TSP

RFC 3161 Time-Stamp Protocol handling. A TimeStampResp is what a client receives from a TSA -- a PKIStatusInfo plus, on success, a TimeStampToken; parse decodes it and enforces the status-to-token coupling (a granted response carries a token, a rejection does not). A TimeStampToken is itself a CMS SignedData whose encapsulated content is a TSTInfo, so parseToken composes the CMS parser, asserts the id-ct-TSTInfo content type and the single-signer rule, and decodes the inner TSTInfo. parseTstInfo decodes a bare TSTInfo payload directly.

The parser surfaces everything a verifier needs and interprets nothing it cannot: messageImprint.hashAlgorithm and the raw hashedMessage, the genTime (with sub-second precision), the serialNumber and nonce (lossless, as BigInt + hex), and the policy. The PRESENCE of the ESS SigningCertificate(V2) attribute is asserted at parse (a structural token property); the imprint-to-request and nonce-to-request round-trips, the ESS hash-vs-certificate binding, the timestamping EKU, and the signature are verification-layer concerns above parse altitude. DER-only, fail-closed.

pki.schema.tsp.parseRequest

since 0.2.19 experimental
pki.schema.tsp.parseRequest(input) -> timeStampReq

Parse a DER Buffer or PEM string into a TimeStampReq (RFC 3161 sec. 2.4.1): { version, messageImprint, reqPolicy, reqPolicyName, nonce, nonceHex, certReq, extensions }. version MUST be 1; certReq is BOOLEAN DEFAULT FALSE (an explicit FALSE is non-DER and rejected tsp/bad-request); nonce is lossless (BigInt + hex); messageImprint.hashedMessage is the raw digest. A malformed structure throws a typed TspError.

Example

var req = pki.schema.tsp.parseRequest(der);
req.certReq;                        // -> boolean
req.messageImprint.hashedMessage;   // -> Buffer (the raw digest)

See also: pki.schema.tsp.parse, pki.tsp.request

References

pki.schema.tsp.parseTstInfo

since 0.1.13 stable
pki.schema.tsp.parseTstInfo(input) -> tstInfo

Parse a bare TSTInfo payload (a DER Buffer) -- the structure a timestamp token encapsulates -- into { version, policy, messageImprint, serialNumber, genTime, accuracy, ordering, nonce, tsa, extensions }. messageImprint.hashedMessage is the raw digest; serialNumber / nonce are lossless (BigInt + hex); genTime is a Date with sub-second precision. A malformed structure throws a typed TspError (tsp/*); a leaf-level codec fault surfaces as asn1/*.

Example

var tst = pki.schema.tsp.parseTstInfo(der);
tst.genTime;                       // -> Date
tst.messageImprint.hashedMessage;  // -> Buffer (the raw digest)

See also: pki.schema.tsp.parseToken, pki.schema.tsp.parse

References

pki.schema.tsp.parse

since 0.1.13 stable
pki.schema.tsp.parse(input) -> timeStampResp

Parse a DER Buffer or a PEM string into a TimeStampResp: { status, statusString, failInfo, timeStampToken }. The status-to-token coupling is enforced -- a granted response (status 0/1) carries timeStampToken (surfaced raw for parseToken), any other status does not. failInfo decodes the PKIFailureInfo named bits. A malformed structure throws a typed TspError.

Example

var res = pki.schema.tsp.parse(der);
res.status;                              // -> 0 (granted)
res.timeStampToken.tstInfo.genTime;      // -> Date (a granted token is decoded)

See also: pki.schema.tsp.parseToken, pki.schema.parse

References

pki.schema.tsp.parseToken

since 0.1.13 stable
pki.schema.tsp.parseToken(input) -> tstInfo

Parse a TimeStampToken (a DER Buffer or PEM) -- a CMS SignedData whose encapsulated content is a TSTInfo. Composes pki.schema.cms.parse, asserts the id-ct-TSTInfo content type (tsp/wrong-econtent-type), that the content is attached (tsp/detached-token), the single-signer rule (tsp/multi-signer, RFC 3161 sec. 2.4.2), and that the signerInfo carries a SigningCertificate or SigningCertificateV2 signed attribute (tsp/missing-signing-certificate, RFC 3161 sec. 2.4.2 / RFC 5816 -- the hash-vs-certificate binding stays a verification-layer concern), then decodes the inner TSTInfo. Returns { tstInfo, eContent, signerInfo, certificates } -- the decoded payload, the raw eContent bytes a verifier hashes for the CMS message-digest, and the CMS signer material.

Example

var token = pki.schema.tsp.parseToken(tokenDer);
token.tstInfo.genTime;   // -> Date
token.signerInfo.sid;    // -> the TSA signer identifier

See also: pki.schema.tsp.parse, pki.schema.cms.parse

References

pki.schema.tsp.pemDecode

since 0.1.13 stable
pki.schema.tsp.pemDecode(text, label?) -> Buffer

Extract the DER bytes from a PEM block (RFC 3161 defines no standard label, so the first block is taken unless label is given). Throws PemError on a missing envelope or a non-base64 body.

Example

var der = pki.schema.tsp.pemDecode(pemText);

See also: pki.schema.tsp.parse

References

pki.schema.tsp.pemEncode

since 0.1.23 stable
pki.schema.tsp.pemEncode(der, label) -> string

Wrap DER bytes in a PEM envelope. RFC 3161 defines no standard PEM label, so label is REQUIRED -- the operator names the envelope explicitly (mirroring pemDecode, which accepts any label). Omitting it throws pem/bad-label.

Example

var pem = pki.schema.tsp.pemEncode(der, "TSP RESPONSE");

See also: pki.schema.tsp.pemDecode

References