@le-space/orbitdb-identity-provider-webauthn-did 0.5.2 → 0.5.3

package/CHANGELOG.md

@@ -2,6 +2,31 @@
 
 ## Unreleased
 
+## 0.5.3
+
+### Security
+
+- **Varsig identities could still be forged through
+  `createWebAuthnVarsigIdentities()`**
+  ([GHSA-326j-4cc3-4rrg](https://github.com/Le-Space/orbitdb-identity-provider-webauthn-did/security/advisories/GHSA-326j-4cc3-4rrg),
+  left open by 0.5.2). 0.5.2 bound a varsig identity's id to the key that
+  signs for it, but only in `verifyVarsigIdentity`. The verifier returned by
+  `createWebAuthnVarsigIdentities()` — what OrbitDB's access controller
+  calls when an app builds its identities with it, as the varsig demo does —
+  still checked the two signatures against whatever key the identity
+  carried, so a second user's passkey on the same origin could sign someone
+  else's DID and be accepted as a writer under it. It now delegates to
+  `verifyVarsigIdentity`. orbitdb-relay is not affected: it registers
+  `verifyVarsigIdentity` directly.
+
+### Added
+
+- `signingKeyType: 'Ed25519'` derives the OrbitDB signing key as Ed25519
+  instead of secp256k1 — still from the passkey's PRF output (HKDF-SHA256,
+  domain-separated by DID and key type), so one passkey still yields one
+  identity document on every device. The default stays secp256k1, and a
+  keystore that already holds a key for the DID keeps it.
+
 ## 0.5.2
 
 ### Security

package/README.md

@@ -10,6 +10,7 @@ This package provides:
 - A standalone WebAuthn toolkit export (`@le-space/orbitdb-identity-provider-webauthn-did/standalone`) for reuse outside OrbitDB identity wiring.
 - A keystore helper export (`@le-space/orbitdb-identity-provider-webauthn-did/keystore`) for encrypted keystore utilities and provider wiring.
 - **WebAuthn-Varsig**: No insecure OrbitDB keystore at all. Each entry is signed by WebAuthn (varsig envelope), so keys never leave the authenticator, one Passkey (WebAuthn) prompt per write.
+- **Passkey DID with a derived signing key** (the default): the DID is the credential's own P-256 key, and OrbitDB signs entries with a key derived from the passkey's PRF output (HKDF-SHA256, domain-separated by the DID) — secp256k1 by default, Ed25519 with `signingKeyType: 'Ed25519'`. The same passkey yields the same identity document on every device. That key lives in OrbitDB's keystore and is **not** covered by `encryptKeystore`; without PRF the keystore generates one, which then stays on that device.
 - **Keystore-based DID**: Generates an Ed25519/secp256k1 keystore keypair for OrbitDB signing in browser memory. When `encryptKeystore` is enabled, the private key is encrypted with AES-GCM and only rehydrated in memory after a WebAuthn unlock (PRF, largeBlob, or hmac-secret).
 
 ## Current WebAuthn Model

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/orbitdb-identity-provider-webauthn-did",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "description": "WebAuthn-based DID identity provider for OrbitDB for hardware-secured wallets and biometric Passkey authentication",
   "main": "src/index.js",
   "types": "types/index.d.ts",

package/src/keystore/derived-signing-key.js

@@ -21,12 +21,19 @@
  * Needs no change to `@orbitdb/core` — it only has to happen before
  * `getKey(id)` is called, which `getId()` is.
  *
+ * The key is secp256k1, the type `createKey` would have produced, unless the
+ * provider is created with `signingKeyType: 'Ed25519'`. OrbitDB's keystore
+ * reads the type from the raw key, so either signs and verifies unchanged.
+ *
  * See issue #18, option 1.
  */
 import { logger } from '@libp2p/logger';
-import { privateKeyFromRaw } from '@libp2p/crypto/keys';
+import {
+  generateKeyPairFromSeed,
+  privateKeyFromRaw,
+} from '@libp2p/crypto/keys';
 
-import { CRYPTO_ALGORITHMS } from '../constants.js';
+import { CRYPTO_ALGORITHMS, KEY_TYPES } from '../constants.js';
 import { buildCredentialRequestOptions } from '../webauthn/config.js';
 
 const log = logger('orbitdb-identity-provider-webauthn-did:derived-key');
@@ -64,17 +71,35 @@ async function hkdf(seed, info) {
 }
 
