@le-space/orbitdb-identity-provider-webauthn-did 0.5.1 → 0.5.2

package/CHANGELOG.md

@@ -2,6 +2,52 @@
 
 ## Unreleased
 
+## 0.5.2
+
+### Security
+
+- **Identity verification checked shapes, not signatures**
+  ([GHSA-326j-4cc3-4rrg](https://github.com/Le-Space/orbitdb-identity-provider-webauthn-did/security/advisories/GHSA-326j-4cc3-4rrg)).
+  Four checks that decide whether an identity may speak for a DID verified
+  nothing: the static `verifyIdentity` OrbitDB calls accepted any `did:key:` of
+  type `webauthn`; `WebAuthnDIDProvider.verify()` accepted any proof with the
+  right fields; varsig verification returned `true` whenever
+  `window.__PLAYWRIGHT__` was set; and `verifyVarsigIdentity` never compared the
+  id with the key signing for it. Anyone who knew a DID could write as it
+  wherever write access was granted to that DID.
+
+  `src/webauthn/proof-verification.js` now decides it. A credential DID (P-256)
+  is bound through the WebAuthn assertion in `signatures.publicKey`, verified
+  against the key the DID itself encodes. A keystore DID (Ed25519, secp256k1)
+  must be exactly the key that signs. A varsig identity must carry the DID of
+  its own key. The test-mode branches are gone from `src/`.
+
+  **Check before upgrading** — three things that were accepted and now are not:
+  - Entries written under `useKeystoreDID` by 0.5.1 or earlier. Those identities
+    signed with a key unrelated to their DID (see _Fixed_), which makes their
+    entries indistinguishable from forgeries, so upgraded peers refuse them.
+    Identities with the default credential DID are unaffected.
+  - Legacy 64-hex identity ids. They cannot be bound to any key.
+  - `WebAuthnDIDProvider.verify(signature)` with one argument. It now needs the
+    signed data and the public key: `verify(signature, data, publicKey)`.
+
+### Fixed
+
+- `useKeystoreDID` with `keystoreKeyType: 'Ed25519'` signed entries with a
+  secp256k1 key. The provider stored its key under the credential's P-256 DID;
+  OrbitDB looked it up under the keystore DID, found nothing and generated a
+  fresh secp256k1 key, so only the DID was Ed25519. The key now goes under the
+  DID OrbitDB looks it up by, encrypted and unencrypted.
+- The Ed25519 demo kept `prfInput` across a reload as a plain object, which the
+  browser refused as a PRF input; the worker's seed then fell back to the
+  credential ID and its archive could no longer be opened.
+
+### Tests
+
+- `tests/identity-forgery.test.js`: every forgery above is refused, and beside
+  each the genuine identity still passes. The browser suites use a Chromium
+  virtual authenticator instead of mocks that signed with 64 zero bytes.
+
 ## 0.5.1
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/orbitdb-identity-provider-webauthn-did",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "WebAuthn-based DID identity provider for OrbitDB for hardware-secured wallets and biometric Passkey authentication",
   "main": "src/index.js",
   "types": "types/index.d.ts",
@@ -145,7 +145,7 @@
       "iso-web": "^3.1.2",
       "iso-webauthn-varsig": "npm:@le-space/iso-webauthn-varsig@^0.3.0",
       "conf>ajv": "^8.18.0",
-      "ajv>fast-uri": "^3.1.4"
+      "ajv>fast-uri": "^3.1.6"
     },
     "onlyBuiltDependencies": [
       "@ipshipyard/node-datachannel",

package/src/keystore/provider.js

@@ -9,6 +9,7 @@ import { base58btc } from 'multiformats/bases/base58';
 import * as KeystoreEncryption from './encryption.js';
 import { ensureDerivedSigningKey } from './derived-signing-key.js';
 import { WebAuthnDIDProvider } from '../webauthn/provider.js';
+import { verifyWebAuthnIdentityBinding } from '../webauthn/proof-verification.js';
 import {
   identityProofKey,
   loadIdentityProof,
@@ -171,12 +172,24 @@ export class OrbitDBWebAuthnIdentityProvider {
         const publicKeyBytes = normalizeByteArray(encryptedData.publicKey);
         const keyType = encryptedData.keyType || this.keystoreKeyType;
 
-        return this.createDIDFromKeystorePublicKey(
+        const did = this.createDIDFromKeystorePublicKey(
           publicKeyBytes,
           keyType,
           varint,
           base58btc
         );
+        // OrbitDB signs with whatever key it finds under the id, and creates a
+        // secp256k1 one when there is none — so without this the DID said
+        // Ed25519 and the entries were signed by an unrelated key.
+        if (
+          this.unlockedKeypair?.privateKey &&
+          !(await this.keystore.getKey(did))
+        ) {
+          await this.keystore.addKey(did, {
+            privateKey: this.unlockedKeypair.privateKey,
+          });
+        }
+        return did;
       }
 
       // Get the keystore's identity ID (this will be used to retrieve the key)
@@ -293,12 +306,18 @@ export class OrbitDBWebAuthnIdentityProvider {
         keystoreKey.type
       );
 
-      return this.createDIDFromKeystorePublicKey(
+      const did = this.createDIDFromKeystorePublicKey(
         publicKeyBytes,
         keystoreKey.type,
         varint,
         base58btc
       );
+      // Stored above under the credential's P-256 DID; OrbitDB looks it up under
+      // the DID returned here, found nothing, and generated a secp256k1 key.
+      if (!(await this.keystore.getKey(did))) {
+        await this.keystore.addKey(did, { privateKey: keystoreKey.raw });
+      }
+      return did;
     } catch (error) {
       identityLog.error(
         'Failed to create Ed25519 DID from keystore: %s',
@@ -734,27 +753,10 @@ OrbitDBWebAuthnIdentityProviderFunction.type = IDENTITY_TYPES.WEBAUTHN;
 OrbitDBWebAuthnIdentityProviderFunction.verifyIdentity = async function (
   identity
 ) {
-  try {
-    // For WebAuthn identities, we need to store the credential info in the identity
-    // Since WebAuthn verification requires the original credential, not just the public key,
-    // we'll create a simplified verification that checks the proof structure
-
-    // For WebAuthn, the identity should have been created with our provider,
-    // so we can trust it if it has the right structure
-    // Accept both DID format (did:key:...) and hash format (hex string) for backward compatibility
-    const isValidDID = identity.id && identity.id.startsWith(DID_KEY_PREFIX);
-    const isValidHash = identity.id && /^[a-f0-9]{64}$/.test(identity.id); // 64-char hex string (legacy)
-
-    if (
-      identity.type === IDENTITY_TYPES.WEBAUTHN &&
-      (isValidDID || isValidHash)
-    ) {
-      return true;
-    }
-
-    return false;
-  } catch (error) {
-    console.error('WebAuthn static identity verification failed:', error);
-    return false;
-  }
+  // The check OrbitDB relies on to decide whether this identity may speak for
+  // its DID. It used to accept any `did:key:` of type `webauthn`, so a peer
+  // holding only its own key could write as anyone in a write list
+  // (GHSA-326j-4cc3-4rrg). See ../webauthn/proof-verification.js.
+  if (identity?.type !== IDENTITY_TYPES.WEBAUTHN) return false;
+  return verifyWebAuthnIdentityBinding(identity);
 };

package/src/varsig/assertion.js

@@ -19,16 +19,13 @@ import {
   toBytes,
 } from './utils.js';
 import { buildCredentialRequestOptions } from '../webauthn/config.js';
-import { KEY_TYPES, WEBAUTHN_CLIENT_DATA_TYPES } from '../constants.js';
+import { KEY_TYPES } from '../constants.js';
 import {
   VarsigVerificationError,
   WebAuthnAuthenticationError,
 } from '../errors.js';
 import { logWebAuthnResponse } from '../webauthn/debug-log.js';
 
-const isTestMode = () =>
-  typeof window !== 'undefined' && window.__PLAYWRIGHT__ === true;
-
 /**
  * Run a WebAuthn assertion for a payload.
  * @param {Object} credential - WebAuthn credential info.
@@ -54,27 +51,6 @@ async function runWebAuthnAssertionForPayload(
   const signedBytes = bindContext(domainLabel, payloadBytes);
   const challengeBytes = await buildChallengeBytes(signedBytes);
 
-  if (isTestMode()) {
-    return {
-      rpId,
-      origin,
-      challengeBytes,
-      algorithm: credential.algorithm,
-      publicKey: credential.publicKey,
-      assertion: {
-        authenticatorData: new Uint8Array(37),
-        clientDataJSON: new TextEncoder().encode(
-          JSON.stringify({
-            type: WEBAUTHN_CLIENT_DATA_TYPES.GET,
-            challenge: 'test',
-            origin,
-          })
-        ),
-        signature: new Uint8Array(64),
-      },
-    };
-  }
-
   const assertion = await navigator.credentials.get(
     buildCredentialRequestOptions({
       rpId,
@@ -114,15 +90,6 @@ async function runWebAuthnAssertionForPayload(
  * @returns {Promise<{varsig: Uint8Array, clientData: Object, verification: Object, signatureValid: boolean}>}
  */
 async function buildVarsigOutput(assertionData) {
-  if (isTestMode()) {
-    return {
-      varsig: new Uint8Array([1, 2, 3]),
-      clientData: {},
-      verification: { valid: true },
-      signatureValid: true,
-    };
-  }
-
   const { assertion, algorithm, origin, rpId, challengeBytes, publicKey } =
     assertionData;
 
@@ -200,10 +167,6 @@ async function verifyVarsigForPayload(
   payloadBytes,
   domainLabel
 ) {
-  if (isTestMode()) {
-    return true;
-  }
-
   let decoded;
   try {
     decoded = decodeWebAuthnVarsigV1(signature);
@@ -252,6 +215,7 @@ async function verifyVarsigForPayload(
 }
 
 export {
+  algorithmFromPublicKey,
   buildVarsigOutput,
   runWebAuthnAssertionForPayload,
   verifyVarsigForPayload,

package/src/varsig/credential.js

@@ -7,9 +7,6 @@ import { toArrayBuffer } from './utils.js';
 import { buildAuthenticatorSelection } from '../webauthn/config.js';
 import { logWebAuthnResponse } from '../webauthn/debug-log.js';
 
-const isTestMode = () =>
-  typeof window !== 'undefined' && window.__PLAYWRIGHT__ === true;
-
 /**
  * Extract public key info from a WebAuthn attestation object.
  * @param {Uint8Array} attestationObject - Raw attestation object bytes.
@@ -81,23 +78,6 @@ async function createWebAuthnVarsigCredential(options = {}) {
     ...options,
   };
 
-  if (isTestMode()) {
-    const credentialId = new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8]);
-    const publicKey = new Uint8Array(32);
-    for (let i = 0; i < publicKey.length; i++) {
-      publicKey[i] = i + 1;
-    }
-    const algorithm = 'Ed25519';
-    const did = DIDKey.fromPublicKey(algorithm, publicKey).did;
-    return {
-      credentialId,
-      publicKey,
-      did,
-      algorithm,
-      cose: { kty: 1, alg: -8, crv: 6 },
-    };
-  }
-
   const publicKey = {
     rp: { name: 'OrbitDB Varsig Identity', id: domain },
     user: {

package/src/varsig/identity.js

@@ -10,7 +10,7 @@ import { DIDKey } from 'iso-did';
 import { concat } from 'iso-webauthn-varsig';
 import { DEFAULT_DOMAIN_LABELS } from './domain.js';
 import { encoder, toBytes } from './utils.js';
-import { verifyVarsigForPayload } from './assertion.js';
+import { verifyVarsigForPayload, algorithmFromPublicKey } from './assertion.js';
 import { WebAuthnVarsigProvider } from './provider.js';
 
 const IDENTITY_CODEC = dagCbor;
@@ -330,6 +330,21 @@ export async function decodeVarsigIdentityFromBytes(bytes, domainLabels = {}) {
  */
 export async function verifyVarsigIdentity(identity, domainLabels = {}) {
   if (!identity || !identity.publicKey || !identity.signatures) return false;
+
+  // The id has to be the DID of the key that signs for it. Both signatures
+  // below are checked against `identity.publicKey`, so without this anyone
+  // with a passkey on the same origin could sign a stranger's DID with their
+  // own key and pass.
+  let expectedDid;
+  try {
+    expectedDid = DIDKey.fromPublicKey(
+      algorithmFromPublicKey(identity.publicKey),
+      identity.publicKey
+    ).did;
+  } catch {
+    return false;
+  }
+  if (identity.id !== expectedDid) return false;
   const labels = { ...DEFAULT_DOMAIN_LABELS, ...domainLabels };
 
   const idBytes = encoder.encode(identity.id);

package/src/webauthn/proof-verification.js

@@ -0,0 +1,235 @@
+/**
+ * @module ProofVerification
+ * @description
+ * Checks that an identity's claim to a DID is backed by the key that DID
+ * encodes.
+ *
+ * OrbitDB verifies `signatures.id` against the identity's own `publicKey`, which
+ * any key satisfies for itself, and then asks the provider whether the rest
+ * holds. So this is the only place where "this identity may speak for that DID"
+ * is decided — and until GHSA-326j-4cc3-4rrg it decided nothing: the static
+ * `verifyIdentity` looked at the type and the `did:key:` prefix, and
+ * `WebAuthnDIDProvider.verify()` looked at the proof's fields. A peer holding
+ * only its own key could claim any DID in any write list.
+ *
+ * Two kinds of DID reach here, and each is bound differently:
+ *
+ * - **P-256, the credential's own key** (multicodec 0x1200). The passkey signed
+ *   `publicKey + signatures.id` during `createIdentity`; that WebAuthn assertion
+ *   is `signatures.publicKey`. It is verified against the key the DID encodes,
+ *   so no lookup is needed — the DID *is* the verification key.
+ * - **Ed25519 or secp256k1, a keystore key** (`useKeystoreDID`). The DID is the
+ *   signing key itself, so `publicKey` must be exactly the key it encodes;
+ *   OrbitDB has already checked that key signed the id.
+ *
+ * Anything else — including the legacy 64-hex ids — cannot be bound to a key,
+ * and is refused rather than waved through.
+ */
+import { varint } from 'multiformats';
+import { base58btc } from 'multiformats/bases/base58';
+import { unwrapEC2Signature } from 'iso-passkeys';
+
+import { DID_KEY_PREFIX, WEBAUTHN_CLIENT_DATA_TYPES } from '../constants.js';
+
+export const MULTICODEC = Object.freeze({
+  P256_PUB: 0x1200,
+  ED25519_PUB: 0xed,
+  SECP256K1_PUB: 0xe7,
+});
+
+const FLAG_USER_PRESENT = 0x01;
+// rpIdHash (32) + flags (1) + signCount (4)
+const AUTH_DATA_MIN_LENGTH = 37;
+const P1363_SIGNATURE_LENGTH = 64;
+
+function base64urlToBytes(value) {
+  const base64 = value.replace(/-/g, '+').replace(/_/g, '/');
+  const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+  return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));
+}
+
+function bytesToBase64url(bytes) {
+  let binary = '';
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary)
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+}
+
+function concat(a, b) {
+  const out = new Uint8Array(a.length + b.length);
+  out.set(a, 0);
+  out.set(b, a.length);
+  return out;
+}
+
+async function sha256(bytes) {
+  return new Uint8Array(await crypto.subtle.digest('SHA-256', bytes));
+}
+
+/**
+ * @param {Uint8Array} bytes
+ * @returns {string} lowercase hex
+ */
+export function bytesToHex(bytes) {
+  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join(
+    ''
+  );
+}
+
+/**
+ * Split a `did:key` into its multicodec and raw public key.
+ * @param {string} did
+ * @returns {{ codec: number, keyBytes: Uint8Array }}
+ */
+export function decodeDidKey(did) {
+  if (typeof did !== 'string' || !did.startsWith(`${DID_KEY_PREFIX}z`)) {
+    throw new Error('Not a base58btc did:key');
+  }
+  const bytes = base58btc.decode(did.slice(DID_KEY_PREFIX.length));
+  const [codec, prefixLength] = varint.decode(bytes);
+  return { codec, keyBytes: bytes.subarray(prefixLength) };
+}
+
+/**
+ * A P-256 public key as raw SEC1 bytes, from either raw bytes or `{ x, y }`.
+ * @param {Uint8Array|{x: ArrayLike<number>, y: ArrayLike<number>}|undefined} publicKey
+ * @returns {Uint8Array|null}
+ */
+export function p256PublicKeyBytes(publicKey) {
+  if (publicKey instanceof Uint8Array) {
+    if (publicKey.length === 65 && publicKey[0] === 0x04) return publicKey;
+    if (publicKey.length === 33) return publicKey;
+    return null;
+  }
+  if (publicKey?.x && publicKey?.y) {
+    const x = Uint8Array.from(publicKey.x);
+    const y = Uint8Array.from(publicKey.y);
+    if (x.length !== 32 || y.length !== 32) return null;
+    const out = new Uint8Array(65);
+    out[0] = 0x04;
+    out.set(x, 1);
+    out.set(y, 33);
+    return out;
+  }
+  return null;
+}
+
+/**
+ * Verify a proof produced by `WebAuthnDIDProvider.sign(data)`.
+ *
+ * Checks, in order: the client data type; that the challenge is the one
+ * `sign()` derives — SHA-256(rawCredentialId ‖ data) — so the assertion is
+ * about this data and no other; that the user was present; and the ECDSA
+ * P-256 signature over `authenticatorData ‖ SHA-256(clientDataJSON)` against
+ * the given key. Never throws: a malformed proof is simply not valid.
+ *
+ * Origin and rpId are not checked. They defend an authentication ceremony
+ * against relaying; here the question is only whether the holder of this key
+ * signed this data, which the signature answers wherever it was made.
+ *
+ * @param {string} encodedProof base64url JSON, as returned by `sign()`
+ * @param {string|Uint8Array} data what was signed
+ * @param {Uint8Array} publicKeyBytes P-256 public key, SEC1
+ * @returns {Promise<boolean>}
+ */
+export async function verifyWebAuthnProof(encodedProof, data, publicKeyBytes) {
+  try {
+    if (typeof encodedProof !== 'string' || !publicKeyBytes) return false;
+    const proof = JSON.parse(
+      new TextDecoder().decode(base64urlToBytes(encodedProof))
+    );
+    const { credentialId, authenticatorData, clientDataJSON, signature } =
+      proof ?? {};
+    if (
+      typeof credentialId !== 'string' ||
+      typeof authenticatorData !== 'string' ||
+      typeof clientDataJSON !== 'string' ||
+      typeof signature !== 'string'
+    ) {
+      return false;
+    }
+
+    const clientData = JSON.parse(clientDataJSON);
+    if (clientData?.type !== WEBAUTHN_CLIENT_DATA_TYPES.GET) return false;
+
+    const dataBytes =
+      typeof data === 'string'
+        ? new TextEncoder().encode(data)
+        : new Uint8Array(data);
+    const expectedChallenge = bytesToBase64url(
+      await sha256(concat(base64urlToBytes(credentialId), dataBytes))
+    );
+    if (clientData.challenge !== expectedChallenge) return false;
+
+    const authData = base64urlToBytes(authenticatorData);
+    if (authData.length < AUTH_DATA_MIN_LENGTH) return false;
+    if ((authData[32] & FLAG_USER_PRESENT) === 0) return false;
+
+    const signedBytes = concat(
+      authData,
+      await sha256(new TextEncoder().encode(clientDataJSON))
+    );
+    const signatureBytes = base64urlToBytes(signature);
+    const p1363 =
+      signatureBytes.length === P1363_SIGNATURE_LENGTH
+        ? signatureBytes
+        : Uint8Array.from(unwrapEC2Signature(signatureBytes));
+
+    const key = await crypto.subtle.importKey(
+      'raw',
+      publicKeyBytes,
+      { name: 'ECDSA', namedCurve: 'P-256' },
+      false,
+      ['verify']
+    );
+    return await crypto.subtle.verify(
+      { name: 'ECDSA', hash: 'SHA-256' },
+      key,
+      p1363,
+      signedBytes
+    );
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Whether an OrbitDB identity of type `webauthn` may speak for its `id`.
+ * @param {{id: string, publicKey: string, signatures: {id: string, publicKey: string}}} identity
+ * @returns {Promise<boolean>}
+ */
+export async function verifyWebAuthnIdentityBinding(identity) {
+  if (
+    !identity ||
+    typeof identity.publicKey !== 'string' ||
+    !identity.signatures
+  ) {
+    return false;
+  }
+
+  let decoded;
+  try {
+    decoded = decodeDidKey(identity.id);
+  } catch {
+    return false;
+  }
+
+  if (decoded.codec === MULTICODEC.P256_PUB) {
+    return verifyWebAuthnProof(
+      identity.signatures.publicKey,
+      identity.publicKey + identity.signatures.id,
+      decoded.keyBytes
+    );
+  }
+
+  if (
+    decoded.codec === MULTICODEC.ED25519_PUB ||
+    decoded.codec === MULTICODEC.SECP256K1_PUB
+  ) {
+    return bytesToHex(decoded.keyBytes) === identity.publicKey.toLowerCase();
+  }
+
+  return false;
+}

