[passkey] initial draft #474

alex4506 · 2024-07-22T01:39:29Z

Description

This submission adds basic support for passkey to the SDK, and also includes corresponding tests.

Test Plan

There still some errors in api tests, especially the submission part of passkey transactions

Related Links

This submission mainly referenced the passkeySigning branch.

src/core/crypto/passkey.ts

hariria · 2024-07-22T18:45:53Z

src/internal/passkey.ts

+  });
+}
+
+export async function registerCredential(


In addition to the registerCredential, there needs to be more methods verifying whether or not the credential was actually backedup (parse the registration response, verify backup eligibility and backup state), otherwise people will shoot themselves in the foot and create non-backedup credentials.

See https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-66.md#authenticator-data

Additionally we need support for identifying incompetent / malicious authenticators via AAGUID. see https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-66.md#incompetent--malicious-authenticators

Can I just expose this method verifyAuthenticationResponse to user? Its return type VerifiedAuthenticationResponse include credentialDeviceType and credentialBackedUp

Should we implement a policy that only allows the use of password managers on the list https://github.com/passkeydeveloper/passkey-authenticator-aaguids/blob/main/aaguid.json ?

For context on my general thought process here, overall I'd like to provide strong / safe defaults on passkey registration for the user with the ability to override them if a developer wants to.

Yes you're on the right track, the verifyAuthenticationResponse method parses BE and BS and returns the VerifiedAuthenticationResponse. To make it easier for the user we can just check to make sure both are set to true to determine if the credential is backed up.

Per the point above, yes, I think it may make sense to have a strong default for users that allows for authenticators that are well known and ~~guaranteed~~ to be backed up. iCloud Keychain (Managed), iCloud Keychain, and Google Password Manager for example. 1Password and Dashlane may also be acceptable but I'm not confident on the rest of them at this moment.

0xmaayan · 2024-07-22T18:44:23Z

babel.config.js

@@ -0,0 +1,3 @@
+module.exports = {
+  presets: [["@babel/preset-env", { targets: { node: "current" } }]],


what is the reason for adding babel? the sdk uses tsup as the bundle tool

It is for babel-jest

Some imports from @simplewebauthn/browser broke jest, and I couldn't find a way to successfully run it using only ts-jest, so I introduced bable-jest.

I see. I'd prefer not to introduce another bundle tool and keep the existing one. Also, to reduce potential errors, and to not increase the package size.

Agree, but I have spent two days, still cannot run jest with only ts-jest, looking forward to any suggestions

BTW, the solution I found is from MasterKale/SimpleWebAuthn#293

0xmaayan · 2024-07-22T18:45:06Z

examples/typescript/passkey/src/App.tsx

+   * @returns {Promise<*>}
+   *
+   */
+  const balance = async (aptos: Aptos, name: string, address: AccountAddress) => {


could we keep this example in a node env - same as all the other examples on the SDK? https://github.com/aptos-labs/aptos-ts-sdk/blob/main/examples/typescript/keyless.ts

I will have a try, but it maybe hard. Passkey (webauthn) requires browser API for interactive authentication process.

src/api/passkey.ts

src/core/crypto/passkey.ts

hariria · 2024-07-23T15:03:52Z

Please also include functions for ECDSA Public Key recovery: https://github.com/aptos-labs/aptos-ts-sdk/pull/194/files#diff-0d9fbf024d51030ac58aa3709e3eed1a07f4d45b5f65affd1211bff56dacb9b4R1.

alex4506 · 2024-07-25T09:17:57Z

Please also include functions for ECDSA Public Key recovery: https://github.com/aptos-labs/aptos-ts-sdk/pull/194/files#diff-0d9fbf024d51030ac58aa3709e3eed1a07f4d45b5f65affd1211bff56dacb9b4R1.

Added

hariria · 2024-07-27T00:22:09Z

examples/typescript/passkey/src/recoverPubKey.ts

+export async function recoverPublicKey(
+  authenticatorData: Uint8Array,
+  clientDataJSON: Uint8Array,
+  signature: Uint8Array,
+) {
+  const shaClientDataJSON = await sha256(clientDataJSON);
+  const message = concatenateUint8Arrays(authenticatorData, shaClientDataJSON);
+
+  const result = await recoverPublicKeyFromMessageAndSignature(message, signature);
+  return result;
+}
+
+export async function recoverPublicKeyFromMessageAndSignature(message: Uint8Array, signature: Uint8Array) {


Thanks for adding this in.

Can we add tests for these methods that use the Passkey classes below? We want to make sure users can recover the public key associated with their passkey credential from one or more valid ECDSA signatures in the event that that the relying party loses or misplaces the user's public key.

Also lets include a button in the UI for the examples/typescript/passkey folder that tests this

tests/e2e/api/passkey.test.ts

hariria · 2024-07-27T00:35:42Z

src/internal/passkey.ts

+  });
+}
+
+export async function registerCredential(


For context on my general thought process here, overall I'd like to provide strong / safe defaults on passkey registration for the user with the ability to override them if a developer wants to.

Yes you're on the right track, the verifyAuthenticationResponse method parses BE and BS and returns the VerifiedAuthenticationResponse. To make it easier for the user we can just check to make sure both are set to true to determine if the credential is backed up.

Per the point above, yes, I think it may make sense to have a strong default for users that allows for authenticators that are well known and ~~guaranteed~~ to be backed up. iCloud Keychain (Managed), iCloud Keychain, and Google Password Manager for example. 1Password and Dashlane may also be acceptable but I'm not confident on the rest of them at this moment.

hariria · 2024-07-27T00:47:11Z

Also I'm not sure if SimpleWebAuthn provides this but I think it would be good to provide a method like checkPlatformBackupable that checks

browser version (should be Chrome 118+ for backupable passkeys on MacOS iirc, safari, firefox)
operating system

And this method should be checked in the happy path for passkey registration.

See https://passkeys.dev/device-support/ for more info

hariria reviewed Jul 22, 2024

View reviewed changes

src/core/crypto/passkey.ts Outdated Show resolved Hide resolved

hariria reviewed Jul 22, 2024

View reviewed changes

0xmaayan reviewed Jul 22, 2024

View reviewed changes

hariria reviewed Jul 23, 2024

View reviewed changes

src/core/crypto/passkey.ts Outdated Show resolved Hide resolved

src/core/crypto/passkey.ts Outdated Show resolved Hide resolved

src/core/crypto/passkey.ts Outdated Show resolved Hide resolved

hariria reviewed Jul 27, 2024

View reviewed changes

hariria force-pushed the passkey branch 7 times, most recently from 390d5bc to fa185dd Compare August 22, 2024 23:18

alex4506 and others added 12 commits August 25, 2024 21:39

[passkey] Add passkey support

739ad74

[passkey] Add passkey demo

a6e4570

[passkey] support sign without submit

fa7712c

[passkey] fix typo

e1e742d

[passkey] modify jest config to support simplewebauthn

14a85b5

[passkey] add more tests

d1692b7

[passkey] Discard PasskeyPublicKey

091299f

[passkey] add ECDSA Public Key recovery

89a1338

[passkey] add more doc strings

4b9efb8

[passkey] Amend api test with mock assertion response

d147a31

[passkey] fix lock file

918e79e

[passkey] fix sha256 in verifySignature

c8d4801

alex4506 force-pushed the passkey branch from fa185dd to c8d4801 Compare August 25, 2024 14:17

hariria added 2 commits August 26, 2024 15:31

[passkey] Secp256r1 Ecdsa PublicKey Recovery

723bde7

[passkey] Secp256r1 Ecdsa PublicKey Recovery

d0e8f76

hariria added 2 commits August 27, 2024 16:05

[passkey] Ecdsa Recovery for passkey public key in API tests

3d1d6f0

[passkey] Ecdsa recovery with two signatures

aea2146

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[passkey] initial draft #474

[passkey] initial draft #474

alex4506 commented Jul 22, 2024

hariria Jul 22, 2024

hariria Jul 22, 2024

alex4506 Jul 27, 2024

hariria Jul 27, 2024

0xmaayan Jul 22, 2024

alex4506 Jul 23, 2024 •

edited

Loading

0xmaayan Jul 23, 2024

alex4506 Jul 23, 2024

alex4506 Jul 23, 2024

0xmaayan Jul 22, 2024

alex4506 Jul 23, 2024

hariria commented Jul 23, 2024

alex4506 commented Jul 25, 2024

hariria Jul 27, 2024

hariria Jul 27, 2024

hariria commented Jul 27, 2024 •

edited

Loading

		@@ -0,0 +1,3 @@
		module.exports = {
		presets: [["@babel/preset-env", { targets: { node: "current" } }]],

[passkey] initial draft #474

Are you sure you want to change the base?

[passkey] initial draft #474

Conversation

alex4506 commented Jul 22, 2024

Description

Test Plan

Related Links

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

alex4506 Jul 23, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hariria commented Jul 23, 2024

alex4506 commented Jul 25, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hariria commented Jul 27, 2024 • edited Loading

alex4506 Jul 23, 2024 •

edited

Loading

hariria commented Jul 27, 2024 •

edited

Loading