Skip to content

fix(webauthn): offer RS256 for the PRF-wrapping credential #142

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stormer78 merged 1 commit into from
Aug 30, 2026
Merged

fix(webauthn): offer RS256 for the PRF-wrapping credential #142

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions packages/extension/src/webauthn-prf-wrap.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -332,6 +332,22 @@ export class WebAuthnPrfSecretWrap implements SecretWrap {
pubKeyCredParams: [
{ type: "public-key", alg: -8 }, // EdDSA
{ type: "public-key", alg: -7 }, // ES256
// RS256, last and least preferred. Nothing here ever verifies a
// signature from this credential — it exists only to carry the PRF
// extension, and the PRF output is independent of the key's
// algorithm — so admitting RSA costs nothing and widens the set of
// authenticators that can hold the wallet's wrapping secret.
//
// It also silences a Chromium console warning that offering neither
// ES256 *nor* RS256 risks registration failures on incompatible
// authenticators. The warning surfaces in chrome://extensions as an
// error against the extension, where it sits next to real faults
// and costs someone the time to rule out. Do NOT copy this to
// `enrollPasskey` in core, whose key IS registered as a DID
// verification method: `importSpkiForAlg` accepts only
// ES256/EdDSA/ES384, so an RSA credential there would enroll and
// then fail to import.
{ type: "public-key", alg: -257 }, // RS256
],
authenticatorSelection: {
residentKey: "required",
Expand Down
Loading