secp256r1 could enable passkey wallets...

I think supporting just secp256r1 would be sufficient to get decent passkey support.

I found some reports of some Windows machines only supporting RSA, and technically the Webauthn spec encourages at least supporting the following three schemes/algos:

-8 (Ed25519)

-7 (ES256)

-257 (RS256)

Ref: https://w3c.github.io/webauthn/#dom-publickeycredentialcreationoptions-pubkeycredparams

Where:

-7 (ES256) is secp256r1
-257 (RS256) is RSASSA-PKCS1-v1_5 with SHA-256 RFC8017.

However, from best I can tell Ed25519 is not commonly supported, and a test we did confirmed ES256 is available on Windows in browners.

Also, supporting RSA would be challenging from a cost perspective as the keys and signatures are large. Keys and signatures would be 256-512 bytes.

We could support a limited set of passkeys that already support Ed25519 today, such as some Yubikeys.

Add secp256r1 curve host fns #807

Description

dmkozhopenedon May 15, 2023

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Add `secp256r1` curve host fns #807

dmkozh
openedon May 15, 2023