package/src/webauthn/provider.js

@@ -14,20 +14,22 @@ import {
   DID_KEY_PREFIX,
   IDENTITY_TYPES,
   KEYSTORE_ENCRYPTION_METHODS,
-  WEBAUTHN_CLIENT_DATA_TYPES,
 } from '../constants.js';
 import {
   WebAuthnIdentityError,
   WebAuthnAuthenticationError,
   WebAuthnCredentialError,
   WebAuthnNotSupportedError,
-  WebAuthnVerificationError,
 } from '../errors.js';
 import {
   buildAuthenticatorSelection,
   buildCredentialRequestOptions,
 } from './config.js';
 import { logWebAuthnResponse } from './debug-log.js';
+import {
+  p256PublicKeyBytes,
+  verifyWebAuthnProof,
+} from './proof-verification.js';
 
 const webauthnLog = logger('orbitdb-identity-provider-webauthn-did:webauthn');
 
@@ -751,77 +753,27 @@ export class WebAuthnDIDProvider {
    * @param {string} signatureData - Base64url signature envelope.
    * @returns {Promise<boolean>} True if verification succeeds.
    */
-  async verify(signatureData) {
-    webauthnLog(
-      'verify() called with signature length: %d',
-      signatureData.length
-    );
-
-    try {
-      // Decode the WebAuthn proof object
-      const proofBytes =
-        WebAuthnDIDProvider.base64urlToArrayBuffer(signatureData);
-      const proofText = new TextDecoder().decode(proofBytes);
-      const proof = JSON.parse(proofText);
-
-      // Verify the proof structure
-      if (!proof.credentialId || !proof.dataHash || !proof.signature) {
-        throw new WebAuthnVerificationError('Invalid WebAuthn proof structure');
-      }
-
-      // Check if credential ID matches
-      webauthnLog('Verification step: checking credential ID');
-      if (proof.credentialId !== this.credentialId) {
-        webauthnLog.error(
-          'Credential ID mismatch in WebAuthn proof verification'
-        );
-        throw new WebAuthnVerificationError('Credential ID mismatch');
-      }
-      webauthnLog('Verification step: credential ID check PASSED');
-
-      // Verify client data JSON
-      webauthnLog('Verification step: checking client data');
-      if (proof.clientDataJSON) {
-        const clientData = JSON.parse(proof.clientDataJSON);
-        if (clientData.type !== WEBAUTHN_CLIENT_DATA_TYPES.GET) {
-          webauthnLog.error('Invalid WebAuthn proof type: %s', clientData.type);
-          throw new WebAuthnVerificationError('Invalid WebAuthn proof type');
-        }
-        webauthnLog('Verification step: client data check PASSED');
-      } else {
-        webauthnLog.error('Invalid client data in WebAuthn proof');
-        throw new WebAuthnVerificationError('Invalid client data');
-      }
-
-      // No expiry check. This proof is embedded in an OrbitDB identity
-      // document, and every entry ever signed under that document has to stay
-      // validatable — an expiring proof would silently invalidate history.
-      // The proof attests that this credential signed this payload, which does
-      // not stop being true. Proofs written by earlier versions still carry a
-      // timestamp field; it is simply ignored.
-
-      // Verify authenticator data exists
-      webauthnLog('Verification step: checking authenticator data');
-      if (!proof.authenticatorData) {
-        webauthnLog.error('Missing authenticator data in WebAuthn proof');
-        throw new WebAuthnVerificationError('Missing authenticator data');
-      }
-      webauthnLog('Verification step: authenticator data check PASSED');
-
-      webauthnLog('Verification result: SUCCESS');
-      return true;
-    } catch (error) {
-      webauthnLog.error(
-        'WebAuthn proof verification failed: %s',
-        error.message
-      );
+  /**
+   * Verify a proof from `sign(data)` against a P-256 key.
+   *
+   * This used to check that the proof had the right fields and return true —
+   * no signature, no challenge — so any proof-shaped JSON passed
+   * (GHSA-326j-4cc3-4rrg).
+   *
+   * @param {string} signatureData base64url proof from `sign()`
+   * @param {string|Uint8Array} data the signed data
+   * @param {Uint8Array|{x: ArrayLike<number>, y: ArrayLike<number>}} publicKey P-256 key
+   * @returns {Promise<boolean>}
+   */
+  async verify(signatureData, data, publicKey) {
+    const keyBytes = p256PublicKeyBytes(publicKey);
+    if (!keyBytes || data === undefined) {
+      webauthnLog('verify() needs the signed data and a P-256 public key');
       return false;
     }
+    return verifyWebAuthnProof(signatureData, data, keyBytes);
   }
 
-  /**
-   * Utility: Convert ArrayBuffer to base64url
-   */
   static arrayBufferToBase64url(buffer) {
     const bytes = new Uint8Array(buffer);
     let binary = '';