Skip to content

Passkeys: Add publicKey to register response#12757

Merged
phoerious merged 4 commits intokeepassxreboot:developfrom
varjolintu:fix/passkeys_add_spki_publickey_to_response
Jan 17, 2026
Merged

Passkeys: Add publicKey to register response#12757
phoerious merged 4 commits intokeepassxreboot:developfrom
varjolintu:fix/passkeys_add_spki_publickey_to_response

Conversation

@varjolintu
Copy link
Copy Markdown
Member

@varjolintu varjolintu commented Nov 29, 2025

Adds a DER SubjectPublicKeyInfo to the passkey registration response. We are currently not writing this, even if It is part of the specification https://w3c.github.io/webauthn/#sctn-public-key-easy:

User agents MUST be able to return a non-null value for getPublicKey() when the credential public key has a COSEAlgorithmIdentifier value of:
-7 (ES256), where kty is 2 (with uncompressed points) and crv is 1 (P-256).
-257 (RS256).
-8 (EdDSA), where crv is 6 (Ed25519).

Fixes a passkey creation on Logitech site https://id.logi.com.

Testing strategy

Manually with: keepassxreboot/keepassxc-browser#2782
Tested https://webauthn.io with all three different algorithms to verify the response has the new publicKey in base64 format in the browser logs.

Type of change

  • ✅ Bug fix (non-breaking change that fixes an issue)

@varjolintu varjolintu force-pushed the fix/passkeys_add_spki_publickey_to_response branch from 017fc17 to fee044d Compare November 29, 2025 08:46
@varjolintu
Copy link
Copy Markdown
Member Author

Need to add some exceptions for Botan 2.

@droidmonkey
Copy link
Copy Markdown
Member

Can we add a test for this response?

@varjolintu
Copy link
Copy Markdown
Member Author

varjolintu commented Nov 29, 2025

Can we add a test for this response?

I'll try. We use predefined values for the keys so it should be possible.

EDIT: We are not actually creating any keys in the tests so.. I'll try to modify the tests so we can create actual keys with const predefined data.

@varjolintu varjolintu force-pushed the fix/passkeys_add_spki_publickey_to_response branch from 06ecbea to d0735de Compare November 29, 2025 16:12
@varjolintu
Copy link
Copy Markdown
Member Author

varjolintu commented Nov 29, 2025

Modified the testRegister() unit test. It is using a new variable for const data when creating an actual ECDSA private key. Cleaned up the variable names a bit. All didn't match with the ones specified in header files.

And of course the private key data changes affected to some other tests too.

@phoerious phoerious merged commit 01b4992 into keepassxreboot:develop Jan 17, 2026
12 checks passed
@varjolintu varjolintu deleted the fix/passkeys_add_spki_publickey_to_response branch January 17, 2026 13:07
@phoerious phoerious added the pr:backport-pending Pull request to be backported label Jan 17, 2026
@phoerious phoerious mentioned this pull request Jan 17, 2026
20 tasks
pull bot pushed a commit to NeatNerdPrime/keepassxc that referenced this pull request Jan 17, 2026
pull bot pushed a commit to TheTechOddBug/keepassxc that referenced this pull request Jan 17, 2026
pull bot pushed a commit to lucienlmy/keepassxc that referenced this pull request Jan 17, 2026
@phoerious phoerious added pr: backported Pull request backported to previous release and removed pr:backport-pending Pull request to be backported labels Mar 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

feature: Passkeys pr: backported Pull request backported to previous release pr: bugfix Pull request fixes a bug

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants