Validate Passkey Algorithm + CRV when decoding CredentialPublicKey
Open
area-identity
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 290
Description
We check if the CRV and KTY are a valid combination:
https://github.com/dotnet/aspnetcore/blob/9e6f35811b1129c6ec8b7b15fb0507dfe3a66c90/src/Identity/Core/src/Passkeys/CredentialPublicKey.cs#L156
We should also add validation for ALG + CRV combinations
See https://www.w3.org/TR/webauthn-3/#sctn-alg-identifier for combinations.
Contributor guide
Assessment
This issue has not been assessed yet.