Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This is extremely obvious in the new FIDO specification for key export, where they neglect to specify the format in which the private keys are encoded.

In other words, it's a "standard" designed to let Apple, Google, and Microsoft enable portability between each other, but to keep software like KeePass out of the mix.



Isn’t that here?

https://fidoalliance.org/specs/cx/cxf-v1.0-wd-20241003.html#...

The private key is specified as being a “PKCS#8 formatted byte string which is then Base64url encoded”. Is that insufficient?


This really is the least problem.

As long as the key export API isn't actually gated (e.g. by only working over a backend-to-backend API with a mandatory "security audit" to gain access, by wrapping exported keys using vendor-specific keys and requiring a similar audit to be included as an export target etc.), everything else can be figured out. There's only so many ways you can encode an ECDSA key.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: