    *  answer for a value that selects an algorithm. The embedded jwk comes from the parsed header and is
    *  this module's own object, so it needs no copy. */
-  var suppliedKey = opts.key === undefined ? undefined
+  var suppliedKey = opts.key == null ? undefined
     : guard.bytes.snapshotDeep(opts.key, JoseError, "jose/bad-key", "opts.key");
   var jwk = header.jwk || suppliedKey;
   if (!jwk) throw E("jose/bad-key", "a verification key is required (opts.key) when the profile does not embed a jwk");

package/lib/lint.js

@@ -3908,9 +3908,8 @@ function _isMlKem(cert) {
  *  MUST NOT be present. The row runs in the rfc5280 profile because that is the profile whose own
  *  clause delegates the question, and the profile every authoring call is held to.
  *
- *  Only the id-ecPublicKey arm is here. Sec. 3's other two arms govern id-ecDH and id-ecMQV, which
- *  this registry does not name, so a row keyed on them could never fire; registering them as
- *  subject-key algorithms is adding surface rather than closing this. There is no RSA row: RFC 3279
+ *  Only the id-ecPublicKey arm is here; no row is keyed on id-ecDH or id-ecMQV, the identifiers
+ *  sec. 3's other two arms govern. There is no RSA row: RFC 3279
  *  sec. 2.3.1 states a MAY list and no prohibition, so an error-severity finding there would promote
  *  a MAY-list omission to a MUST NOT and stop the signer emitting a certificate a caller may want. */
 var EC_FORBIDDEN_KU_BITS = ["keyEncipherment", "dataEncipherment"];
@@ -3938,6 +3937,46 @@ var RFC5480_RULES = [
   },
 ];
 
+function _isEcSubjectKey(cert) {
+  var spki = cert.subjectPublicKeyInfo;
+  if (!spki || !spki.algorithm || !intrinsic.isBuffer(spki.bytes)) return false;
+  var n = spki.algorithm.name;
+  return n === "ecPublicKey" || n === "ecDH" || n === "ecMQV";
+}
+function _hasSubjectKey(cert) {
+  return !!cert.subjectPublicKeyInfo && intrinsic.isBuffer(cert.subjectPublicKeyInfo.bytes);
+}
+/** @internal The built-in list, keyed by digest, for the row that names a listed key. */
+var _COMPROMISED_BY_DIGEST = intrinsic.create(null);
+(function () {
+  var listed = guard.distrust.knownCompromised();
+  for (var i = 0; i < listed.length; i++) _COMPROMISED_BY_DIGEST[listed[i].spkiSha256] = listed[i];
+})();
+
+var KEY_COMPROMISE_RULES = [
+  {
+    id: "lint/key-compromise/small-ec-private-key", severity: "error", source: "key-compromise",
+    citation: "CABF TLS BR 6.1.1.3 (4)",
+    message: "the elliptic curve private key is a small integer, so anyone can recover it from the public key",
+    appliesTo: _isEcSubjectKey,
+    check: function (cert) {
+      var curve = guard.distrust.smallEcScalar(cert.subjectPublicKeyInfo.bytes);
+      return curve === null ? null : { context: { curve: curve, scalarBelow: guard.distrust.SMALL_SCALAR_BOUND } };
+    },
+  },
+  {
+    id: "lint/key-compromise/known-compromised-key", severity: "error", source: "key-compromise",
+    citation: "CABF TLS BR 6.1.1.3 (4)",
+    message: "the subject key is on the list of keys whose private key is public (pki.trust.knownCompromisedKeys)",
+    appliesTo: _hasSubjectKey,
+    check: function (cert) {
+      var bytes = cert.subjectPublicKeyInfo.bytes;
+      var entry = _COMPROMISED_BY_DIGEST[guard.distrust.digest(bytes)] || _COMPROMISED_BY_DIGEST[guard.distrust.keyDigest(bytes)];
+      return entry ? { context: { name: entry.name, spkiSha256: entry.spkiSha256 } } : null;
+    },
+  },
+];
+
 var RFC9935_RULES = [
   {
     id: "lint/rfc9935/kem-key-usage", severity: "error", source: "rfc9935", citation: "RFC 9935 5",
@@ -6129,7 +6168,7 @@ function _nistKindOf(alg) {
   /** @internal A key-agreement scheme names a key-derivation function for CMS rather than an algorithm
    * a certificate declares, and its name opens with the family word. */
   if (name.indexOf("dhSinglePass-") === 0) return undefined;
-  if (name === "ecPublicKey" || name.indexOf("ecdsaWith") === 0 ||
+  if (name === "ecPublicKey" || name === "ecDH" || name === "ecMQV" || name.indexOf("ecdsaWith") === 0 ||
     name === "X25519" || name === "X448") return "ecc";
   if (name === "Ed25519" || name === "Ed448") return "eddsa";
   if (name === "dsa" || name.indexOf("dsaWith") === 0 ||
@@ -6719,6 +6758,7 @@ var PROFILES = Object.assign(Object.create(null), {
    *  from a rule that quietly replaced the other. */
   "cnsa-2.0": CNSA2_RULES.concat(RFC9881_RULES).concat(RFC9935_RULES)
     .concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  "key-compromise": intrinsic.concatList(KEY_COMPROMISE_RULES, RFC5280_EXTENSION_SYNTAX_RULES),
 });
 var ALL_RULES = RFC5280_RULES.concat(RFC9881_RULES).concat(RFC9909_RULES).concat(RFC9935_RULES)
   .concat(RFC9763_RULES).concat(RFC7633_RULES).concat(X509_ALTSIG_RULES)
@@ -6732,6 +6772,7 @@ var ALL_RULES = RFC5280_RULES.concat(RFC9881_RULES).concat(RFC9909_RULES).concat
  *  operand and builds through ArraySpeciesCreate, so a replacement decides which rows the default
  *  set holds. The pre-existing chain above is counted in the conversion budget. */
 ALL_RULES = intrinsic.concatList(ALL_RULES, RFC5480_RULES);
+ALL_RULES = intrinsic.concatList(ALL_RULES, KEY_COMPROMISE_RULES);
 
 var CABF_TLS_CSR_RULES = CABF_TLS_RULES.filter(function (r) {
   return CABF_TLS_CSR_RULE_IDS.indexOf(r.id) !== -1;
@@ -6820,8 +6861,9 @@ var CSR_PROFILES = Object.assign(Object.create(null), {
   "rfc2986": CSR_STRUCTURAL_RULES,
   "cabf-tls": CSR_STRUCTURAL_RULES.concat(CABF_TLS_CSR_RULES),
   "rfc9883": RFC9883_CSR_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  "key-compromise": intrinsic.concatList(KEY_COMPROMISE_RULES, RFC5280_EXTENSION_SYNTAX_RULES),
 });
-var ALL_CSR_RULES = CSR_STRUCTURAL_RULES.concat(RFC9883_CSR_RULES);
+var ALL_CSR_RULES = intrinsic.concatList(CSR_STRUCTURAL_RULES.concat(RFC9883_CSR_RULES), KEY_COMPROMISE_RULES);
 
 function _subjectIsNonEmpty(csr) {
   var rdns = csr.subject && csr.subject.rdns;
@@ -7751,8 +7793,8 @@ function rules(profile, artifact) {
  *   // -> ["rfc5280", "rfc5480", "rfc9881", "rfc9909", "rfc9935", "rfc9763", "rfc7633",
  *   //     "x509-altsig", "cabf-tls", "cabf-smime", "cabf-cs", "etsi-qc", "mozilla-root",
  *   //     "chrome-root", "microsoft-root", "apple-root", "nist-pqc-transition", "cnsa-2.0",
- *   //     "rfc2986", "rfc9883", "rfc5280-crl", "rfc6960", "rfc5019", "rfc5652", "rfc8933",
- *   //     "rfc3161", "rfc5755"]
+ *   //     "key-compromise", "rfc2986", "rfc9883", "rfc5280-crl", "rfc6960", "rfc5019",
+ *   //     "rfc5652", "rfc8933", "rfc3161", "rfc5755"]
  */
 /** @internal `cabf-tls` names the certificate profile in this list and is not repeated for the
  *  request form: `pki.lint.csr` takes the same name and runs those rows against what a request

package/lib/ocsp-verify.js

@@ -74,7 +74,12 @@ function makeOcspVerify(deps) {
     return false;
   }
 
-  async function ocspAuthorizeResponder(basicResponse, cert, issuer, issuerKeyBits, time) {
+  /** @internal `distrusted` is a list `guard.distrust.keys` returned, or null. A responder whose key
+   * is on it is not an authorized responder. A listed issuing CA authorizes no responder at all: its
+   * own answer is refused, and so is a delegate it certified, since the holder of the listed key can
+   * certify one. */
+  async function ocspAuthorizeResponder(basicResponse, cert, issuer, issuerKeyBits, time, distrusted) {
+    if (guard.distrust.has(distrusted, issuer.workingPublicKey)) return null;
     var rid = basicResponse.responderID;
     var matchesIssuer = false;
     try {
@@ -93,6 +98,7 @@ function makeOcspVerify(deps) {
         else if (rid.byKey) identifies = _bytesEqual(rid.byKey, await ocspDigest("SHA-1", ocspKeyValue(rc.subjectPublicKeyInfo.bytes)));
       } catch (_e) { identifies = false; }
       if (!identifies) continue;
+      if (guard.distrust.has(distrusted, rc.subjectPublicKeyInfo.bytes) || guard.distrust.has(distrusted, ocspResponderSpki(rc, issuer))) continue;
       var issuedByCa;
       try { issuedByCa = dnEqual(rc.issuer.rdns, cert.issuer.rdns); }
       catch (_e) { continue; }
@@ -141,11 +147,11 @@ function makeOcspVerify(deps) {
     }, extras);
   }
 
-  async function evaluateResponse(resp, cert, issuer, issuerKeyBits, issuerNameCandidates, time, historical) {
+  async function evaluateResponse(resp, cert, issuer, issuerKeyBits, issuerNameCandidates, time, historical, distrusted) {
     if (resp.responseStatus.code !== 0) return _evaluation({ reason: "non-successful OCSP responseStatus (" + resp.responseStatus.code + ")" });
     var br = resp.basicResponse;
     if (!br) return _evaluation({ reason: "successful OCSP response carries no BasicOCSPResponse" });
-    var signerSpki = await ocspAuthorizeResponder(br, cert, issuer, issuerKeyBits, time);
+    var signerSpki = await ocspAuthorizeResponder(br, cert, issuer, issuerKeyBits, time, distrusted || null);
     if (!signerSpki) return _evaluation({ applicable: true, reason: "no authorized OCSP responder signs this response (RFC 6960 sec. 4.2.2.2)" });
     if (!(await verifyWithSpki(br.signatureAlgorithm, br.signature, signerSpki, br.tbsResponseDataBytes))) {
       return _evaluation({ applicable: true, responderAuthorized: true, reason: "the OCSP response signature does not verify over tbsResponseData" });

package/lib/ocsp.js

@@ -682,6 +682,9 @@ function buildErrorResponse(status) {
  *   time            the validation instant (default: now).
  *   requestNonce    the nonce the client sent; when given, the response MUST echo it (constant-time).
  *   historicalMode  defer a strictly-future revocation (report good) instead of revoking on skew.
+ *   distrustedKeys  SHA-256 digests of SubjectPublicKeyInfo values (64 hex characters or 32 bytes each, see
+ *                   `pki.trust.spkiDigest`); a response signed by a listed key, the issuing CA's or a
+ *                   delegate's, has no authorized responder and is `"unknown"`.
  * @example
  *   var ca = await pki.key.generate("Ed25519");
  *   var caKey = await pki.key.export(ca.privateKey);
@@ -699,7 +702,7 @@ function buildErrorResponse(status) {
  *   var res = await pki.ocsp.verify(responseDer, { cert: leafDer, issuer: caDer });
  *   res.status;   // "good" | "revoked" | "unknown"
  */
-var _VERIFY_OPTS = Object.assign(Object.create(null), { cert: 1, historicalMode: 1, issuer: 1, requestNonce: 1, time: 1 });
+var _VERIFY_OPTS = Object.assign(Object.create(null), { cert: 1, distrustedKeys: 1, historicalMode: 1, issuer: 1, requestNonce: 1, time: 1 });
 
 function verify(response, opts) {
   try {
@@ -708,8 +711,9 @@ function verify(response, opts) {
       "pki.ocsp.verify has an unknown option (the request nonce to bind against is `requestNonce`): ");
   } catch (e) { return _promiseReject(_Promise, e); }
   if (opts.cert == null || opts.issuer == null) return _promiseReject(_Promise, _err("ocsp/bad-input", "verify requires opts.cert and opts.issuer"));
-  var parsed, cert, issuerCert, time;
+  var parsed, cert, issuerCert, time, distrusted;
   try {
+    distrusted = guard.distrust.keys(opts.distrustedKeys, _err, "ocsp/bad-input", "opts.distrustedKeys");
     parsed = _responseFromBytes(response);
     cert = _certOf(opts.cert, "the target certificate");
     issuerCert = _certOf(opts.issuer, "the issuer certificate");
@@ -728,7 +732,7 @@ function verify(response, opts) {
   /** @internal Captured: this continuation is where the response's status becomes the verdict a
    * caller reads, so a settled value in place of it reports a status nothing evaluated. */
   var evaluated = pathValidate.verifyOcspResponse(parsed, cert, issuerCert, time,
-    { historicalMode: opts.historicalMode === true, requestNonce: reqNonce });
+    { historicalMode: opts.historicalMode === true, requestNonce: reqNonce, distrustedKeys: distrusted });
   return _ocspIntrinsic.chain(evaluated, function (verdict) {
     return guard.verdict.of(verdict, { valid: verdict.status === "good" });
   });
@@ -949,7 +953,7 @@ function httpRequest(der, responderUrl, opts) {
   if (!guard.encoding.isAsciiText(responderUrl)) {
     throw E("ocsp/bad-input", "httpRequest: the responder URL must be US-ASCII (RFC 3986 sec. 2); percent-encode the rest before passing it, since the RFC 5019 sec. 5 size bound counts the bytes that go on the wire");
   }
-  var asked = opts.method === undefined ? null : opts.method;
+  var asked = opts.method == null ? null : opts.method;
   if (asked !== null && asked !== "GET" && asked !== "POST") {
     throw E("ocsp/bad-input", "httpRequest: opts.method must be \"GET\" or \"POST\"");
   }

package/lib/oid.js

@@ -351,6 +351,10 @@ var FAMILIES = Object.assign(Object.create(null), {
     sect233k1: 26, sect233r1: 27, secp192k1: 31, secp224k1: 32, secp224r1: 33,
     secp384r1: 34, secp521r1: 35, sect409k1: 36, sect409r1: 37, sect571k1: 38, sect571r1: 39 } },
 
+  /** @internal RFC 5480 sec. 2.1.2: the two algorithm identifiers that restrict an elliptic curve key to
+   *  key agreement. The key itself is an ecPublicKey key, which is how a distrust list reads it. */
+  secgSchemes: { base: [1, 3, 132, 1], of: { ecDH: 12, ecMQV: 13 } },
+
   brainpool: { base: [1, 3, 36, 3, 3, 2, 8, 1, 1], of: {
     brainpoolP160r1: 1, brainpoolP160t1: 2, brainpoolP192r1: 3, brainpoolP192t1: 4,
     brainpoolP224r1: 5, brainpoolP224t1: 6, brainpoolP256r1: 7, brainpoolP256t1: 8,

package/lib/path-validate.js

@@ -1023,8 +1023,8 @@ function _initialState(certs, params, seeds, anchor, n, ta, policySwitches) {
     validPolicyGraph: graphRoot(),
     policyIndex: intrinsic.create(null),
     policyNodeCount: 1,
-    maxPolicyNodes: params.maxPolicyNodes !== undefined ? params.maxPolicyNodes : constants.LIMITS.PATH_MAX_POLICY_NODES,
-    minRsaModulusBits: params.minRsaModulusBits !== undefined ? params.minRsaModulusBits : constants.LIMITS.RSA_MIN_MODULUS_BITS,
+    maxPolicyNodes: params.maxPolicyNodes != null ? params.maxPolicyNodes : constants.LIMITS.PATH_MAX_POLICY_NODES,
+    minRsaModulusBits: params.minRsaModulusBits != null ? params.minRsaModulusBits : constants.LIMITS.RSA_MIN_MODULUS_BITS,
     permittedGenerations: intrinsic.selectList(seeds.permittedGenerations, function (g) { return g.length > 0; }),
     excludedSubtrees: seeds.excluded,
     explicitPolicy: _flagSet(policySwitches.initialExplicitPolicy, ta.policyFlags, "requireExplicitPolicy") ? 0 : n + 1,
@@ -1129,6 +1129,17 @@ function spliceSpkiParameters(spki, algOid, paramsBytes) {
   ]);
 }
 
