Security model

Every certificate, PEM text and DER blob pkinative reads is treated as attacker-controlled. This guide explains what that means in practice: strict decoding, bounded resources, typed failures, and a hard line around cryptography.

Refuse ambiguity #

A signature covers bytes. If two parsers can read the same bytes as two different values, an attacker can have one of them verify what the other one displays (CWE-436). DER exists to rule that out, and pkinative decodes it the way X.690 §10–11 defines it: indefinite lengths, non-minimal lengths and tags, constructed strings, BOOLEAN values other than 0x00 and 0xFF, non-minimal INTEGERs, non-zero BIT STRING padding and trailing bytes are all refused with a stable code.

BER is accepted only when the caller asks for it with encodingRules: 'ber' — as real CMS needs — and every tolerated construct is reported once as a diagnostic. encodeAsn1Node refuses to re-encode a BER-only tree as if it were DER.

One exception is deliberate: a DEFAULT value encoded explicitly (cA FALSE, critical FALSE, version v1) reads the same in every parser, and Go, OpenSSL and BoringSSL accept it; pkinative reads it with the PKI_DIAG_DEFAULT_ENCODED diagnostic, and strict: true refuses it.

Bound every resource #

Every loop over input consults a named limit. The decoder is iterative, so nesting depth is a limit and never a call-stack overflow. Every declared length is checked against the remaining input before anything is allocated.

Exceeding a limit throws PkiLimitError with code PKI_LIMIT_EXCEEDED and the limit, configured and observed values. Override per call with options.limits; DEFAULT_PKI_LIMITS holds the defaults.

Fail in one way #

A structural failure throws a PkiError subclass — PkiEncodingError for X.690, OID and PEM syntax, PkiCertificateError for the RFC 5280 structure, PkiLimitError for a limit, PkiCryptoError for a Web Crypto operation that could not run, PkiCmsError and PkiKeyError for CMS and key containers — with a stable code. A conformance concern is a diagnostic. The two never mix: a diagnostic never hides a structural failure, and a thrown error never carries a merely pedantic concern. Any other exception escaping on malformed input — a TypeError, a RangeError — is a bug, and the fuzzing suites plus the conformance gate check that none does across every truncation, every single-octet mutation and 30 361 unique x509-limbo certificates.

Decoded names and OIDs are kept in arrays and Maps, never as plain object keys, so a crafted __proto__ cannot reach an object prototype (CWE-1321). formatDistinguishedName escapes control characters, so a crafted name cannot drive the terminal that prints it.

Cryptography pkinative does not own #

pkinative never implements secret-dependent cryptography in TypeScript: no signing arithmetic, no key generation, no RSA modular exponentiation, no elliptic-curve scalar multiplication. Every signature it verifies and every signature it creates — on a certificate, a certification request or a CMS SignedData — is one Web Crypto call with the caller's key, and so is every password-based derivation, MAC and decryption of a PKCS#8 or PKCS#12 container; the arithmetic runs in the host's native implementation, not in JavaScript BigInts. The hashes pkinative computes itself — SHA-1, SHA-256, SHA-384 and SHA-512 for fingerprints, SHAKE256 for Ed448 CMS signers — run over public data only; shake256(data, outputLength) is the one exported as a general-purpose digest. src/crypto/webcrypto.ts is the only module that names those operations, and it refuses generateKey, exportKey, deriveBits, encrypt and wrapKey for good. The SHA-1, SHA-256, SHA-384 and SHA-512 code exists for synchronous fingerprints of public data only and is not exported as general-purpose hashing.

The consequence is a split worth knowing: the structure around a signature is pkinative's to check — the DER of an ECDSA signature, the algorithm named inside and outside the signed bytes, the key's curve — and the arithmetic is the host's, RSA padding, Ed25519 canonicity and the ECDSA scalar range included. The CVE-class corpus below says which side stops each known attack.

This is a deliberate departure from the code pkinative grew out of: pdfnative's pure-JavaScript RSA and ECDSA use BigInt arithmetic that is not constant-time, and are not ported. The reasoning behind each permanent refusal — a Web Crypto operation, a legacy PKCS#12 scheme, an algorithm Web Crypto lacks — is recorded in the architecture decision records.

No reach outside the engine #

src/ has no filesystem, network, process or dynamic-import access, no eval and no Function, and no module-level side effects — all enforced from the syntax tree by the architecture test. The package is tree-shakeable, and npm run verify:bundle proves that a certificate parser bundle carries no PEM code, no hash and no OID name registry.

CVE classes #

Every published vulnerability of a PKI library whose class pkinative could share is replayed against the engine on every gate run: tests/security/cve-classes.test.ts rebuilds each one from synthetic input — raw DER, keys generated in the test, forgeries computed with public arithmetic — and asserts the refusal, the code or the verdict. docs/data/cve-classes.json records, for each identifier, the library it hit, the class, the CWE, whether it applies, why, and the test that proves it; the cve-class-parity rule of npm run verify:docs fails the build when the registry, the tests and this table disagree.

Applies is no when pkinative has the code path and refuses the attack, n.a. when the class cannot exist here (no DSA, no padding parser, no memory-unsafe code), and yes when the audit found it. Stopped by is honest about delegation: where it says the host's Web Crypto, pkinative hands the bytes over unchanged and the test proves the host refuses them — a host that stopped refusing would turn the suite red.

CVE-2022-36083 is the one that applied: a PKCS#12 with no MAC could make openPkcs12 run one ten-million-iteration PBKDF2 per entry. maxPkcs12KdfIterations bounds the work of a whole file and refuses it at parse, before anything is derived.

Coverage-guided fuzzing complements the replays: ClusterFuzzLite runs eight targets in fuzz/ — the X.690 decoder, X.509, PEM and OIDs, CMS SignedData, CRLs, OCSP responses, RFC 3161 timestamps, and PKCS#12 with PKCS#8 — each seeded with a real structure of its grammar and each executed against src/ on every gate run by tests/fuzzing/targets.test.ts.

Reporting a vulnerability #

Report privately, never in an issue: through GitHub's private vulnerability reporting, or by email to security@pkinative.dev. See SECURITY.md for scope and response times.