Implement signing using FIDO sign extension and ARKG
#14
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Emacs struggles with very long lines, making it very cumbersome to work with the file.
emlun
force-pushed
the
sign-extension-arkg
branch
from
fc90187 to
b0165f9
Compare
emlun
force-pushed
the
sign-extension-arkg
branch
from
5a54ea4 to
b0fdf2c
Compare
This fixes possible issues with rotating the key immediately after creating it, where otherwise it wouldn't be possible to re-wrap private keys without first taking a detour through session storage to get `importMainKey` to add the "unwrapKey" usage.
emlun
force-pushed
the
sign-extension-arkg
branch
from
4a61cb5 to
c3f160f
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This implements using our proposed WebAuthn
signextension to create credential keypairs and using them to sign credential issuances and presentations. This also implements using ARKG to generate public keys; this currently has no benefit since we still need to sign using the credential private key during the issuance flow, but we anticipate an updated OpenID4VCI profile where this signature will not be needed, enabling a much smoother user experience where public keys can be generated fully automatically even without the security key present.If either the browser or the authenticator doesn't support the
signextension, the wallet falls back to using PRF based keys like before. Also, at the moment the ARKG implementation only works if there is exactly 1 ARKG-compatible key in the wallet. We'll need to decide what to do if there's more than one.As of now, this imports the
josemodule as a submodule so that we can make theSignJWT.sign()function support a customizablesignFunctionparameter. I've pushed this branch of thejoserepository into the wallet-frontend repo, so that we don't need any new repos just for this. So all you should need to do to get this initialized is:In order to try/test this you'll also need a browser that supports the WebAuthn
signextension. I have a custom branch of Firefox that does that, I'll look into how I can best share that with y'all.I haven't yet been able to test this in the Funke context, so it's possible that some things might break...