CRMF: reject the publication information RFC 4211 sec. 6.3 forbids - pubInfos present with the dontPublish action, or present and empty - on parsing and on construction.

Author: dghgit

docs/releasenotes.md

@@ -32,6 +32,7 @@ Date: 2026, TBD
 - The RFC 9709 content-encryption AlgorithmIdentifier, which carries the real algorithm inside the parameters of an outer id-alg-cek-hkdf-sha256, was unwrapped at only one of the points where a CMS recipient makes a decision about it. Key-size validation was corrected for plain key transport in 1.86, but the same call in the KEK, RSA-KTS and KEM recipients, and in the key-transport recipient's own ORI-KEM branch, still compared the recovered key against the outer identifier, which registers no key size, so setKeySizeValidation(true) silently checked nothing there; the setAllowedContentAlgorithms allow-list and the setMinimumTagSize floor were applied to the outer identifier on every recipient family, including the one already corrected, so neither constrained an RFC 9709 message. The unwrap now happens once for the key-size check and once for the two policy checks, and every recipient polices and validates the content-encryption algorithm the message actually carries. A recipient with no allow-list, no tag floor and no key-size validation configured behaves exactly as before; a caller who listed id-alg-cek-hkdf-sha256 in an allow-list in order to admit RFC 9709 messages must now list the content-encryption algorithms themselves (github PR #2446).
 - A CMS message whose EncryptedContentInfo named the RFC 9709 key derivation but carried no readable content-encryption AlgorithmIdentifier in its parameters was reported as a NullPointerException, or as an IllegalArgumentException from the ASN.1 decoder, out of methods declared to throw CMSException, RecipientInformation.getContent() among them. The four places that resolve the wrapper - the CEK derivation, the content cipher selection, the key-size check, and the recipient's allowed-algorithm and tag-size checks - now share one resolver, which reports an absent or unreadable inner algorithm as a CMSException.
 - The two YubiKey OpenPGP smart-card decryptor factories zeroized the user PIN array the KeyPassphraseProvider handed them rather than a copy of it, in a finally block after each private-key operation. Both providers BC ships return the application's own array by reference - DefaultKeyPassphraseProvider hands back the char[] it has cached for the key, and the provider inside OpenPGPApi.editKey returns its argument - so the first card operation destroyed the caller's PIN and the next private-key operation presented an all-zero PIN to the card, which the card refuses at the cost of a PIN retry. The PIN is now fetched as a clone the card operation owns - in OpenPGPSmartCard.requireUserPin, where the smart-card restructuring of this release put the fetch the two factories used to make - and KeyPassphraseProvider.getKeyPassword records that the array it returns stays owned by the provider (github PR #2444).
+- The CRMF PKIPublicationInfo structure accepted, and could be built with, publication information RFC 4211 sec. 6.3 forbids: pubInfos MUST NOT be present if the action is dontPublish, and the field is SEQUENCE SIZE (1..MAX), so a present one is never empty. Both contradictions are now rejected with an IllegalArgumentException, on parsing and on construction from an array of SinglePubInfo. An absent pubInfos with the pleasePublish action, which is how the RFC spells "don't care", is unaffected, and no constructor in the library could produce either rejected form.
 
 ### 2.1.3 Additional Features and Functionality
 

util/src/main/java/org/bouncycastle/asn1/crmf/PKIPublicationInfo.java

@@ -35,10 +35,30 @@ private PKIPublicationInfo(ASN1Sequence seq)
         action = ASN1Integer.getInstance(seq.getObjectAt(0));
         if (seq.size() > 1)
         {
-            pubInfos = ASN1Sequence.getInstance(seq.getObjectAt(1));
+            pubInfos = checkPubInfos(action, ASN1Sequence.getInstance(seq.getObjectAt(1)));
         }
     }
 
+    /**
+     * RFC 4211 sec. 6.3: pubInfos MUST NOT be present if action is dontPublish, and the field is
+     * SEQUENCE SIZE (1..MAX), so a present one carries at least one SinglePubInfo. "Don't care" is
+     * an absent pubInfos with the pleasePublish action, not an empty or contradictory one.
+     */
+    private static ASN1Sequence checkPubInfos(ASN1Integer action, ASN1Sequence pubInfos)
+    {
+        if (dontPublish.equals(action))
+        {
+            throw new IllegalArgumentException("pubInfos must be absent if action is dontPublish");
+        }
+
+        if (pubInfos.size() == 0)
+        {
+            throw new IllegalArgumentException("pubInfos must contain at least one SinglePubInfo");
+        }
+
+        return pubInfos;
+    }
+
     public static PKIPublicationInfo getInstance(Object o)
     {
         if (o instanceof PKIPublicationInfo)
@@ -85,7 +105,7 @@ public PKIPublicationInfo(SinglePubInfo[] pubInfos)
 
         if (pubInfos != null)
         {
-            this.pubInfos = new DERSequence(pubInfos);
+            this.pubInfos = checkPubInfos(this.action, new DERSequence(pubInfos));
         }
         else
         {

util/src/test/java/org/bouncycastle/asn1/crmf/test/PKIPublicationInfoTest.java

@@ -2,6 +2,8 @@
 
 import java.io.IOException;
 
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.DERSequence;
 import org.bouncycastle.asn1.crmf.PKIPublicationInfo;
 import org.bouncycastle.asn1.crmf.SinglePubInfo;
 import org.bouncycastle.asn1.x500.X500Name;
@@ -70,6 +72,57 @@ public void performTest()
         isTrue(null == pkiPubInfo.getPubInfos());
 
         encEqualTest(pkiPubInfo);
+
+        rejectionTests();
+    }
+
+    /**
+     * RFC 4211 sec. 6.3: pubInfos MUST NOT be present if the action is dontPublish, and the field
+     * is SEQUENCE SIZE (1..MAX), so a present one is never empty. Both are rejected on parsing and
+     * on construction.
+     */
+    private void rejectionTests()
+        throws IOException
+    {
+        ASN1EncodableVector v = new ASN1EncodableVector();
+
+        v.add(PKIPublicationInfo.dontPublish);
+        v.add(new DERSequence(new SinglePubInfo(SinglePubInfo.dontCare, null)));
+
+        try
+        {
+            PKIPublicationInfo.getInstance(new DERSequence(v).getEncoded());
+            fail("no exception on dontPublish with pubInfos");
+        }
+        catch (IllegalArgumentException e)
+        {
+            isEquals("pubInfos must be absent if action is dontPublish", e.getMessage());
+        }
+
+        v = new ASN1EncodableVector();
+
+        v.add(PKIPublicationInfo.pleasePublish);
+        v.add(new DERSequence());
+
+        try
+        {
+            PKIPublicationInfo.getInstance(new DERSequence(v).getEncoded());
+            fail("no exception on an empty pubInfos");
+        }
+        catch (IllegalArgumentException e)
+        {
+            isEquals("pubInfos must contain at least one SinglePubInfo", e.getMessage());
+        }
+
+        try
+        {
+            new PKIPublicationInfo(new SinglePubInfo[0]);
+            fail("no exception on an empty pubInfo array");
+        }
+        catch (IllegalArgumentException e)
+        {
+            isEquals("pubInfos must contain at least one SinglePubInfo", e.getMessage());
+        }
     }
 
     private void encEqualTest(PKIPublicationInfo pubInfo)