Huge News!Announcing our $40M Series B led by Abstract Ventures.Learn More
Socket
Sign inDemoInstall
Socket

webauthn-p256

Package Overview
Dependencies
Maintainers
0
Versions
71
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

webauthn-p256

P256 signature utilities for WebAuthn

  • 0.0.1-main.20240627T195620
  • Source
  • npm
  • Socket score

Version published
Weekly downloads
255K
decreased by-1.51%
Maintainers
0
Weekly downloads
 
Created
Source

webauthn-p256

P256 signature utilities for WebAuthn.

Version MIT License Downloads per month

Table of Contents

Install

npm i webauthn-p256
pnpm add webauthn-p256
bun i webauthn-p256

Usage

import { createCredential, sign, verify } from 'webauthn-p256'

const credential = createCredential({
  name: 'Example',
})

const signature = await sign({
  credentialId: credential.id,
  hash: '0x...'
})

const verified = await verify({
  signature,
  publicKey: credential.publicKey,
})

Onchain Verification

We can also verify WebAuthn signatures onchain via contracts that expose a WebAuthn verifier interface.

The example below uses Viem to call the verify function on the WebAuthn.sol contract. However, in a real world scenario, a contract implementing the WebAuthn verifier interface will call the verify function (e.g. a isValidSignature interface on an ERC-4337 Smart Wallet).

Note: Bytecode for the code variable can be obtained here.

import { createCredential, sign } from 'webauthn-p256'
import { createPublicClient, http } from 'viem'
import { mainnet } from 'viem/chains'

const abi = parseAbi([
  'struct WebAuthnAuth { bytes authenticatorData; string clientDataJSON; uint256 challengeIndex; uint256 typeIndex; uint256 r; uint256 s; }',
  'function verify(bytes, bool, WebAuthnAuth, uint256, uint256)'
])
const code = '0x...'

const credential = createCredential({
  name: 'Example',
})

const hash = '0x...'

const signature = await sign({
  credentialId: credential.id,
  hash
})

const verified = await client.readContract({
  abi,
  code,
  functionName: 'verify',
  args: [
    hash,
    true,
    signature,
    credential.publicKey.x,
    credential.publicKey.y,
  ],
})

Core Reference

createCredential

Creates a P256 WebAuthn credential with a Passkey authenticator.

Usage
import { createCredential } from 'webauthn-p256'

const credential = createCredential({
  name: 'Example',
})
API
NameDescriptionType
nameName for the credential.string
challengeCustom creation challenge for the credential.BufferSource
createFnCredential creation function. Useful for environments that do not support the WebAuthn API natively (i.e. React Native or testing environments).(options: CredentialCreationOptions) => Promise<Credential | null>
excludeCredentialIdsList of credential IDs to exclude from the creation. This property can be used to prevent creation of a credential if it already exists.string[]
rpAn object describing the relying party that requested the credential creation.{ id: string; name: string }
timeoutTimeout for the credential creation.number
userAn object describing the user account for which the credential is generated.{ displayName: string; id: string; name: string }
returnsP256 CredentialP256Credential

sign

Signs a hash using a stored credential. If no credential is provided, a prompt will be displayed for the user to select an existing credential that was previously registered.

Usage
import { sign } from 'webauthn-p256'

const credential = { /* ... */ }

const signature = await sign({
  credentialId: credential.id,
  hash: '0x...',
})
API
NameDescriptionType
credentialIdCredential ID to use for signing.string
getFnCredential retrieval function.(options: CredentialRequestOptions) => Promise<Credential | null>
hashHash to sign.0x${string}
rpIdRelying party identifier.string
returnsWebAuthn-formatted signature.WebAuthnSignature

verify

Verifies a signature using the credential public key and the hash which was signed.

Usage
import { verify } from 'webauthn-p256'

const credential = { /* ... */ }
const signature = { /* ... */ }
 
const valid = await verify({ 
  hash: '0x...', 
  publicKey: credential.publicKey, 
  signature 
})
API
NameDescriptionType
hashHash to verify.0x${string}
publicKeyP256 Credential public key.PublicKey
signatureWebAuthn-formatted signature.WebAuthnSignature
returnsSignature verification result.boolean

Utilities Reference

getCredentialCreationOptions

Returns the credential creation options for a P256-flavoured WebAuthn credential.

Usage
import { getCredentialCreationOptions } from 'webauthn-p256'

const options = getCredentialCreationOptions({
  name: 'Example',
})
API
NameDescriptionType
nameName for the credential.string
challengeCustom creation challenge for the credential.BufferSource
excludeCredentialIdsList of credential IDs to exclude from the creation. This property can be used to prevent creation of a credential if it already exists.string[]
rpAn object describing the relying party that requested the credential creation.{ id: string; name: string }
timeoutTimeout for the credential creation.number
userAn object describing the user account for which the credential is generated.{ displayName: string; id: string; name: string }
returnsPublic key credentialPublicKeyCredential

getCredentialSignRequestOptions

Returns the credential sign request options for a P256-flavoured WebAuthn credential.

Usage
import { getCredentialSignRequestOptions } from 'webauthn-p256'

const options = getCredentialSignRequestOptions({
  credentialId: '...',
  hash: '0x...',
})
API
NameDescriptionType
credentialIdCredential ID to use for signing.string
hashHash to sign.0x${string}
rpIdRelying party identifier.string
returnsCredentialCredential

parsePublicKey

Parses a serialized public key into x and y coordinates.

Usage
import { parsePublicKey } from 'webauthn-p256'

const publicKey = parsePublicKey('0x...')

console.log(publicKey)
// { x: 1231..., y: 12412... }
API
NameDescriptionType
publicKeySerialized P256 Credential public key.0x${string}
returnsParsed public key.PublicKey

serializePublicKey

Serializes a public key into a hex string or bytes.

Usage
import { parsePublicKey } from 'webauthn-p256'

const publicKey = serializePublicKey({
  x: 12341...,
  y: 12341...,
})

console.log(publicKey)
// '0x...'
API
NameDescriptionType
publicKeyP256 Credential public key.PublicKey
returnsSerialized public key.string

Authors

License

MIT License

FAQs

Package last updated on 27 Jun 2024

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc