Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Generalize credential public key return value #137

Closed
grzuy opened this issue Mar 26, 2019 · 4 comments
Closed

Generalize credential public key return value #137

grzuy opened this issue Mar 26, 2019 · 4 comments

Comments

@grzuy
Copy link
Contributor

grzuy commented Mar 26, 2019

Right now in response#credential we're returning the public key in EC point uncompressed format.

We need to change that to become agnostic of the public key type.

@grzuy
Copy link
Contributor Author

grzuy commented Mar 26, 2019

We probably just want to return the exact bytes in the credentialPublicKey field in https://www.w3.org/TR/webauthn/#credentialpublickey.

@grzuy
Copy link
Contributor Author

grzuy commented Mar 26, 2019

This change needs to be backwards-compatible by keeping support for the EC point uncompressed format in the allowed_credentials option for the AuthenticatorAssertionResponse#verify method.

So that current apps with stored credentials don't break.

@grzuy
Copy link
Contributor Author

grzuy commented Mar 28, 2019

FWIW this will make us comply more precisely with step 18 in https://www.w3.org/TR/webauthn/#registering-a-new-credential.

[...] by associating it with the credentialId and credentialPublicKey in the attestedCredentialData in authData, as appropriate for the Relying Party's system.

@grzuy grzuy removed this from the 2.0 milestone Apr 3, 2019
@grzuy
Copy link
Contributor Author

grzuy commented Apr 3, 2019

Released in v1.12.0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant