W3C home > Mailing lists > Public > public-webauthn@w3.org > August 2019

Re: [webauthn] Section 8.6 step 6 clarification (Correct Hash algorithm) (#1279)

From: Adam Langley via GitHub <sysbot+gh@w3.org>
Date: Tue, 20 Aug 2019 22:27:43 +0000
To: public-webauthn@w3.org
Message-ID: <issue_comment.created-523219367-1566340062-sysbot+gh@w3.org>
> Other implementers have grabbed the hash algorithm from the auth_data => attested_credential_data => credential_public_key map and then done a lookup based on COSE. This seems to me like an unnecessary step, but I am not 100% sure.

You're talking about verifying the attestation signature? If so, then looking at the [credential public key](https://w3c.github.io/webauthn/#credentialpublickey) is wrong because that's the public key that has just been _generated_ by the authenticator. It's not the key that's embedded into the authenticator and used to sign the (transformed) [attested credential data](https://w3c.github.io/webauthn/#sctn-attested-credential-data).

The attestation certificate is an X.509 certificate and thus contains a [Subject Public Key Info](https://tools.ietf.org/html/rfc5280#section-4.1) which describes the public key but not the signature hash function. The hash function is just SHA-256 by convention and we should nail that down in the spec.

GitHub Notification of comment by agl
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1279#issuecomment-523219367 using your GitHub account
Received on Tuesday, 20 August 2019 22:27:45 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 18:59:06 UTC