Re: [webauthn] Can the private keys be used for other cryptographic operations? (#1595)

Thanks @ve7jtb. Agreed that this does seem a bit fraught, would need to be done carefully as it's not the intended use case.

It seems that WebAuthn, WebCrypto, and similar specs are circling around the bigger topic of opening up cryptography using secure device hardware to web apps. I'm not sure why this has been commonplace for mobile apps for years but still isn't an option for web apps. It may not be possible to expand the scope of WebAuthn to include this, given how tightly coupled it is to the authentication use case, but I'm encouraged that level 3 might reintroduce broader usage of keys. 

To me at least, it seems like a very natural and useful generalization. Perhaps another spec that encapsulates WebAuthn as one part.

-- 
GitHub Notification of comment by certainlyNotHeisenberg
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1595#issuecomment-816268903 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Thursday, 8 April 2021 22:18:22 UTC