3 ms·

I think CBOR could be one of the reasons why WebAuthn unfortunately hasn’t gained more popularity. Would have been much easier for all parties if they would hav

I think CBOR could be one of the reasons why WebAuthn unfortunately hasn’t gained more popularity. Would have been much easier for all parties if they would have simply used JSON and base64 or hex to encode/decode binary data. I implemented the server side of WebAuthn from scratch, and CBOR felt unnecessary, the added value of encoding binary data slightly more efficient seems a small win, given the small data size transmitted/received in a WebAuthn authentication.

JoelJacobson 5y ago
For reference, here is my PostgreSQL extension implementation of CBOR and WebAuthn: https://github.com/truthly/pg-cbor https://github.com/truthly/pg-cbor https://github.com/truthly/pg-webauthn https://github.com/truthly/pg-webauthn
arianvanp 5y ago
FWIW if you don't care about attestation, Webauthn-L2 has client-side helper functions like getPublicKey() that allow you to do the handshake without parsing any CBOR https://www.w3.org/TR/webauthn-2/#sctn-public-key-easy https://www.w3.org/TR/webauthn-2/#sctn-public-key-easy If you want to check attestation you still need to parse CBOR (and whatever attestation format is inside.) I used this for a minimal webauthn implementation which is under 300 LoC https://github.com/arianvp/webauthn-minimal https://github.com/arianvp/webauthn-minimal (WIP) However only Chrome seems to implement the L2 spec so far. It feels like Webauthn is basically abandoned on Mozilla side of things as they still haven't finished implementing L1 (It's missing all the CTAP2 stuff) whilst it has been out for more than a year. And there have barely been any Webauthn-related commits in the past years. But yeh; in general webauthn is a design-by-committee dumpster fire; unfortunately. U2F was conceptually way simpler.
amluto 5y ago
FIDO1 was mostly just a pile of bytes. Sadly, some silly ASN.1 encoding for signatures was used that treated the big numbers as numbers instead of byte strings, causing a variable length encoding, but this wasn’t a big deal. If you wanted attestation, you had to deal with X.509, but that’s par for the course. Other than that, the spec was delightfully boring.

JoelJacobson 5y ago

For reference, here is my PostgreSQL extension implementation of CBOR and WebAuthn: https://github.com/truthly/pg-cbor https://github.com/truthly/pg-cbor https://github.com/truthly/pg-webauthn https://github.com/truthly/pg-webauthn

arianvanp 5y ago

FWIW if you don't care about attestation, Webauthn-L2 has client-side helper functions like getPublicKey() that allow you to do the handshake without parsing any CBOR https://www.w3.org/TR/webauthn-2/#sctn-public-key-easy https://www.w3.org/TR/webauthn-2/#sctn-public-key-easy If you want to check attestation you still need to parse CBOR (and whatever attestation format is inside.) I used this for a minimal webauthn implementation which is under 300 LoC https://github.com/arianvp/webauthn-minimal https://github.com/arianvp/webauthn-minimal (WIP) However only Chrome seems to implement the L2 spec so far. It feels like Webauthn is basically abandoned on Mozilla side of things as they still haven't finished implementing L1 (It's missing all the CTAP2 stuff) whilst it has been out for more than a year. And there have barely been any Webauthn-related commits in the past years. But yeh; in general webauthn is a design-by-committee dumpster fire; unfortunately. U2F was conceptually way simpler.

amluto 5y ago

FIDO1 was mostly just a pile of bytes. Sadly, some silly ASN.1 encoding for signatures was used that treated the big numbers as numbers instead of byte strings, causing a variable length encoding, but this wasn’t a big deal. If you wanted attestation, you had to deal with X.509, but that’s par for the course. Other than that, the spec was delightfully boring.