{
  "$comment": "The registry of every error code pkinative throws. The error-parity rule of scripts/verify-docs.ts keeps it in bidirectional sync with the code unions and class membership of src/types/pki-errors.ts, and checks that every throw site's message starts with 'pkinative: '. Codes are frozen from 0.8.0: removal or renaming is semver-major, addition semver-minor. PKCS#12 is the last subsystem that adds codes, so 0.8.0 is the first version at which the vocabulary is complete, and 0.9.0 exists to prove no rename is needed.",
  "schemaVersion": 1,
  "package": "pkinative",
  "verifiedOn": "2026-09-15",
  "errors": [
    { "code": "PKI_INVALID_INPUT", "class": "PkiError", "since": "0.1.0", "raisedWhen": "A function receives a value of the wrong type: DER input that is not a Uint8Array, PEM input that is not a string.", "remedy": "Pass a Uint8Array of DER bytes (decode PEM text with decodePem first), or a string where text is expected.", "standard": "pkinative API", "cwe": "CWE-20" },
    { "code": "PKI_INVALID_OPTION", "class": "PkiError", "since": "0.1.0", "raisedWhen": "An option value, or an argument with a closed set of values, is outside its documented domain: an unknown encodingRules, a PEM mode other than strict or lax, a fingerprint algorithm other than SHA-1, SHA-256, SHA-384 or SHA-512, an ECDSA signing algorithm whose namedCurve is not P-256, P-384 or P-521, a shake256 outputLength that is not an integer from 0 to 1 048 576, an OCSP freshness tolerance that is not a finite non-negative number.", "remedy": "Correct the option against the TSDoc of the function; unknown values are refused rather than ignored.", "standard": "pkinative API", "cwe": "CWE-20" },
    { "code": "PKI_API_MISUSE", "class": "PkiError", "since": "0.1.0", "raisedWhen": "The caller breaks a documented contract: asking for the DER re-encoding of a value decoded from an indefinite-length BER form, an OCSP nonce outside 1 to 32 octets, an external signer that returns a signature of the wrong size for its curve, a subjectPublicKey that is not one SubjectPublicKeyInfo SEQUENCE or an extension value that is not one DER value.", "remedy": "Follow the precondition the message names.", "standard": "pkinative API", "cwe": null },
    { "code": "PKI_STRICT_DIAGNOSTIC", "class": "PkiError", "since": "0.1.0", "raisedWhen": "strict: true is set and the operation reported a diagnostic; the message carries the diagnostic code.", "remedy": "Fix the input, or drop strict: true to accept it and read the diagnostic from the result.", "standard": "pkinative API", "cwe": null },
    { "code": "PKI_INTERNAL", "class": "PkiError", "since": "0.1.0", "raisedWhen": "An internal invariant broke. This is a pkinative bug.", "remedy": "Report it with the input that triggers it, privately through SECURITY.md when the input is hostile.", "standard": "pkinative API", "cwe": null },

    { "code": "PKI_ASN1_TRUNCATED", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "A tag, a length or content runs past the end of the input or of its enclosing value.", "remedy": "The input is incomplete or corrupt; obtain the whole DER object.", "standard": "ITU-T X.690 §8.1", "cwe": "CWE-125" },
    { "code": "PKI_ASN1_TAG_INVALID", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "A high-tag-number identifier is non-minimal (a leading 0x80 octet, or the long form for a number below 31) or does not fit in 31 bits.", "remedy": "The encoder is broken; X.690 requires the shortest identifier form.", "standard": "ITU-T X.690 §8.1.2.4", "cwe": "CWE-1286" },
    { "code": "PKI_ASN1_LENGTH_INVALID", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "The initial length octet is 0xFF, which X.690 reserves.", "remedy": "The input is corrupt or is not ASN.1.", "standard": "ITU-T X.690 §8.1.3.5", "cwe": "CWE-1286" },
    { "code": "PKI_ASN1_LENGTH_NON_MINIMAL", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "Under DER, a length uses more octets than necessary: the long form for a length below 128, or a leading zero octet.", "remedy": "Re-encode as DER, or decode with encodingRules: 'ber' when the producer is known to emit BER.", "standard": "ITU-T X.690 §10.1", "cwe": "CWE-436" },
    { "code": "PKI_ASN1_LENGTH_OVERFLOW", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "A declared length exceeds the bytes remaining in the input or in the enclosing value.", "remedy": "The input is truncated or crafted; do not trust any part of it.", "standard": "ITU-T X.690 §8.1.3", "cwe": "CWE-130" },
    { "code": "PKI_ASN1_INDEFINITE_LENGTH_FORBIDDEN", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "Under DER, a constructed value uses the indefinite length form.", "remedy": "Decode with encodingRules: 'ber' when the input is BER (common in CMS), or re-encode as DER.", "standard": "ITU-T X.690 §10.1", "cwe": "CWE-436" },
    { "code": "PKI_ASN1_CONSTRUCTED_STRING_FORBIDDEN", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "Under DER, a BIT STRING, an OCTET STRING or a restricted character string is encoded in constructed form.", "remedy": "Decode with encodingRules: 'ber' when the input is BER, or re-encode as DER.", "standard": "ITU-T X.690 §10.2", "cwe": "CWE-436" },
    { "code": "PKI_ASN1_CONSTRUCTED_FORM_INVALID", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "A universal type appears in a form its definition forbids: a primitive SEQUENCE or SET; a constructed BOOLEAN, INTEGER, NULL, OBJECT IDENTIFIER or time; an indefinite length on a primitive value.", "remedy": "The input is corrupt, or is not the ASN.1 it claims to be.", "standard": "ITU-T X.690 §8.1.2.5", "cwe": "CWE-1286" },
    { "code": "PKI_ASN1_EOC_UNEXPECTED", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "An end-of-contents marker appears outside an indefinite-length value, or is not the two octets 0x00 0x00.", "remedy": "The input is corrupt.", "standard": "ITU-T X.690 §8.1.5", "cwe": "CWE-1286" },
    { "code": "PKI_ASN1_TRAILING_DATA", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "Bytes remain after the outermost value.", "remedy": "Pass exactly one DER object, split concatenated objects with decodeAsn1Sequence, or set allowTrailingData when the container defines what follows.", "standard": "ITU-T X.690 §8.1.1", "cwe": "CWE-436" },
    { "code": "PKI_ASN1_UNEXPECTED_TAG", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "A value reader or a structure parser receives a value of another type than the one its definition requires.", "remedy": "Check that the input is the ASN.1 structure the function expects.", "standard": "ITU-T X.680 §8", "cwe": "CWE-1286" },
    { "code": "PKI_ASN1_BOOLEAN_INVALID", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "A BOOLEAN has content other than one octet, or, under DER, a TRUE other than 0xFF.", "remedy": "Re-encode as DER, or decode with encodingRules: 'ber'.", "standard": "ITU-T X.690 §8.2, §11.1", "cwe": "CWE-436" },
    { "code": "PKI_ASN1_INTEGER_INVALID", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "An INTEGER or ENUMERATED has no content octet, or its first nine bits are all zeros or all ones (a non-minimal two's complement).", "remedy": "The encoder is broken; X.690 requires the minimal two's complement form.", "standard": "ITU-T X.690 §8.3.2", "cwe": "CWE-436" },
    { "code": "PKI_ASN1_INTEGER_UNREPRESENTABLE", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "A reader that returns a number receives an INTEGER outside ±(2^53 − 1), or a small field such as a path length holds a negative or oversized value.", "remedy": "Read the value with readInteger (bigint) when a large value is legitimate.", "standard": "ITU-T X.690 §8.3", "cwe": "CWE-190" },
    { "code": "PKI_ASN1_BIT_STRING_INVALID", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "A BIT STRING has no content, an unused-bits count above 7, unused bits on an empty string, or, under DER, non-zero padding bits.", "remedy": "The encoder is broken; the unused bits must be zero.", "standard": "ITU-T X.690 §8.6.2, §11.2", "cwe": "CWE-1286" },
    { "code": "PKI_ASN1_NULL_INVALID", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "A NULL has content octets.", "remedy": "The input is corrupt.", "standard": "ITU-T X.690 §8.8", "cwe": "CWE-1286" },
    { "code": "PKI_ASN1_STRING_INVALID", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "A string's octets are outside its type: invalid UTF-8, an odd-length or surrogate BMPString, an out-of-range UniversalString, a non-ASCII IA5String, VisibleString or NumericString.", "remedy": "The issuer encoded the value wrongly; the raw bytes remain available on the decoded node.", "standard": "ITU-T X.680 §41, RFC 3629", "cwe": "CWE-176" },
    { "code": "PKI_ASN1_TIME_INVALID", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "A UTCTime or GeneralizedTime does not follow its DER form (YYMMDDHHMMSSZ, YYYYMMDDHHMMSS[.fff]Z) or names an impossible instant (month 13, 31 April, hour 24, second 60).", "remedy": "The issuer encoded the time wrongly; RFC 5280 leaves no lenient interpretation.", "standard": "ITU-T X.690 §11.7, §11.8; RFC 5280 §4.1.2.5", "cwe": "CWE-1284" },
    { "code": "PKI_ASN1_VALUE_OUT_OF_RANGE", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "An encoder receives a value its type cannot represent: a tag number above 2^31 − 1, unused bits above 7, a date outside the years 0000–9999, a character outside a restricted string type.", "remedy": "Pass a value within the documented range of the encoder.", "standard": "ITU-T X.690", "cwe": "CWE-1284" },
    { "code": "PKI_OID_INVALID", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "An OBJECT IDENTIFIER is empty, starts an arc with 0x80 or ends inside an arc, or a dotted string is not two or more decimal arcs with a first arc of 0, 1 or 2.", "remedy": "The input is corrupt; for a dotted string, check the format with isValidOid.", "standard": "ITU-T X.690 §8.19", "cwe": "CWE-1286" },
    { "code": "PKI_PEM_NO_BLOCK", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "The text contains no -----BEGIN line — in strict mode, none on a line of its own without whitespace around it.", "remedy": "Pass the PEM text itself; for DER bytes, call the DER function directly; for boundary lines with surrounding whitespace, decode with mode: 'lax'.", "standard": "RFC 7468 §2", "cwe": "CWE-1286" },
    { "code": "PKI_PEM_LABEL_INVALID", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "A BEGIN or END label contains characters outside the RFC 7468 label grammar.", "remedy": "Fix the label; RFC 7468 allows printable ASCII other than a hyphen at either end.", "standard": "RFC 7468 §3", "cwe": "CWE-1286" },
    { "code": "PKI_PEM_LABEL_MISMATCH", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "The END line's label differs from the BEGIN line's label.", "remedy": "The text was spliced or corrupted; do not guess which label is right.", "standard": "RFC 7468 §2", "cwe": "CWE-436" },
    { "code": "PKI_PEM_UNEXPECTED_LABEL", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "A block's label is not the label the caller asked for, such as PRIVATE KEY where CERTIFICATE is expected.", "remedy": "Pass the right block, or omit the label option to read every block.", "standard": "RFC 7468 §5", "cwe": "CWE-1286" },
    { "code": "PKI_PEM_UNTERMINATED", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "A BEGIN line has no matching END line — in strict mode, an END line with whitespace around it does not count.", "remedy": "The text is truncated, or its END line carries whitespace: obtain the complete PEM, or decode with mode: 'lax'.", "standard": "RFC 7468 §2", "cwe": "CWE-1286" },
    { "code": "PKI_PEM_BASE64_INVALID", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "The block body is not canonical base64: a character outside the alphabet, misplaced padding, non-zero padding bits, or, in strict mode, lines longer than 64 characters.", "remedy": "Fix the encoder, or decode with mode: 'lax' to tolerate whitespace and line-length deviations.", "standard": "RFC 7468 §3, RFC 4648 §4", "cwe": "CWE-1286" },
    { "code": "PKI_PEM_HEADERS_FORBIDDEN", "class": "PkiEncodingError", "since": "0.1.0", "raisedWhen": "Strict mode meets RFC 1421 encapsulated headers, such as Proc-Type, inside a block.", "remedy": "Headers mark legacy encrypted PEM, which RFC 7468 does not define; decode with mode: 'lax' to read them.", "standard": "RFC 7468 §2", "cwe": "CWE-1286" },

    { "code": "PKI_X509_STRUCTURE_INVALID", "class": "PkiCertificateError", "since": "0.1.0", "raisedWhen": "The DER is well formed but is not the structure the reader expects: for parseCertificate, the outer SEQUENCE does not hold tbsCertificate, signatureAlgorithm and signatureValue, or a TBSCertificate field is missing, misplaced or of the wrong type; for parseCertificationRequest, the same of a CertificationRequest (RFC 2986 §4), its attributes field or a challengePassword or extensionRequest attribute of the wrong shape.", "remedy": "Check that the input is the structure the reader expects: a certificate, a CSR, a CRL and a key are four different ones.", "standard": "RFC 5280 §4.1, RFC 2986 §4", "cwe": "CWE-1286" },
    { "code": "PKI_X509_VERSION_INVALID", "class": "PkiCertificateError", "since": "0.1.0", "raisedWhen": "The encoded version INTEGER of a certificate is not 0, 1 or 2 (v1, v2, v3; certificate.version reports it as 1, 2 or 3), or that of a certification request is not 0 (v1, the only PKCS#10 version).", "remedy": "The input is not a version RFC 5280 (certificate) or RFC 2986 (request) defines.", "standard": "RFC 5280 §4.1.2.1, RFC 2986 §4.1", "cwe": "CWE-1286" },
    { "code": "PKI_X509_NAME_INVALID", "class": "PkiCertificateError", "since": "0.1.0", "raisedWhen": "A Name is not a SEQUENCE OF SET OF AttributeTypeAndValue, a relative distinguished name is empty, or an attribute value is not a single ASN.1 value.", "remedy": "The issuer encoded the name wrongly.", "standard": "RFC 5280 §4.1.2.4", "cwe": "CWE-1286" },
    { "code": "PKI_X509_VALIDITY_INVALID", "class": "PkiCertificateError", "since": "0.1.0", "raisedWhen": "Validity is not a SEQUENCE of two times, or a time is neither a UTCTime nor a GeneralizedTime.", "remedy": "The issuer encoded the validity period wrongly.", "standard": "RFC 5280 §4.1.2.5", "cwe": "CWE-1286" },
    { "code": "PKI_X509_SPKI_INVALID", "class": "PkiCertificateError", "since": "0.1.0", "raisedWhen": "SubjectPublicKeyInfo does not hold an AlgorithmIdentifier and a BIT STRING, or the key of a recognised algorithm does not match its definition (an RSA key that is not two positive INTEGERs, an EC point of the wrong length).", "remedy": "The issuer encoded the public key wrongly.", "standard": "RFC 5280 §4.1.2.7, RFC 3279, RFC 5480, RFC 8410, RFC 9881", "cwe": "CWE-1286" },
    { "code": "PKI_X509_UNIQUE_ID_INVALID", "class": "PkiCertificateError", "since": "0.1.0", "raisedWhen": "An issuerUniqueID or subjectUniqueID is not a BIT STRING under its implicit tag, or appears out of order.", "remedy": "The issuer encoded the certificate wrongly.", "standard": "RFC 5280 §4.1.2.8", "cwe": "CWE-1286" },
    { "code": "PKI_X509_EXTENSIONS_EMPTY", "class": "PkiCertificateError", "since": "0.1.0", "raisedWhen": "The extensions field of a certificate, or the extensionRequest attribute of a certification request, is present but holds no extension.", "remedy": "The issuer encoded the certificate wrongly; RFC 5280 requires at least one extension when the field is present.", "standard": "RFC 5280 §4.1", "cwe": "CWE-1286" },
    { "code": "PKI_X509_EXTENSION_DUPLICATE", "class": "PkiCertificateError", "since": "0.1.0", "raisedWhen": "Two extensions share one OID — in a certificate, or inside the extensionRequest of a certification request; also two attributes of a certification request sharing one type.", "remedy": "A certificate must not include an extension twice, and a request an attribute twice; which instance a verifier reads is undefined, so the structure is refused.", "standard": "RFC 5280 §4.2, RFC 2985 §5.4", "cwe": "CWE-694" },
    { "code": "PKI_X509_EXTENSION_MALFORMED", "class": "PkiCertificateError", "since": "0.1.0", "raisedWhen": "A recognised extension's value does not match its ASN.1 definition.", "remedy": "Parse with decodeExtensions: false to keep every extension raw, then decode the ones you need with decodeExtensionValue.", "standard": "RFC 5280 §4.2.1", "cwe": "CWE-1286" },
    { "code": "PKI_X509_GENERAL_NAME_INVALID", "class": "PkiCertificateError", "since": "0.1.0", "raisedWhen": "A GeneralName uses an unknown tag, an iPAddress is not 4 or 16 octets (8 or 32 in name constraints), or an IA5String name contains non-ASCII octets.", "remedy": "The issuer encoded the name wrongly.", "standard": "RFC 5280 §4.2.1.6", "cwe": "CWE-1286" },

    { "code": "PKI_LIMIT_EXCEEDED", "class": "PkiLimitError", "since": "0.1.0", "raisedWhen": "An input exceeds a configured bound of PkiLimits; the error's limit, configured and observed fields name it.", "remedy": "Raise the named limit in options.limits only when the input is trusted.", "standard": "SECURITY.md §Resource Limits", "cwe": "CWE-400" },
    { "code": "PKI_LIMIT_INVALID", "class": "PkiLimitError", "since": "0.1.0", "raisedWhen": "options.limits is not an object, names an unknown limit, or gives a value that is not a positive integer or Infinity.", "remedy": "Use the keys of DEFAULT_PKI_LIMITS with positive integer values.", "standard": "pkinative API", "cwe": "CWE-20" },

    { "code": "PKI_CRYPTO_UNAVAILABLE", "class": "PkiCryptoError", "since": "0.3.0", "raisedWhen": "A verification was asked for on a runtime whose globalThis.crypto.subtle has no importKey or no verify.", "remedy": "Call canVerify() before verifying, and run where Web Crypto exists: Node 22+, any browser on a secure origin, Deno, Bun or Workers. A page served over plain HTTP has no crypto.subtle.", "standard": "W3C WebCryptoAPI", "cwe": "CWE-693" },
    { "code": "PKI_CRYPTO_ALGORITHM_UNSUPPORTED", "class": "PkiCryptoError", "since": "0.3.0", "raisedWhen": "The signature algorithm OID is outside the set pkinative verifies, or its RSASSA-PSS parameters name a digest, a mask generation function or a trailer field Web Crypto cannot express. The error's algorithm field carries the OID.", "remedy": "MD2 and MD5 signatures are refused because Web Crypto implements neither; verify them with a library that does. For an algorithm that Web Crypto supports and pkinative does not yet map, open an issue naming the certificate.", "standard": "RFC 4055 §3.1", "cwe": "CWE-757" },
    { "code": "PKI_CRYPTO_KEY_UNSUPPORTED", "class": "PkiCryptoError", "since": "0.3.0", "raisedWhen": "The issuer's key is of the right family for the signature but on a curve Web Crypto does not verify, or the runtime refused to import it. A key that simply cannot have produced this kind of signature is false, not this error. Since 0.8.0 also raised for a private key: a PKCS#8 whose algorithm has no Web Crypto signing form (DSA, X25519, an EC key on an unnamed or unsupported curve), or one the runtime refused — an id-RSASSA-PSS key under PBES2 among them on a runtime that imports RSA only under rsaEncryption (Node.js 22), since a shrouded key is unwrapped by the host and never re-wrapped here. The error's algorithm field carries the OID.", "remedy": "Web Crypto verifies and signs ECDSA only on P-256, P-384 and P-521; another curve needs another library. Ed448 and, on several runtimes still, Ed25519 are not implemented everywhere — for a certificate signature as for a CMS signer (RFC 8419 §3.1, verified since 1.0.0 wherever the host has Ed448) — so try another runtime before concluding the certificate or the key is at fault. An id-RSASSA-PSS key is the same RSA key restricted by its OID (RFC 4055 §1.2): since 1.0.0 an id-RSASSA-PSS issuer or signer public key is handed to the host under rsaEncryption once the signature has been held to the key's parameters, so certificates, CRLs, OCSP responses and CMS signed by such a key verify on every runtime; importPrivateKey re-wraps an unencrypted id-RSASSA-PSS PKCS#8 the same way, and openPkcs12 opens a plain keyBag under such a certificate with RSA-PSS and the certificate's digest. An id-RSASSA-PSS key under PBES2 (decryptPrivateKey, a shroudedKeyBag) still depends on the host: re-export it under rsaEncryption with the tool that holds it, and it imports with algorithm { name: 'RSA-PSS', hash } and signs exactly as before. A PKCS#1 v1.5 signature under such a key, or a PSS signature its key parameters exclude, is false rather than this error (RFC 4055 §1.2 and §3.3).", "standard": "W3C WebCryptoAPI", "cwe": "CWE-757" },