+/** @internal The certificate's key with the parameters it inherits from its issuer spliced in, the
+ *  way `updateWorkingKey` builds the key the next signature is verified under, or null when the
+ *  certificate states its own parameters or inherits none. Read before `updateWorkingKey` runs for
+ *  this certificate, while `state` still holds the issuer's working key. */
+function _inheritedSpki(state, cert) {
+  var keyAlg = cert.subjectPublicKeyInfo.algorithm;
+  if (!isNullOrAbsentParams(keyAlg.parameters)) return null;
+  if (keyAlg.oid !== state.workingPublicKeyAlgorithm || !state.workingPublicKeyParameters) return null;
+  return spliceSpkiParameters(cert.subjectPublicKeyInfo, keyAlg.oid, state.workingPublicKeyParameters);
+}
+
 function updateWorkingKey(state, cert) {
   var keyAlg = cert.subjectPublicKeyInfo.algorithm;
   if (!isNullOrAbsentParams(keyAlg.parameters)) {
@@ -1370,7 +1381,7 @@ function _revocationRow(row, rv) {
  * (`initialExplicitPolicy`, `initialAnyPolicyInhibit`,
  * `initialPolicyMappingInhibit`) each take `true`, `false`, `null` or an absent
  * option, and any other value throws `path/bad-input` for the same reason. Returns `{ valid, revocationChecked, anchorConstraints,
- * path, results, workingPublicKey, workingPublicKeyAlgorithm,
+ * distrustedKeysApplied, path, results, workingPublicKey, workingPublicKeyAlgorithm,
  * workingPublicKeyParameters, validPolicyGraph, userConstrainedPolicySet }` where `results[i].checks`
  * carries a per-check reason code (`path/*`) for every step. Pure and
  * re-entrant: no input object is mutated. An empty path or a missing anchor
@@ -1422,6 +1433,27 @@ function _revocationRow(row, rv) {
  * `softFail` says. `softFail` opts into an undetermined answer; the built-in
  * checkers report one as `{ status: "unknown" }` and do not throw.
  *
+ * `distrustedKeys` is a list of SHA-256 digests of DER SubjectPublicKeyInfo values, each 64
+ * hexadecimal characters or 32 bytes (`pki.trust.spkiDigest` computes one from a certificate). A
+ * certificate on the path whose key is listed fails with `path/distrusted-key` in its
+ * `distrustedKey` row, and a listed trust anchor key fails the path with the same code in the
+ * `distrustedIssuerKey` row of the certificate the anchor issued. A key matches when the digest of
+ * the SubjectPublicKeyInfo as the certificate encodes it, or as node re-encodes the key (an
+ * uncompressed EC point, RSA parameters with NULL), is listed, so one entry refuses a CA certificate
+ * and every cross-certificate for the same key. No revocation status is asked for a certificate at
+ * or below a distrusted key, and a standalone `crlChecker`, `ocspChecker` or `fetchingChecker` given
+ * the list in its context answers `"unknown"` for an issuer whose key is listed.
+ *
+ * A key whose private key is public is refused whether or not a list is given, and no option turns
+ * the refusal off: a key on `pki.trust.knownCompromisedKeys()`, and an elliptic curve key on P-256,
+ * P-384, P-521 or secp256k1 whose private key is an integer below 256. Such a key fails the path with
+ * `path/compromised-key`, in the `compromisedKey` row of the certificate that carries it or in the
+ * `compromisedIssuerKey` row of the certificate a trust anchor with such a key issued. A compromised
+ * key is reported in these rows rather than as distrusted when the list names it too, and the
+ * revocation checkers answer `"unknown"` for a compromised issuer as they do for a listed one.
+ * `distrustedKeysApplied` reports whether a non-empty list was supplied. A malformed list is
+ * `path/bad-input`.
+ *
  * `anchorConstraints` reports what the anchor's own trust metadata decided:
  * the `checkedPurpose` it was judged under, and whether the `distrustAfter`
  * date, the `purposes` delegator map and the `nameConstraints` namespace each
@@ -1461,7 +1493,7 @@ function _revocationRow(row, rv) {
  *   res.valid;  // boolean; res.results[0].checks carries the per-check codes
  */
 var _VALIDATE_OPTS = intrinsic.assign(intrinsic.create(null), {
-  checkPurpose: 1, ctLogList: 1, ctPolicy: 1, historicalMode: 1, identity: 1, initialAnyPolicyInhibit: 1,
+  checkPurpose: 1, ctLogList: 1, ctPolicy: 1, distrustedKeys: 1, historicalMode: 1, identity: 1, initialAnyPolicyInhibit: 1,
   initialExcludedSubtrees: 1, initialExplicitPolicy: 1, initialPermittedSubtrees: 1,
   initialPolicyMappingInhibit: 1, maxPathCerts: 1, maxPolicyNodes: 1, minRsaModulusBits: 1, requireRevocation: 1,
   requiredEku: 1, revocationChecker: 1, softFail: 1, time: 1, trustAnchors: 1,
@@ -1516,8 +1548,12 @@ async function validate(path, opts) {
   if (suppliedVerifier !== null && typeof suppliedVerify !== "function") {
     throw E("path/bad-input", "validate: opts.verifier must carry a verify(args) function");
   }
+  /** @internal The distrust list is read and copied here, once, and every anchor attempt reads the
+   * copy: the attempts run after awaits, and a list re-read from the caller's array there could have
+   * been emptied by a revocation checker that ran in between. */
+  var distrusted = guard.distrust.keys(checked.distrustedKeys, E, "path/bad-input", "validate: opts.distrustedKeys");
   var scope = intrinsic.freeze(intrinsic.assign(intrinsic.create(null), {
-    verifier: suppliedVerifier, verify: suppliedVerify,
+    verifier: suppliedVerifier, verify: suppliedVerify, distrusted: distrusted,
   }));
   return _validate(path, checked, intrinsic.freeze(intrinsic.create(null)), scope);
 }
@@ -1670,6 +1706,14 @@ async function _validate(path, opts, run, scope) {
   var revocationRan = false, revocationWaived = false, revocationUndetermined = false;
   var prefixAuthentic = true;
   var anchorDistrustApplied = false, anchorPurposeApplied = false;
+  var distrusted = scope.distrusted;
+  var anchorKeyCompromised = guard.distrust.compromised(anchor.publicKey);
+  var anchorKeyDistrusted = guard.distrust.has(distrusted, anchor.publicKey);
+  /** @internal The first path index whose issuer chain holds a distrusted key: the anchor's key
+   * makes it 0, a certificate's own key makes it that certificate. From there down, no revocation
+   * status is asked for. The path fails either way, and a checker that fetches would open a
+   * connection on behalf of certificates issued under a key the caller refuses. */
+  var distrustedFrom = anchorKeyDistrusted ? 0 : -1;
   if (!checkPurpose && _hasPurposeScopedMetadata(anchor)) {
     throw E("path/bad-input", "validate: the trust anchor carries purpose-scoped metadata (distrustAfter / purposes), which is keyed by key purpose -- supply opts.checkPurpose to say which purpose this validation is for, or the constraint cannot be applied");
   }
@@ -1705,6 +1749,28 @@ async function _validate(path, opts, run, scope) {
      * no certificate under it is authenticated however its own check reads. */
     if (!sigRes.ok) prefixAuthentic = false;
 
+    /** @internal The digest covers the SubjectPublicKeyInfo as the certificate encodes it, not the
+     * working key, which carries parameters inherited from the issuer. A cross-signed certificate
+     * carries the same encoded key as the certificate it duplicates, so one entry refuses both. */
+    if (idx === 0 && anchorKeyCompromised !== null) {
+      guard.list.append(checks, { name: "compromisedIssuerKey", ok: false, code: "path/compromised-key" });
+      failed = true;
+    } else if (idx === 0 && anchorKeyDistrusted) {
+      guard.list.append(checks, { name: "distrustedIssuerKey", ok: false, code: "path/distrusted-key" });
+      failed = true;
+    }
+    var inheritedSpki = _inheritedSpki(state, cert);
+    var keyCompromised = guard.distrust.compromised(cert.subjectPublicKeyInfo.bytes) || guard.distrust.compromised(inheritedSpki);
+    if (keyCompromised !== null) {
+      guard.list.append(checks, { name: "compromisedKey", ok: false, code: "path/compromised-key" });
+      failed = true;
+      if (distrustedFrom === -1) distrustedFrom = idx;
+    } else if (guard.distrust.has(distrusted, cert.subjectPublicKeyInfo.bytes) || guard.distrust.has(distrusted, inheritedSpki)) {
+      guard.list.append(checks, { name: "distrustedKey", ok: false, code: "path/distrusted-key" });
+      failed = true;
+      if (distrustedFrom === -1) distrustedFrom = idx;
+    }
+
     if (compositeSig.COMPOSITE_ALGS[cert.subjectPublicKeyInfo.algorithm.oid]) {
       var cku = compositeKeyUsageCheck(cert);
       guard.list.append(checks,{ name: "compositeKeyUsage", ok: cku.ok, code: cku.ok ? undefined : cku.code });
@@ -1760,7 +1826,13 @@ async function _validate(path, opts, run, scope) {
      * socket, so asking anyway lets an unauthenticated certificate choose a destination and spend
      * the fetch budget. The row says the status was not asked for, which is an undetermined
      * outcome and not a checked one. */
-    if (revocationChecker && !prefixAuthentic) {
+    if (revocationChecker && distrustedFrom !== -1 && idx >= distrustedFrom) {
+      guard.list.append(checks, { name: "revocation", ok: false, status: "unknown",
+        code: "path/revocation-undetermined",
+        reason: "a key at or above this certificate on the path is distrusted, so no revocation status was asked for" });
+      revocationUndetermined = true;
+      revocationRan = true;
+    } else if (revocationChecker && !prefixAuthentic) {
       guard.list.append(checks, { name: "revocation", ok: false, status: "unknown",
         code: "path/revocation-undetermined",
         reason: sigRes.ok
@@ -1771,7 +1843,7 @@ async function _validate(path, opts, run, scope) {
     } else if (revocationChecker) {
       var issuerCert = idx > 0 ? certs[idx - 1] : null;
       var rv, rvError = null;
-      try { rv = await revocationChecker.check(cert, { workingIssuerName: state.workingIssuerName, workingPublicKey: state.workingPublicKey, workingPublicKeyAlgorithm: state.workingPublicKeyAlgorithm, issuerCert: issuerCert }, { time: opts.time, historicalMode: opts.historicalMode === true, run: run }); }
+      try { rv = await revocationChecker.check(cert, { workingIssuerName: state.workingIssuerName, workingPublicKey: state.workingPublicKey, workingPublicKeyAlgorithm: state.workingPublicKeyAlgorithm, issuerCert: issuerCert }, { time: opts.time, historicalMode: opts.historicalMode === true, run: run, distrustedKeys: distrusted }); }
       catch (e) { rv = { status: "error" }; rvError = e; }
       var rvStatus = (rv && typeof rv.status === "string") ? rv.status : "unknown";
       if (rv && rv.status === "good") { guard.list.append(checks, _revocationRow({ name: "revocation", ok: true, status: "good" }, rv)); }
@@ -1894,6 +1966,7 @@ async function _validate(path, opts, run, scope) {
   return guard.verdict.of({
     valid: !failed,
     identityChecked: identityChecked,
+    distrustedKeysApplied: distrusted !== null && distrusted.length > 0,
     revocationChecked: !revocationRan ? false
       : revocationUndetermined ? "undetermined"
         : revocationWaived ? "waived" : "determined",
@@ -2181,6 +2254,13 @@ function crlChecker(crls, opts) {
     check: async function (cert, issuer, ctx) {
       var time = ctx.time;
       var historical = ctx.historicalMode === true;
+      /** @internal Every CRL this checker takes is verified under the issuer's key, so a listed
+       * issuer key leaves no CRL that can answer. */
+      var distrusted = guard.distrust.keys(ctx.distrustedKeys, E, "path/bad-input", "crlChecker: ctx.distrustedKeys");
+      var issuerRefusal = guard.distrust.refusal(distrusted, issuer.workingPublicKey, "distrustedKeys");
+      if (issuerRefusal !== null) {
+        return guard.verdict.of({ status: "unknown", reason: "the issuer's key " + issuerRefusal + ", so no CRL it signs is an answer" });
+      }
       var certIsCa = null, certScopeFault = null;
       try {
         var bc = decodeExt(cert, OID.basicConstraints);
@@ -2473,6 +2553,7 @@ function ocspChecker(responses) {
     check: async function (cert, issuer, ctx) {
       var time = ctx.time;
       var historical = ctx.historicalMode === true;
+      var distrusted = guard.distrust.keys(ctx.distrustedKeys, E, "path/bad-input", "ocspChecker: ctx.distrustedKeys");
       var issuerNameCandidates = [cert.issuer.bytes];
       function addNameCandidate(nm) {
         if (nm && nm.bytes && !guard.list.anyMatches(issuerNameCandidates, function (e) { return e.equals(nm.bytes); })) guard.list.append(issuerNameCandidates, nm.bytes);
@@ -2488,7 +2569,7 @@ function ocspChecker(responses) {
       var sawUnknownStatus = false;
 
