Re: [webauthn] Use fully-specified COSEAlgorithmIdentifiers in examples and recommendations (#2283)

> Here, it sounds to me like you are talking about key representations:

I am indeed.

> It may not be OK for WebAuthn, but for the cryptographic algorithm, it doesn't matter if the key is represented as a JWK, a COSE_Key, in a X.509 certificate, or in an XML data structure, provided the implementation understands and correctly uses it.

That's fine. I'm looking at this entirely from the perspective of WebAuthn since there seems to be a desire to explicitly incorporate these new IDs into the spec despite objections. I'm unsure if the current description for Ed25519 is not sufficient from the wider context of COSE either. I'm "attacking" the description purely from the perspective of WebAuthn. So you may also not want to change the description of it assuming that the current description was the actual intent.

Does Ed25519 only mean _any_ EdDSA that uses curve ed25519, or is the intent for it to only mean the Ed25519 scheme as defined in RFC 8032 ยง 5.1? Seeing how incredibly broad a lot of these IDs are, it wouldn't surprise me if Ed25519 were to only _any_ EdDSA that uses curve ed25519. From the perspective of WebAuthn that would be highly unfortunate though.

-- 
GitHub Notification of comment by zacknewman
Please view or discuss this issue at https://github.com/w3c/webauthn/pull/2283#issuecomment-2885101261 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Thursday, 15 May 2025 21:32:15 UTC