Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat/better-signature-verification #256

Merged
merged 10 commits into from
Aug 17, 2022

Conversation

MasterKale
Copy link
Owner

@MasterKale MasterKale commented Aug 17, 2022

This PR adds support for Ed25519 signature verification. Unfortunately this represents a breaking change to SimpleWebAuthn as verifyAuthenticationResponse() needed to be marked async and return Promise<VerifiedAuthenticationResponse> instead of simply VerifiedAuthenticationResponse in order to work with the library I pulled in to assist with the Ed25519 signature verification. The silver lining is that now both verifyRegistrationResponse() and verifyAuthenticationResponse() return Promise<boolean> and it's simpler to internalize "both return promises" than "registration is a promise, and authentication is just a boolean...or was it the other way around?"

I also managed to completely remove elliptic and node-rsa libraries for more of Node's crypto module.

I ran the Example server with this code again FIDO Conformance v1.7.2 and was able to pass all tests, including most of the optional algorithm tests:

Screen Shot 2022-08-16 at 12 22 11 AM

Screen Shot 2022-08-16 at 12 24 39 AM

This includes the Ed25519 test mentioned in #252:

Screen Shot 2022-08-16 at 9 40 46 PM

Refactoring existing use of verifyAuthenticationResponse()

Update your existing calls to verifyAuthenticationResponse() to work with them like promises, whether with .then() or await depending on your code structure:

Before

const verification = verifyAuthenticationResponse({
  // ...
});

after

const verification = await verifyAuthenticationResponse({
  // ...
});

@MasterKale MasterKale merged commit 2de1972 into master Aug 17, 2022
@MasterKale MasterKale deleted the feat/better-signature-verification branch August 17, 2022 04:42
@MasterKale MasterKale added this to the v6.0.0 milestone Aug 17, 2022
@MasterKale MasterKale added the package:server @simplewebauthn/server label Aug 17, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
package:server @simplewebauthn/server
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant