{"record":{"id":"1c64f9b725682632","repo":"basecamp/fizzy","slug":"unsupported-okp-curve-curve","errorCode":null,"errorMessage":"Unsupported OKP curve: #{curve}","messagePattern":"Unsupported OKP curve: #(.+?)","errorType":"exception","errorClass":"ActionPack::WebAuthn::UnsupportedKeyTypeError","httpStatus":null,"severity":"error","filePath":"lib/action_pack/web_authn/cose_key.rb","lineNumber":140,"sourceCode":"      # Uncompressed point format: 0x04 || x || y\n      public_key_bytes = [ UNCOMPRESSED_POINT_MARKER, *x.bytes, *y.bytes ].pack(\"C*\")\n\n      asn1 = OpenSSL::ASN1::Sequence([\n        OpenSSL::ASN1::Sequence([\n          OpenSSL::ASN1::ObjectId(\"id-ecPublicKey\"),\n          OpenSSL::ASN1::ObjectId(\"prime256v1\")\n        ]),\n        OpenSSL::ASN1::BitString(public_key_bytes)\n      ])\n\n      OpenSSL::PKey::EC.new(asn1.to_der)\n    rescue OpenSSL::PKey::PKeyError => error\n      raise ActionPack::WebAuthn::InvalidKeyError, \"Invalid EC2 key: #{error.message}\"\n    end\n\n    def build_okp_eddsa_key\n      curve = parameters[OKP_CURVE_LABEL]\n      raise ActionPack::WebAuthn::UnsupportedKeyTypeError, \"Unsupported OKP curve: #{curve}\" unless curve == ED25519\n\n      x = parameters[OKP_X_LABEL]\n      raise ActionPack::WebAuthn::InvalidKeyError, \"Missing OKP key coordinate\" if x.nil?\n\n      asn1 = OpenSSL::ASN1::Sequence([\n        OpenSSL::ASN1::Sequence([\n          OpenSSL::ASN1::ObjectId(\"ED25519\")\n        ]),\n        OpenSSL::ASN1::BitString(x)\n      ])\n\n      OpenSSL::PKey.read(asn1.to_der)\n    rescue OpenSSL::PKey::PKeyError => error\n      raise ActionPack::WebAuthn::InvalidKeyError, \"Invalid OKP key: #{error.message}\"\n    end\n\n    def build_rsa_rs256_key\n      n_bytes = parameters[RSA_N_LABEL]","sourceCodeStart":122,"sourceCodeEnd":158,"githubUrl":"https://github.com/basecamp/fizzy/blob/7aabe7458060d8a1759a53b7ede39e74e6c0b20d/lib/action_pack/web_authn/cose_key.rb#L122-L158","documentation":"For OKP (Octet Key Pair) keys the library only supports Ed25519: the COSE curve label (-1) must equal 6. Curve 7 (Ed448), 4 (X25519), or a missing/nil value raises UnsupportedKeyTypeError with the value interpolated. Ed448 signatures have a different length and key layout, so they cannot be verified as Ed25519.","triggerScenarios":"A credential created with Ed448 (curve 7) or an OKP key whose -1 label is absent/mis-encoded, followed by to_openssl_key during registration; pubKeyCredParams that advertised alg -8 without pinning the Ed25519 curve.","commonSituations":"Experimental authenticators or test tools emitting Ed448; COSE maps round-tripped through JSON where label -1 was dropped or stringified; conformance suites probing OKP variants.","solutions":["Pre-check parameters[OKP_CURVE_LABEL] == 6 before to_openssl_key and reject with a specific message.","Ensure registration options advertise EdDSA (-8) only alongside authenticators/browsers that create Ed25519 credentials (the dominant case).","Rescue UnsupportedKeyTypeError at registration and guide the user to a different authenticator.","If Ed448 support is required, add a dedicated builder branch — do not coerce the key through the Ed25519 path."],"exampleFix":"# before\nkey = cose_key.to_openssl_key # raises for curve 7 (Ed448) or nil\n\n# after — gate on Ed25519 explicitly\nif cose_key.key_type == CoseKey::OKP && cose_key.parameters[CoseKey::OKP_CURVE_LABEL] != CoseKey::ED25519\n  return render json: { error: 'only Ed25519 credentials are supported' }, status: :bad_request\nend\nkey = cose_key.to_openssl_key","handlingStrategy":"validation","validationCode":"if cose_key.key_type == ActionPack::WebAuthn::CoseKey::OKP && cose_key.parameters[ActionPack::WebAuthn::CoseKey::OKP_CURVE_LABEL] != ActionPack::WebAuthn::CoseKey::ED25519\n  return render json: { error: 'only Ed25519 credentials are supported' }, status: :bad_request\nend","typeGuard":"def supported_okp_curve?(cose_key)\n  cose_key.parameters[ActionPack::WebAuthn::CoseKey::OKP_CURVE_LABEL] == ActionPack::WebAuthn::CoseKey::ED25519\nend","tryCatchPattern":"begin\n  key = cose_key.to_openssl_key\nrescue ActionPack::WebAuthn::UnsupportedKeyTypeError => e\n  render json: { error: 'please use a different security key' }, status: :bad_request\nend","preventionTips":["Gate OKP keys on curve == 6 (Ed25519) before conversion.","Advertise alg -8 only where the fleet creates Ed25519 credentials.","Rescue UnsupportedKeyTypeError separately and surface a user-actionable 'try another key' message."],"tags":["webauthn","cose","ed25519","unsupported-algorithm","cryptography"],"backgroundTag":"unsupported-elliptic-curve","analyzedSha":"7aabe7458060d8a1759a53b7ede39e74e6c0b20d","analyzedAt":"2026-08-21T18:33:25.349Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}