0

I've been reading about WebAuthn and try to write some code to exercise.

One thing I noticed is that the spec doesn't seem to provide any way to verify the correctness of the public-key being create()'d other than through attestation. And by TOFU paradigm mentioned in MDN document, it's not to be verified in the first place.

However, with PKIX CSR, the public-key in the cert request is signed by its corresponding private key, which provide a basic level of verification.

So, what are the pro's and con's of public-key verification signatures? Why WebAuthn choose this over that?

Improve this question

1 Answer 1

Reset to default
1

After a bit of further reading, I found these:

The 'self' attestation type is WebAuthn's equivalent of verifying a public key with itself. This attestation type is currently only supported by 'packed' statement format.

The danger of not verifying the public key is shortly mentioned in Chapter 7 where recommended rely party behavior is specified. Specifically, the note following step 26 of "Registering a New Credential - it's discussed in the rationale note explaining why a duplicated public key credential should be rejected (because it's not integrity protected unless attestation type is 'self')

As for the pro's and con's of integrity protecting the public key - THERE IS NO CON:)

Improve this answer
3
  • are we now referring to chapters of a unknown source? not very helpful...
    – LvB
    Commented Aug 14, 2023 at 10:57
  • 1
    @LvB, I assumed readers would automatically refer to the WebAuthn draft from W3C. Added link to make it clearer.
    – DannyNiu
    Commented Aug 14, 2023 at 12:06
  • while that was the first thing that popped to mind for me... I know it wouldn't for everyone. in any case. in the future it might not be as obvious anymore. so thank you for adding the links.
    – LvB
    Commented Aug 14, 2023 at 13:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .