search

madwizard-org / webauthn-server

WebAuthn Relying Party server library for PHP
MIT License
51 stars 12 forks source link

Fix EdDSA keys / improve YubiKey support #23

Open MarkusBauer opened 1 year ago

MarkusBauer commented 1 year ago

This PR fixes two issues we faced with YubiKeys.

First issue: kty and crv can either be int or tstraccording to the RFC, where the string version should be one of the constants (like OKP or Ed25519). However, this library parses only the int version. This PR adds support for the string constants related to elliptic curves. There are likely more places where string constants are applicable, but the provided fixes are at least enough to get YubiKey working. Example input of such a key: {1: 'OKP', 3: -8, -1: 'Ed25519'}.

Second issue: some keys generate broken keys during registration (two errors: map length is wrong, and public key component x is bytearray instead of bytestring). See this issue for a more in-depth discussion. While this is technically not a fault in this library, this PR adds a workaround that detects and fixes those broken keys. Other webauthn libraries use such workarounds as well.

madwizard-thomas commented 12 months ago

Thanks for your PR! I will look into it and include it in the next release.