3 ms·
I wonder if you could use those keys also for encrypting content?
by kennu 8y ago
I wonder if you could use those keys also for encrypting content?
- tialaramex 8y agoNot with this API. You can purchase objects which can do this AND handle say your GPG keys for encryption, but WebAuthn is deliberately narrowly scoped. Using the same key for unrelated things can result in unpleasant surprises. So it's to be avoided. If you have a crappy insecure email server that uses SSLv3 still, and uses the same key as your tightly locked down Web server with TLS 1.2 then this bites you really badly, I can use the email server to help me impersonate your web server.
- franciscop 8y agoIt doesn't seem like it, but it does require the content to be encrypted with TLS, which implies another pair of public-private key parts and certificates.