web-auth / cose-lib Goto Github PK

Version(s) affected

4.0.5

Description

https://github.com/web-auth/cose-lib/search?q=COSE_ALGORITHM_EdDSA 👀

How to reproduce

Possible Solution

Change it to COSE_ALGORITHM_EDDSA

Version(s) affected

Current git master

Description

Is it intentional that this file exists in git:

https://github.com/web-auth/cose-lib/blob/v4.0/infection.txt?

If it is, then it should be added to .gitattributes as export-ignore, otherwise consumers will need to download 250kB of useless text.

How to reproduce

Look at the git repository.

Possible Solution

Delete the file.

Additional Context

No response

Version(s) affected

4.2.0

Description

When you check fields 1 and -1 of an OKP key, you assume the value is an integer, or following rfc9053, it can also be a text string. So if I have a registered key and the cbor map contains tstr as values and not integer, verify throw an exception.

Linked to issue 448 of web-auth/webauthn-framework (web-auth/webauthn-framework#448)

How to reproduce

With this binary key:

0xA401634F4B50032720674564323535313921582098C91448E657A3366C3C04551DAFD92A8BB2BA35138B4ACB94CA1E79D2627BAE

{1: "OKP", 3: -8, -1: "Ed25519", -2: h'98C91448E657A3366C3C04551DAFD92A8BB2BA35138B4ACB94CA1E79D2627BAE'}

Currently the lib throw an exception but the key is valid.

Possible Solution

No response

Additional Context

No response

Version(s) affected

4.0.0

Description

How to reproduce

Let CI run.

Possible Solution

To be implemented... (surprise) #4

Additional Context

No response