4 ms·
This is extremely obvious in the new FIDO specification for key export, where they neglect to specify the format in which the private keys are encoded. In othe
by Borealid 2y ago
This is extremely obvious in the new FIDO specification for key export, where they neglect to specify the format in which the private keys are encoded.
In other words, it's a "standard" designed to let Apple, Google, and Microsoft enable portability between each other, but to keep software like KeePass out of the mix.
- lxgr 2y agoThis really is the least problem. As long as the key export API isn't actually gated (e.g. by only working over a backend-to-backend API with a mandatory "security audit" to gain access, by wrapping exported keys using vendor-specific keys and requiring a similar audit to be included as an export target etc.), everything else can be figured out. There's only so many ways you can encode an ECDSA key.
- comex 2y agoIsn’t that here? https://fidoalliance.org/specs/cx/cxf-v1.0-wd-20241003.html#dict-passkey https://fidoalliance.org/specs/cx/cxf-v1.0-wd-20241003.html#... The private key is specified as being a “PKCS#8 formatted byte string which is then Base64url encoded”. Is that insufficient?