@le-space/orbitdb-identity-provider-webauthn-did 0.5.0 → 0.5.2

package/CHANGELOG.md

@@ -2,6 +2,161 @@
 
 ## Unreleased
 
+## 0.5.2
+
+### Security
+
+- **Identity verification checked shapes, not signatures**
+  ([GHSA-326j-4cc3-4rrg](https://github.com/Le-Space/orbitdb-identity-provider-webauthn-did/security/advisories/GHSA-326j-4cc3-4rrg)).
+  Four checks that decide whether an identity may speak for a DID verified
+  nothing: the static `verifyIdentity` OrbitDB calls accepted any `did:key:` of
+  type `webauthn`; `WebAuthnDIDProvider.verify()` accepted any proof with the
+  right fields; varsig verification returned `true` whenever
+  `window.__PLAYWRIGHT__` was set; and `verifyVarsigIdentity` never compared the
+  id with the key signing for it. Anyone who knew a DID could write as it
+  wherever write access was granted to that DID.
+
+  `src/webauthn/proof-verification.js` now decides it. A credential DID (P-256)
+  is bound through the WebAuthn assertion in `signatures.publicKey`, verified
+  against the key the DID itself encodes. A keystore DID (Ed25519, secp256k1)
+  must be exactly the key that signs. A varsig identity must carry the DID of
+  its own key. The test-mode branches are gone from `src/`.
+
+  **Check before upgrading** — three things that were accepted and now are not:
+  - Entries written under `useKeystoreDID` by 0.5.1 or earlier. Those identities
+    signed with a key unrelated to their DID (see _Fixed_), which makes their
+    entries indistinguishable from forgeries, so upgraded peers refuse them.
+    Identities with the default credential DID are unaffected.
+  - Legacy 64-hex identity ids. They cannot be bound to any key.
+  - `WebAuthnDIDProvider.verify(signature)` with one argument. It now needs the
+    signed data and the public key: `verify(signature, data, publicKey)`.
+
+### Fixed
+
+- `useKeystoreDID` with `keystoreKeyType: 'Ed25519'` signed entries with a
+  secp256k1 key. The provider stored its key under the credential's P-256 DID;
+  OrbitDB looked it up under the keystore DID, found nothing and generated a
+  fresh secp256k1 key, so only the DID was Ed25519. The key now goes under the
+  DID OrbitDB looks it up by, encrypted and unencrypted.
+- The Ed25519 demo kept `prfInput` across a reload as a plain object, which the
+  browser refused as a PRF input; the worker's seed then fell back to the
+  credential ID and its archive could no longer be opened.
+
+### Tests
+
+- `tests/identity-forgery.test.js`: every forgery above is refused, and beside
+  each the genuine identity still passes. The browser suites use a Chromium
+  virtual authenticator instead of mocks that signed with 64 zero bytes.
+
+## 0.5.1
+
+### Fixed
+
+- The WebAuthn user handle is 64 random bytes instead of the UTF-8 of whatever
+  the caller passes as `userId`. An authenticator keeps one discoverable
+  credential per `(rp.id, user.id)` and **replaces** the previous one when both
+  match — silently, with no prompt and nothing to undo. Deriving the handle from
+  a typed name therefore meant two people registering as "anna" on a shared
+  device destroyed each other's passkey, and with it the DID and every entry
+  signed under it. The same happened to one person re-entering their usual name
+  after clearing storage. WebAuthn L2 §5.4.3 also forbids putting personally
+  identifying information in the handle, which a name or e-mail plainly is, and
+  the handle is stored in the authenticator indefinitely.
+
+  `userId` keeps its rightful place as `user.name`, the label the credential
+  picker shows. It is a label only: it identifies nothing, two credentials may
+  carry the same one, and nothing in this package looks a credential up by it.
+  Closes #45.
+
+  Nothing needs migrating. Recovery goes through discoverable credentials
+  (`readLargeBlobMetadata` calls `get()` with no `allowCredentials`), or through
+  an explicit credential ID where those are switched off — no path resolves a
+  credential by handle, so credentials registered under the old scheme keep
+  working untouched. The derived `did:key` comes from the credential's public
+  key and does not change.
+
+  Consumers should expect a behavioural difference: re-registering under a name
+  that was used before now **adds** a passkey instead of replacing one. That is
+  the point — a replaced passkey is data loss, a second entry is a choice — but
+  it means the picker can show several, so `user.name` and `displayName` should
+  be distinguishing enough to pick from. The new random handle is returned as
+  `credential.userHandle` (base64url); the authenticator keeps its own copy, so
+  storing it is optional.
+
+- Actually write the secret key into `largeBlob`. The keystore record carried
+  `secretKey: sk, // Will be moved to largeBlob` — and nothing ever moved it.
+  That was the only occurrence of the field in `src/`, and
+  `storeEncryptedKeystore()` serialises a fixed whitelist that does not include
+  it, so the key was dropped at persist time. Choosing largeBlob therefore
+  produced a keystore that worked for the session that created it and could
+  never be unlocked again: on the next load `retrieveSKFromLargeBlob()` read a
+  blob nobody had written and failed with "No largeBlob data found in
+  credential".
+
+  The key never reached disk in the clear — the whitelist saw to that — but the
+  feature was inert. `writeSKToLargeBlob()` now performs the assertion that
+  stores it (a blob can only be written during an assertion, never at
+  registration, so this costs one extra prompt) and **throws unless the
+  authenticator reports `written: true`**. Failing there beats persisting a
+  record that cannot be opened.
+
+- Carry the authenticator's own answer on the credential. `createCredential()`
+  now records `extensionSupport` — what the authenticator agreed to during the
+  ceremony — because the raw `PublicKeyCredential` does not survive past that
+  function, so the answer is read there or lost. Client support is not
+  authenticator support: measured on a macOS platform authenticator in Brave,
+  the client advertises `hmacCreateSecret` while the authenticator refuses it
+  and PRF works. Reading only the client is what left the demo offering
+  hmac-secret and then failing at the ceremony, which is the failure originally
+  reported in #9.
+
+  The encrypted-keystore demo consumes it: methods the authenticator refused
+  read "Browser yes, this passkey no" rather than "Supported", become
+  unselectable, and a selection it cannot honour falls back automatically. It
+  also no longer logs `encrypted: Yes (largeBlob)` off the back of the
+  _requested_ options — that line reported intent as though it were outcome, so
+  a failed write looked identical to a successful one. It now names the request
+  and the authenticator's capability separately, so a mismatch is visible.
+
+- Detect WebAuthn extensions by asking the browser instead of inspecting a
+  prototype. `checkExtensionSupport()` tested
+  `'largeBlob' in PublicKeyCredential.prototype` — but extensions are never
+  properties of that interface, they arrive through
+  `getClientExtensionResults()`. The test therefore returned `false` in every
+  browser ever shipped, including those with complete support, and `hmacSecret`
+  was hard-coded `false` beside it. Both together meant the encrypted-keystore
+  demo disabled its own headline feature everywhere and could not be switched
+  on at all.
+
+  Measured on Chrome 148: the prototype probe answered `false` for `largeBlob`,
+  `prf` and `hmacCreateSecret` while `getClientCapabilities()` reported all
+  three `true`. Every extension name behaves the same way, so no browser could
+  ever have passed. Closes #9.
+
+  `checkExtensionSupport()` now reads `getClientCapabilities()` and reports
+  `prf` alongside the other two. It also returns `known`, distinguishing "the
+  browser says no" from "the browser cannot say" — callers must not treat the
+  second as a refusal, or they disable a feature that may well work.
+
+### Added
+
+- `extensionSupportFromCredential(credential)` reads what the authenticator
+  actually agreed to, from the registration response. This is the authoritative
+  answer and the one worth persisting: a browser may support `largeBlob` while
+  the security key in front of it does not, and only the ceremony settles that.
+  `addLargeBlobToCredentialOptions()` takes an optional support level for the
+  same reason — it stays `'required'` by default, because under `'preferred'`
+  an unsupported authenticator yields a credential whose secret was silently
+  never written.
+
+### Changed
+
+- The encrypted-keystore demo offers PRF as a keystore encryption method and
+  prefers it, matching the library's own default since 0.4.0. It had hard-coded
+  `largeBlob`, so it overrode that default and never exercised PRF at all.
+  Methods the browser cannot vouch for are now labelled "Unknown" rather than
+  "Not supported", and stay selectable.
+
 ## 0.5.0
 
 ### Breaking

package/README.md

@@ -290,6 +290,27 @@ Mermaid sequences for scripts:
 - `SECURITY.md`
 - `CODE_OF_CONDUCT.md`
 
+## Cross-Project Verification
+
+This repo's own suite covers the units and runs two OrbitDB peers in-process. The strongest evidence that a release actually works, though, comes from outside it: the replication mode matrix in [`orbitdb-relay`](https://github.com/NiKrause/orbitdb-relay), at `mocha/relay-replication-mode-matrix.mjs`.
+
+It drives six alice/bob pairings through a real relay:
+
+| Mode                                          | Pairing                                    |
+| --------------------------------------------- | ------------------------------------------ |
+| `alice-worker-bob-hardware-ed25519`           | worker keystore ↔ hardware Ed25519         |
+| `alice-worker-bob-hardware-p256`              | worker keystore ↔ hardware P-256           |
+| `alice-hardware-ed25519-bob-hardware-p256`    | the two hardware curves against each other |
+| `alice-worker-ed25519-bob-worker-ed25519`     | worker keystore, both sides                |
+| `alice-hardware-ed25519-bob-hardware-ed25519` | hardware Ed25519, both sides               |
+| `alice-hardware-p256-bob-hardware-p256`       | hardware P-256, both sides                 |
+
+Three things make it worth more than an in-repo test. It runs **out of process and across repos**, against the published package rather than the working tree. It exercises **identity verification between two distinct peers** — different keystores, different identity documents — instead of one instance talking to itself. And the relay **verifies identities itself**, so a third independent verifier sits in the path.
+
+That is exactly the surface a change to the signing format breaks. The 0.5.0 signing-context change was validated here before the consumers moved: all six pairings replicate under the new format.
+
+If you change anything that touches signing, identity documents or verification, run that matrix — not just this repo's tests.
+
 ## Identity Recovery Summary
 
 Current identity recovery behavior in this repo:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/orbitdb-identity-provider-webauthn-did",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "WebAuthn-based DID identity provider for OrbitDB for hardware-secured wallets and biometric Passkey authentication",
   "main": "src/index.js",
   "types": "types/index.d.ts",
@@ -145,7 +145,7 @@
       "iso-web": "^3.1.2",
       "iso-webauthn-varsig": "npm:@le-space/iso-webauthn-varsig@^0.3.0",
       "conf>ajv": "^8.18.0",
-      "ajv>fast-uri": "^3.1.4"
+      "ajv>fast-uri": "^3.1.6"
     },
     "onlyBuiltDependencies": [
       "@ipshipyard/node-datachannel",

package/src/index.js

@@ -277,6 +277,7 @@ export {
   decryptWithAESGCM,
   addLargeBlobToCredentialOptions,
   addPRFToCredentialOptions,
+  writeSKToLargeBlob,
   retrieveSKFromLargeBlob,
   addHmacSecretToCredentialOptions,
   wrapSKWithPRF,
@@ -287,6 +288,7 @@ export {
   loadEncryptedKeystore,
   clearEncryptedKeystore,
   checkExtensionSupport,
+  extensionSupportFromCredential,
 } from './keystore/encryption.js';
 
 export default {

package/src/keystore/encryption.js

@@ -150,19 +150,37 @@ export async function decryptWithAESGCM(ciphertext, sk, iv) {
 
 /**
  * Store secret key in WebAuthn credential using largeBlob extension
+ *
+ * Defaults to `support: 'required'` so an authenticator that cannot hold a
+ * blob fails the ceremony outright. That is the safe default here: under
+ * `'preferred'` the credential is created successfully and the secret is
+ * simply never written, which loses the keystore silently.
+ *
+ * Pass `'preferred'` only when the caller reads the outcome back with
+ * {@link extensionSupportFromCredential} and handles an unsupported
+ * authenticator itself — probing for capability, for instance.
+ *
  * @param {Object} credentialOptions - WebAuthn credential creation options
  * @param {Uint8Array} sk - Secret key to store
- * @returns {Promise<Object>} Enhanced credential options with largeBlob
+ * @param {'required'|'preferred'} [support] - largeBlob support level
+ * @returns {Object} Enhanced credential options with largeBlob
  */
-export function addLargeBlobToCredentialOptions(credentialOptions, sk) {
-  log('Adding largeBlob extension to credential options');
+export function addLargeBlobToCredentialOptions(
+  credentialOptions,
+  sk,
+  support = 'required'
+) {
+  log(
+    'Adding largeBlob extension to credential options (support: %s)',
+    support
+  );
 
   return {
     ...credentialOptions,
     extensions: {
       ...credentialOptions.extensions,
       largeBlob: {
-        support: 'required',
+        support,
         write: sk,
       },
     },
@@ -195,6 +213,67 @@ export function addPRFToCredentialOptions(
   };
 }
 
+/**
+ * Write the secret key into the credential's largeBlob.
+ *
+ * A blob can only be written during an assertion, never at registration — so
+ * this costs one extra WebAuthn prompt after the credential exists. That is
+ * why `addLargeBlobToCredentialOptions()` alone does not persist anything.
+ *
+ * Throws unless the authenticator reports `written: true`. Silence here would
+ * leave a keystore whose key exists only in memory: it works for the current
+ * session and can never be unlocked again, because
+ * {@link retrieveSKFromLargeBlob} would read a blob nobody wrote.
+ *
+ * @param {Uint8Array} credentialId - WebAuthn credential ID (raw bytes).
+ * @param {Uint8Array} sk - Secret key to store.
+ * @param {string} rpId - Relying party ID (domain).
+ * @returns {Promise<void>}
+ */
+export async function writeSKToLargeBlob(credentialId, sk, rpId) {
+  log('Writing secret key to largeBlob');
+
+  let assertion;
+  try {
+    assertion = await navigator.credentials.get(
+      buildCredentialRequestOptions({
+        challenge: crypto.getRandomValues(new Uint8Array(32)),
+        credentialId,
+        rpId,
+        userVerification: 'required',
+        extensions: {
+          largeBlob: {
+            write: sk,
+          },
+        },
+      })
+    );
+  } catch (error) {
+    log.error('largeBlob write assertion failed: %s', error.message);
+    throw new KeystoreEncryptionError(
+      `Failed to write secret key to largeBlob: ${error.message}`,
+      { cause: error }
+    );
+  }
+
+  // The authenticator answers whether it took the blob. Accepting the
+  // assertion without reading this is how a write that never happened passes
+  // for a success.
+  const written = assertion?.getClientExtensionResults?.()?.largeBlob?.written;
+
+  if (written !== true) {
+    log.error(
+      'Authenticator did not write the largeBlob (written: %o)',
+      written
+    );
+    throw new KeystoreEncryptionError(
+      'Authenticator did not store the secret key in largeBlob'
+    );
+  }
+
+  log('Secret key written to largeBlob');
+}
+
 /**
  * Retrieve secret key from WebAuthn credential using largeBlob extension
  * @param {Uint8Array} credentialId - WebAuthn credential ID
@@ -620,39 +699,95 @@ export async function clearEncryptedKeystore(credentialId) {
 }
 
 /**
- * Check if browser supports WebAuthn extensions
- * @returns {Promise<Object>} Support status for largeBlob and hmac-secret
+ * Which WebAuthn extensions is this *client* willing to negotiate?
+ *
+ * Answers one question only: would the browser pass the extension through. It
+ * cannot tell you whether the authenticator behind it will honour the request —
+ * that is settled during a ceremony, by
+ * {@link extensionSupportFromCredential}, and belongs to the credential rather
+ * than to the browser.
+ *
+ * `known: false` means the browser is too old to say. That is **not** the same
+ * as unsupported: callers should attempt the ceremony and let its result
+ * decide, rather than disabling the feature outright.
+ *
+ * @returns {Promise<{largeBlob: boolean, prf: boolean, hmacSecret: boolean, known: boolean}>}
  */
 export async function checkExtensionSupport() {
   const support = {
     largeBlob: false,
+    prf: false,
     hmacSecret: false,
+    known: false,
   };
 
-  if (!window.PublicKeyCredential) {
+  if (typeof globalThis.PublicKeyCredential !== 'function') {
     return support;
   }
 
-  try {
-    // Check largeBlob support
-    if (
-      window.PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable
-    ) {
-      const available =
-        await window.PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();
-      // largeBlob is available in Chrome 106+, Edge 106+
-      support.largeBlob =
-        available && 'largeBlob' in PublicKeyCredential.prototype;
-    }
+  // getClientCapabilities is the only pre-flight answer that means anything.
+  // The previous check asked `'largeBlob' in PublicKeyCredential.prototype`,
+  // which tests whether the extension is a property of the credential
+  // interface. Extensions never are — they arrive through
+  // getClientExtensionResults() — so it returned false in every browser ever
+  // shipped, including those with complete support, and silently disabled
+  // keystore encryption everywhere.
+  if (typeof PublicKeyCredential.getClientCapabilities !== 'function') {
+    log('getClientCapabilities unavailable; extension support is unknown');
+    return support;
+  }
 
-    // hmac-secret support cannot be reliably detected without a real credential.
-    // Keep it false by default and let users opt-in explicitly.
-    support.hmacSecret = false;
+  try {
+    const capabilities = await PublicKeyCredential.getClientCapabilities();
+    return {
+      largeBlob: capabilities['extension:largeBlob'] === true,
+      prf: capabilities['extension:prf'] === true,
+      hmacSecret: capabilities['extension:hmacCreateSecret'] === true,
+      known: true,
+    };
   } catch (error) {
     log.error('Failed to check extension support: %s', error.message);
+    return support;
+  }
+}
+
+/**
+ * What did the authenticator actually agree to, for this credential?
+ *
+ * The authoritative answer, and the only one worth persisting: a browser may
+ * support largeBlob while the security key in front of it does not. Read this
+ * from the registration response and store it next to the credential.
+ *
+ * Requires the ceremony to have asked with `support: 'preferred'` — see
+ * {@link addLargeBlobToCredentialOptions}. Asking with `'required'` makes
+ * creation fail outright instead of reporting back.
+ *
+ * @param {PublicKeyCredential} credential - The result of navigator.credentials.create().
+ * @returns {{largeBlob: boolean, prf: boolean, hmacSecret: boolean}}
+ */
+export function extensionSupportFromCredential(credential) {
+  const support = { largeBlob: false, prf: false, hmacSecret: false };
+
+  if (typeof credential?.getClientExtensionResults !== 'function') {
+    return support;
   }
 
-  return support;
+  try {
+    const results = credential.getClientExtensionResults() ?? {};
+    return {
+      largeBlob: results.largeBlob?.supported === true,
+      // PRF reports either an explicit `enabled` flag or, when the ceremony
+      // evaluated a salt straight away, the results themselves.
+      prf: results.prf?.enabled === true || results.prf?.results != null,
+      hmacSecret: results.hmacCreateSecret === true,
+    };
+  } catch (error) {
+    log.error(
+      'Failed to read extension results from credential: %s',
+      error.message
+    );
+    return support;
+  }
 }
 
 export default {
@@ -660,6 +795,7 @@ export default {
   encryptWithAESGCM,
   decryptWithAESGCM,
   addLargeBlobToCredentialOptions,
+  writeSKToLargeBlob,
   retrieveSKFromLargeBlob,
   addHmacSecretToCredentialOptions,
   wrapSKWithHmacSecret,
@@ -668,4 +804,5 @@ export default {
   loadEncryptedKeystore,
   clearEncryptedKeystore,
   checkExtensionSupport,
+  extensionSupportFromCredential,
 };

package/src/keystore/provider.js

@@ -9,6 +9,7 @@ import { base58btc } from 'multiformats/bases/base58';
 import * as KeystoreEncryption from './encryption.js';
 import { ensureDerivedSigningKey } from './derived-signing-key.js';
 import { WebAuthnDIDProvider } from '../webauthn/provider.js';
+import { verifyWebAuthnIdentityBinding } from '../webauthn/proof-verification.js';
 import {
   identityProofKey,
   loadIdentityProof,
@@ -171,12 +172,24 @@ export class OrbitDBWebAuthnIdentityProvider {
         const publicKeyBytes = normalizeByteArray(encryptedData.publicKey);
         const keyType = encryptedData.keyType || this.keystoreKeyType;
 
-        return this.createDIDFromKeystorePublicKey(
+        const did = this.createDIDFromKeystorePublicKey(
           publicKeyBytes,
           keyType,
           varint,
           base58btc
         );
+        // OrbitDB signs with whatever key it finds under the id, and creates a
+        // secp256k1 one when there is none — so without this the DID said
+        // Ed25519 and the entries were signed by an unrelated key.
+        if (
+          this.unlockedKeypair?.privateKey &&
+          !(await this.keystore.getKey(did))
+        ) {
+          await this.keystore.addKey(did, {
+            privateKey: this.unlockedKeypair.privateKey,
+          });
+        }
+        return did;
       }
 
       // Get the keystore's identity ID (this will be used to retrieve the key)
@@ -293,12 +306,18 @@ export class OrbitDBWebAuthnIdentityProvider {
         keystoreKey.type
       );
 
-      return this.createDIDFromKeystorePublicKey(
+      const did = this.createDIDFromKeystorePublicKey(
         publicKeyBytes,
         keystoreKey.type,
         varint,
         base58btc
       );
+      // Stored above under the credential's P-256 DID; OrbitDB looks it up under
+      // the DID returned here, found nothing, and generated a secp256k1 key.
+      if (!(await this.keystore.getKey(did))) {
+        await this.keystore.addKey(did, { privateKey: keystoreKey.raw });
+      }
+      return did;
     } catch (error) {
       identityLog.error(
         'Failed to create Ed25519 DID from keystore: %s',
@@ -408,15 +427,24 @@ export class OrbitDBWebAuthnIdentityProvider {
       } else if (
         this.keystoreEncryptionMethod === KEYSTORE_ENCRYPTION_METHODS.LARGE_BLOB
       ) {
-        // For largeBlob, we need to store SK during next authentication
-        // Store it temporarily for wrapping
+        // Write the key into the authenticator before recording anything.
+        // This used to be `secretKey: sk, // Will be moved to largeBlob` — and
+        // nothing ever moved it: the field was dropped at serialization, so
+        // the key survived only in memory and the keystore could never be
+        // unlocked again. Throws if the authenticator refuses, which is better
+        // than persisting a record that cannot be opened.
+        await KeystoreEncryption.writeSKToLargeBlob(
+          this.credential.rawCredentialId,
+          sk,
+          window.location.hostname
+        );
+
         encryptedData = {
           ciphertext,
           iv,
           credentialId: this.credential.credentialId,
           publicKey: publicKeyBytes,
           keyType,
-          secretKey: sk, // Will be moved to largeBlob
           encryptionMethod: KEYSTORE_ENCRYPTION_METHODS.LARGE_BLOB,
         };
       } else if (
@@ -725,27 +753,10 @@ OrbitDBWebAuthnIdentityProviderFunction.type = IDENTITY_TYPES.WEBAUTHN;
 OrbitDBWebAuthnIdentityProviderFunction.verifyIdentity = async function (
   identity
 ) {
-  try {
-    // For WebAuthn identities, we need to store the credential info in the identity
-    // Since WebAuthn verification requires the original credential, not just the public key,
-    // we'll create a simplified verification that checks the proof structure
-
-    // For WebAuthn, the identity should have been created with our provider,
-    // so we can trust it if it has the right structure
-    // Accept both DID format (did:key:...) and hash format (hex string) for backward compatibility
-    const isValidDID = identity.id && identity.id.startsWith(DID_KEY_PREFIX);
-    const isValidHash = identity.id && /^[a-f0-9]{64}$/.test(identity.id); // 64-char hex string (legacy)
-
-    if (
-      identity.type === IDENTITY_TYPES.WEBAUTHN &&
-      (isValidDID || isValidHash)
-    ) {
-      return true;
-    }
-
-    return false;
-  } catch (error) {
-    console.error('WebAuthn static identity verification failed:', error);
-    return false;
-  }
+  // The check OrbitDB relies on to decide whether this identity may speak for
+  // its DID. It used to accept any `did:key:` of type `webauthn`, so a peer
+  // holding only its own key could write as anyone in a write list
+  // (GHSA-326j-4cc3-4rrg). See ../webauthn/proof-verification.js.
+  if (identity?.type !== IDENTITY_TYPES.WEBAUTHN) return false;
+  return verifyWebAuthnIdentityBinding(identity);
 };

package/src/varsig/assertion.js

@@ -19,16 +19,13 @@ import {
   toBytes,
 } from './utils.js';
 import { buildCredentialRequestOptions } from '../webauthn/config.js';
-import { KEY_TYPES, WEBAUTHN_CLIENT_DATA_TYPES } from '../constants.js';
+import { KEY_TYPES } from '../constants.js';
 import {
   VarsigVerificationError,
   WebAuthnAuthenticationError,
 } from '../errors.js';
 import { logWebAuthnResponse } from '../webauthn/debug-log.js';
 
-const isTestMode = () =>
-  typeof window !== 'undefined' && window.__PLAYWRIGHT__ === true;
-
 /**
  * Run a WebAuthn assertion for a payload.
  * @param {Object} credential - WebAuthn credential info.
@@ -54,27 +51,6 @@ async function runWebAuthnAssertionForPayload(
   const signedBytes = bindContext(domainLabel, payloadBytes);
   const challengeBytes = await buildChallengeBytes(signedBytes);
 
-  if (isTestMode()) {
-    return {
-      rpId,
-      origin,
-      challengeBytes,
-      algorithm: credential.algorithm,
-      publicKey: credential.publicKey,
-      assertion: {
-        authenticatorData: new Uint8Array(37),
-        clientDataJSON: new TextEncoder().encode(
-          JSON.stringify({
-            type: WEBAUTHN_CLIENT_DATA_TYPES.GET,
-            challenge: 'test',
-            origin,
-          })
-        ),
-        signature: new Uint8Array(64),
-      },
-    };
-  }
-
   const assertion = await navigator.credentials.get(
     buildCredentialRequestOptions({
       rpId,
@@ -114,15 +90,6 @@ async function runWebAuthnAssertionForPayload(
  * @returns {Promise<{varsig: Uint8Array, clientData: Object, verification: Object, signatureValid: boolean}>}
  */
 async function buildVarsigOutput(assertionData) {
-  if (isTestMode()) {
-    return {
-      varsig: new Uint8Array([1, 2, 3]),
-      clientData: {},
-      verification: { valid: true },
-      signatureValid: true,
-    };
-  }
-
   const { assertion, algorithm, origin, rpId, challengeBytes, publicKey } =
     assertionData;
 
@@ -200,10 +167,6 @@ async function verifyVarsigForPayload(
   payloadBytes,
   domainLabel
 ) {
-  if (isTestMode()) {
-    return true;
-  }
-
   let decoded;
   try {
     decoded = decodeWebAuthnVarsigV1(signature);
@@ -252,6 +215,7 @@ async function verifyVarsigForPayload(
 }
 
 export {
+  algorithmFromPublicKey,
   buildVarsigOutput,
   runWebAuthnAssertionForPayload,
   verifyVarsigForPayload,

package/src/varsig/credential.js

@@ -7,9 +7,6 @@ import { toArrayBuffer } from './utils.js';
 import { buildAuthenticatorSelection } from '../webauthn/config.js';
 import { logWebAuthnResponse } from '../webauthn/debug-log.js';
 
-const isTestMode = () =>
-  typeof window !== 'undefined' && window.__PLAYWRIGHT__ === true;
-
 /**
  * Extract public key info from a WebAuthn attestation object.
  * @param {Uint8Array} attestationObject - Raw attestation object bytes.
@@ -81,23 +78,6 @@ async function createWebAuthnVarsigCredential(options = {}) {
     ...options,
   };
 
-  if (isTestMode()) {
-    const credentialId = new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8]);
-    const publicKey = new Uint8Array(32);
-    for (let i = 0; i < publicKey.length; i++) {
-      publicKey[i] = i + 1;
-    }
-    const algorithm = 'Ed25519';
-    const did = DIDKey.fromPublicKey(algorithm, publicKey).did;
-    return {
-      credentialId,
-      publicKey,
-      did,
-      algorithm,
-      cose: { kty: 1, alg: -8, crv: 6 },
-    };
-  }
-
   const publicKey = {
     rp: { name: 'OrbitDB Varsig Identity', id: domain },
     user: {

package/src/varsig/identity.js

@@ -10,7 +10,7 @@ import { DIDKey } from 'iso-did';
 import { concat } from 'iso-webauthn-varsig';
 import { DEFAULT_DOMAIN_LABELS } from './domain.js';
 import { encoder, toBytes } from './utils.js';
-import { verifyVarsigForPayload } from './assertion.js';
+import { verifyVarsigForPayload, algorithmFromPublicKey } from './assertion.js';
 import { WebAuthnVarsigProvider } from './provider.js';
 
 const IDENTITY_CODEC = dagCbor;
@@ -330,6 +330,21 @@ export async function decodeVarsigIdentityFromBytes(bytes, domainLabels = {}) {
  */
 export async function verifyVarsigIdentity(identity, domainLabels = {}) {
   if (!identity || !identity.publicKey || !identity.signatures) return false;
+
+  // The id has to be the DID of the key that signs for it. Both signatures
+  // below are checked against `identity.publicKey`, so without this anyone
+  // with a passkey on the same origin could sign a stranger's DID with their
+  // own key and pass.
+  let expectedDid;
+  try {
+    expectedDid = DIDKey.fromPublicKey(
+      algorithmFromPublicKey(identity.publicKey),
+      identity.publicKey
+    ).did;
+  } catch {
+    return false;
+  }
+  if (identity.id !== expectedDid) return false;
   const labels = { ...DEFAULT_DOMAIN_LABELS, ...domainLabels };
 
   const idBytes = encoder.encode(identity.id);

package/src/webauthn/proof-verification.js

@@ -0,0 +1,235 @@
+/**
+ * @module ProofVerification
+ * @description
+ * Checks that an identity's claim to a DID is backed by the key that DID
+ * encodes.
+ *
+ * OrbitDB verifies `signatures.id` against the identity's own `publicKey`, which
+ * any key satisfies for itself, and then asks the provider whether the rest
+ * holds. So this is the only place where "this identity may speak for that DID"
+ * is decided — and until GHSA-326j-4cc3-4rrg it decided nothing: the static
+ * `verifyIdentity` looked at the type and the `did:key:` prefix, and
+ * `WebAuthnDIDProvider.verify()` looked at the proof's fields. A peer holding
+ * only its own key could claim any DID in any write list.
+ *
+ * Two kinds of DID reach here, and each is bound differently:
+ *
+ * - **P-256, the credential's own key** (multicodec 0x1200). The passkey signed
+ *   `publicKey + signatures.id` during `createIdentity`; that WebAuthn assertion
+ *   is `signatures.publicKey`. It is verified against the key the DID encodes,
+ *   so no lookup is needed — the DID *is* the verification key.
+ * - **Ed25519 or secp256k1, a keystore key** (`useKeystoreDID`). The DID is the
+ *   signing key itself, so `publicKey` must be exactly the key it encodes;
+ *   OrbitDB has already checked that key signed the id.
+ *
+ * Anything else — including the legacy 64-hex ids — cannot be bound to a key,
+ * and is refused rather than waved through.
+ */
+import { varint } from 'multiformats';
+import { base58btc } from 'multiformats/bases/base58';
+import { unwrapEC2Signature } from 'iso-passkeys';
+
+import { DID_KEY_PREFIX, WEBAUTHN_CLIENT_DATA_TYPES } from '../constants.js';
+
+export const MULTICODEC = Object.freeze({
+  P256_PUB: 0x1200,
+  ED25519_PUB: 0xed,
+  SECP256K1_PUB: 0xe7,
+});
+
+const FLAG_USER_PRESENT = 0x01;
+// rpIdHash (32) + flags (1) + signCount (4)
+const AUTH_DATA_MIN_LENGTH = 37;
+const P1363_SIGNATURE_LENGTH = 64;
+
+function base64urlToBytes(value) {
+  const base64 = value.replace(/-/g, '+').replace(/_/g, '/');
+  const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+  return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));
+}
+
+function bytesToBase64url(bytes) {
+  let binary = '';
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary)
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+}
+
+function concat(a, b) {
+  const out = new Uint8Array(a.length + b.length);
+  out.set(a, 0);
+  out.set(b, a.length);
+  return out;
+}
+
+async function sha256(bytes) {
+  return new Uint8Array(await crypto.subtle.digest('SHA-256', bytes));
+}
+
+/**
+ * @param {Uint8Array} bytes
+ * @returns {string} lowercase hex
+ */
+export function bytesToHex(bytes) {
+  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join(
+    ''
+  );
+}
+
+/**
+ * Split a `did:key` into its multicodec and raw public key.
+ * @param {string} did
+ * @returns {{ codec: number, keyBytes: Uint8Array }}
+ */
+export function decodeDidKey(did) {
+  if (typeof did !== 'string' || !did.startsWith(`${DID_KEY_PREFIX}z`)) {
+    throw new Error('Not a base58btc did:key');
+  }
+  const bytes = base58btc.decode(did.slice(DID_KEY_PREFIX.length));
+  const [codec, prefixLength] = varint.decode(bytes);
+  return { codec, keyBytes: bytes.subarray(prefixLength) };
+}
+
+/**
+ * A P-256 public key as raw SEC1 bytes, from either raw bytes or `{ x, y }`.
+ * @param {Uint8Array|{x: ArrayLike<number>, y: ArrayLike<number>}|undefined} publicKey
+ * @returns {Uint8Array|null}
+ */
+export function p256PublicKeyBytes(publicKey) {
+  if (publicKey instanceof Uint8Array) {
+    if (publicKey.length === 65 && publicKey[0] === 0x04) return publicKey;
+    if (publicKey.length === 33) return publicKey;
+    return null;
+  }
+  if (publicKey?.x && publicKey?.y) {
+    const x = Uint8Array.from(publicKey.x);
+    const y = Uint8Array.from(publicKey.y);
+    if (x.length !== 32 || y.length !== 32) return null;
+    const out = new Uint8Array(65);
+    out[0] = 0x04;
+    out.set(x, 1);
+    out.set(y, 33);
+    return out;
+  }
+  return null;
+}
+
+/**
+ * Verify a proof produced by `WebAuthnDIDProvider.sign(data)`.
+ *
+ * Checks, in order: the client data type; that the challenge is the one
+ * `sign()` derives — SHA-256(rawCredentialId ‖ data) — so the assertion is
+ * about this data and no other; that the user was present; and the ECDSA
+ * P-256 signature over `authenticatorData ‖ SHA-256(clientDataJSON)` against
+ * the given key. Never throws: a malformed proof is simply not valid.
+ *
+ * Origin and rpId are not checked. They defend an authentication ceremony
+ * against relaying; here the question is only whether the holder of this key
+ * signed this data, which the signature answers wherever it was made.
+ *
+ * @param {string} encodedProof base64url JSON, as returned by `sign()`
+ * @param {string|Uint8Array} data what was signed
+ * @param {Uint8Array} publicKeyBytes P-256 public key, SEC1
+ * @returns {Promise<boolean>}
+ */
+export async function verifyWebAuthnProof(encodedProof, data, publicKeyBytes) {
+  try {
+    if (typeof encodedProof !== 'string' || !publicKeyBytes) return false;
+    const proof = JSON.parse(
+      new TextDecoder().decode(base64urlToBytes(encodedProof))
+    );
+    const { credentialId, authenticatorData, clientDataJSON, signature } =
+      proof ?? {};
+    if (
+      typeof credentialId !== 'string' ||
+      typeof authenticatorData !== 'string' ||
+      typeof clientDataJSON !== 'string' ||
+      typeof signature !== 'string'
+    ) {
+      return false;
+    }
+
+    const clientData = JSON.parse(clientDataJSON);
+    if (clientData?.type !== WEBAUTHN_CLIENT_DATA_TYPES.GET) return false;
+
+    const dataBytes =
+      typeof data === 'string'
+        ? new TextEncoder().encode(data)
+        : new Uint8Array(data);
+    const expectedChallenge = bytesToBase64url(
+      await sha256(concat(base64urlToBytes(credentialId), dataBytes))
+    );
+    if (clientData.challenge !== expectedChallenge) return false;
+
+    const authData = base64urlToBytes(authenticatorData);
+    if (authData.length < AUTH_DATA_MIN_LENGTH) return false;
+    if ((authData[32] & FLAG_USER_PRESENT) === 0) return false;
+
+    const signedBytes = concat(
+      authData,
+      await sha256(new TextEncoder().encode(clientDataJSON))
+    );
+    const signatureBytes = base64urlToBytes(signature);
+    const p1363 =
+      signatureBytes.length === P1363_SIGNATURE_LENGTH
+        ? signatureBytes
+        : Uint8Array.from(unwrapEC2Signature(signatureBytes));
+
+    const key = await crypto.subtle.importKey(
+      'raw',
+      publicKeyBytes,
+      { name: 'ECDSA', namedCurve: 'P-256' },
+      false,
+      ['verify']
+    );
+    return await crypto.subtle.verify(
+      { name: 'ECDSA', hash: 'SHA-256' },
+      key,
+      p1363,
+      signedBytes
+    );
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Whether an OrbitDB identity of type `webauthn` may speak for its `id`.
+ * @param {{id: string, publicKey: string, signatures: {id: string, publicKey: string}}} identity
+ * @returns {Promise<boolean>}
+ */
+export async function verifyWebAuthnIdentityBinding(identity) {
+  if (
+    !identity ||
+    typeof identity.publicKey !== 'string' ||
+    !identity.signatures
+  ) {
+    return false;
+  }
+
+  let decoded;
+  try {
+    decoded = decodeDidKey(identity.id);
+  } catch {
+    return false;
+  }
+
+  if (decoded.codec === MULTICODEC.P256_PUB) {
+    return verifyWebAuthnProof(
+      identity.signatures.publicKey,
+      identity.publicKey + identity.signatures.id,
+      decoded.keyBytes
+    );
+  }
+
+  if (
+    decoded.codec === MULTICODEC.ED25519_PUB ||
+    decoded.codec === MULTICODEC.SECP256K1_PUB
+  ) {
+    return bytesToHex(decoded.keyBytes) === identity.publicKey.toLowerCase();
+  }
+
+  return false;
+}

package/src/webauthn/provider.js

@@ -14,20 +14,22 @@ import {
   DID_KEY_PREFIX,
   IDENTITY_TYPES,
   KEYSTORE_ENCRYPTION_METHODS,
-  WEBAUTHN_CLIENT_DATA_TYPES,
 } from '../constants.js';
 import {
   WebAuthnIdentityError,
   WebAuthnAuthenticationError,
   WebAuthnCredentialError,
   WebAuthnNotSupportedError,
-  WebAuthnVerificationError,
 } from '../errors.js';
 import {
   buildAuthenticatorSelection,
   buildCredentialRequestOptions,
 } from './config.js';
 import { logWebAuthnResponse } from './debug-log.js';
+import {
+  p256PublicKeyBytes,
+  verifyWebAuthnProof,
+} from './proof-verification.js';
 
 const webauthnLog = logger('orbitdb-identity-provider-webauthn-did:webauthn');
 
@@ -82,7 +84,11 @@ export class WebAuthnDIDProvider {
    * Create a WebAuthn credential for OrbitDB identity
    * This triggers biometric authentication (Face ID, Touch ID, Windows Hello, etc.)
    * @param {Object} options - Credential options
-   * @param {string} options.userId - User ID
+   * @param {string} options.userId - Account label shown in the credential
+   *   picker (`user.name`). A label only: it does not identify the credential,
+   *   two credentials may carry the same one, and it is never used to look one
+   *   up. The handle the authenticator files the credential under is generated
+   *   here and returned as `userHandle`.
    * @param {string} options.displayName - Display name
    * @param {string} options.domain - Domain/RP ID
    * @param {boolean} options.encryptKeystore - Enable keystore encryption
@@ -117,7 +123,19 @@ export class WebAuthnDIDProvider {
 
     // Generate challenge for credential creation
     const challenge = crypto.getRandomValues(new Uint8Array(32));
-    const userIdBytes = new TextEncoder().encode(userId);
+
+    // The user handle is an opaque key, not a label. An authenticator stores
+    // one discoverable credential per (rp.id, user.id) pair and *replaces* the
+    // previous one when both match — silently, with no prompt and nothing to
+    // undo. Deriving the handle from a typed name therefore meant two people
+    // registering as "anna" on a shared device destroyed each other's passkey,
+    // and with it the DID and everything written under it (#45).
+    //
+    // 64 random bytes, as WebAuthn L2 §5.4.3 recommends. The same section
+    // forbids putting personally identifying information here, which a typed
+    // name or e-mail address plainly is. The name keeps its rightful place in
+    // `user.name` below, where the credential picker shows it.
+    const userHandle = crypto.getRandomValues(new Uint8Array(64));
 
     webauthnLog('Calling navigator.credentials.create() for user: %s', userId);
 
@@ -130,7 +148,7 @@ export class WebAuthnDIDProvider {
           id: domain,
         },
         user: {
-          id: userIdBytes,
+          id: userHandle,
           name: userId,
           displayName,
         },
@@ -228,6 +246,17 @@ export class WebAuthnDIDProvider {
         hasY: !!publicKey.y,
       });
 
+      // What the authenticator actually agreed to, as opposed to what the
+      // browser said it could negotiate. Only the ceremony settles this, and
+      // the raw PublicKeyCredential does not survive past this function — so
+      // read it here or lose the answer. Callers that offer a choice of
+      // keystore encryption method need it: a client can support largeBlob
+      // while the key in front of it does not.
+      const extensionSupport =
+        KeystoreEncryption.extensionSupportFromCredential(credential);
+
+      webauthnLog('Authenticator extension support: %o', extensionSupport);
+
       const result = {
         credentialId: WebAuthnDIDProvider.arrayBufferToBase64url(
           credential.rawId
@@ -236,10 +265,18 @@ export class WebAuthnDIDProvider {
         publicKey,
         userId,
         displayName,
+        // Nothing in this package looks a credential up by handle — recovery
+        // goes through discoverable credentials, or through an explicit
+        // credential ID when those are switched off. It is surfaced anyway
+        // because it is the only copy the caller will ever see, and a flow
+        // that one day passes `allowCredentials` needs it. Decode with
+        // `WebAuthnDIDProvider.base64urlToArrayBuffer()`.
+        userHandle: WebAuthnDIDProvider.arrayBufferToBase64url(userHandle),
         attestationObject: new Uint8Array(
           credential.response.attestationObject
         ),
         prfInput: prfInput || undefined,
+        extensionSupport,
       };
 
       webauthnLog('Credential creation completed successfully');
@@ -716,77 +753,27 @@ export class WebAuthnDIDProvider {
    * @param {string} signatureData - Base64url signature envelope.
    * @returns {Promise<boolean>} True if verification succeeds.
    */
-  async verify(signatureData) {
-    webauthnLog(
-      'verify() called with signature length: %d',
-      signatureData.length
-    );
-
-    try {
-      // Decode the WebAuthn proof object
-      const proofBytes =
-        WebAuthnDIDProvider.base64urlToArrayBuffer(signatureData);
-      const proofText = new TextDecoder().decode(proofBytes);
-      const proof = JSON.parse(proofText);
-
-      // Verify the proof structure
-      if (!proof.credentialId || !proof.dataHash || !proof.signature) {
-        throw new WebAuthnVerificationError('Invalid WebAuthn proof structure');
-      }
-
-      // Check if credential ID matches
-      webauthnLog('Verification step: checking credential ID');
-      if (proof.credentialId !== this.credentialId) {
-        webauthnLog.error(
-          'Credential ID mismatch in WebAuthn proof verification'
-        );
-        throw new WebAuthnVerificationError('Credential ID mismatch');
-      }
-      webauthnLog('Verification step: credential ID check PASSED');
-
-      // Verify client data JSON
-      webauthnLog('Verification step: checking client data');
-      if (proof.clientDataJSON) {
-        const clientData = JSON.parse(proof.clientDataJSON);
-        if (clientData.type !== WEBAUTHN_CLIENT_DATA_TYPES.GET) {
-          webauthnLog.error('Invalid WebAuthn proof type: %s', clientData.type);
-          throw new WebAuthnVerificationError('Invalid WebAuthn proof type');
-        }
-        webauthnLog('Verification step: client data check PASSED');
-      } else {
-        webauthnLog.error('Invalid client data in WebAuthn proof');
-        throw new WebAuthnVerificationError('Invalid client data');
-      }
-
-      // No expiry check. This proof is embedded in an OrbitDB identity
-      // document, and every entry ever signed under that document has to stay
-      // validatable — an expiring proof would silently invalidate history.
-      // The proof attests that this credential signed this payload, which does
-      // not stop being true. Proofs written by earlier versions still carry a
-      // timestamp field; it is simply ignored.
-
-      // Verify authenticator data exists
-      webauthnLog('Verification step: checking authenticator data');
-      if (!proof.authenticatorData) {
-        webauthnLog.error('Missing authenticator data in WebAuthn proof');
-        throw new WebAuthnVerificationError('Missing authenticator data');
-      }
-      webauthnLog('Verification step: authenticator data check PASSED');
-
-      webauthnLog('Verification result: SUCCESS');
-      return true;
-    } catch (error) {
-      webauthnLog.error(
-        'WebAuthn proof verification failed: %s',
-        error.message
-      );
+  /**
+   * Verify a proof from `sign(data)` against a P-256 key.
+   *
+   * This used to check that the proof had the right fields and return true —
+   * no signature, no challenge — so any proof-shaped JSON passed
+   * (GHSA-326j-4cc3-4rrg).
+   *
+   * @param {string} signatureData base64url proof from `sign()`
+   * @param {string|Uint8Array} data the signed data
+   * @param {Uint8Array|{x: ArrayLike<number>, y: ArrayLike<number>}} publicKey P-256 key
+   * @returns {Promise<boolean>}
+   */
+  async verify(signatureData, data, publicKey) {
+    const keyBytes = p256PublicKeyBytes(publicKey);
+    if (!keyBytes || data === undefined) {
+      webauthnLog('verify() needs the signed data and a P-256 public key');
       return false;
     }
+    return verifyWebAuthnProof(signatureData, data, keyBytes);
   }
 
-  /**
-   * Utility: Convert ArrayBuffer to base64url
-   */
   static arrayBufferToBase64url(buffer) {
     const bytes = new Uint8Array(buffer);
     let binary = '';

package/types/index.d.ts

@@ -91,6 +91,8 @@ export interface WebAuthnCredentialInfo {
   publicKey: WebAuthnPublicKey | Uint8Array;
   userId?: string;
   displayName?: string;
+  /** Random 64-byte WebAuthn user handle, base64url. Not derived from userId. */
+  userHandle?: string;
   attestationObject?: Uint8Array;
   prfInput?: Uint8Array;
   did?: string;
@@ -99,6 +101,7 @@ export interface WebAuthnCredentialInfo {
 }
 
 export interface CreateCredentialOptions {
+  /** Account label for the credential picker. Not an identifier. */
   userId?: string;
   displayName?: string;
   domain?: string;