    { "code": "PKI_CRYPTO_ALGORITHM_REFUSED", "class": "PkiCryptoError", "since": "0.5.0", "raisedWhen": "The signature is over SHA-1, which Web Crypto will compute and pkinative will not treat as evidence. SHA-1 collisions have been practical since 2017 (SHAttered), so a SHA-1 signature does not bind the bytes it covers, and returning true would be a false assurance rather than a verdict. The error's algorithm field carries the OID.", "remedy": "Get the certificate reissued under SHA-256 or better; the Web PKI has forbidden SHA-1 signatures since 2016. To read a historical artefact whose signature is being examined rather than relied upon, pass { allowSha1: true } and treat the result as an archival fact, not an authentication decision. A certificate's own SHA-1 fingerprint is unaffected: that is public data, not a signature.", "standard": "RFC 9155 §3", "cwe": "CWE-327" },
    { "code": "PKI_CRYPTO_DECRYPTION_FAILED", "class": "PkiCryptoError", "since": "0.8.0", "raisedWhen": "Web Crypto could not decrypt a PBES2 payload or unwrap a PBES2-encrypted private key with the key derived from the password. AES-CBC carries no authentication tag, so the host cannot say which of three things happened: the password is wrong, the ciphertext was altered, or — when unwrapping — the key inside is not of the algorithm it was unwrapped as. The error's algorithm field carries the encryption scheme OID.", "remedy": "Check the password first: a string is encoded as UTF-8, which is what OpenSSL and RFC 9579 use; pass the exact octets as a Uint8Array if the file was written with another encoding. Then check that the algorithm named for the key matches it. A file that fails with the right password and the right algorithm has been altered.", "standard": "RFC 8018 §6.2", "cwe": "CWE-354" },
    { "code": "PKI_CMS_STRUCTURE_INVALID", "class": "PkiCmsError", "since": "0.7.0", "raisedWhen": "The DER is well formed but a value does not match the RFC 5652 CMS or RFC 3161 timestamp ASN.1 module it was read as: a field missing or out of order, a CHOICE alternative the syntax does not define, an empty SET that must hold at least one element, a timestamp response whose status and token disagree, or a PKIStatus or failInfo value RFC 3161 does not define. The error's path names the field.", "remedy": "The input is not the structure it claims to be, or it was produced by a non-conforming encoder. Check that you passed the whole ContentInfo (a .p7s, .p7m or PDF /Contents value) rather than a SignedData without its wrapper, and that a PDF /Contents value was sliced to its DER length rather than passed with its zero padding.", "standard": "RFC 5652 §5", "cwe": "CWE-1286" },
    { "code": "PKI_CMS_CONTENT_TYPE_UNEXPECTED", "class": "PkiCmsError", "since": "0.7.0", "raisedWhen": "A ContentInfo carries a content type other than the one the function reads — enveloped-data, encrypted-data or authenticated-data handed to parseSignedData, or a SignedData whose content is not a TSTInfo handed to parseTimeStampToken. The message names the type found.", "remedy": "Use the reader for the type you have. pkinative reads signed data and timestamp tokens here. Enveloped and authenticated data are addressed to a recipient key, and opening them is key-transport or key-agreement cryptography pkinative does not implement, in any version; the only encrypted content it opens is a password-protected PKCS#8 or PKCS#12 under PBES2, through their own readers.", "standard": "RFC 5652 §3", "cwe": "CWE-843" },
    { "code": "PKI_CMS_VERSION_UNSUPPORTED", "class": "PkiCmsError", "since": "0.7.0", "raisedWhen": "A SignedData version outside 1, 3, 4 and 5, or a TSTInfo or TimeStampReq version other than 1. Those are the only versions the syntaxes define, so another one promises a structure this reader cannot know. A known version that disagrees with what RFC 5652 §5.1 derives from the content is only a diagnostic.", "remedy": "The producer is either newer than RFC 5652 and RFC 3161 or not conforming to them. If it is newer, open an issue naming it; if it is not conforming, the structure cannot be read reliably and should be regenerated.", "standard": "RFC 5652 §5.1", "cwe": "CWE-1286" },
    { "code": "PKI_CMS_CONTENT_NOT_OCTET_STRING", "class": "PkiCmsError", "since": "0.7.0", "raisedWhen": "The encapsulated content is not an OCTET STRING. PKCS #7 allowed any type there, and RFC 5652 §5.2.1 describes the compatibility case — Microsoft Authenticode is the one still in use — in which the digest covers the value octets of that other type instead. The two rules disagree about which bytes are signed.", "remedy": "Authenticode and other PKCS #7 profiles that put a structured value in the content are not read by pkinative: their digest rule differs from RFC 5652's, and half-supporting it would verify a signature against the wrong bytes. Use a tool built for that profile.", "standard": "RFC 5652 §5.2.1", "cwe": "CWE-843" },
    { "code": "PKI_KEY_STRUCTURE_INVALID", "class": "PkiKeyError", "since": "0.8.0", "raisedWhen": "The DER is well formed but a value does not match the RFC 5958 PKCS#8 or RFC 7292 PKCS#12 ASN.1 module it was read as: a field missing or out of order, an AlgorithmIdentifier with the wrong shape, PBES2 parameters that contradict each other (a PBKDF2 keyLength that is not the cipher's), an initialisation vector that is not 16 octets, or an AuthenticatedSafe entry of a content type RFC 7292 does not define. The error's path names the field.", "remedy": "The input is not the structure it claims to be, or it was produced by a non-conforming writer. Check that a PEM block was decoded from the right label — PRIVATE KEY for PKCS#8, ENCRYPTED PRIVATE KEY for its encrypted form — and that a .p12 or .pfx file was read as binary rather than as text.", "standard": "RFC 7292 §4", "cwe": "CWE-1286" },
    { "code": "PKI_KEY_VERSION_UNSUPPORTED", "class": "PkiKeyError", "since": "0.8.0", "raisedWhen": "A PrivateKeyInfo version other than 0 or 1, or a PFX version other than 3. Those are the only versions RFC 5958 and RFC 7292 define, so another one promises a structure this reader cannot know.", "remedy": "The file was written by something newer than the RFCs or not conforming to them. Re-export it from the tool that owns the key.", "standard": "RFC 5958 §2", "cwe": "CWE-1286" },
    { "code": "PKI_KEY_ENCRYPTION_UNSUPPORTED", "class": "PkiKeyError", "since": "0.8.0", "raisedWhen": "A key or a bag of certificates is encrypted with a scheme other than PBES2 with PBKDF2 and AES-CBC: a PKCS#12 scheme of RFC 7292 Appendix C (pbeWithSHAAnd3-KeyTripleDES-CBC, pbeWithSHAAnd40BitRC2-CBC and the rest), a PKCS#5 v1.5 PBES1 scheme, PBES2 with another KDF or another cipher, a PBKDF2 PRF Web Crypto does not implement, or public-key privacy mode. The error's path names the value and the message names the scheme.", "remedy": "This is a policy, not a gap: the PKCS#12 schemes derive their key with RFC 7292 Appendix B, iterated SHA-1 with byte arithmetic over the password, and protect it with 3DES or 40-bit RC2. Convert the file once with OpenSSL 3.4 or later — openssl pkcs12 -in legacy.p12 -legacy -aes256 -out bundle.pem, then openssl pkcs12 -export -in bundle.pem -pbmac1_pbkdf2 -out modern.p12 (-aes256 keeps the key in bundle.pem under AES-256-CBC and the passphrase you give, where -legacy alone would pick 3DES; the export is PBES2 with AES-256-CBC by default; delete bundle.pem afterwards) — or, for a key alone, openssl pkcs8 -topk8 -v2 aes-256-cbc -v2prf hmacWithSHA256.", "standard": "RFC 8018 §6.2", "cwe": "CWE-327" },
    { "code": "PKI_KEY_MAC_UNSUPPORTED", "class": "PkiKeyError", "since": "0.8.0", "raisedWhen": "A PKCS#12 MAC was asked to be verified and it is not RFC 9579 PBMAC1: its key is derived with the RFC 7292 Appendix B KDF, which is every MAC OpenSSL wrote before 3.4 and most it still writes. Public-key integrity mode, where the AuthenticatedSafe is signed data, is refused with the same code.", "remedy": "pkinative verifies PBMAC1 only, for the reason it decrypts PBES2 only. Re-export the file with openssl pkcs12 -export -pbmac1_pbkdf2 (OpenSSL 3.4 or later). A caller who accepts an unverified container can read it without the MAC check — the one-call reader reports it as PKI_REASON_PKCS12_INTEGRITY_UNVERIFIED and takes allowUnverifiedIntegrity for that decision.", "standard": "RFC 9579 §3", "cwe": "CWE-327" }
  ]
}