3

According to EOSIO they are able to use WebAuthn:

Support for WebAuthn, a W3C web authentication protocol WebAuthn is a standard for strong user authentication collaborated on by the World Wide Web Consortium (W3C), the Fast Identity Online (FIDO) Alliance, with help from Google, Mozilla, Microsoft, Yubico, and others. WebAuthn allows you to use a hardware device for authenticating and signing transactions in a browser without extensions or other software installed on your device. With WebAuthn support for EOSIO, developers can begin testing WebAuthn for authentication in their EOSIO blockchain applications.

My question is why does Ethereum based Dapps not using this and instead of signing transactions with Chrome apps based wallets like Metamask? This involves lot more complexity and Ux problems.

Am i missing something?

Improve this question

3 Answers 3

Reset to default
3

Yes and no.

Ethereum wallets are more versatile what you seem to have. MetaMask predates Web3authn, so it has the first mover advantage. The different "wallet providers" provide different ways to connect a wallet and sigh the transaction. For example, WalletConnect wallets connect by a scanning a QR code and you sign the transaction using a mobile push notification.

As far as I know, nothing prevents you to build a wallet that uses WebAuthn internally. Ethereum already has couple of these "website based wallets" and some of them might use WebAuthn internally, though I have not checked.

More information here: Connecting the wallet of a user to your dApp / web3.js project

Improve this answer
0
1

The eclipse curves are different. Ethereum: secp256k1 FIDO2: secp256r1

Improve this answer
2
  • One could store ones Ethereum key inside a binary data blob symmetrically encrypted memory store with Web3authn correct? I wonder how MetaMask stores its data. Is SubtleCrypto / WebCrypto still a thing and does Web3authn supercede those libs?
    – Tomachi
    Commented Jun 16, 2022 at 18:07
  • WebAuthn currently doesn't have any support for data encryption. Although extensions such as hmac-secret and largeBlob exist, they are not implemented in the the browsers yet.
    – Yao
    Commented Jan 6, 2023 at 5:57
1

It is just a matter of time.

Of equal importance is likely the convenience issue of getting the user to export their key from metamask to WebAuthn or whatever (maybe both can be supported in apps?). If it is inside the browser, perhaps that browser already has a copy.

https://github.com/w3c/webauthn/blob/main/draft-jones-webauthn-secp256k1.txt

WebAuthn Working Group                                          M. Jones
Internet-Draft                                                 Microsoft
Intended status: Informational                              May 30, 2018
Expires: December 1, 2018


                   Using secp256k1 with JOSE and COSE
                   draft-jones-webauthn-secp256k1-00

Abstract

   This specification defines algorithm encodings and representations
   enabling the Standards for Efficient Cryptography Group (SECG)
   elliptic curve "secp256k1" to be used for JSON Object Signing and
   Encryption (JOSE) and CBOR Object Signing and Encryption (COSE)
   messages.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.
Improve this answer
1
  • Unfortunately , the draft has been proposed for a few times but it has not received any updates.
    – Yao
    Commented Jan 6, 2023 at 5:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.