@blamejs/pki 0.9.6 → 0.9.7

package/lib/trust.js

@@ -1350,6 +1350,39 @@ function spkiDigest(cert) {
   return guard.distrust.keyDigest(spki);
 }
 
+/**
+ * @primitive  pki.trust.knownCompromisedKeys
+ * @signature  pki.trust.knownCompromisedKeys() -> Array<{ spkiSha256, name, reason, sources }>
+ * @since      0.9.7
+ * @status     stable
+ * @spec       CA/Browser Forum TLS BR
+ * @related    pki.trust.spkiDigest, pki.path.validate, pki.transport.https, pki.x509.sign
+ *
+ * The keys every verb in this toolkit refuses because their private key is public. Each record holds
+ * `spkiSha256`, the `pki.trust.spkiDigest` value of the key; `name`, the subject common name of a
+ * certificate that carries it, or the product's CA name for a key published without a certificate;
+ * `reason`, how the private key became public; and `sources`, the URLs where that is recorded. Each
+ * record is frozen, and the array is a new one on every call.
+ *
+ * The toolkit also refuses an elliptic curve key on P-256, P-384, P-521 or secp256k1 whose private key
+ * is an integer below 256, or below 256 short of the group order, whether or not it is listed here.
+ *
+ * Path validation fails a chain whose trust anchor, intermediate or target carries such a key with
+ * `path/compromised-key`. `pki.trust.systemAnchors` skips such a certificate with the reason
+ * `trust/compromised-key`. `pki.transport.https` refuses a server whose certificate chain carries one
+ * with `transport/server-key-compromised`, and a proxy with `transport/proxy-key-compromised`.
+ * `pki.x509.sign`, `pki.csr.sign` and `pki.crmf.build` refuse to certify, sign with or request a
+ * certificate for one, with `x509/compromised-key`, `csr/compromised-key` and `crmf/compromised-key`.
+ * None of these refusals can be turned off.
+ *
+ * @example
+ *   var listed = pki.trust.knownCompromisedKeys();
+ *   listed[0].spkiSha256.length;   // 64
+ */
+function knownCompromisedKeys() {
+  return guard.distrust.knownCompromised();
+}
+
 /**
  * @primitive  pki.trust.systemAnchors
  * @signature  pki.trust.systemAnchors(opts?) -> { anchors, intermediates, source, path, skipped }
@@ -1375,8 +1408,10 @@ function spkiDigest(cert) {
  * neither list.
  *
  * A certificate whose key is listed in `opts.distrustedKeys` is neither an anchor nor an
- * intermediate; it is listed in `skipped` with the reason `trust/distrusted-key`. A bundle left with
- * no anchor is refused with `trust/no-anchors`.
+ * intermediate; it is listed in `skipped` with the reason `trust/distrusted-key`. A certificate whose
+ * private key is public (see `pki.trust.knownCompromisedKeys`) is skipped the same way with the reason
+ * `trust/compromised-key`, whether or not a list is given. A bundle left with no anchor is refused
+ * with `trust/no-anchors`.
  *
  * A host whose roots are not in a readable PEM file is refused, and the refusal names the command
  * that exports them. macOS keeps its roots in a binary keychain and Windows in a registry-backed
@@ -1465,6 +1500,8 @@ function systemAnchors(opts) {
  * in an attribute value) is reported rather than thrown, so one malformed entry does not refuse the
  * whole bundle. */
 function _systemEntryRefusal(cert, distrusted) {
+  var compromised = guard.distrust.compromised(cert.subjectPublicKeyInfo.bytes);
+  if (compromised !== null) return { intermediate: false, reason: "trust/compromised-key: " + compromised };
   if (guard.distrust.has(distrusted, cert.subjectPublicKeyInfo.bytes)) {
     return { intermediate: false, reason: "trust/distrusted-key: the certificate's key is listed in opts.distrustedKeys" };
   }
@@ -1629,4 +1666,5 @@ module.exports = intrinsic.freeze({
   discoversBundles: discoversBundles,
   anchor: anchor,
   spkiDigest: spkiDigest,
+  knownCompromisedKeys: knownCompromisedKeys,
 });

package/lib/webauthn-mds.js

@@ -391,8 +391,9 @@ function _chainToAnchor(chain, anchors, at, what, code, distrusted) {
       var strippedAnchor = false;
       if (path.length && _isAnchorItself(path[0], anchor)) { path = intrinsic.copyList(path, 1); strippedAnchor = true; }
       if (path.length === 0) {
-        if (strippedAnchor && guard.distrust.has(distrusted, anchor.subjectPublicKeyInfo.bytes)) {
-          lastFault = _err(faultCode, "the " + subject + " is a trust anchor whose key is listed in opts.distrustedKeys");
+        var anchorRefusal = strippedAnchor ? guard.distrust.refusal(distrusted, anchor.subjectPublicKeyInfo.bytes, "opts.distrustedKeys") : null;
+        if (anchorRefusal !== null) {
+          lastFault = _err(faultCode, "the " + subject + " is a trust anchor whose key " + anchorRefusal);
           return false;
         }
         return strippedAnchor;

package/lib/x509-sign.js

@@ -384,11 +384,13 @@ function _resolveAltSigning(issuer, extSpec, issuerCert, selfSigned) {
     KNOWN_ALT_ISSUER_KEYS, _err, "x509/bad-input", "unknown alternative issuer field: ");
   var subjectAltSpki = _reqDer(subjectAltRaw, "extensions.subjectAltPublicKeyInfo (the subject's alternative SPKI DER)");
   _assertValidSpki(subjectAltSpki, "extensions.subjectAltPublicKeyInfo");
+  guard.distrust.refuseCompromised(subjectAltSpki, _err, "x509/compromised-key", "extensions.subjectAltPublicKeyInfo");
   if (issuer.altPublicKey == null) {
     throw _err("x509/bad-input", "an issuer altKey needs issuer.altPublicKey, the SPKI of its public half, to resolve the alternative signature algorithm");
   }
   var issuerAltSpki = _reqDer(issuer.altPublicKey, "issuer.altPublicKey (the issuer's alternative SPKI DER)");
   _assertValidSpki(issuerAltSpki, "issuer.altPublicKey");
+  guard.distrust.refuseCompromised(issuerAltSpki, _err, "x509/compromised-key", "issuer.altPublicKey");
   /** @internal Bound to the issuer, the way the native signature already is: its key is read OUT of
    *  issuer.cert, while this one arrives beside the certificate, so nothing otherwise stops a CA signing
    *  with a second alternative pair. Clause 9.8.4 has a relying party check an alternative signature with
@@ -555,7 +557,9 @@ function _hasCriticalSan(extSpec) {
  * fail-closed into its form (`"host.example"`, `"a@b.example"`, `"10.0.0.1"`, `"https://host.example/"`).
  * The signature algorithm is resolved from the signing key: RSA (PKCS#1 v1.5
  * or PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, or a composite arm, so every algorithm the
- * toolkit signs with is available here without a per-algorithm branch.
+ * toolkit signs with is available here without a per-algorithm branch. A subject key, issuer key or
+ * alternative key whose private key is public (see `pki.trust.knownCompromisedKeys`) is refused with
+ * `x509/compromised-key`.
  *
  * The version is derived from the field set (v3 when extensions are present, else v1). Two
  * extensions are emitted without being named, because RFC 5280 places them on the issuing CA: a
@@ -741,6 +745,7 @@ function _sign(spec, issuer, opts) {
 
   var spki = _reqDer(spec.subjectPublicKey, "spec.subjectPublicKey (the SPKI DER of the certified key)");
   _assertValidSpki(spki, "spec.subjectPublicKey");
+  guard.distrust.refuseCompromised(spki, _err, "x509/compromised-key", "spec.subjectPublicKey");
   var subjectDer = _encodeName(spec.subject == null ? [] : spec.subject);
   var subjectEmpty = _isEmptyName(subjectDer);
 
@@ -754,10 +759,12 @@ function _sign(spec, issuer, opts) {
     issuerPathLen = _assertIssuerIsCa(issuerCert);
     issuerDer = pkiBuild.tbsNameField(issuerCert, "subject");
     issuerSpki = issuerCert.subjectPublicKeyInfo.bytes;
+    guard.distrust.refuseCompromised(issuerSpki, _err, "x509/compromised-key", "the key of issuer.cert");
   } else {
     issuerDer = _encodeName(issuer.name == null ? [] : issuer.name);
     issuerSpki = _reqDer(issuer.publicKey, "issuer.publicKey (the issuer SPKI DER)");
     _assertValidSpki(issuerSpki, "issuer.publicKey");
+    guard.distrust.refuseCompromised(issuerSpki, _err, "x509/compromised-key", "issuer.publicKey");
   }
   if (_isEmptyName(issuerDer)) throw _err("x509/bad-issuer", "issuer must be a non-empty distinguished name");
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.9.6",
+  "version": "0.9.7",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:114691ca-67be-44e1-9f29-b49116312f56",
+  "serialNumber": "urn:uuid:1f2b6ec8-3dcd-4f4f-abc6-92aeb5ba8795",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-21T08:20:31.429Z",
+    "timestamp": "2026-10-21T20:18:37.023Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.9.6",
+      "bom-ref": "@blamejs/pki@0.9.7",
       "type": "application",
       "name": "pki",
-      "version": "0.9.6",
+      "version": "0.9.7",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.9.6",
+      "purl": "pkg:npm/%40blamejs/pki@0.9.7",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.9.6",
+      "ref": "@blamejs/pki@0.9.7",
       "dependsOn": []
     }
   ]