       for (var k = 0; k < parsed.length; k++) {
-        var v = await ocspCore.evaluateResponse(parsed[k], cert, issuer, issuerKeyBits, issuerNameCandidates, time, historical);
+        var v = await ocspCore.evaluateResponse(parsed[k], cert, issuer, issuerKeyBits, issuerNameCandidates, time, historical, distrusted);
         if (v.revoked && !revokedResult) {
           revokedResult = guard.verdict.of({ status: "revoked", revocationReason: v.revoked.revocationReason, revocationTime: v.revoked.revocationTime, reason: v.revoked.reason });
         }
@@ -2536,6 +2617,11 @@ function ocspChecker(responses) {
  * `time` either way. `time` must be a valid `Date`. A malformed response's parse
  * fault surfaces as the parser's typed `ocsp/*` / `asn1/*` error.
  *
+ * `opts.distrustedKeys` lists SHA-256 SubjectPublicKeyInfo digests (see `pki.trust.spkiDigest`). A
+ * response signed by a listed key, whether the issuing CA's or a delegated responder's, has no
+ * authorized responder and is `"unknown"` with `responderAuthorized: false`. `pki.path.ocspChecker`
+ * and `pki.path.fetchingChecker` apply the list `pki.path.validate` was given.
+ *
  * `opts.requestNonce` is the nonce bytes the request carried. Given one, the response must echo it
  * (RFC 9654 sec. 2.1, RFC 6960 sec. 4.4.1), compared in constant time, and `nonceMatched` reports
  * the outcome: `true`, `false`, or `null` when no nonce was sent. An unechoed nonce takes a `good`
@@ -2571,7 +2657,7 @@ function ocspChecker(responses) {
  *   var v = await pki.path.verifyOcspResponse(der, cert, issuerCert, new Date());
  *   v.status;   // "good" | "revoked" | "unknown"
  */
-var _VERIFY_OCSP_OPTS = intrinsic.assign(intrinsic.create(null), { historicalMode: 1, requestNonce: 1 });
+var _VERIFY_OCSP_OPTS = intrinsic.assign(intrinsic.create(null), { distrustedKeys: 1, historicalMode: 1, requestNonce: 1 });
 
 async function verifyOcspResponse(response, cert, issuerCert, time, opts) {
   var parsedResponse, subject, issuer, checkedOpts;
@@ -2583,11 +2669,13 @@ async function verifyOcspResponse(response, cert, issuerCert, time, opts) {
     checkedOpts = guard.identifier.optionsObject(opts, E, "path/bad-input", "verifyOcspResponse: opts");
     guard.identifier.assertKnownKeys(checkedOpts, _VERIFY_OCSP_OPTS, E, "path/bad-input",
       "pki.path.verifyOcspResponse has an unknown option (the request nonce to bind against is `requestNonce`). The unknown option was: ");
+    var distrusted = guard.distrust.keys(checkedOpts.distrustedKeys, E, "path/bad-input", "verifyOcspResponse: opts.distrustedKeys");
     parsedResponse = _ocspFromBytes(response);
     subject = coerceCert(cert, "the certificate");
     issuer = coerceCert(issuerCert, "the issuer certificate");
   } catch (e) { return _reject(_Promise, e); }
-  var v = await _verifyOcspParsed(parsedResponse, subject, issuer, time, checkedOpts);
+  var v = await _verifyOcspParsed(parsedResponse, subject, issuer, time,
+    { historicalMode: checkedOpts.historicalMode, requestNonce: checkedOpts.requestNonce, distrustedKeys: distrusted });
   var out = guard.verdict.of(v);
   return guard.verdict.of(out, { valid: out.status === "good" });
 }
@@ -2646,7 +2734,7 @@ function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
     try { issuerKeyBits = ocspVerify.ocspKeyValue(issuerCert.subjectPublicKeyInfo.bytes); }
     catch (_e) { return unbound("the issuer public key could not be read to recompute the OCSP CertID"); }
     return intrinsic.chain(ocspCore.evaluateResponse(parsedResponse, cert, issuerCtx, issuerKeyBits,
-      issuerNameCandidates, time, opts.historicalMode === true), function (v) {
+      issuerNameCandidates, time, opts.historicalMode === true, opts.distrustedKeys || null), function (v) {
       if (v.revoked) return _withNonceRule(guard.verdict.of({ status: "revoked", responderAuthorized: true, signatureValid: true, matched: true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, revocationReason: v.revoked.revocationReason, revocationTime: v.revoked.revocationTime, reason: v.revoked.reason }), parsedResponse, wantNonce, nonce);
       if (v.sawGood) return _withNonceRule(guard.verdict.of({ status: "good", responderAuthorized: true, signatureValid: true, matched: true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, reason: "good" }), parsedResponse, wantNonce, nonce);
       return _withNonceRule(guard.verdict.of({ status: "unknown", responderAuthorized: v.responderAuthorized === true, signatureValid: v.signatureValid === true, matched: v.matched === true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, reason: v.reason }), parsedResponse, wantNonce, nonce);
@@ -2714,6 +2802,7 @@ function assertAnchorConstraints(ta, checkPurpose) {
 
 function resolvePurposeOpts(opts) {
   var requiredEku = null;
+  // allow:caller-option-presence-tested-against-undefined -- absence means no EKU is required, so a null must be refused rather than drop the restriction
   if (opts.requiredEku !== undefined) {
     if (!intrinsic.isArray(opts.requiredEku) || opts.requiredEku.length === 0) {
       throw E("path/bad-input", "validate: opts.requiredEku must be a non-empty array of key-purpose OID names or dotted OID strings");
@@ -2727,6 +2816,7 @@ function resolvePurposeOpts(opts) {
     });
   }
   var checkPurpose = null;
+  // allow:caller-option-presence-tested-against-undefined -- absence means no purpose is checked, so a null must be refused rather than drop the check
   if (opts.checkPurpose !== undefined) {
     if (typeof opts.checkPurpose !== "string" || opts.checkPurpose.length === 0) {
       throw E("path/bad-input", "validate: opts.checkPurpose must be a key-purpose OID name or dotted OID string");
@@ -3499,6 +3589,7 @@ async function _fetchAiaIssuers(current, aia) {
  * @opts  maxAiaPerCert          Cap on caIssuers URLs tried per certificate (default `C.LIMITS.PATH_AIA_MAX_PER_CERT`).
  * @opts  aiaTimeout             Per-fetch timeout in ms, forwarded to the transport.
  * @opts  maxResponseBytes       Per-fetch response size cap, forwarded to the transport (tightenable downward only).
+ * @opts  distrustedKeys         SHA-256 SubjectPublicKeyInfo digests refused on every path `validate` is handed (see `pki.path.validate`). It is read once at this door, refused with `path/bad-input` when malformed even if no path assembles, and refused alongside `validate: false`. A path through a distrusted intermediate or anchor fails, so the search backtracks to another, such as a cross-certificate to a different root.
  * @opts  (validate options)     Every `pki.path.validate` option (`requiredEku`, `revocationChecker`, `checkPurpose`, the initial policy inputs, ...) is forwarded unchanged. `requireRevocation` and the three policy inputs are typed at this door as well as at `validate`'s, because a build reaches an AIA fetch before it reaches `validate` and a build that assembles no path never calls it. When `userInitialPolicySet` is supplied, build returns the accepted path whose user-constrained policy set best satisfies it (RFC 4158 sec. 4 forward policy chaining) rather than the first accepted path; `validate` still gates every path, so this changes only which valid path is chosen. The ranking explores more of the candidate graph than a first-accept build, so it is bounded by `maxCandidatesConsidered` like the rest of the search. Reaching that cap means stop looking, not nothing found: if a valid path was already accepted, build returns the best-policy one of those; it reaches `path/build-limit` only when the cap is hit before any valid path is accepted. An `anyPolicy` entry makes the set unconstrained, so ranking is skipped and the first accepted path is returned.
  * @example
  *   var pair = await pki.key.generate("Ed25519");
@@ -3523,6 +3614,21 @@ var _BUILD_OPTS = (function () {
   return o;
 })();
 
+/** @internal The TLS policy for the AIA host, checked and copied at the build door. An AIA fetch fault
+ *  is a silent skip, so a misspelled key or a malformed distrust list that reached the transport
+ *  would only ever show as an intermediate that was not fetched. */
+function _aiaTls(tls) {
+  if (tls == null) return intrinsic.create(null);
+  guard.identifier.assertKnownKeys(tls, httpTransport.TLS_KEYS, E, "path/bad-input", "build: opts.tls has an unknown option ");
+  /** @internal Each setting the transport reads is taken by value, inherited or own, as the transport
+   *  reads the bag. */
+  var copy = guard.identifier.pickSettings(tls, intrinsic.keys(httpTransport.TLS_KEYS));
+  if (copy.distrustedKeys != null) {
+    copy.distrustedKeys = guard.distrust.keys(copy.distrustedKeys, E, "path/bad-input", "build: opts.tls.distrustedKeys");
+  }
+  return copy;
+}
+
 async function build(leaf, opts) {
   opts = guard.identifier.optionsObject(opts, E, "path/bad-input", "build: opts");
   guard.identifier.assertKnownKeys(opts, _BUILD_OPTS, E, "path/bad-input",
@@ -3565,11 +3671,19 @@ async function build(leaf, opts) {
       }
     });
   }
+  /** @internal Typed and copied at this door for the reason the switches are: a build that
+   * assembles no path never reaches `validate`, and every path it does assemble is validated after
+   * an await. Every `validate` call is handed this copy. */
+  var buildDistrusted = guard.distrust.keys(opts.distrustedKeys, E, "path/bad-input", "build: opts.distrustedKeys");
+  if (!doValidateOpt && buildDistrusted !== null && buildDistrusted.length > 0) {
+    throw E("path/bad-input", "build: opts.distrustedKeys refuses keys during validation, and opts.validate is false, " +
+      "which returns the ordered path without validating; drop one of the two");
+  }
   var leafCert;
   try { leafCert = coerceCert(leaf); }
   catch (e) { throw E("path/bad-input", "build: the leaf certificate did not parse", e); }
 
-  var poolInput = opts.candidates !== undefined ? opts.candidates : opts.intermediates;
+  var poolInput = opts.candidates != null ? opts.candidates : opts.intermediates;
   if (poolInput === undefined) poolInput = [];
   if (!intrinsic.isArray(poolInput)) throw E("path/bad-input", "build: opts.candidates must be an array of certificates");
   var poolCeiling = constants.LIMITS.PATH_BUILD_MAX_CANDIDATES;
@@ -3604,7 +3718,7 @@ async function build(leaf, opts) {
   var maxConsidered = guard.limits.cap(opts.maxCandidatesConsidered, "build: opts.maxCandidatesConsidered", poolCeiling, { E: E, code: "path/bad-input", min: 1 });
   var doValidate = doValidateOpt;
 
-  var direction = opts.direction !== undefined ? opts.direction : "forward";
+  var direction = opts.direction != null ? opts.direction : "forward";
   if (direction !== "forward" && direction !== "reverse" && direction !== "auto") {
     throw E("path/bad-input", "build: opts.direction must be \"forward\", \"reverse\", or \"auto\", got " + guard.text.showValue(opts.direction));
   }
@@ -3613,7 +3727,7 @@ async function build(leaf, opts) {
 
