@le-space/orbitdb-identity-provider-webauthn-did 0.5.1 → 0.5.3

package/CHANGELOG.md

@@ -2,6 +2,77 @@
 
 ## Unreleased
 
+## 0.5.3
+
+### Security
+
+- **Varsig identities could still be forged through
+  `createWebAuthnVarsigIdentities()`**
+  ([GHSA-326j-4cc3-4rrg](https://github.com/Le-Space/orbitdb-identity-provider-webauthn-did/security/advisories/GHSA-326j-4cc3-4rrg),
+  left open by 0.5.2). 0.5.2 bound a varsig identity's id to the key that
+  signs for it, but only in `verifyVarsigIdentity`. The verifier returned by
+  `createWebAuthnVarsigIdentities()` — what OrbitDB's access controller
+  calls when an app builds its identities with it, as the varsig demo does —
+  still checked the two signatures against whatever key the identity
+  carried, so a second user's passkey on the same origin could sign someone
+  else's DID and be accepted as a writer under it. It now delegates to
+  `verifyVarsigIdentity`. orbitdb-relay is not affected: it registers
+  `verifyVarsigIdentity` directly.
+
+### Added
+
+- `signingKeyType: 'Ed25519'` derives the OrbitDB signing key as Ed25519
+  instead of secp256k1 — still from the passkey's PRF output (HKDF-SHA256,
+  domain-separated by DID and key type), so one passkey still yields one
+  identity document on every device. The default stays secp256k1, and a
+  keystore that already holds a key for the DID keeps it.
+
+## 0.5.2
+
+### Security
+
+- **Identity verification checked shapes, not signatures**
+  ([GHSA-326j-4cc3-4rrg](https://github.com/Le-Space/orbitdb-identity-provider-webauthn-did/security/advisories/GHSA-326j-4cc3-4rrg)).
+  Four checks that decide whether an identity may speak for a DID verified
+  nothing: the static `verifyIdentity` OrbitDB calls accepted any `did:key:` of
+  type `webauthn`; `WebAuthnDIDProvider.verify()` accepted any proof with the
+  right fields; varsig verification returned `true` whenever
+  `window.__PLAYWRIGHT__` was set; and `verifyVarsigIdentity` never compared the
+  id with the key signing for it. Anyone who knew a DID could write as it
+  wherever write access was granted to that DID.
+
+  `src/webauthn/proof-verification.js` now decides it. A credential DID (P-256)
+  is bound through the WebAuthn assertion in `signatures.publicKey`, verified
+  against the key the DID itself encodes. A keystore DID (Ed25519, secp256k1)
+  must be exactly the key that signs. A varsig identity must carry the DID of
+  its own key. The test-mode branches are gone from `src/`.
+
+  **Check before upgrading** — three things that were accepted and now are not:
+  - Entries written under `useKeystoreDID` by 0.5.1 or earlier. Those identities
+    signed with a key unrelated to their DID (see _Fixed_), which makes their
+    entries indistinguishable from forgeries, so upgraded peers refuse them.
+    Identities with the default credential DID are unaffected.
+  - Legacy 64-hex identity ids. They cannot be bound to any key.
+  - `WebAuthnDIDProvider.verify(signature)` with one argument. It now needs the
+    signed data and the public key: `verify(signature, data, publicKey)`.
+
+### Fixed
+
+- `useKeystoreDID` with `keystoreKeyType: 'Ed25519'` signed entries with a
+  secp256k1 key. The provider stored its key under the credential's P-256 DID;
+  OrbitDB looked it up under the keystore DID, found nothing and generated a
+  fresh secp256k1 key, so only the DID was Ed25519. The key now goes under the
+  DID OrbitDB looks it up by, encrypted and unencrypted.
+- The Ed25519 demo kept `prfInput` across a reload as a plain object, which the
+  browser refused as a PRF input; the worker's seed then fell back to the
+  credential ID and its archive could no longer be opened.
+
+### Tests
+
+- `tests/identity-forgery.test.js`: every forgery above is refused, and beside
+  each the genuine identity still passes. The browser suites use a Chromium
+  virtual authenticator instead of mocks that signed with 64 zero bytes.
+
 ## 0.5.1
 
 ### Fixed

package/README.md

@@ -10,6 +10,7 @@ This package provides:
 - A standalone WebAuthn toolkit export (`@le-space/orbitdb-identity-provider-webauthn-did/standalone`) for reuse outside OrbitDB identity wiring.
 - A keystore helper export (`@le-space/orbitdb-identity-provider-webauthn-did/keystore`) for encrypted keystore utilities and provider wiring.
 - **WebAuthn-Varsig**: No insecure OrbitDB keystore at all. Each entry is signed by WebAuthn (varsig envelope), so keys never leave the authenticator, one Passkey (WebAuthn) prompt per write.
+- **Passkey DID with a derived signing key** (the default): the DID is the credential's own P-256 key, and OrbitDB signs entries with a key derived from the passkey's PRF output (HKDF-SHA256, domain-separated by the DID) — secp256k1 by default, Ed25519 with `signingKeyType: 'Ed25519'`. The same passkey yields the same identity document on every device. That key lives in OrbitDB's keystore and is **not** covered by `encryptKeystore`; without PRF the keystore generates one, which then stays on that device.
 - **Keystore-based DID**: Generates an Ed25519/secp256k1 keystore keypair for OrbitDB signing in browser memory. When `encryptKeystore` is enabled, the private key is encrypted with AES-GCM and only rehydrated in memory after a WebAuthn unlock (PRF, largeBlob, or hmac-secret).
 
 ## Current WebAuthn Model

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/orbitdb-identity-provider-webauthn-did",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "WebAuthn-based DID identity provider for OrbitDB for hardware-secured wallets and biometric Passkey authentication",
   "main": "src/index.js",
   "types": "types/index.d.ts",
@@ -145,7 +145,7 @@
       "iso-web": "^3.1.2",
       "iso-webauthn-varsig": "npm:@le-space/iso-webauthn-varsig@^0.3.0",
       "conf>ajv": "^8.18.0",
-      "ajv>fast-uri": "^3.1.4"
+      "ajv>fast-uri": "^3.1.6"
     },
     "onlyBuiltDependencies": [
       "@ipshipyard/node-datachannel",

package/src/keystore/derived-signing-key.js

@@ -21,12 +21,19 @@
  * Needs no change to `@orbitdb/core` — it only has to happen before
  * `getKey(id)` is called, which `getId()` is.
  *
+ * The key is secp256k1, the type `createKey` would have produced, unless the
+ * provider is created with `signingKeyType: 'Ed25519'`. OrbitDB's keystore
+ * reads the type from the raw key, so either signs and verifies unchanged.
+ *
  * See issue #18, option 1.
  */
 import { logger } from '@libp2p/logger';
-import { privateKeyFromRaw } from '@libp2p/crypto/keys';
+import {
+  generateKeyPairFromSeed,
+  privateKeyFromRaw,
+} from '@libp2p/crypto/keys';
 
-import { CRYPTO_ALGORITHMS } from '../constants.js';
+import { CRYPTO_ALGORITHMS, KEY_TYPES } from '../constants.js';
 import { buildCredentialRequestOptions } from '../webauthn/config.js';
 
 const log = logger('orbitdb-identity-provider-webauthn-did:derived-key');
@@ -64,17 +71,35 @@ async function hkdf(seed, info) {
 }
 
 /**
- * Turn a PRF seed into a valid secp256k1 private key.
+ * Turn a PRF seed into a private key of the requested type, as the raw bytes
+ * `keystore.addKey` takes.
+ *
+ * secp256k1: values outside the curve order are invalid. That is vanishingly
+ * unlikely for a 256-bit hash, but retrying with a counter keeps the
+ * derivation total and deterministic rather than probabilistic.
  *
- * Values outside the curve order are invalid. That is vanishingly unlikely for
- * a 256-bit hash, but retrying with a counter keeps the derivation total and
- * deterministic rather than probabilistic.
+ * Ed25519: every 32 bytes are a valid seed, so there is nothing to retry. The
+ * key type is part of its info string, so the two derivations never share
+ * key material, even for the same passkey and DID.
  *
  * @param {Uint8Array} seed - PRF output.
  * @param {string} did - Identity DID, mixed in for domain separation.
- * @returns {Promise<Uint8Array>} A valid 32-byte secp256k1 private key.
+ * @param {string} [keyType='secp256k1'] - 'secp256k1' or 'Ed25519'.
+ * @returns {Promise<Uint8Array>} The 32-byte secp256k1 scalar, or the 64-byte
+ *   Ed25519 private key (seed ‖ public key) libp2p expects.
  */
-export async function deriveSigningKeyBytes(seed, did) {
+export async function deriveSigningKeyBytes(
+  seed,
+  did,
+  keyType = KEY_TYPES.SECP256K1
+) {
+  if (keyType === KEY_TYPES.ED25519) {
+    const edSeed = await hkdf(seed, `${DERIVATION_INFO}:ed25519:${did}`);
+    return (await generateKeyPairFromSeed(KEY_TYPES.ED25519, edSeed)).raw;
+  }
+  if (keyType !== KEY_TYPES.SECP256K1) {
+    throw new Error(`unsupported signing key type: ${keyType}`);
+  }
   for (let counter = 0; counter < 256; counter++) {
     const candidate = await hkdf(seed, `${DERIVATION_INFO}:${did}:${counter}`);
     try {
@@ -158,6 +183,7 @@ export async function getPrfOutput(credential, { rpId } = {}) {
  * @param {string} params.did - Identity DID.
  * @param {Object} params.credential - Stored WebAuthn credential info.
  * @param {string} [params.rpId] - Relying party id.
+ * @param {string} [params.keyType='secp256k1'] - Type of key to derive.
  * @returns {Promise<'derived'|'existing'|'unavailable'>} What happened.
  */
 export async function ensureDerivedSigningKey({
@@ -165,12 +191,24 @@ export async function ensureDerivedSigningKey({
   did,
   credential,
   rpId,
+  keyType = KEY_TYPES.SECP256K1,
 }) {
   if (!keystore || !did || !credential) return 'unavailable';
 
   try {
-    if (await keystore.getKey(did)) {
-      log('keystore already holds a key for this DID; leaving it alone');
+    const existing = await keystore.getKey(did);
+    if (existing) {
+      if (existing.type !== keyType) {
+        // Still left alone: a key of the other type has history behind it,
+        // and replacing it would mint a second document for the DID.
+        log(
+          'keystore already holds a %s key for this DID, not the requested %s; leaving it alone',
+          existing.type,
+          keyType
+        );
+      } else {
+        log('keystore already holds a key for this DID; leaving it alone');
+      }
       return 'existing';
     }
   } catch (error) {
@@ -187,9 +225,9 @@ export async function ensureDerivedSigningKey({
   }
 
   try {
-    const privateKey = await deriveSigningKeyBytes(seed, did);
+    const privateKey = await deriveSigningKeyBytes(seed, did, keyType);
     await keystore.addKey(did, { privateKey });
-    log('seeded the keystore with a PRF-derived signing key');
+    log('seeded the keystore with a PRF-derived %s signing key', keyType);
     return 'derived';
   } catch (error) {
     log('failed to seed the derived key: %s', error.message);

package/src/keystore/provider.js

@@ -9,6 +9,7 @@ import { base58btc } from 'multiformats/bases/base58';
 import * as KeystoreEncryption from './encryption.js';
 import { ensureDerivedSigningKey } from './derived-signing-key.js';
 import { WebAuthnDIDProvider } from '../webauthn/provider.js';
+import { verifyWebAuthnIdentityBinding } from '../webauthn/proof-verification.js';
 import {
   identityProofKey,
   loadIdentityProof,
@@ -49,6 +50,11 @@ export class OrbitDBWebAuthnIdentityProvider {
    * @param {string} [options.keystoreKeyType='secp256k1'] - Keystore key type.
    * @param {boolean} [options.encryptKeystore=false] - Encrypt keystore at rest.
    * @param {string} [options.keystoreEncryptionMethod='prf'] - Encryption method.
+   * @param {boolean} [options.deriveSigningKeyFromPrf=true] - Derive the OrbitDB
+   *   signing key from the passkey's PRF output instead of a random one.
+   * @param {string} [options.signingKeyType='secp256k1'] - Type of that derived
+   *   key: 'secp256k1' or 'Ed25519'. `useKeystoreDID` has its own
+   *   `keystoreKeyType`.
    */
   constructor({
     webauthnCredential,
@@ -58,8 +64,15 @@ export class OrbitDBWebAuthnIdentityProvider {
     encryptKeystore = false,
     keystoreEncryptionMethod = KEYSTORE_ENCRYPTION_METHODS.PRF,
     deriveSigningKeyFromPrf = true,
+    signingKeyType = KEY_TYPES.SECP256K1,
   }) {
+    if (![KEY_TYPES.SECP256K1, KEY_TYPES.ED25519].includes(signingKeyType)) {
+      throw new Error(
+        `signingKeyType must be '${KEY_TYPES.SECP256K1}' or '${KEY_TYPES.ED25519}', not '${signingKeyType}'`
+      );
+    }
     this.credential = webauthnCredential;
+    this.signingKeyType = signingKeyType;
     // Costs one extra assertion the first time an identity is created on a
     // device. Set false to keep a keystore-generated key instead.
     this.deriveSigningKeyFromPrf = deriveSigningKeyFromPrf;
@@ -117,6 +130,7 @@ export class OrbitDBWebAuthnIdentityProvider {
           keystore,
           did,
           credential: this.credential,
+          keyType: this.signingKeyType,
         });
         identityLog('Derived signing key: %s', outcome);
       }
@@ -171,12 +185,24 @@ export class OrbitDBWebAuthnIdentityProvider {
         const publicKeyBytes = normalizeByteArray(encryptedData.publicKey);
         const keyType = encryptedData.keyType || this.keystoreKeyType;
 
-        return this.createDIDFromKeystorePublicKey(
+        const did = this.createDIDFromKeystorePublicKey(
           publicKeyBytes,
           keyType,
           varint,
           base58btc
         );
+        // OrbitDB signs with whatever key it finds under the id, and creates a
+        // secp256k1 one when there is none — so without this the DID said
+        // Ed25519 and the entries were signed by an unrelated key.
+        if (
+          this.unlockedKeypair?.privateKey &&
+          !(await this.keystore.getKey(did))
+        ) {
+          await this.keystore.addKey(did, {
+            privateKey: this.unlockedKeypair.privateKey,
+          });
+        }
+        return did;
       }
 
       // Get the keystore's identity ID (this will be used to retrieve the key)
@@ -293,12 +319,18 @@ export class OrbitDBWebAuthnIdentityProvider {
         keystoreKey.type
       );
 
-      return this.createDIDFromKeystorePublicKey(
+      const did = this.createDIDFromKeystorePublicKey(
         publicKeyBytes,
         keystoreKey.type,
         varint,
         base58btc
       );
+      // Stored above under the credential's P-256 DID; OrbitDB looks it up under
+      // the DID returned here, found nothing, and generated a secp256k1 key.
+      if (!(await this.keystore.getKey(did))) {
+        await this.keystore.addKey(did, { privateKey: keystoreKey.raw });
+      }
+      return did;
     } catch (error) {
       identityLog.error(
         'Failed to create Ed25519 DID from keystore: %s',
@@ -633,6 +665,8 @@ export class OrbitDBWebAuthnIdentityProvider {
       keystoreKeyType = KEY_TYPES.SECP256K1,
       encryptKeystore = false,
       keystoreEncryptionMethod = KEYSTORE_ENCRYPTION_METHODS.PRF,
+      deriveSigningKeyFromPrf = true,
+      signingKeyType = KEY_TYPES.SECP256K1,
     } = options;
 
     identityLog(
@@ -649,6 +683,8 @@ export class OrbitDBWebAuthnIdentityProvider {
       keystoreKeyType,
       encryptKeystore,
       keystoreEncryptionMethod,
+      deriveSigningKeyFromPrf,
+      signingKeyType,
     });
 
     // If encryption is enabled, create and unlock encrypted keystore
@@ -720,6 +756,7 @@ export class OrbitDBWebAuthnIdentityProvider {
  * @param {string} options.keystoreKeyType - Key type for keystore: 'secp256k1' (default) or 'Ed25519'
  * @param {boolean} options.encryptKeystore - If true, encrypts the keystore with WebAuthn-protected secret
  * @param {string} options.keystoreEncryptionMethod - Encryption method: 'largeBlob' or 'hmac-secret'
+ * @param {string} [options.signingKeyType] - PRF-derived signing key type: 'secp256k1' (default) or 'Ed25519'
  * @returns {Function} Provider factory for OrbitDB.
  */
 export function OrbitDBWebAuthnIdentityProviderFunction(options = {}) {
@@ -734,27 +771,10 @@ OrbitDBWebAuthnIdentityProviderFunction.type = IDENTITY_TYPES.WEBAUTHN;
 OrbitDBWebAuthnIdentityProviderFunction.verifyIdentity = async function (
   identity
 ) {
-  try {
-    // For WebAuthn identities, we need to store the credential info in the identity
-    // Since WebAuthn verification requires the original credential, not just the public key,
-    // we'll create a simplified verification that checks the proof structure
-
-    // For WebAuthn, the identity should have been created with our provider,
-    // so we can trust it if it has the right structure
-    // Accept both DID format (did:key:...) and hash format (hex string) for backward compatibility
-    const isValidDID = identity.id && identity.id.startsWith(DID_KEY_PREFIX);
-    const isValidHash = identity.id && /^[a-f0-9]{64}$/.test(identity.id); // 64-char hex string (legacy)
-
-    if (
-      identity.type === IDENTITY_TYPES.WEBAUTHN &&
-      (isValidDID || isValidHash)
-    ) {
-      return true;
-    }
-
-    return false;
-  } catch (error) {
-    console.error('WebAuthn static identity verification failed:', error);
-    return false;
-  }
+  // The check OrbitDB relies on to decide whether this identity may speak for
+  // its DID. It used to accept any `did:key:` of type `webauthn`, so a peer
+  // holding only its own key could write as anyone in a write list
+  // (GHSA-326j-4cc3-4rrg). See ../webauthn/proof-verification.js.
+  if (identity?.type !== IDENTITY_TYPES.WEBAUTHN) return false;
+  return verifyWebAuthnIdentityBinding(identity);
 };

package/src/varsig/assertion.js

@@ -19,16 +19,13 @@ import {
   toBytes,
 } from './utils.js';
 import { buildCredentialRequestOptions } from '../webauthn/config.js';
-import { KEY_TYPES, WEBAUTHN_CLIENT_DATA_TYPES } from '../constants.js';
+import { KEY_TYPES } from '../constants.js';
 import {
   VarsigVerificationError,
   WebAuthnAuthenticationError,
 } from '../errors.js';
 import { logWebAuthnResponse } from '../webauthn/debug-log.js';
 
-const isTestMode = () =>
-  typeof window !== 'undefined' && window.__PLAYWRIGHT__ === true;
-
 /**
  * Run a WebAuthn assertion for a payload.
  * @param {Object} credential - WebAuthn credential info.
@@ -54,27 +51,6 @@ async function runWebAuthnAssertionForPayload(
   const signedBytes = bindContext(domainLabel, payloadBytes);
   const challengeBytes = await buildChallengeBytes(signedBytes);
 
-  if (isTestMode()) {
-    return {
-      rpId,
-      origin,
-      challengeBytes,
-      algorithm: credential.algorithm,
-      publicKey: credential.publicKey,
-      assertion: {
-        authenticatorData: new Uint8Array(37),
-        clientDataJSON: new TextEncoder().encode(
-          JSON.stringify({
-            type: WEBAUTHN_CLIENT_DATA_TYPES.GET,
-            challenge: 'test',
-            origin,
-          })
-        ),
-        signature: new Uint8Array(64),
-      },
-    };
-  }
-
   const assertion = await navigator.credentials.get(
     buildCredentialRequestOptions({
       rpId,
@@ -114,15 +90,6 @@ async function runWebAuthnAssertionForPayload(
  * @returns {Promise<{varsig: Uint8Array, clientData: Object, verification: Object, signatureValid: boolean}>}
  */
 async function buildVarsigOutput(assertionData) {
-  if (isTestMode()) {
-    return {
-      varsig: new Uint8Array([1, 2, 3]),
-      clientData: {},
-      verification: { valid: true },
-      signatureValid: true,
-    };
-  }
-
   const { assertion, algorithm, origin, rpId, challengeBytes, publicKey } =
     assertionData;
 
@@ -200,10 +167,6 @@ async function verifyVarsigForPayload(
   payloadBytes,
   domainLabel
 ) {
-  if (isTestMode()) {
-    return true;
-  }
-
   let decoded;
   try {
     decoded = decodeWebAuthnVarsigV1(signature);
@@ -252,6 +215,7 @@ async function verifyVarsigForPayload(
 }
 
 export {
+  algorithmFromPublicKey,
   buildVarsigOutput,
   runWebAuthnAssertionForPayload,
   verifyVarsigForPayload,

package/src/varsig/credential.js

@@ -7,9 +7,6 @@ import { toArrayBuffer } from './utils.js';
 import { buildAuthenticatorSelection } from '../webauthn/config.js';
 import { logWebAuthnResponse } from '../webauthn/debug-log.js';
 
-const isTestMode = () =>
-  typeof window !== 'undefined' && window.__PLAYWRIGHT__ === true;
-
 /**
  * Extract public key info from a WebAuthn attestation object.
  * @param {Uint8Array} attestationObject - Raw attestation object bytes.
@@ -81,23 +78,6 @@ async function createWebAuthnVarsigCredential(options = {}) {
     ...options,
   };
 
-  if (isTestMode()) {
-    const credentialId = new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8]);
-    const publicKey = new Uint8Array(32);
-    for (let i = 0; i < publicKey.length; i++) {
-      publicKey[i] = i + 1;
-    }
-    const algorithm = 'Ed25519';
-    const did = DIDKey.fromPublicKey(algorithm, publicKey).did;
-    return {
-      credentialId,
-      publicKey,
-      did,
-      algorithm,
-      cose: { kty: 1, alg: -8, crv: 6 },
-    };
-  }
-
   const publicKey = {
     rp: { name: 'OrbitDB Varsig Identity', id: domain },
     user: {

package/src/varsig/identity.js

@@ -10,7 +10,7 @@ import { DIDKey } from 'iso-did';
 import { concat } from 'iso-webauthn-varsig';
 import { DEFAULT_DOMAIN_LABELS } from './domain.js';
 import { encoder, toBytes } from './utils.js';
-import { verifyVarsigForPayload } from './assertion.js';
+import { verifyVarsigForPayload, algorithmFromPublicKey } from './assertion.js';
 import { WebAuthnVarsigProvider } from './provider.js';
 
 const IDENTITY_CODEC = dagCbor;
@@ -193,26 +193,11 @@ export function createWebAuthnVarsigIdentities(identity, domainLabels = {}) {
       return false;
     }
 
-    const idBytes = encoder.encode(identityToVerify.id);
-    const idValid = await verifyVarsigForPayload(
-      identityToVerify.signatures.id,
-      identityToVerify.publicKey,
-      idBytes,
-      labels.id
-    );
-    if (!idValid) return false;
-
-    const publicKeyPayload = concat([
-      identityToVerify.publicKey,
-      identityToVerify.signatures.id,
-    ]);
-
-    return verifyVarsigForPayload(
-      identityToVerify.signatures.publicKey,
-      identityToVerify.publicKey,
-      publicKeyPayload,
-      labels.publicKey
-    );
+    // The same check OrbitDB's provider registry uses, including the binding
+    // of the id to the key that signs for it. Verifying only the two
+    // signatures, as this did, accepted a stranger's passkey signing someone
+    // else's DID (GHSA-326j-4cc3-4rrg, left open here in 0.5.2).
+    return verifyVarsigIdentity(identityToVerify, labels);
   };
 
