Re: [webauthn] Which "pubKeyCredParams" to use? (#1757)

> For developer: **tldr** use -7 (ES256)

The three algorithms I've thought lately we can safely suggest within the spec are, in this order:

- `-8` (Ed25519)
- `-7` (ES256)
- `-257` (RS256)

I'd put `-8` at the top of the list to encourage adoption of Ed25519, since authenticators that can support it will choose to use it if it's first on the list. After that `-7` and `-257` are the two that practically cover almost 100% of existing authenticators.

I wouldn't drop `-257` just yet, even if signs are that platform authenticators used via Windows Hello will start using ES256, because of how long older versions of Windows can stick around.

Thanks for bumping this up, it reminded me that I need to get started on this 😅 

-- 
GitHub Notification of comment by MasterKale
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1757#issuecomment-1321203084 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Sunday, 20 November 2022 18:04:45 UTC