Re: [webauthn] Extensions need to define how their parameters convert to/from CBOR

Those specifications are pretty useless, sorry.   The first example I came to: says:

> The client extension input encoded as a CBOR text string (major type 3).

What does that mean?  The input is an ES Value, right?  Is used?  Something else?  If it's ToString, that can have side-effects, so the exact timing of the operation needs to be defined.

Then once you've got an ES String, you have a sequence of 16-bit integers.  "major type 3" in RFC 7049 is a string of "Unicode characters encoded as UTF-8".  Is the sequence of 16-bit integers meant to be treated as UTF-16?  If so, how are invalid codepoints handled?  All of this needs to be specified and it's not.

And this is the simplest case.  Cases like are completely unspecified in terms of how one goes from an ES Value to something that can be encoded in CBOR.  And this is all observable, because there are side-effects everywhere, because ES.

GitHub Notification of comment by bzbarsky
Please view or discuss this issue at using your GitHub account

Received on Wednesday, 11 October 2017 20:01:39 UTC