The algorithm field is optional, see RFC 8152 § 7:
COSE_Key = {
1 => tstr / int, ; kty
? 2 => bstr, ; kid
? 3 => tstr / int, ; alg
? 4 => [+ (tstr / int) ], ; key_ops
? 5 => bstr, ; Base IV
* label => values
}
alg: This parameter is used to restrict the algorithm that is used
with the key. If this parameter is present in the key structure,
the application MUST verify that this algorithm matches the
algorithm for which the key is being used.
This patch introduces the RawPublicKey helper type that takes care of
serialization and deserialization of the key type. The *PublicKey
structs now only need to check if all required fields are present and
have the correct value. It also adds extensive tests to make sure that
serialization and deserialization work correctly.
The deserialization of authenticatorGetAssertion requests using the
hmac-secret extension as sent by e. g. python-fido2 currently fails.
This patch adds some tests with the offending input.
Robin Krahl
Felix Gohla
Sosthène Guédon
Nicolas Stalder