Article: Security Concerns Surrounding WebAuthn

This article was published today, highlighting a number of issues they
identified in WebAuthn:

https://paragonie.com/blog/2018/08/security-concerns-surrounding-webauthn-don-t-implement-ecdaa-yet

As far as I can tell, their main concerns are:

- JOSE implementations are historically error prone
- RSA with PKCS1v1.5 padding
- Many concerns about the security of ECDAA
  - Point compression not allowed
  - Nondeterministic nonces
  - BN curves

/Emil

-- 

Emil Lundberg

Software Developer | Yubico <http://www.yubico.com/>