@blamejs/pki 0.9.6 → 0.9.7

package/lib/guard-distrust.js

@@ -9,6 +9,7 @@ var constants = require("./constants");
 var gBytes = require("./guard-bytes");
 var gList = require("./guard-list");
 var gCrypto = require("./guard-crypto");
+var compromisedKeys = require("./compromised-keys");
 
 var _freeze = intrinsic.freeze;
 var _isArray = intrinsic.isArray;
@@ -182,17 +183,119 @@ function keyDigest(spkiBytes) {
   return digest(canonical !== null ? canonical : spkiBytes);
 }
 
-/** Whether the key `spkiBytes` names is on `list`, a value `keys` returned. A `null` or empty list
- * answers `false`. The digest of the bytes as given is compared, and so is `keyDigest`, so an entry
- * `keyDigest` computed matches the key however a certificate encodes it (a compressed EC point, RSA
- * parameters without NULL), and an entry computed over raw bytes matches a certificate with the same
- * bytes.
+/** @internal The built-in list, keyed by digest. */
+var COMPROMISED = _create(null);
+for (var _ci = 0; _ci < compromisedKeys.KEYS.length; _ci++) COMPROMISED[compromisedKeys.KEYS[_ci].spkiSha256] = compromisedKeys.KEYS[_ci];
+
+/** @internal The curves the small-scalar table is built for, by JWK curve name, with the width of a
+ *  coordinate in bytes, and the scalar bound. Each table holds the x-coordinates of d*G for d from 1
+ *  to the bound minus one, built once per curve on first use (measured on Node 26: 4 ms for P-256,
+ *  138 ms for P-384, 321 ms for P-521). The points d*G and (n-d)*G share an x-coordinate, so one
+ *  comparison covers both. */
+var SMALL_SCALAR_CURVES = intrinsic.assign(_create(null), {
+  "P-256": { name: "prime256v1", width: 32 },
+  "P-384": { name: "secp384r1", width: 48 },
+  "P-521": { name: "secp521r1", width: 66 },
+  "secp256k1": { name: "secp256k1", width: 32 },
+});
+var SMALL_SCALAR_BOUND = 256;
+var _smallScalarTables = _create(null);
+function _smallScalarTable(curve) {
+  if (_smallScalarTables[curve.name]) return _smallScalarTables[curve.name];
+  var table = _create(null);
+  var scalar = intrinsic.bufferAlloc(curve.width);
+  for (var d = 1; d < SMALL_SCALAR_BOUND; d++) {
+    scalar[curve.width - 1] = d;
+    table[_bufToString(gCrypto.ecPointFromScalar(curve.name, scalar), "hex", 1, 1 + curve.width)] = true;
+  }
+  _smallScalarTables[curve.name] = table;
+  return table;
+}
+
+/** The curve name of an elliptic curve key whose private scalar is below 256, or below 256 short of
+ * the group order, or `null` for any other key. Anyone can recover such a private key from the public
+ * key by trying each candidate. The key is read through node's own import after an id-ecDH or
+ * id-ecMQV identifier is read as ecPublicKey, so a named or explicit curve and an uncompressed,
+ * compressed or hybrid point are all judged; a point that is not on the curve is not a key and
+ * answers `null`. The covered curves are P-256, P-384, P-521 and secp256k1.
+ *
+ * @enforced-by behavioral -- the defect is a curve or an encoding the table does not reach, which has
+ * no code shape; the guard is the per-curve and per-encoding vectors in guard-distrust.test.js and
+ * lint-key-compromise.test.js.
+ */
+function smallEcScalar(spkiBytes) {
+  var jwk;
+  try {
+    var spki = _unrestricted(spkiBytes, _codec());
+    var key = gCrypto.publicKey({ key: spki, format: "der", type: "spki" });
+    if (gCrypto.keyTypeOf(key) !== "ec") return null;
+    jwk = gCrypto.exportKey(key, { format: "jwk" });
+  } catch (_e) {
+    // allow:swallow-unverified a key node does not import as an elliptic curve point has no scalar to judge
+    return null;
+  }
+  var curve = typeof jwk.crv === "string" && _hasOwn(SMALL_SCALAR_CURVES, jwk.crv) ? SMALL_SCALAR_CURVES[jwk.crv] : null;
+  if (curve === null || typeof jwk.x !== "string") return null;
+  return _smallScalarTable(curve)[_bufToString(intrinsic.bufferFrom(jwk.x, "base64url"), "hex")] === true ? curve.name : null;
