> https://www.w3.org/TR/2018/CR-webauthn-20180320/#sctn-cose-alg-reg https://www.w3.org/TR/2018/CR-webauthn-20180320/#sctn-cose-a... I'm not feeling great abou

> https://www.w3.org/TR/2018/CR-webauthn-20180320/#sctn-cose-alg-reg https://www.w3.org/TR/2018/CR-webauthn-20180320/#sctn-cose-a... I'm not feeling great about these algorithm choices. Namely: RSA with PKCS1v1.5 See also: https://robotattack.org https://robotattack.org EDIT: Also, elliptic curve digital signatures with a random nonce (here, "r") instead of deterministic nonces makes me feel itchy. https://fidoalliance.org/specs/fido-uaf-v1.1-id-20170202/fido-ecdaa-algorithm-v1.1-id-20170202.html#ecdaa-sign https://fidoalliance.org/specs/fido-uaf-v1.1-id-20170202/fid...