I’m keeping my dependencies as minimal as possible. If the double encode/decode solution turns out to be brittle, I will likely use base64-js. The Socket report looks acceptable, and the package is actually maintained by Feross, one of the creators of Socket.dev. 
Thanks for the suggestion!
type1fool
1
type1fool
@tangui The Wax demo is using DETS for storage, but I’m using Postgres. Jason fails to encode the cose key for storage due to invalid bytes. Is there a way to encode they key for DB storage?
Error
[error] GenServer #PID<0.695.0> terminating
** (Jason.EncodeError) invalid byte 0x98 in <<152, 56, 87, 90, 219, 182, 209, 197, 234, 133, 243, 172, 126, 118, 138, 103, 80, ..., 166, 6, 236, 39, 106, 29, 54>>
Example Cose Key
%{
-3 => <<182, 81, 183, 218, 92, 107, 106, 120, 60, 51, 75, 104, 141, 130,
119, 232, 34, 245, 84, 203, 246, 165, 148, 179, 169, 31, 205, 126, 241,
188, 241, 176>>,
-2 => <<89, 29, 193, 225, 4, 234, 101, 162, 32, 6, 15, 14, 130, 179, 223,
207, 53, 2, 134, 184, 178, 127, 51, 145, 57, 180, 104, 242, 138, 96, 27,
221>>,
-1 => 1,
1 => 2,
3 => -7
}
1
tomciopp
@type1fool I’ve also written a webauthn library, and am the creator of the cbor library as well. GitHub - scalpel-software/webauthn: Authenticate users to your web application using public key cryptography by becoming a webauthn relying party · GitHub (I will be writing more documentation soon)
For saving the cose key you can create a custom ecto type and save it as a binary.
something like
defmodule Ecto.CoseKey do
use Ecto.Type
def type, do: :binary
def cast(value) when is_map(value) do
try do
{:ok, CBOR.encode(value)}
rescue
Protocol.UndefinedError -> :error
end
end
def cast(_), do: :error
def load(data) when is_binary(data) do
case CBOR.decode(data) do
{:ok, cose_key, ""} -> {:ok, cose_key}
_other -> :error
end
end
def dump(value), do: {:ok, value}
end
Let me know if you have any additional questions.
3
tangui
You can store it as a string:
key |> term_to_binary() |> Base.encode64()
and back from the DB:
key_from_db |> Base.decode64() |> binary_to_term()
1
type1fool
Hey @tomciopp ! I saw the webauthn package when I was getting started, but the alpha status and docs made it hard to choose it fwiw. Regardless, I see that cbor is a dependency for Wax, so I owe you and @tangui a drink. 
Thank you for the custom Ecto type suggestion. It works, and it’s idiomatic. Nice! Now I need to use Ecto.Type to clean up some unrelated work. 
1
type1fool
On another note, after a bit of refactoring, I removed the double encoding/decoding steps after finding issues with my Uint8Array JS implementation. I still get errors on occasion, but they’re much less frequent. I suspect the JS needs just a little more TLC.
0
type1fool
Update
I’ve made significant progress on this over the past weeks. In Chrome (and Safari - see next reply), I can register and login using TouchID or a USB key via WebAuthn. 
To share what I’ve been learning, I started live streaming via Twitch.
Today, I encountered an error when I attempted to register in Safari. The attestation statement is coming back with an invalid format. pubKeyCredParams is configured as recommended by webauthn.guide and MDN docs, so I don’t understand why Safari/WebKit is returning a different format. Has anyone else seen this?
Safari: Invalid attStmt
attestation_decoded: {:ok,
%{
"attStmt" => %{
"x5c" => [
%CBOR.Tag{
tag: :bytes,
value: <<48, 130, 2, 66, 48, 130, 1, 201, 160, 3, 2, 1, 2, 2, 6, 1,
128, 124, 231, 151, 17, 48, 10, 6, 8, 42, 134, 72, 206, 61, 4, 3, 2,
48, 72, 49, 28, 48, 26, 6, 3, 85, 4, ...>>
},
%CBOR.Tag{
tag: :bytes,
value: <<48, 130, 2, 52, 48, 130, 1, 186, 160, 3, 2, 1, 2, 2, 16, 86,
37, 83, 149, 199, 167, 251, 64, 235, 226, 40, 216, 38, 8, 83, 182,
48, 10, 6, 8, 42, 134, 72, 206, 61, 4, 3, ...>>
}
]
},
"authData" => %CBOR.Tag{
tag: :bytes,
value: <<73, 150, 13, 229, 136, 14, 140, 104, 116, 52, 23, 15, 100, 118,
96, 91, 143, 228, 174, 185, 162, 134, 50, 199, 153, 92, 243, 186, 131,
29, 151, 99, 69, 0, 0, 0, 0, 242, 74, 142, 112, 208, 211, 248, ...>>
},
"fmt" => "apple"
}, ""}
Chrome: Valid attStmt
attestation_decoded: {:ok,
%{
"attStmt" => %{
"alg" => -7,
"sig" => %CBOR.Tag{
tag: :bytes,
value: <<48, 69, 2, 32, 47, 29, 113, 135, 145, 72, 34, 17, 253, 171, 217,
197, 203, 183, 23, 136, 9, 11, 218, 71, 128, 245, 55, 104, 177, 220,
10, 73, 42, 207, 157, 7, 2, 33, 0, 158, 243, 192, 200, ...>>
}
},
"authData" => %CBOR.Tag{
tag: :bytes,
value: <<73, 150, 13, 229, 136, 14, 140, 104, 116, 52, 23, 15, 100, 118,
96, 91, 143, 228, 174, 185, 162, 134, 50, 199, 153, 92, 243, 186, 131,
29, 151, 99, 69, 98, 109, 204, 235, 173, 206, 0, 2, 53, 188, 198, ...>>
},
"fmt" => "packed"
}, ""}
Public Key Config
const publicKey = {
challenge: challenge.buffer,
rp: {
name: appName,
id: rp_id,
},
user: {
id: new Uint8Array(16).buffer,
name: user.email,
displayName: user.username,
},
pubKeyCredParams: [{ alg: -7, type: "public-key" }],
timeout: 60000,
attestation: attestation,
authenticatorSelection: {
userVerification: user_verification,
},
};
2
type1fool
Ok, I poked around webauthn.io and found that it would only work in Safari if attestation was set to none. Problem solved I suppose, though I’m reading further on implications of this change.
Testing on my iPhone with Safari 15.4, somehow, navigator.credentials doesn’t exist. I’m baffled since webauth.io can register, and I see the call to navigator.credentials.create in the source JS. I do have Web Authentication API & Web Authentication Modern enabled in advanced settings, and it seems to have been supported since v13 (caniuse). This is weird.
Edit: Eureka!
It turns out Safari only allows navigator.credentials on https with no exception for localhost. Running my site over ngrok https, WebAuthn works!
7
dch
just found your video on this, thanks for sharing! Is the source code for the module around anywhere?
2
type1fool
It’s not publicly available yet, but I intend to extract it from the app and release a package.
3