News for hackers. Stuff that matters.

A comment on Funds of every Trust Wallet browser extension could have been stolen. Parent comment

Re:Funds of every Trust Wallet browser extension could have ... by jeroenhd on Monday May 01, 2023 @10:19AM (#35773124)
Interesting! Does the WebAuthn API provide enough of a cryptographic basis to fulfill the needs of cryptocurrency wallets?

I know it works through public/private key sharing but I wasn't aware that it provides such direct primitives.

[ Parent | on HN ]
Re:Funds of every Trust Wallet browser extension could have ... by lxgr on Tuesday May 02, 2023 @12:21AM (#35783331)
It doesn't, at least not for generic/unmodified cryptographic applications.

WebAuthN signatures are of a very specific challenge/response format [1] that applications need to explicitly support. For example, SSH had to add new key and signature formats [2] to support it.

Theoretically, a blockchain/cryptocurrency application could adopt the WebAuthN signature format as its canonical or an alternative signature format, but I'm not aware of any popular one having done so.

[1] https://developers.yubico.com/WebAuthn/Concepts/Using_WebAut...

[2] https://github.com/openssh/openssh-portable/blob/master/PROT...

[ Parent | on HN ]
Re:Funds of every Trust Wallet browser extension could have ... by jeroenhd on Tuesday May 02, 2023 @07:08AM (#35785784)
Thank you for explaining!
[ Parent | on HN ]