   const getIdentity = async (hash) => {
@@ -330,6 +315,21 @@ export async function decodeVarsigIdentityFromBytes(bytes, domainLabels = {}) {
  */
 export async function verifyVarsigIdentity(identity, domainLabels = {}) {
   if (!identity || !identity.publicKey || !identity.signatures) return false;
+
+  // The id has to be the DID of the key that signs for it. Both signatures
+  // below are checked against `identity.publicKey`, so without this anyone
+  // with a passkey on the same origin could sign a stranger's DID with their
+  // own key and pass.
+  let expectedDid;
+  try {
+    expectedDid = DIDKey.fromPublicKey(
+      algorithmFromPublicKey(identity.publicKey),
+      identity.publicKey
+    ).did;
+  } catch {
+    return false;
+  }
+  if (identity.id !== expectedDid) return false;
   const labels = { ...DEFAULT_DOMAIN_LABELS, ...domainLabels };
 
   const idBytes = encoder.encode(identity.id);

package/src/webauthn/proof-verification.js

@@ -0,0 +1,235 @@
+/**
+ * @module ProofVerification
+ * @description
+ * Checks that an identity's claim to a DID is backed by the key that DID
+ * encodes.
+ *
+ * OrbitDB verifies `signatures.id` against the identity's own `publicKey`, which
+ * any key satisfies for itself, and then asks the provider whether the rest
+ * holds. So this is the only place where "this identity may speak for that DID"
+ * is decided — and until GHSA-326j-4cc3-4rrg it decided nothing: the static
+ * `verifyIdentity` looked at the type and the `did:key:` prefix, and
+ * `WebAuthnDIDProvider.verify()` looked at the proof's fields. A peer holding
+ * only its own key could claim any DID in any write list.
+ *
+ * Two kinds of DID reach here, and each is bound differently:
+ *
+ * - **P-256, the credential's own key** (multicodec 0x1200). The passkey signed
+ *   `publicKey + signatures.id` during `createIdentity`; that WebAuthn assertion
+ *   is `signatures.publicKey`. It is verified against the key the DID encodes,
+ *   so no lookup is needed — the DID *is* the verification key.
+ * - **Ed25519 or secp256k1, a keystore key** (`useKeystoreDID`). The DID is the
+ *   signing key itself, so `publicKey` must be exactly the key it encodes;
+ *   OrbitDB has already checked that key signed the id.
+ *
+ * Anything else — including the legacy 64-hex ids — cannot be bound to a key,
+ * and is refused rather than waved through.
+ */
+import { varint } from 'multiformats';
+import { base58btc } from 'multiformats/bases/base58';
+import { unwrapEC2Signature } from 'iso-passkeys';
+
+import { DID_KEY_PREFIX, WEBAUTHN_CLIENT_DATA_TYPES } from '../constants.js';
+
+export const MULTICODEC = Object.freeze({
+  P256_PUB: 0x1200,
+  ED25519_PUB: 0xed,
+  SECP256K1_PUB: 0xe7,
+});
+
+const FLAG_USER_PRESENT = 0x01;
+// rpIdHash (32) + flags (1) + signCount (4)
+const AUTH_DATA_MIN_LENGTH = 37;
+const P1363_SIGNATURE_LENGTH = 64;
+
+function base64urlToBytes(value) {
+  const base64 = value.replace(/-/g, '+').replace(/_/g, '/');
+  const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+  return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));
+}
+
+function bytesToBase64url(bytes) {
+  let binary = '';
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary)
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+}
+
+function concat(a, b) {
+  const out = new Uint8Array(a.length + b.length);
+  out.set(a, 0);
+  out.set(b, a.length);
+  return out;
+}
+
+async function sha256(bytes) {
+  return new Uint8Array(await crypto.subtle.digest('SHA-256', bytes));
+}
+
+/**
+ * @param {Uint8Array} bytes
+ * @returns {string} lowercase hex
+ */
+export function bytesToHex(bytes) {
+  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join(
+    ''
+  );
+}
+
+/**
+ * Split a `did:key` into its multicodec and raw public key.
+ * @param {string} did
+ * @returns {{ codec: number, keyBytes: Uint8Array }}
+ */
+export function decodeDidKey(did) {
+  if (typeof did !== 'string' || !did.startsWith(`${DID_KEY_PREFIX}z`)) {
+    throw new Error('Not a base58btc did:key');
+  }
+  const bytes = base58btc.decode(did.slice(DID_KEY_PREFIX.length));
+  const [codec, prefixLength] = varint.decode(bytes);
+  return { codec, keyBytes: bytes.subarray(prefixLength) };
+}
+
+/**
+ * A P-256 public key as raw SEC1 bytes, from either raw bytes or `{ x, y }`.
+ * @param {Uint8Array|{x: ArrayLike<number>, y: ArrayLike<number>}|undefined} publicKey
+ * @returns {Uint8Array|null}
+ */
+export function p256PublicKeyBytes(publicKey) {
+  if (publicKey instanceof Uint8Array) {
+    if (publicKey.length === 65 && publicKey[0] === 0x04) return publicKey;
+    if (publicKey.length === 33) return publicKey;
+    return null;
+  }
+  if (publicKey?.x && publicKey?.y) {
+    const x = Uint8Array.from(publicKey.x);
+    const y = Uint8Array.from(publicKey.y);
+    if (x.length !== 32 || y.length !== 32) return null;
+    const out = new Uint8Array(65);
+    out[0] = 0x04;
+    out.set(x, 1);
+    out.set(y, 33);
+    return out;
+  }
+  return null;
+}
+
+/**
+ * Verify a proof produced by `WebAuthnDIDProvider.sign(data)`.
+ *
+ * Checks, in order: the client data type; that the challenge is the one
+ * `sign()` derives — SHA-256(rawCredentialId ‖ data) — so the assertion is
+ * about this data and no other; that the user was present; and the ECDSA
+ * P-256 signature over `authenticatorData ‖ SHA-256(clientDataJSON)` against
+ * the given key. Never throws: a malformed proof is simply not valid.
+ *
+ * Origin and rpId are not checked. They defend an authentication ceremony
+ * against relaying; here the question is only whether the holder of this key
+ * signed this data, which the signature answers wherever it was made.
+ *
+ * @param {string} encodedProof base64url JSON, as returned by `sign()`
+ * @param {string|Uint8Array} data what was signed
+ * @param {Uint8Array} publicKeyBytes P-256 public key, SEC1
+ * @returns {Promise<boolean>}
+ */
+export async function verifyWebAuthnProof(encodedProof, data, publicKeyBytes) {
+  try {
+    if (typeof encodedProof !== 'string' || !publicKeyBytes) return false;
+    const proof = JSON.parse(
+      new TextDecoder().decode(base64urlToBytes(encodedProof))
+    );
+    const { credentialId, authenticatorData, clientDataJSON, signature } =
+      proof ?? {};
+    if (
+      typeof credentialId !== 'string' ||
+      typeof authenticatorData !== 'string' ||
+      typeof clientDataJSON !== 'string' ||
+      typeof signature !== 'string'
+    ) {
+      return false;
+    }
+
+    const clientData = JSON.parse(clientDataJSON);
+    if (clientData?.type !== WEBAUTHN_CLIENT_DATA_TYPES.GET) return false;
+
+    const dataBytes =
+      typeof data === 'string'
+        ? new TextEncoder().encode(data)
+        : new Uint8Array(data);
+    const expectedChallenge = bytesToBase64url(
+      await sha256(concat(base64urlToBytes(credentialId), dataBytes))
+    );
+    if (clientData.challenge !== expectedChallenge) return false;
+
+    const authData = base64urlToBytes(authenticatorData);
+    if (authData.length < AUTH_DATA_MIN_LENGTH) return false;
+    if ((authData[32] & FLAG_USER_PRESENT) === 0) return false;
+
+    const signedBytes = concat(
+      authData,
+      await sha256(new TextEncoder().encode(clientDataJSON))
+    );
+    const signatureBytes = base64urlToBytes(signature);
+    const p1363 =
+      signatureBytes.length === P1363_SIGNATURE_LENGTH
+        ? signatureBytes
+        : Uint8Array.from(unwrapEC2Signature(signatureBytes));
+
+    const key = await crypto.subtle.importKey(
+      'raw',
+      publicKeyBytes,
+      { name: 'ECDSA', namedCurve: 'P-256' },
+      false,
+      ['verify']
+    );
+    return await crypto.subtle.verify(
+      { name: 'ECDSA', hash: 'SHA-256' },
+      key,
+      p1363,
+      signedBytes
+    );
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Whether an OrbitDB identity of type `webauthn` may speak for its `id`.
+ * @param {{id: string, publicKey: string, signatures: {id: string, publicKey: string}}} identity
+ * @returns {Promise<boolean>}
+ */
+export async function verifyWebAuthnIdentityBinding(identity) {
+  if (
+    !identity ||
+    typeof identity.publicKey !== 'string' ||
+    !identity.signatures
+  ) {
+    return false;
+  }
+
+  let decoded;
+  try {
+    decoded = decodeDidKey(identity.id);
+  } catch {
+    return false;
+  }
+
+  if (decoded.codec === MULTICODEC.P256_PUB) {
+    return verifyWebAuthnProof(
+      identity.signatures.publicKey,
+      identity.publicKey + identity.signatures.id,
+      decoded.keyBytes
+    );
+  }
+
+  if (
+    decoded.codec === MULTICODEC.ED25519_PUB ||
+    decoded.codec === MULTICODEC.SECP256K1_PUB
+  ) {
+    return bytesToHex(decoded.keyBytes) === identity.publicKey.toLowerCase();
+  }
+
+  return false;
+}

package/src/webauthn/provider.js

@@ -14,20 +14,22 @@ import {
   DID_KEY_PREFIX,
   IDENTITY_TYPES,
   KEYSTORE_ENCRYPTION_METHODS,
-  WEBAUTHN_CLIENT_DATA_TYPES,
 } from '../constants.js';
 import {
   WebAuthnIdentityError,
   WebAuthnAuthenticationError,
   WebAuthnCredentialError,
   WebAuthnNotSupportedError,
-  WebAuthnVerificationError,
 } from '../errors.js';
 import {
   buildAuthenticatorSelection,
   buildCredentialRequestOptions,
 } from './config.js';
 import { logWebAuthnResponse } from './debug-log.js';
+import {
+  p256PublicKeyBytes,
+  verifyWebAuthnProof,
+} from './proof-verification.js';
 
 const webauthnLog = logger('orbitdb-identity-provider-webauthn-did:webauthn');
 
