Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Verify public key points are on specified curve #67

Closed
Firehed opened this issue Jan 3, 2024 · 0 comments · Fixed by #77
Closed

Verify public key points are on specified curve #67

Firehed opened this issue Jan 3, 2024 · 0 comments · Fixed by #77
Labels
enhancement New feature or request

Comments

@Firehed
Copy link
Owner

Firehed commented Jan 3, 2024

https://www.w3.org/TR/webauthn-3/#sctn-alg-identifier calls out that signature verification should check that the EC public key is actually on the specified curve (this was a new callout; see #48). Let's do so.
@Firehed Firehed added the enhancement New feature or request label Jan 3, 2024
@Firehed Firehed mentioned this issue Mar 10, 2024
Merged
Firehed added a commit that referenced this issue Mar 10, 2024
@Firehed
Verify P-256 keys are on the curve (#77)
ef12eb8 
I got some AI-assisted guidance on the implementation, but
cross-referenced several documents that specify and confirm the curve
parameters. The actual verification procedure is pretty straightforward
- do the systems-of-equations with basic algebra, and the apply the
modulus since that's how finite fields work.

Fixes #67
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Verify P-256 keys are on the curve Firehed/webauthn-php
1 participant
@Firehed