 /**
- * Turn a PRF seed into a valid secp256k1 private key.
+ * Turn a PRF seed into a private key of the requested type, as the raw bytes
+ * `keystore.addKey` takes.
+ *
+ * secp256k1: values outside the curve order are invalid. That is vanishingly
+ * unlikely for a 256-bit hash, but retrying with a counter keeps the
+ * derivation total and deterministic rather than probabilistic.
  *
- * Values outside the curve order are invalid. That is vanishingly unlikely for
- * a 256-bit hash, but retrying with a counter keeps the derivation total and
- * deterministic rather than probabilistic.
+ * Ed25519: every 32 bytes are a valid seed, so there is nothing to retry. The
+ * key type is part of its info string, so the two derivations never share
+ * key material, even for the same passkey and DID.
  *
  * @param {Uint8Array} seed - PRF output.
  * @param {string} did - Identity DID, mixed in for domain separation.
- * @returns {Promise<Uint8Array>} A valid 32-byte secp256k1 private key.
+ * @param {string} [keyType='secp256k1'] - 'secp256k1' or 'Ed25519'.
+ * @returns {Promise<Uint8Array>} The 32-byte secp256k1 scalar, or the 64-byte
+ *   Ed25519 private key (seed ‖ public key) libp2p expects.
  */
-export async function deriveSigningKeyBytes(seed, did) {
+export async function deriveSigningKeyBytes(
+  seed,
+  did,
+  keyType = KEY_TYPES.SECP256K1
+) {
+  if (keyType === KEY_TYPES.ED25519) {
+    const edSeed = await hkdf(seed, `${DERIVATION_INFO}:ed25519:${did}`);
+    return (await generateKeyPairFromSeed(KEY_TYPES.ED25519, edSeed)).raw;
+  }
+  if (keyType !== KEY_TYPES.SECP256K1) {
+    throw new Error(`unsupported signing key type: ${keyType}`);
+  }
   for (let counter = 0; counter < 256; counter++) {
     const candidate = await hkdf(seed, `${DERIVATION_INFO}:${did}:${counter}`);
     try {
@@ -158,6 +183,7 @@ export async function getPrfOutput(credential, { rpId } = {}) {
  * @param {string} params.did - Identity DID.
  * @param {Object} params.credential - Stored WebAuthn credential info.
  * @param {string} [params.rpId] - Relying party id.
+ * @param {string} [params.keyType='secp256k1'] - Type of key to derive.
  * @returns {Promise<'derived'|'existing'|'unavailable'>} What happened.
  */
 export async function ensureDerivedSigningKey({
@@ -165,12 +191,24 @@ export async function ensureDerivedSigningKey({
   did,
   credential,
   rpId,
+  keyType = KEY_TYPES.SECP256K1,
 }) {
   if (!keystore || !did || !credential) return 'unavailable';
 
   try {
-    if (await keystore.getKey(did)) {
-      log('keystore already holds a key for this DID; leaving it alone');
+    const existing = await keystore.getKey(did);
+    if (existing) {
+      if (existing.type !== keyType) {
+        // Still left alone: a key of the other type has history behind it,
+        // and replacing it would mint a second document for the DID.
+        log(
+          'keystore already holds a %s key for this DID, not the requested %s; leaving it alone',
+          existing.type,
+          keyType
+        );
+      } else {
+        log('keystore already holds a key for this DID; leaving it alone');
+      }
       return 'existing';
     }
   } catch (error) {
@@ -187,9 +225,9 @@ export async function ensureDerivedSigningKey({
   }
 
   try {
-    const privateKey = await deriveSigningKeyBytes(seed, did);
+    const privateKey = await deriveSigningKeyBytes(seed, did, keyType);
     await keystore.addKey(did, { privateKey });
-    log('seeded the keystore with a PRF-derived signing key');
+    log('seeded the keystore with a PRF-derived %s signing key', keyType);
     return 'derived';
   } catch (error) {
     log('failed to seed the derived key: %s', error.message);

package/src/keystore/provider.js

@@ -50,6 +50,11 @@ export class OrbitDBWebAuthnIdentityProvider {
    * @param {string} [options.keystoreKeyType='secp256k1'] - Keystore key type.
    * @param {boolean} [options.encryptKeystore=false] - Encrypt keystore at rest.
    * @param {string} [options.keystoreEncryptionMethod='prf'] - Encryption method.
+   * @param {boolean} [options.deriveSigningKeyFromPrf=true] - Derive the OrbitDB
+   *   signing key from the passkey's PRF output instead of a random one.
+   * @param {string} [options.signingKeyType='secp256k1'] - Type of that derived
+   *   key: 'secp256k1' or 'Ed25519'. `useKeystoreDID` has its own
+   *   `keystoreKeyType`.
    */
   constructor({
     webauthnCredential,
@@ -59,8 +64,15 @@ export class OrbitDBWebAuthnIdentityProvider {
     encryptKeystore = false,
     keystoreEncryptionMethod = KEYSTORE_ENCRYPTION_METHODS.PRF,
     deriveSigningKeyFromPrf = true,
+    signingKeyType = KEY_TYPES.SECP256K1,
   }) {
+    if (![KEY_TYPES.SECP256K1, KEY_TYPES.ED25519].includes(signingKeyType)) {
+      throw new Error(
+        `signingKeyType must be '${KEY_TYPES.SECP256K1}' or '${KEY_TYPES.ED25519}', not '${signingKeyType}'`
+      );
+    }
     this.credential = webauthnCredential;
+    this.signingKeyType = signingKeyType;
     // Costs one extra assertion the first time an identity is created on a
     // device. Set false to keep a keystore-generated key instead.
     this.deriveSigningKeyFromPrf = deriveSigningKeyFromPrf;
@@ -118,6 +130,7 @@ export class OrbitDBWebAuthnIdentityProvider {
           keystore,
           did,
           credential: this.credential,
+          keyType: this.signingKeyType,
         });
         identityLog('Derived signing key: %s', outcome);
       }
@@ -652,6 +665,8 @@ export class OrbitDBWebAuthnIdentityProvider {
       keystoreKeyType = KEY_TYPES.SECP256K1,
       encryptKeystore = false,
       keystoreEncryptionMethod = KEYSTORE_ENCRYPTION_METHODS.PRF,
+      deriveSigningKeyFromPrf = true,
+      signingKeyType = KEY_TYPES.SECP256K1,
     } = options;
 
     identityLog(
@@ -668,6 +683,8 @@ export class OrbitDBWebAuthnIdentityProvider {
       keystoreKeyType,
       encryptKeystore,
       keystoreEncryptionMethod,
+      deriveSigningKeyFromPrf,
+      signingKeyType,
     });
 
     // If encryption is enabled, create and unlock encrypted keystore
@@ -739,6 +756,7 @@ export class OrbitDBWebAuthnIdentityProvider {
  * @param {string} options.keystoreKeyType - Key type for keystore: 'secp256k1' (default) or 'Ed25519'
  * @param {boolean} options.encryptKeystore - If true, encrypts the keystore with WebAuthn-protected secret
  * @param {string} options.keystoreEncryptionMethod - Encryption method: 'largeBlob' or 'hmac-secret'
+ * @param {string} [options.signingKeyType] - PRF-derived signing key type: 'secp256k1' (default) or 'Ed25519'
  * @returns {Function} Provider factory for OrbitDB.
  */
 export function OrbitDBWebAuthnIdentityProviderFunction(options = {}) {

package/src/varsig/identity.js

@@ -193,26 +193,11 @@ export function createWebAuthnVarsigIdentities(identity, domainLabels = {}) {
       return false;
     }
 
-    const idBytes = encoder.encode(identityToVerify.id);
-    const idValid = await verifyVarsigForPayload(
-      identityToVerify.signatures.id,
-      identityToVerify.publicKey,
-      idBytes,
-      labels.id
-    );
-    if (!idValid) return false;
-
-    const publicKeyPayload = concat([
-      identityToVerify.publicKey,
-      identityToVerify.signatures.id,
-    ]);
-
-    return verifyVarsigForPayload(
-      identityToVerify.signatures.publicKey,
-      identityToVerify.publicKey,
-      publicKeyPayload,
-      labels.publicKey
-    );
+    // The same check OrbitDB's provider registry uses, including the binding
+    // of the id to the key that signs for it. Verifying only the two
+    // signatures, as this did, accepted a stranger's passkey signing someone
+    // else's DID (GHSA-326j-4cc3-4rrg, left open here in 0.5.2).
+    return verifyVarsigIdentity(identityToVerify, labels);
   };
 
   const getIdentity = async (hash) => {

package/types/keystore.d.ts

@@ -48,6 +48,10 @@ export interface OrbitDBWebAuthnIdentityProviderOptions {
   keystoreKeyType?: string;
   encryptKeystore?: boolean;
   keystoreEncryptionMethod?: KeystoreEncryptionMethod;
+  /** Derive the OrbitDB signing key from the passkey's PRF output (default true). */
+  deriveSigningKeyFromPrf?: boolean;
+  /** Type of that derived key (default 'secp256k1'). */
+  signingKeyType?: 'secp256k1' | 'Ed25519';
   [key: string]: unknown;
 }