MasterKale / SimpleWebAuthn

WebAuthn, Simplified. A collection of TypeScript-first libraries for simpler WebAuthn integration. Supports modern browsers, Node, Deno, and more.
https://simplewebauthn.dev
MIT License
1.63k stars 137 forks source link

feat/better-signature-verification #256

Closed MasterKale closed 2 years ago

MasterKale commented 2 years ago

This PR adds support for Ed25519 signature verification. Unfortunately this represents a breaking change to SimpleWebAuthn as verifyAuthenticationResponse() needed to be marked async and return Promise<VerifiedAuthenticationResponse> instead of simply VerifiedAuthenticationResponse in order to work with the library I pulled in to assist with the Ed25519 signature verification. The silver lining is that now both verifyRegistrationResponse() and verifyAuthenticationResponse() return Promise<boolean> and it's simpler to internalize "both return promises" than "registration is a promise, and authentication is just a boolean...or was it the other way around?"

I also managed to completely remove elliptic and node-rsa libraries for more of Node's crypto module.

I ran the Example server with this code again FIDO Conformance v1.7.2 and was able to pass all tests, including most of the optional algorithm tests:

Screen Shot 2022-08-16 at 12 22 11 AM

Screen Shot 2022-08-16 at 12 24 39 AM

This includes the Ed25519 test mentioned in #252:

Screen Shot 2022-08-16 at 9 40 46 PM

Refactoring existing use of verifyAuthenticationResponse()

Update your existing calls to verifyAuthenticationResponse() to work with them like promises, whether with .then() or await depending on your code structure:

Before

const verification = verifyAuthenticationResponse({
  // ...
});

after

const verification = await verifyAuthenticationResponse({
  // ...
});