Re: [webauthn] Increase/remove maximum length requirement for credential ID (#2299)

It's true that 1023 bytes can only accommodate RSA keys up to just under 8 kib, and it's unfortunate that this falls short of the RFC 8230 recommendation, but this is unlikely to be a problem in practice. Server-side storage is mostly relevant for security keys with constrained hardware, and those devices are less likely to support large RSA keys anyway precisely because of their large size. For example, YubiKey 5 doesn't support RSA at all in its CTAP module, only ES256, ES384 and Ed25519. On the other hand, authenticators with lots of storage space can easily store the key internally instead of server-side (and the key can still be non-discoverable by simply marking it as such), so they can easily work around the credential ID length limit and thus support, say, 8-kib RSA without issue.

And indeed, ML-DSA keys can be stored as the seed rather than the expanded key. That [appears to be the primary representation the COSE WG is settling on](https://mailarchive.ietf.org/arch/msg/cose/ZYg6hwq8tzez0YxX-2Yt78mkjkE/) as well, for what it's worth.

-- 
GitHub Notification of comment by emlun
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/2299#issuecomment-2930870000 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Monday, 2 June 2025 13:58:51 UTC