@@ -751,77 +753,27 @@ export class WebAuthnDIDProvider {
    * @param {string} signatureData - Base64url signature envelope.
    * @returns {Promise<boolean>} True if verification succeeds.
    */
-  async verify(signatureData) {
-    webauthnLog(
-      'verify() called with signature length: %d',
-      signatureData.length
-    );
-
-    try {
-      // Decode the WebAuthn proof object
-      const proofBytes =
-        WebAuthnDIDProvider.base64urlToArrayBuffer(signatureData);
-      const proofText = new TextDecoder().decode(proofBytes);
-      const proof = JSON.parse(proofText);
-
-      // Verify the proof structure
-      if (!proof.credentialId || !proof.dataHash || !proof.signature) {
-        throw new WebAuthnVerificationError('Invalid WebAuthn proof structure');
-      }
-
-      // Check if credential ID matches
-      webauthnLog('Verification step: checking credential ID');
-      if (proof.credentialId !== this.credentialId) {
-        webauthnLog.error(
-          'Credential ID mismatch in WebAuthn proof verification'
-        );
-        throw new WebAuthnVerificationError('Credential ID mismatch');
-      }
-      webauthnLog('Verification step: credential ID check PASSED');
-
-      // Verify client data JSON
-      webauthnLog('Verification step: checking client data');
-      if (proof.clientDataJSON) {
-        const clientData = JSON.parse(proof.clientDataJSON);
-        if (clientData.type !== WEBAUTHN_CLIENT_DATA_TYPES.GET) {
-          webauthnLog.error('Invalid WebAuthn proof type: %s', clientData.type);
-          throw new WebAuthnVerificationError('Invalid WebAuthn proof type');
-        }
-        webauthnLog('Verification step: client data check PASSED');
-      } else {
-        webauthnLog.error('Invalid client data in WebAuthn proof');
-        throw new WebAuthnVerificationError('Invalid client data');
-      }
-
-      // No expiry check. This proof is embedded in an OrbitDB identity
-      // document, and every entry ever signed under that document has to stay
-      // validatable — an expiring proof would silently invalidate history.
-      // The proof attests that this credential signed this payload, which does
-      // not stop being true. Proofs written by earlier versions still carry a
-      // timestamp field; it is simply ignored.
-
-      // Verify authenticator data exists
-      webauthnLog('Verification step: checking authenticator data');
-      if (!proof.authenticatorData) {
-        webauthnLog.error('Missing authenticator data in WebAuthn proof');
-        throw new WebAuthnVerificationError('Missing authenticator data');
-      }
-      webauthnLog('Verification step: authenticator data check PASSED');
-
-      webauthnLog('Verification result: SUCCESS');
-      return true;
-    } catch (error) {
-      webauthnLog.error(
-        'WebAuthn proof verification failed: %s',
-        error.message
-      );
+  /**
+   * Verify a proof from `sign(data)` against a P-256 key.
+   *
+   * This used to check that the proof had the right fields and return true —
+   * no signature, no challenge — so any proof-shaped JSON passed
+   * (GHSA-326j-4cc3-4rrg).
+   *
+   * @param {string} signatureData base64url proof from `sign()`
+   * @param {string|Uint8Array} data the signed data
+   * @param {Uint8Array|{x: ArrayLike<number>, y: ArrayLike<number>}} publicKey P-256 key
+   * @returns {Promise<boolean>}
+   */
+  async verify(signatureData, data, publicKey) {
+    const keyBytes = p256PublicKeyBytes(publicKey);
+    if (!keyBytes || data === undefined) {
+      webauthnLog('verify() needs the signed data and a P-256 public key');
       return false;
     }
+    return verifyWebAuthnProof(signatureData, data, keyBytes);
   }
 
-  /**
-   * Utility: Convert ArrayBuffer to base64url
-   */
   static arrayBufferToBase64url(buffer) {
     const bytes = new Uint8Array(buffer);
     let binary = '';

package/types/keystore.d.ts

@@ -48,6 +48,10 @@ export interface OrbitDBWebAuthnIdentityProviderOptions {
   keystoreKeyType?: string;
   encryptKeystore?: boolean;
   keystoreEncryptionMethod?: KeystoreEncryptionMethod;
+  /** Derive the OrbitDB signing key from the passkey's PRF output (default true). */
+  deriveSigningKeyFromPrf?: boolean;
+  /** Type of that derived key (default 'secp256k1'). */
+  signingKeyType?: 'secp256k1' | 'Ed25519';
   [key: string]: unknown;
 }