+}
+
+/** Why the private key of `spkiBytes` is public, as one sentence, or `null`. A key is compromised
+ * when its digest, as given or as `keyDigest` computes it, is on the list `pki.trust.knownCompromisedKeys()`
+ * returns, or when `smallEcScalar` answers a curve for it. Every verifier in this toolkit refuses such
+ * a key, with no option that turns the refusal off.
+ *
+ * @enforced-by behavioral -- the defect is a door that does not refuse, which has no rename-proof code
+ * shape; every door reaches this through `has`, and the guard is the compromised-key vector each verb
+ * carries.
+ */
+function compromised(spkiBytes) {
+  if (spkiBytes === null || spkiBytes === undefined) return null;
+  var entry = COMPROMISED[digest(spkiBytes)] || COMPROMISED[keyDigest(spkiBytes)];
+  if (entry) return "the key is the published key of " + entry.name + ": " + entry.reason;
+  var curve = smallEcScalar(spkiBytes);
+  if (curve !== null) return "the " + curve + " private key is an integer below " + SMALL_SCALAR_BOUND + ", so anyone can recover it from the public key";
+  return null;
+}
+
+/** Throws `E(code, ...)` when `compromised(spkiBytes)` answers, naming the key by `label` and saying
+ * why its private key is public. A verb that certifies a key, signs with one or requests a
+ * certificate for one calls this on each key it is handed.
+ *
+ * @enforced-by behavioral -- the defect is a signing verb that does not call this, which has no
+ * rename-proof code shape; the guard is the compromised-key vector each signing verb carries.
+ */
+function refuseCompromised(spkiBytes, E, code, label) {
+  var why = compromised(spkiBytes);
+  if (why !== null) throw E(code, label + " is a compromised key: " + why);
+}
+
+/** Why the key `spkiBytes` names is refused, as the end of a sentence about the key, or `null` when
+ * `has(list, spkiBytes)` is false: "is a compromised key: " and the `compromised` reason, or "is
+ * listed in " and `label`, the option the caller's list came from.
+ *
+ * @enforced-by behavioral -- a message has no rename-proof code shape; the guard is the vectors that
+ * assert each door's message names a compromised key as one and a listed key as listed.
+ */
+function refusal(list, spkiBytes, label) {
+  var why = compromised(spkiBytes);
+  if (why !== null) return "is a compromised key: " + why;
+  return has(list, spkiBytes) ? "is listed in " + label : null;
+}
+
+/** Whether the key `spkiBytes` names is refused: it is compromised (see `compromised`), or it is on
+ * `list`, a value `keys` returned. A `null` or empty list still refuses a compromised key. The digest
+ * of the bytes as given is compared with the list, and so is `keyDigest`, so an entry `keyDigest`
+ * computed matches the key however a certificate encodes it (a compressed EC point, RSA parameters
+ * without NULL), and an entry computed over raw bytes matches a certificate with the same bytes.
  *
  * @enforced-by behavioral -- membership has no rename-proof code shape; the RED vectors are the
- * listed-key refusals at each verb, and the re-encodings in guard-distrust.test.js in both directions.
+ * listed-key and compromised-key refusals at each verb, and the re-encodings in guard-distrust.test.js
+ * in both directions.
  */
 function has(list, spkiBytes) {
-  if (list === null || list === undefined || list.length === 0 || spkiBytes === null || spkiBytes === undefined) return false;
+  if (spkiBytes === null || spkiBytes === undefined) return false;
+  if (compromised(spkiBytes) !== null) return true;
+  if (list === null || list === undefined || list.length === 0) return false;
   if (gList.contains(list, digest(spkiBytes))) return true;
   return gList.contains(list, keyDigest(spkiBytes));
 }
@@ -221,4 +324,21 @@ function union(a, b) {
   return _freeze(out);
 }
 
-module.exports = _freeze({ keys: keys, digest: digest, keyDigest: keyDigest, has: has, union: union });
+/** A copy of the built-in list: one `{ spkiSha256, name, reason, sources }` record per key, each
+ * frozen, in a new array the caller may change.
+ *
+ * @enforced-by behavioral -- a copy has no rename-proof code shape; the guard is the vector that
+ * changes the returned array and reads the list again.
+ */
+function knownCompromised() {
+  var out = [];
+  for (var i = 0; i < compromisedKeys.KEYS.length; i++) gList.append(out, compromisedKeys.KEYS[i]);
+  return out;
+}
+
+module.exports = _freeze({
+  keys: keys, digest: digest, keyDigest: keyDigest, has: has, union: union,
+  compromised: compromised, refuseCompromised: refuseCompromised, refusal: refusal,
+  smallEcScalar: smallEcScalar, knownCompromised: knownCompromised,
+  SMALL_SCALAR_BOUND: SMALL_SCALAR_BOUND,
+});

package/lib/guard-verdict.js

@@ -9,6 +9,19 @@ var _defineProperty = require("./guard-intrinsic").defineProperty;
 var _getOwnPropertyDescriptor = require("./guard-intrinsic").getOwnPropertyDescriptor;
 var _hasOwn = require("./guard-intrinsic").hasOwn;
 var _Object = require("./guard-intrinsic").Object;
+var _create = require("./guard-intrinsic").create;
+
+/** @internal A writable, configurable data descriptor with no prototype. A descriptor written as an
+ *  object literal inherits from `Object.prototype`, and `defineProperty` reads `get` and `set` through
+ *  that chain, so an inherited `get` beside the `value` made every define here throw. */
+function _data(value, enumerable) {
+  var d = _create(null);
+  d.value = value;
+  d.enumerable = enumerable;
+  d.configurable = true;
+  d.writable = true;
+  return d;
+}
 
 function _copyOwn(out, src) {
   var keys = _keys(src);
@@ -16,7 +29,7 @@ function _copyOwn(out, src) {
     var d = _getOwnPropertyDescriptor(src, keys[i]);
     if (!d) continue;
     var value = _hasOwn(d, "value") ? d.value : src[keys[i]];
-    _defineProperty(out, keys[i], { value: value, enumerable: true, configurable: true, writable: true });
+    _defineProperty(out, keys[i], _data(value, true));
   }
 }
 
@@ -49,7 +62,7 @@ function shield(target) {
      * machinery looks, and reading it to decide would be the one read that does not count. */
     if (d && _hasOwn(d, "value") && typeof d.value !== "function") return target;
   }
-  _defineProperty(target, "then", { value: undefined, enumerable: false, configurable: true, writable: true });
+  _defineProperty(target, "then", _data(undefined, false));
   return target;
 }
 
@@ -68,7 +81,7 @@ function carries(obj, key) {
 
 // @enforced-by behavioral -- for a target that cannot be rebuilt, an Error carrying a field a
 function set(target, key, value) {
-  _defineProperty(target, key, { value: value, enumerable: true, configurable: true, writable: true });
+  _defineProperty(target, key, _data(value, true));
   /** @internal The target leaves here carrying the sentinel as well. A field set on an object is the
    * same kind of value a verdict is, and a target that reached a promise resolution without one would
    * hand the lookup to Object.prototype however it was assembled. */

package/lib/http-transport.js

@@ -295,10 +295,60 @@ function _systemCa() {
     // allow:swallow-unverified an unreadable platform store answers empty, and an empty list is refused by every caller
     try { var c = intrinsic.apply(_getCACertificates, nodeTls, ["system"]); if (_isArray(c)) out = _concatList(out, c); } catch (_e) { }
   }
-  _systemCaCache = out;
+  _systemCaCache = _withoutCompromised(out);
+  return _systemCaCache;
+}
+
+/** @internal `pems` without the entries holding a certificate whose key is compromised
+ *  (`guard.distrust.compromised`), so the TLS layer cannot verify a session through one. An entry
+ *  this reader cannot decode is kept: `_anchorKeySet` reports no certificate for it. */
+function _withoutCompromised(pems) {
+  var out = [];
+  for (var i = 0; i < pems.length; i++) {
+    var entries = _anchorKeySet([pems[i]]).entries;
+    var listed = false;
+    for (var j = 0; j < entries.length && !listed; j++) listed = guard.distrust.compromised(entries[j].spki) !== null;
+    if (!listed) _arrPush(out, pems[i]);
+  }
   return out;
 }
 
+/** @internal Throws `E(code, ...)` when a caller's anchor carries a compromised key. `pems` is the
+ *  list `_pemifyAnchors` returns, and an entry may hold several certificates. */
+function _refuseCompromisedAnchors(pems, E, code, label) {
+  var keys = _anchorKeySet(pems).entries;
+  for (var i = 0; i < keys.length; i++) {
+    var why = guard.distrust.compromised(keys[i].spki);
+    if (why !== null) throw E(code, label + " holds a certificate with a compromised key: " + why);
+  }
+}
+
+/** @internal The first compromised key on node's walk of the peer chain, as `{ digest, compromised }`;
+ *  `{ unchecked: reason }` when the walk is longer than `LIMITS.PATH_MAX_CERTS` certificates, so part
+ *  of it would go unread; or null. The walk is read as node builds it and no link is proven: the check
+ *  refuses on a hit and does not refuse a walk whose links it cannot prove. This runs
+ *  inside node's `checkServerIdentity` call, which node makes without a `try`, so nothing here may
+ *  throw. */
+function _compromisedOnWalk(cert) {
+  var cur = cert;
+  for (var n = 0; cur && _isBuffer(cur.raw); n++) {
+    if (n >= constants.LIMITS.PATH_MAX_CERTS) {
+      return { unchecked: "the chain is longer than the " + constants.LIMITS.PATH_MAX_CERTS + " certificates the check reads" };
+    }
+    var spki;
+    try { spki = _peerSpki(cur.raw); }
+    catch (_e) {
+      // allow:swallow-unverified a certificate whose key neither reader returns is not a hit here; a non-empty tls.distrustedKeys refuses it as unproven
+      spki = null;
+    }
+    var why = spki === null ? null : guard.distrust.compromised(spki);
+    if (why !== null) return { digest: guard.distrust.digest(spki), compromised: why };
+    if (cur.issuerCertificate === cur) return null;
+    cur = cur.issuerCertificate;
+  }
+  return null;
+}
+
 /** @internal The DER SubjectPublicKeyInfo of a certificate the TLS layer verified. The toolkit's
  *  parser is reached through an inline require because of a circular load (schema-x509 ->
  *  schema-pkix -> ct -> this module). A certificate the strict parser refuses was still accepted by
@@ -405,7 +455,7 @@ function _storeBranchListed(childX509, anchors, list, visited) {
     }
     if (!issues) continue;
     _arrPush(visited, e);
-    if (guard.distrust.has(list, e.spki)) return guard.distrust.digest(e.spki);
+    if (guard.distrust.has(list, e.spki)) return e.spki;
     var above = _storeBranchListed(e.x509, anchors, list, visited);
     if (above !== null) return above;
   }
@@ -437,15 +487,20 @@ function _distrustedInChain(cert, list, anchors) {
     if (seen.length >= constants.LIMITS.PATH_MAX_CERTS) {
       return { unproven: "the chain is longer than the " + constants.LIMITS.PATH_MAX_CERTS + " certificates the check reads" };
     }
-    var spki = _peerSpki(cur.raw);
-    if (guard.distrust.has(list, spki)) return { digest: guard.distrust.digest(spki) };
+    var spki;
+    try { spki = _peerSpki(cur.raw); }
+    catch (_pe) {
+      // allow:swallow-unverified a certificate whose key neither reader returns cannot be checked, so the walk is unproven
+      return { unproven: "the key of a certificate on the chain could not be read" };
+    }
+    if (guard.distrust.has(list, spki)) return _keyHit(spki);
     var storeHit;
     try { storeHit = _storeBranchListed(new _X509Certificate(cur.raw), anchors, list, visitedStore); }
     catch (_se) {
       // allow:swallow-unverified a certificate node cannot read leaves the store branches unchecked, so the walk is unproven
       return { unproven: "a certificate on the chain could not be compared with the trust store" };
     }
-    if (storeHit !== null) return { digest: storeHit };
+    if (storeHit !== null) return _keyHit(storeHit);
     var up = cur.issuerCertificate;
     if (up === cur) {
       return anchors.keys[guard.distrust.keyDigest(spki)] === true ? null
@@ -463,23 +518,53 @@ function _distrustedInChain(cert, list, anchors) {
   }
 }
 
+/** @internal A refused key as `{ digest, compromised }`, where `compromised` is the reason
+ *  `guard.distrust.compromised` gives, or null for a key refused only by the caller's list. */
+function _keyHit(spki) {
+  return { digest: guard.distrust.digest(spki), compromised: guard.distrust.compromised(spki) };
+}
+
 function _distrustError(hit, hop) {
-  var e = new Error(hit.digest !== undefined
+  var e;
+  if (hit.compromised || hit.unchecked) {
+    e = new Error(hit.compromised
+      ? "the " + hop + " certificate chain carries a compromised key (SubjectPublicKeyInfo SHA-256 " + hit.digest + "): " + hit.compromised
+      : "the " + hop + " certificate chain could not be checked for a compromised key: " + hit.unchecked);
+    return guard.verdict.set(e, "pkiCompromisedKey", hop);
+  }
+  e = new Error(hit.digest !== undefined
     ? "the " + hop + " certificate chain carries a key listed in tls.distrustedKeys (SubjectPublicKeyInfo SHA-256 " + hit.digest + ")"
     : "the " + hop + " certificate chain could not be checked against tls.distrustedKeys: " + hit.unproven);
-  e.pkiDistrustedKey = hop;
-  return e;
+  return guard.verdict.set(e, "pkiDistrustedKey", hop);
 }
 
-/** @internal An identity check that also refuses a chain carrying a distrusted key. The identity
- *  verdict comes first, so a name mismatch is still reported as one. */
+/** @internal An identity check that also refuses a chain carrying a compromised or distrusted key.
+ *  With no list, the chain node walks is checked for a compromised key (`_compromisedOnWalk`); with a
+ *  list, the walk is held to the proof `_distrustedInChain` describes, and a key on the list or a
+ *  compromised key anywhere on it refuses the session. The chain is read before the identity check
+ *  runs, because a caller's hook receives the same certificate object and can change it. The identity
+ *  verdict is returned first, so a name mismatch is still reported as one. Node calls this without a
+ *  `try`, so a hook that throws is returned as the refusal, and the refusal is built before the hook
+ *  runs. Anything else in the body that throws, such as a read a changed prototype answers, returns a
+ *  refusal built from string concatenation alone. */
 function _withDistrust(check, list, hop, anchorKeys) {
-  if (list === null || list.length === 0) return check;
+  var strict = list !== null && list.length > 0;
   return function (host, cert) {
-    var err = check(host, cert);
-    if (err) return err;
-    var hit = _distrustedInChain(cert, list, anchorKeys);
-    return hit === null ? undefined : _distrustError(hit, hop);
+    try {
+      var hit = strict ? _distrustedInChain(cert, list, anchorKeys) : _compromisedOnWalk(cert);
+      var refusal = hit === null ? undefined : _distrustError(hit, hop);
+      var err;
+      try { err = check(host, cert); }
+      catch (e) {
+        var thrown = new Error("the " + hop + " identity check (tls.checkServerIdentity) threw: " + guard.text.describeThrown(e));
+        return guard.verdict.set(thrown, "cause", e);
+      }
+      if (err) return err;
+      return refusal;
+    } catch (_e) {
+      // allow:swallow-unverified the throw is returned as a refusal of the session, which is the verdict a failed check has to give
+      return new Error("the " + hop + " certificate chain could not be checked");
+    }
   };
 }
 
@@ -539,8 +624,7 @@ function _isBlockedIp(ip) {
 
 function _blockedAddrErr(hostname, address) {
   var e = new Error("refusing to connect to " + hostname + " -> " + address + " (private / loopback / link-local address blocked)");
-  e.pkiBlockedAddress = true;
-  return e;
+  return guard.verdict.set(e, "pkiBlockedAddress", true);
 }
 function _makeGuardedLookup(lookupFn) {
   return function guardedLookup(hostname, options, callback) {
@@ -594,6 +678,8 @@ function _hasWordBounded(l, word) {
 function _isLowerWordChar(c) { return (c >= 97 && c <= 122) || (c >= 48 && c <= 57) || c === 95; }
 function _classifyError(e, C) {
   if (e && e.pkiBlockedAddress) return C("blocked-address");
+  if (e && e.pkiCompromisedKey === "proxy") return C("proxy-key-compromised");
+  if (e && e.pkiCompromisedKey === "server") return C("server-key-compromised");
   if (e && e.pkiDistrustedKey === "proxy") return C("proxy-key-distrusted");
   if (e && e.pkiDistrustedKey === "server") return C("server-key-distrusted");
   var s = _stringOf((e && e.code) || "") + " " + _stringOf((e && e.message) || "");
@@ -759,7 +845,11 @@ function _validateProxy(request, defaults, E, C, originHost, originStatedPort, o
      * consult `Symbol.isConcatSpreadable` on each argument, so capturing the method leaves the
      * SPREADING replaceable and an inherited hook replaced a validated anchor with another one in
      * the CONNECT options. `concatList` copies own indexes and appends own indexes. */
-    if (pHasAnchors) pCa = _concatList(pCa, _pemifyAnchors(pAnchors));
+    if (pHasAnchors) {
+      var pPems = _pemifyAnchors(pAnchors);
+      _refuseCompromisedAnchors(pPems, E, C("bad-proxy"), "opts.proxy.tls.anchors");
+      pCa = _concatList(pCa, pPems);
+    }
     if (pUseSystem) pCa = _concatList(pCa, _systemCa());
     if (pCa.length === 0) {
       throw E(C("no-trust-anchors"), "proxy.tls.useSystemStore is set and the platform certificate store returned no certificates, " +
@@ -814,6 +904,7 @@ function _digestProxyCredential(headers, pinfo, C, E) {
   }, E);
 }
 function _proxyErrorClass(e, C) {
+  if (e && e.pkiCompromisedKey === "proxy") return C("proxy-key-compromised");
   if (e && e.pkiDistrustedKey === "proxy") return C("proxy-key-distrusted");
   var code = _stringOf((e && e.code) || "");
   if (_strIndexOf(code, "ERR_TLS") === 0 || _strIndexOf(code, "ERR_SSL") === 0 || _strIndexOf(code, "SSL") !== -1 ||
@@ -844,8 +935,21 @@ function _proxyErrorClass(e, C) {
  * (`transport/no-trust-anchors`), a body over the streaming
  * cap (`transport/response-too-large`), a stalled socket (`transport/timeout`), a below
  * -floor negotiation (`transport/tls-floor`), a failed server authentication
- * (`transport/server-auth-failed`), or a verified chain carrying a distrusted key
+ * (`transport/server-auth-failed`), a chain carrying a key whose private key is public
+ * (`transport/server-key-compromised`), or a verified chain carrying a distrusted key
  * (`transport/server-key-distrusted`) all fail closed; `rejectUnauthorized` is always on.
+ * The compromised-key check runs on every connection and hop with no option to turn it off: a
+ * certificate on the chain node reports whose key is on `pki.trust.knownCompromisedKeys()`, or is an
+ * elliptic curve key whose private key is an integer below 256, refuses the server
+ * (`transport/proxy-key-compromised` for a proxy). That chain is the one node builds from the
+ * certificates the server sent and the trust store, and a link of it is not proven; set
+ * `tls.distrustedKeys` for the proven walk described below, which applies the same compromised keys.
+ * A chain longer than `C.LIMITS.PATH_MAX_CERTS` is refused with the same code, and the chain is read
+ * before a `tls.checkServerIdentity` hook runs. A hook that throws refuses the server with
+ * `transport/server-auth-failed`.
+ * A `tls.anchors` or `proxy.tls.anchors` certificate whose key is compromised is refused with
+ * `transport/bad-input` or `transport/bad-proxy` before any connection, and under `useSystemStore`
+ * such a certificate in the platform store is left out of the certificates the connection trusts.
  * A protocol client passes its own error factory (`defaults.E`) + `defaults.errPrefix`
  * to surface domain codes (`est/...`). The transport owns no HTTP/redirect/auth
  * semantics; those live in the message layer that consumes the response triple.
@@ -1005,7 +1109,11 @@ function httpsTransport(defaults) {
     if (typeof sni !== "string") throw E(C("bad-input"), "tls.servername must be a string, got " + guard.text.showValue(sni));
     if (sni && !_isIP(sni)) options.servername = sni;
     var caList = [];
-    if (hasAnchors) caList = _concatList(caList, _pemifyAnchors(anchors));
+    if (hasAnchors) {
+      var anchorPems = _pemifyAnchors(anchors);
+      _refuseCompromisedAnchors(anchorPems, E, C("bad-input"), "tls.anchors");
+      caList = _concatList(caList, anchorPems);
+    }
     if (useSystem) caList = _concatList(caList, systemCa);
     if (caList.length) options.ca = caList;
     if (cert) options.cert = cert;

package/lib/lint.js

@@ -3937,49 +3937,21 @@ var RFC5480_RULES = [
   },
 ];
 
-/** @internal The curves the small-scalar table is built for, and the scalar bound. Each table holds
- *  the x-coordinates of d*G for d from 1 to the bound minus one, built once per curve on first use
- *  (measured on Node 26: 4 ms for P-256, 138 ms for P-384, 321 ms for P-521). The points d*G and
- *  (n-d)*G share an x-coordinate, so one comparison covers both. */
-var SMALL_SCALAR_WIDTH = intrinsic.assign(intrinsic.create(null), { prime256v1: 32, secp384r1: 48, secp521r1: 66, secp256k1: 32 });
-var SMALL_SCALAR_BOUND = 256;
-var _smallScalarTables = intrinsic.create(null);
-function _smallScalarTable(curve) {
-  if (_smallScalarTables[curve]) return _smallScalarTables[curve];
-  var width = SMALL_SCALAR_WIDTH[curve];
-  var table = intrinsic.create(null);
-  var scalar = intrinsic.bufferAlloc(width);
-  for (var d = 1; d < SMALL_SCALAR_BOUND; d++) {
-    scalar[width - 1] = d;
-    var point = guard.crypto.ecPointFromScalar(curve, scalar);
-    table[intrinsic.bufToString(point, "hex", 1, 1 + width)] = true;
-  }
-  _smallScalarTables[curve] = table;
-  return table;
-}
-/** @internal The JWK curve names the table covers, mapped to the curve names this file reports. */
-var SMALL_SCALAR_JWK_CURVES = intrinsic.assign(intrinsic.create(null), {
-  "P-256": "prime256v1", "P-384": "secp384r1", "P-521": "secp521r1", "secp256k1": "secp256k1",
-});
-/** @internal The curve and the x-coordinate of an elliptic curve subject key, read through node's own
- *  import, or null. The import accepts a named or explicit curve and an uncompressed, compressed or
- *  hybrid point, and it refuses a point that is not on the curve, so a key that is not one reports
- *  nothing here. */
-function _ecKeyCoordinate(spki) {
-  try {
-    var jwk = guard.crypto.exportKey(guard.crypto.publicKey({ key: spki.bytes, format: "der", type: "spki" }), { format: "jwk" });
-    var curve = SMALL_SCALAR_JWK_CURVES[jwk.crv];
-    if (curve === undefined || typeof jwk.x !== "string") return null;
-    return { curve: curve, x: intrinsic.bufToString(intrinsic.bufferFrom(jwk.x, "base64url"), "hex") };
-  } catch (_e) {
-    // allow:swallow-unverified a subject key node does not import is not an elliptic curve point this row can judge
-    return null;
-  }
-}
 function _isEcSubjectKey(cert) {
   var spki = cert.subjectPublicKeyInfo;
-  return !!spki && !!spki.algorithm && spki.algorithm.name === "ecPublicKey" && intrinsic.isBuffer(spki.bytes);
+  if (!spki || !spki.algorithm || !intrinsic.isBuffer(spki.bytes)) return false;
+  var n = spki.algorithm.name;
+  return n === "ecPublicKey" || n === "ecDH" || n === "ecMQV";
 }
+function _hasSubjectKey(cert) {
+  return !!cert.subjectPublicKeyInfo && intrinsic.isBuffer(cert.subjectPublicKeyInfo.bytes);
+}
+/** @internal The built-in list, keyed by digest, for the row that names a listed key. */
+var _COMPROMISED_BY_DIGEST = intrinsic.create(null);
+(function () {
+  var listed = guard.distrust.knownCompromised();
+  for (var i = 0; i < listed.length; i++) _COMPROMISED_BY_DIGEST[listed[i].spkiSha256] = listed[i];
+})();
 
 var KEY_COMPROMISE_RULES = [
   {
@@ -3988,9 +3960,19 @@ var KEY_COMPROMISE_RULES = [
     message: "the elliptic curve private key is a small integer, so anyone can recover it from the public key",
     appliesTo: _isEcSubjectKey,
     check: function (cert) {
-      var key = _ecKeyCoordinate(cert.subjectPublicKeyInfo);
-      if (key === null) return null;
-      return _smallScalarTable(key.curve)[key.x] === true ? { context: { curve: key.curve, scalarBelow: SMALL_SCALAR_BOUND } } : null;
+      var curve = guard.distrust.smallEcScalar(cert.subjectPublicKeyInfo.bytes);
+      return curve === null ? null : { context: { curve: curve, scalarBelow: guard.distrust.SMALL_SCALAR_BOUND } };
+    },
+  },
+  {
+    id: "lint/key-compromise/known-compromised-key", severity: "error", source: "key-compromise",
+    citation: "CABF TLS BR 6.1.1.3 (4)",
+    message: "the subject key is on the list of keys whose private key is public (pki.trust.knownCompromisedKeys)",
+    appliesTo: _hasSubjectKey,
+    check: function (cert) {
+      var bytes = cert.subjectPublicKeyInfo.bytes;
+      var entry = _COMPROMISED_BY_DIGEST[guard.distrust.digest(bytes)] || _COMPROMISED_BY_DIGEST[guard.distrust.keyDigest(bytes)];
+      return entry ? { context: { name: entry.name, spkiSha256: entry.spkiSha256 } } : null;
     },
   },
 ];

package/lib/path-validate.js

@@ -1443,6 +1443,14 @@ function _revocationRow(row, rv) {
  * and every cross-certificate for the same key. No revocation status is asked for a certificate at
  * or below a distrusted key, and a standalone `crlChecker`, `ocspChecker` or `fetchingChecker` given
  * the list in its context answers `"unknown"` for an issuer whose key is listed.
+ *
+ * A key whose private key is public is refused whether or not a list is given, and no option turns
+ * the refusal off: a key on `pki.trust.knownCompromisedKeys()`, and an elliptic curve key on P-256,
+ * P-384, P-521 or secp256k1 whose private key is an integer below 256. Such a key fails the path with
+ * `path/compromised-key`, in the `compromisedKey` row of the certificate that carries it or in the
+ * `compromisedIssuerKey` row of the certificate a trust anchor with such a key issued. A compromised
+ * key is reported in these rows rather than as distrusted when the list names it too, and the
+ * revocation checkers answer `"unknown"` for a compromised issuer as they do for a listed one.
  * `distrustedKeysApplied` reports whether a non-empty list was supplied. A malformed list is
  * `path/bad-input`.
  *
@@ -1699,6 +1707,7 @@ async function _validate(path, opts, run, scope) {
   var prefixAuthentic = true;
   var anchorDistrustApplied = false, anchorPurposeApplied = false;
   var distrusted = scope.distrusted;
+  var anchorKeyCompromised = guard.distrust.compromised(anchor.publicKey);
   var anchorKeyDistrusted = guard.distrust.has(distrusted, anchor.publicKey);
   /** @internal The first path index whose issuer chain holds a distrusted key: the anchor's key
    * makes it 0, a certificate's own key makes it that certificate. From there down, no revocation
@@ -1743,11 +1752,20 @@ async function _validate(path, opts, run, scope) {
     /** @internal The digest covers the SubjectPublicKeyInfo as the certificate encodes it, not the
      * working key, which carries parameters inherited from the issuer. A cross-signed certificate
      * carries the same encoded key as the certificate it duplicates, so one entry refuses both. */
-    if (idx === 0 && anchorKeyDistrusted) {
+    if (idx === 0 && anchorKeyCompromised !== null) {
+      guard.list.append(checks, { name: "compromisedIssuerKey", ok: false, code: "path/compromised-key" });
+      failed = true;
+    } else if (idx === 0 && anchorKeyDistrusted) {
       guard.list.append(checks, { name: "distrustedIssuerKey", ok: false, code: "path/distrusted-key" });
       failed = true;
     }
-    if (guard.distrust.has(distrusted, cert.subjectPublicKeyInfo.bytes) || guard.distrust.has(distrusted, _inheritedSpki(state, cert))) {
+    var inheritedSpki = _inheritedSpki(state, cert);
+    var keyCompromised = guard.distrust.compromised(cert.subjectPublicKeyInfo.bytes) || guard.distrust.compromised(inheritedSpki);
+    if (keyCompromised !== null) {
+      guard.list.append(checks, { name: "compromisedKey", ok: false, code: "path/compromised-key" });
+      failed = true;
+      if (distrustedFrom === -1) distrustedFrom = idx;
+    } else if (guard.distrust.has(distrusted, cert.subjectPublicKeyInfo.bytes) || guard.distrust.has(distrusted, inheritedSpki)) {
       guard.list.append(checks, { name: "distrustedKey", ok: false, code: "path/distrusted-key" });
       failed = true;
       if (distrustedFrom === -1) distrustedFrom = idx;
@@ -2239,8 +2257,9 @@ function crlChecker(crls, opts) {
       /** @internal Every CRL this checker takes is verified under the issuer's key, so a listed
        * issuer key leaves no CRL that can answer. */
       var distrusted = guard.distrust.keys(ctx.distrustedKeys, E, "path/bad-input", "crlChecker: ctx.distrustedKeys");
-      if (guard.distrust.has(distrusted, issuer.workingPublicKey)) {
-        return guard.verdict.of({ status: "unknown", reason: "the issuer's key is listed in distrustedKeys, so no CRL it signs is an answer" });
+      var issuerRefusal = guard.distrust.refusal(distrusted, issuer.workingPublicKey, "distrustedKeys");
+      if (issuerRefusal !== null) {
+        return guard.verdict.of({ status: "unknown", reason: "the issuer's key " + issuerRefusal + ", so no CRL it signs is an answer" });
       }
       var certIsCa = null, certScopeFault = null;
       try {

package/lib/revocation-fetch.js

@@ -778,8 +778,9 @@ function fetchingChecker(opts) {
        * caller's fault and is thrown, where a fetch fault below becomes an undetermined verdict. */
       var distrusted = guard.distrust.keys(ctx == null ? undefined : ctx.distrustedKeys, E, "path/bad-input",
         "fetchingChecker: ctx.distrustedKeys");
-      if (guard.distrust.has(distrusted, issuer.workingPublicKey)) {
-        return _unknown("the issuer's key is listed in distrustedKeys, so nothing it signs is an answer", [], []);
+      var issuerRefusal = guard.distrust.refusal(distrusted, issuer.workingPublicKey, "distrustedKeys");
+      if (issuerRefusal !== null) {
+        return _unknown("the issuer's key " + issuerRefusal + ", so nothing it signs is an answer", [], []);
       }
       var notes = [], skips = [];
       var budget = budgetFor(ctx == null ? null : ctx.run);