basecamp/fizzy · error · ActionPack::WebAuthn::UnsupportedKeyTypeError

Unsupported COSE key type/algorithm: #{key_type}/#{algorithm

Error message

Unsupported COSE key type/algorithm: #{key_type}/#{algorithm}

What it means

CoseKey#to_openssl_key supports exactly three key type/algorithm pairs: EC2+ES256 (2/-7), OKP+EdDSA (1/-8), and RSA+RS256 (3/-257). Any other combination raises UnsupportedKeyTypeError with the offending pair interpolated. The COSE map's key type (label 1) and algorithm (label 3) come straight from the authenticator, so this error means the credential was created with an algorithm this library cannot verify.

Source

Thrown at lib/action_pack/web_authn/cose_key.rb:108

    @key_type = key_type
    @algorithm = algorithm
    @parameters = parameters
  end

  # Converts the COSE key to an OpenSSL public key object.
  #
  # Returns an +OpenSSL::PKey::EC+ for EC2 keys, +OpenSSL::PKey::RSA+ for
  # RSA keys, or an Ed25519 key for OKP keys, suitable for use with
  # +OpenSSL::PKey#verify+.
  #
  # Raises +UnsupportedKeyTypeError+ if the key type, algorithm, or curve
  # is not supported.
  def to_openssl_key
    case [ key_type, algorithm ]
    when [ EC2, ES256 ] then build_ec2_es256_key
    when [ OKP, EDDSA ] then build_okp_eddsa_key
    when [ RSA, RS256 ] then build_rsa_rs256_key
    else raise ActionPack::WebAuthn::UnsupportedKeyTypeError, "Unsupported COSE key type/algorithm: #{key_type}/#{algorithm}"
    end
  end

  private
    def build_ec2_es256_key
      curve = parameters[EC2_CURVE_LABEL]
      raise ActionPack::WebAuthn::UnsupportedKeyTypeError, "Unsupported EC curve: #{curve}" unless curve == P256

      x = parameters[EC2_X_LABEL]
      y = parameters[EC2_Y_LABEL]
      raise ActionPack::WebAuthn::InvalidKeyError, "Missing EC2 key coordinates" if x.nil? || y.nil?
      raise ActionPack::WebAuthn::InvalidKeyError, "Invalid EC2 coordinate length" unless x.bytesize == P256_COORDINATE_LENGTH && y.bytesize == P256_COORDINATE_LENGTH

      # Uncompressed point format: 0x04 || x || y
      public_key_bytes = [ UNCOMPRESSED_POINT_MARKER, *x.bytes, *y.bytes ].pack("C*")

      asn1 = OpenSSL::ASN1::Sequence([
        OpenSSL::ASN1::Sequence([

View on GitHub (pinned to 7aabe74580)

Solutions

1. Restrict pubKeyCredParams in your registration options to alg -7 (ES256), -8 (EdDSA) and -257 (RS256) so browsers only create verifiable credentials.
2. Inspect cose_key.key_type and cose_key.algorithm before calling to_openssl_key and reject unsupported pairs with a clear message.
3. Rescue ActionPack::WebAuthn::UnsupportedKeyTypeError during registration and prompt the user to try a different authenticator/security key.
4. If you must support the pair, extend to_openssl_key in a subclass rather than rescuing and skipping verification.

Example fix

// before (client registration options — too permissive)
pubKeyCredParams: [{ type: 'public-key', alg: -7 }, { type: 'public-key', alg: -47 }, { type: 'public-key', alg: -257 }]

// after — only advertise what the server verifies
pubKeyCredParams: [{ type: 'public-key', alg: -7 }, { type: 'public-key', alg: -8 }, { type: 'public-key', alg: -257 }]

SUPPORTED = { [2, -7] => :es256, [1, -8] => :eddsa, [3, -257] => :rs256 }
unless SUPPORTED.key?([cose_key.key_type, cose_key.algorithm])
  return render json: { error: 'unsupported credential algorithm' }, status: :bad_request
end
key = cose_key.to_openssl_key

def supported_cose_algorithm?(cose_key)
  [[2, -7], [1, -8], [3, -257]].include?([cose_key.key_type, cose_key.algorithm])
end

begin
  key = cose_key.to_openssl_key
rescue ActionPack::WebAuthn::UnsupportedKeyTypeError => e
  render json: { error: 'please use a different security key (unsupported algorithm)' }, status: :bad_request
end

When it happens

Trigger: An authenticator attests ES384 (-47), PS256 (-37), Ed448, or an inconsistent pair like key_type 2 with algorithm -257 — then CoseKey.decode(...).to_openssl_key is called during registration verification.

Common situations: Registration options (pubKeyCredParams) advertise algorithms the server cannot verify, so browsers pick them; unusual smart cards or newer platforms defaulting to ES384/Ed448; hand-built COSE maps with mismatched labels; version drift when a deployment predates RS256 support.

Related errors

• Unsupported OKP curve: #{curve}
• Unsupported EC curve: #{curve}
• Invalid base64 encoding in authenticator data
• Authenticator data is too short
• Client data is not valid JSON

AI-assisted analysis of basecamp/fizzy@7aabe74580 (2026-08-21). Data as JSON: /api/errors/4bb3e665dd18bdad. Report an issue: GitHub.