{"record":{"id":"4bb3e665dd18bdad","repo":"basecamp/fizzy","slug":"unsupported-cose-key-type-algorithm-key-type","errorCode":null,"errorMessage":"Unsupported COSE key type/algorithm: #{key_type}/#{algorithm}","messagePattern":"Unsupported COSE key type/algorithm: #(.+?)/#(.+?)","errorType":"exception","errorClass":"ActionPack::WebAuthn::UnsupportedKeyTypeError","httpStatus":null,"severity":"error","filePath":"lib/action_pack/web_authn/cose_key.rb","lineNumber":108,"sourceCode":"    @key_type = key_type\n    @algorithm = algorithm\n    @parameters = parameters\n  end\n\n  # Converts the COSE key to an OpenSSL public key object.\n  #\n  # Returns an +OpenSSL::PKey::EC+ for EC2 keys, +OpenSSL::PKey::RSA+ for\n  # RSA keys, or an Ed25519 key for OKP keys, suitable for use with\n  # +OpenSSL::PKey#verify+.\n  #\n  # Raises +UnsupportedKeyTypeError+ if the key type, algorithm, or curve\n  # is not supported.\n  def to_openssl_key\n    case [ key_type, algorithm ]\n    when [ EC2, ES256 ] then build_ec2_es256_key\n    when [ OKP, EDDSA ] then build_okp_eddsa_key\n    when [ RSA, RS256 ] then build_rsa_rs256_key\n    else raise ActionPack::WebAuthn::UnsupportedKeyTypeError, \"Unsupported COSE key type/algorithm: #{key_type}/#{algorithm}\"\n    end\n  end\n\n  private\n    def build_ec2_es256_key\n      curve = parameters[EC2_CURVE_LABEL]\n      raise ActionPack::WebAuthn::UnsupportedKeyTypeError, \"Unsupported EC curve: #{curve}\" unless curve == P256\n\n      x = parameters[EC2_X_LABEL]\n      y = parameters[EC2_Y_LABEL]\n      raise ActionPack::WebAuthn::InvalidKeyError, \"Missing EC2 key coordinates\" if x.nil? || y.nil?\n      raise ActionPack::WebAuthn::InvalidKeyError, \"Invalid EC2 coordinate length\" unless x.bytesize == P256_COORDINATE_LENGTH && y.bytesize == P256_COORDINATE_LENGTH\n\n      # Uncompressed point format: 0x04 || x || y\n      public_key_bytes = [ UNCOMPRESSED_POINT_MARKER, *x.bytes, *y.bytes ].pack(\"C*\")\n\n      asn1 = OpenSSL::ASN1::Sequence([\n        OpenSSL::ASN1::Sequence([","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/basecamp/fizzy/blob/7aabe7458060d8a1759a53b7ede39e74e6c0b20d/lib/action_pack/web_authn/cose_key.rb#L90-L126","documentation":"CoseKey#to_openssl_key supports exactly three key type/algorithm pairs: EC2+ES256 (2/-7), OKP+EdDSA (1/-8), and RSA+RS256 (3/-257). Any other combination raises UnsupportedKeyTypeError with the offending pair interpolated. The COSE map's key type (label 1) and algorithm (label 3) come straight from the authenticator, so this error means the credential was created with an algorithm this library cannot verify.","triggerScenarios":"An authenticator attests ES384 (-47), PS256 (-37), Ed448, or an inconsistent pair like key_type 2 with algorithm -257 — then CoseKey.decode(...).to_openssl_key is called during registration verification.","commonSituations":"Registration options (pubKeyCredParams) advertise algorithms the server cannot verify, so browsers pick them; unusual smart cards or newer platforms defaulting to ES384/Ed448; hand-built COSE maps with mismatched labels; version drift when a deployment predates RS256 support.","solutions":["Restrict pubKeyCredParams in your registration options to alg -7 (ES256), -8 (EdDSA) and -257 (RS256) so browsers only create verifiable credentials.","Inspect cose_key.key_type and cose_key.algorithm before calling to_openssl_key and reject unsupported pairs with a clear message.","Rescue ActionPack::WebAuthn::UnsupportedKeyTypeError during registration and prompt the user to try a different authenticator/security key.","If you must support the pair, extend to_openssl_key in a subclass rather than rescuing and skipping verification."],"exampleFix":"// before (client registration options — too permissive)\npubKeyCredParams: [{ type: 'public-key', alg: -7 }, { type: 'public-key', alg: -47 }, { type: 'public-key', alg: -257 }]\n\n// after — only advertise what the server verifies\npubKeyCredParams: [{ type: 'public-key', alg: -7 }, { type: 'public-key', alg: -8 }, { type: 'public-key', alg: -257 }]","handlingStrategy":"validation","validationCode":"SUPPORTED = { [2, -7] => :es256, [1, -8] => :eddsa, [3, -257] => :rs256 }\nunless SUPPORTED.key?([cose_key.key_type, cose_key.algorithm])\n  return render json: { error: 'unsupported credential algorithm' }, status: :bad_request\nend\nkey = cose_key.to_openssl_key","typeGuard":"def supported_cose_algorithm?(cose_key)\n  [[2, -7], [1, -8], [3, -257]].include?([cose_key.key_type, cose_key.algorithm])\nend","tryCatchPattern":"begin\n  key = cose_key.to_openssl_key\nrescue ActionPack::WebAuthn::UnsupportedKeyTypeError => e\n  render json: { error: 'please use a different security key (unsupported algorithm)' }, status: :bad_request\nend","preventionTips":["Advertise only algs -7, -8, -257 in pubKeyCredParams so browsers never create unverifiable credentials.","Check key_type/algorithm before conversion and fail with a user-actionable message.","Never rescue UnsupportedKeyTypeError and continue without verification."],"tags":["webauthn","cose","cryptography","unsupported-algorithm","passkeys"],"backgroundTag":"webauthn-unsupported-algorithm","analyzedSha":"7aabe7458060d8a1759a53b7ede39e74e6c0b20d","analyzedAt":"2026-08-21T18:33:25.349Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}