1392366 - WebAuthn: Use WD-05 Hash Algorithm Names

Status: RESOLVED FIXED

(Core :: DOM: Device Interfaces, enhancement, P1)

Description

[J.C. Jones [:jcj] (he/they)]

WebAuthn changed from using algorithm identifiers named "S256" and so forth in WD-04 [1] to those from WebCrypto in WD-05. We need to adopt the WebCrypto algorithm identifiers [2].

[1] https://www.w3.org/TR/2017/WD-webauthn-20170216/#sec-client-data
[2] https://www.w3.org/TR/WebCryptoAPI/#sha-registration

Comment 1

[J.C. Jones [:jcj] (he/they)]

Attachment: Bug 1392366 - WebAuthn must use the WebCrypto SHA-256 algorithm identifier

WD-05 changed the "hashAlg" parameter of the CollectedClientData definition
from using an internally-defined "S256" string to identify the sha256 digest
to the definition in WebCrypto [1]. This only appears once, hard-coded in
WebAuthn (since U2F only supports SHA-256), so we need to change that one
instance.

[1] https://www.w3.org/TR/WebCryptoAPI/#sha-registration

Review commit: https://reviewboard.mozilla.org/r/170872/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/170872/

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Comment on attachment 8899569 [details]
Bug 1392366 - WebAuthn must use the WebCrypto SHA-256 algorithm identifier

https://reviewboard.mozilla.org/r/170872/#review176400

Sounds good.

Comment 3

[J.C. Jones [:jcj] (he/they)]

Thanks! Marking checkin-needed.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/3b20b255ba27
WebAuthn must use the WebCrypto SHA-256 algorithm identifier r=keeler

Comment 5

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/3b20b255ba27