Verify passkey algorithms from COSE keys

2026-09-04 12:19:15 -04:00
parent 3fe1547a5b
commit b1710e08b8
8 changed files with 114 additions and 6 deletions
@@ -19,6 +19,10 @@ authorization decisions, session cookie, HTML, and local recovery command.
 - Request no attestation conveyance.
 - Permit ES256 only until another algorithm has explicit interoperability and
  security evidence.
+- Enforce that policy from the verified COSE public key embedded in
+  authenticator data. Do not rely on the optional browser
+  `publicKeyAlgorithm` convenience member: direct standards-compliant response
+  serializers may omit it even when the attested credential is ES256.
 - Store random challenges and verifier session data only behind opaque,
  single-use ceremony tokens.
 - Treat clone warnings as audit signals rather than automatic lockout for