   var aiaCtx = null;
   if (opts.fetchAia === true) {
-    if (opts.aiaTimeout !== undefined) {
+    if (opts.aiaTimeout != null) {
       guard.limits.cap(opts.aiaTimeout, "build: opts.aiaTimeout", 1, { E: E, code: "path/bad-input", min: 1, max: httpTransport.MAX_TIMEOUT });
     }
     var aiaTransport = checkedTransport || httpTransport.https({ E: E, errPrefix: "path" });
@@ -3625,7 +3739,7 @@ async function build(leaf, opts) {
        * hostname taken from a certificate would be opened on that promise.
        * @guard-via guard.identifier.declaresOwn */
       transportGuardsAddresses: guard.identifier.declaresOwn(aiaTransport, "blocksPrivateAddresses"),
-      tls: opts.tls != null ? opts.tls : intrinsic.create(null),
+      tls: _aiaTls(opts.tls),
       timeout: opts.aiaTimeout,
       maxResponseBytes: guard.limits.cap(opts.maxResponseBytes, "build: opts.maxResponseBytes", constants.LIMITS.PATH_AIA_MAX_RESPONSE_BYTES, { E: E, code: "path/bad-input", min: 1, max: constants.LIMITS.PATH_AIA_MAX_RESPONSE_BYTES }),
       maxPerCert: guard.limits.cap(opts.maxAiaPerCert, "build: opts.maxAiaPerCert", constants.LIMITS.PATH_AIA_MAX_PER_CERT, { E: E, code: "path/bad-input", min: 0 }),
@@ -3645,7 +3759,7 @@ async function build(leaf, opts) {
    * @guard-via guard.identifier.snapshotPresentOptions */
   var FORWARD_BY_VALUE = intrinsic.create(null);
   intrinsic.forEach(intrinsic.keys(_VALIDATE_OPTS), function (k) {
-    if (intrinsic.hasOwn(BUILD_ONLY_OPT, k) || intrinsic.hasOwn(forwardedSwitches, k)) return;
+    if (intrinsic.hasOwn(BUILD_ONLY_OPT, k) || intrinsic.hasOwn(forwardedSwitches, k) || k === "distrustedKeys") return;
     FORWARD_BY_VALUE[k] = 1;
   });
   var forwarded = guard.identifier.snapshotPresentOptions(opts, FORWARD_BY_VALUE);
@@ -3659,6 +3773,7 @@ async function build(leaf, opts) {
   });
   if (buildPermRaw != null) forwarded.initialPermittedSubtrees = buildPermSeeds;
   if (buildExclRaw != null) forwarded.initialExcludedSubtrees = buildExclSeeds;
+  if (buildDistrusted !== null) forwarded.distrustedKeys = buildDistrusted;
   function validateOpts(anchor) {
     var vo = Object.create(null);
     intrinsic.forEach(intrinsic.keys(forwarded), function (f) { vo[f] = forwarded[f]; });

package/lib/possession.js

@@ -118,7 +118,7 @@ var STATEMENT = schema.seq([
 });
 
 var KNOWN_VERIFY_OPTS = _assign(_create(null), {
-  trustAnchors: 1, time: 1, signatureCertificate: 1, intermediates: 1,
+  trustAnchors: 1, time: 1, signatureCertificate: 1, intermediates: 1, distrustedKeys: 1,
 });
 
 /** @internal Whether a certificate is the one an IssuerAndSerialNumber names. Both halves are compared,
@@ -345,6 +345,7 @@ var _isSignatureOnlyKey = pkix.signatureOnlyKeyOid(NS);
  *             that is present and is not a usable `Date` is `possession/bad-input`.
  * @opts signatureCertificate  The signature certificate, for a statement that omits it; refused when it is not the one `signer` names.
  * @opts intermediates  The rest of the signature certificate's path, when an intermediate CA issued it rather than an anchor directly. Ordered as `pki.path.validate` takes a path, from the certificate nearest an anchor down to the issuer of the signature certificate, which this verb appends. Omitted, the signature certificate is validated on its own, which succeeds only when an anchor issued it.
+ * @opts distrustedKeys  SHA-256 digests of SubjectPublicKeyInfo values (64 hex characters or 32 bytes each). A listed key on the anchor, an intermediate or the signature certificate makes `pathValidated` and `valid` false. A malformed list is `possession/bad-input`.
  *
  * @example
  *   var kem = await pki.key.generate({ name: "ML-KEM-768" });
@@ -382,6 +383,7 @@ function _verifyRequest(request, opts) {
   guard.identifier.assertKnownKeys(opts, KNOWN_VERIFY_OPTS, _err, "possession/bad-input",
     "pki.possession.verifyRequest has an unknown option: ");
   var o = guard.identifier.snapshotOptions(opts, KNOWN_VERIFY_OPTS);
+  var distrusted = guard.distrust.keys(o.distrustedKeys, _err, "possession/bad-input", "opts.distrustedKeys");
   if (o.trustAnchors == null || !_isArray(o.trustAnchors) || o.trustAnchors.length === 0) {
     throw _err("possession/bad-input",
       "opts.trustAnchors is required: RFC 9883 sec. 4 makes certification path validation of the signature certificate a MUST, and a verdict that skipped it would not answer the question asked");
@@ -522,8 +524,10 @@ function _verifyRequest(request, opts) {
       "authorize a certification request (RFC 5280 sec. 4.2.1.3)");
   }
 
+  var pathOpts = { trustAnchors: o.trustAnchors, time: at };
+  if (distrusted !== null) pathOpts.distrustedKeys = distrusted;
   return intrinsic.chain(
-    _promiseResolve(_Promise, _validatePath(chain, { trustAnchors: o.trustAnchors, time: at })),
+    _promiseResolve(_Promise, _validatePath(chain, pathOpts)),
     function (pathResult) {
       var pathValidated = pathResult.valid === true;
       if (!pathValidated) _push(reasons, "the signature certificate's certification path is not valid, and RFC 9883 sec. 4 makes that a MUST");

package/lib/related-cert.js

@@ -208,7 +208,7 @@ var KNOWN_VERIFY_OPTS = _assign(_create(null), { digestAlgorithm: 1, signatureAl
  *  an attacker's key verifies forever without it, and a verifier that cannot perform a MUST check must not
  *  answer true. `at` is the instant judged against, for a caller reading a request recorded earlier. */
 function _assertFresh(requestTime, o) {
-  if (o.maxAge === undefined) {
+  if (o.maxAge == null) {
     throw _err("relatedcert/no-freshness-policy",
       "pki.relatedCert.verifyRequest needs opts.maxAge, the seconds a requestTime may be old: RFC 9763 " +
       "sec. 3.2 requires the certification authority to check that it is sufficiently fresh and leaves " +
@@ -217,7 +217,7 @@ function _assertFresh(requestTime, o) {
   }
   var maxAge = guard.range.authoredInteger(o.maxAge, _err, "relatedcert/bad-input", "opts.maxAge");
   if (maxAge < 0n) throw _err("relatedcert/bad-input", "opts.maxAge must not be negative");
-  var at = o.at === undefined ? new intrinsic.Date() : o.at;
+  var at = o.at == null ? new intrinsic.Date() : o.at;
   if (!guard.time.isDate(at)) throw _err("relatedcert/bad-input", "opts.at must be a Date");
   guard.time.assertValid(at, _err, "relatedcert/bad-input", "opts.at");
   var atMs = guard.time.instantOf(at);