2064183 - Support PQC / ML-DSA algorithms when creating WebAuthn credentials

Status: NEW

(Core :: DOM: Web Authentication, enhancement, P3)

Description

[Josh Cigna]

Attachment: Image showing test configuration and error message.

Steps to reproduce:

This has been tested on Linux and MacOS. On MacOS you need to disable macOS system webauthn subsystem to replicate behavior of Linux Build (set security.webauthn.enable_macos_passkeys = false.)

This was tested with a Hardware Security USB Key that has support for ML-DSA algorithms.

1: Navigate to Webauthn.io
2: Enter a test username and then expand advanced settings.
3: Ensure that only the ML-DSA algorithms are selected.
4: Click on "Register"
5: Connect security key to device.
6: Enter Pin
7: Registration Fails.

Actual results:

Registrations fails with a non-deterministic error message.
This process works with other browsers on other operating systems.

Expected results:

Expected result is the creation of a credential on the security key.

Comment 1

[Josh Cigna]

Creation of credentials with ML-DSA algorithms work with the Android version of FireFox. Firefox on linux seems to be able to read credentials that have bene created on other platforms, the issue seem to be related to credential creation.

Comment 2

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::DOM: Web Authentication' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 3

[Michael Farrell [:mfarrell]]

This is COSE algorithms -48, -49 and -50, which were added in RFC 9964 (published May 2026).

According to the current FIDO MDS (v276), no certified authenticators support ML-DSA, either as an undocumented MetadataStatement.authenticationAlgorithms variant, or in AuthenticatorGetInfo.algorithms[].alg.

ML-DSA algorithms do not appear in the MDS schema (published Jan 2026, prior to RFC 9964). However, the published MDS deviates from this published schema (eg: MetadataStatement.iconDark), so I don't take that as authoritative.

There's ongoing discussion within the WebAuthn WG about how to migrate existing credentials to PQC algorithms:

• https://github.com/w3c/webauthn/issues/2417
• https://github.com/w3c/webauthn/pull/2437
• https://github.com/w3c/webauthn/blob/main/explainers/alg-policy.md
• https://github.com/w3c/webauthn/blob/main/explainers/simple-pqc-migration.md

And there are no ML-DSA test vectors: https://github.com/w3c/webauthn/issues/2393

ML-DSA and PQC algorithms will likely be part of WebAuthn Level 4, but there is not even a published working draft.

Elsewhere:

• Chromium are actively working on ML-DSA support, and this seems to be only supported on Android (but there's limited public info)
• Windows' platform APIs don't list the algorithm at all (but these are COSE algorithm identifiers, and it has not been updated since version 1)

In short, I don't think that a RP can require support for PQC / ML-DSA algorithms today and expect it to be usable by a member of the general public.

Adding support for ML-DSA algorithms needs:

• add COSEAlgorithm variants to authenticator-rs
• ensure it's all plumbed through the WebAuthn stack in Firefox
• ensure platform APIs plumb through the MakeCredential algorithm list
• ensure old versions of platform APIs handle "unknown" algorithms properly
• add support to TestToken (virtual authenticator)

As of authenticator-rs v0.6.0 (which is already shipping with Firefox), an authenticator which supports algorithms unknown to Firefox should work with other algorithms, so an ML-DSA-supporting authenticator should work fine with other algorithms.