fix: record what the authenticator agreed to, not just what the browser offers (#43)

* fix: record what the authenticator agreed to, not just what the browser offers

#42 fixed the client-side detection. Testing it on real hardware showed the
other half was still missing: on a macOS platform authenticator in Brave,
getClientCapabilities() advertises hmacCreateSecret, the authenticator refuses
it, and PRF works. The demo therefore labelled hmac-secret "✅ Supported",
offered it, and the ceremony failed — which is the failure #9 reported in the
first place.

Client support is not authenticator support. Only the ceremony settles it, and
the raw PublicKeyCredential does not survive past createCredential(), so the
answer is read there or lost. It now travels on the credential as
`extensionSupport` and is persisted with it.

The demo consumes it: a method the authenticator refused reads "Browser yes,
this passkey no" instead of "Supported", stops being selectable, and a current
selection it cannot honour falls back automatically — PRF, then largeBlob, then
hmac-secret. Client capabilities are resolved before the stored credential is
loaded now; the previous order let the browser's view overwrite the
authenticator's.

Also fixes a log line that the console output from that hardware run exposed:

    encrypted: options.encryptKeystore ? `Yes (${options.encryptionMethod})` : 'No'

That reports the *request*, so "Yes (largeBlob)" appeared whether or not
largeBlob had been honoured, and a failed write was indistinguishable from a
successful one. It now names the request and the authenticator's capability
separately.

Tests: 58 node tests pass, including a new case pinning the disagreement
between the two questions. Format and lint clean, demo builds.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: actually write the secret key into largeBlob

The keystore record carried:

    secretKey: sk, // Will be moved to largeBlob

Nothing ever moved it. That was the only occurrence of the field in all of
src/, and storeEncryptedKeystore() serialises a fixed whitelist which does not
include it — so the key was dropped at persist time. Choosing largeBlob
produced a keystore that worked for exactly the session that created it and
could never be unlocked afterwards: the next load called
retrieveSKFromLargeBlob(), read a blob nobody had written, and failed with "No
largeBlob data found in credential".

Worth stating plainly, because the first suspicion was worse: the key never
reached disk in the clear. The whitelist that dropped it also kept it out of
localStorage. The feature was inert, not leaky.

writeSKToLargeBlob() now performs the assertion that stores it — a blob can
only be written during an assertion, never at registration, which is why
addLargeBlobToCredentialOptions() alone persists nothing and why this costs one
extra prompt. It throws unless the authenticator reports `written: true`.
Failing there beats persisting a record that cannot be opened, and it is the
same lesson as the rest of this branch: read what happened, do not trust what
was requested.

Tests: 5 new cases covering confirmed write, declined write, absent result, a
truthy-but-not-true value, and a refused assertion. 63 node tests pass.

One wrinkle worth recording: Node defines globalThis.navigator as a getter-only
accessor, so the obvious `globalThis.navigator = stub` throws
TypeError: Cannot set property navigator. The stub swaps the property
descriptor and restores the original afterwards.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: NiKrause

CHANGELOG.md

@@ -4,6 +4,41 @@
 
 ### Fixed
 
+- Actually write the secret key into `largeBlob`. The keystore record carried
+  `secretKey: sk, // Will be moved to largeBlob` — and nothing ever moved it.
+  That was the only occurrence of the field in `src/`, and
+  `storeEncryptedKeystore()` serialises a fixed whitelist that does not include
+  it, so the key was dropped at persist time. Choosing largeBlob therefore
+  produced a keystore that worked for the session that created it and could
+  never be unlocked again: on the next load `retrieveSKFromLargeBlob()` read a
+  blob nobody had written and failed with "No largeBlob data found in
+  credential".
+
+  The key never reached disk in the clear — the whitelist saw to that — but the
+  feature was inert. `writeSKToLargeBlob()` now performs the assertion that
+  stores it (a blob can only be written during an assertion, never at
+  registration, so this costs one extra prompt) and **throws unless the
+  authenticator reports `written: true`**. Failing there beats persisting a
+  record that cannot be opened.
+
+- Carry the authenticator's own answer on the credential. `createCredential()`
+  now records `extensionSupport` — what the authenticator agreed to during the
+  ceremony — because the raw `PublicKeyCredential` does not survive past that
+  function, so the answer is read there or lost. Client support is not
+  authenticator support: measured on a macOS platform authenticator in Brave,
+  the client advertises `hmacCreateSecret` while the authenticator refuses it
+  and PRF works. Reading only the client is what left the demo offering
+  hmac-secret and then failing at the ceremony, which is the failure originally
+  reported in #9.
+
+  The encrypted-keystore demo consumes it: methods the authenticator refused
+  read "Browser yes, this passkey no" rather than "Supported", become
+  unselectable, and a selection it cannot honour falls back automatically. It
+  also no longer logs `encrypted: Yes (largeBlob)` off the back of the
+  _requested_ options — that line reported intent as though it were outcome, so
+  a failed write looked identical to a successful one. It now names the request
+  and the authenticator's capability separately, so a mismatch is visible.
+
 - Detect WebAuthn extensions by asking the browser instead of inspecting a
   prototype. `checkExtensionSupport()` tested
   `'largeBlob' in PublicKeyCredential.prototype` — but extensions are never

examples/ed25519-encrypted-keystore-demo/src/lib/WebAuthnTodo.svelte

@@ -64,6 +64,11 @@
     hmacSecret: false,
     known: false,
   };
+  // What the authenticator agreed to during registration, which is a different
+  // question from what the browser can negotiate. Null until a credential
+  // exists. A platform authenticator commonly answers yes to PRF and no to
+  // hmac-secret on a browser that advertises both.
+  let credentialSupport = null;
   let useWorkerKeystore = false;
   let workerAvailable = false;
   let workerClient = null;
@@ -148,21 +153,79 @@
       };
     }
 
-    await initializeWebAuthn();
+    // Client capabilities first, then the credential. The order matters:
+    // initializeWebAuthn() loads a stored credential and lets its recorded
+    // answer refine the choice, and checkEncryptionSupport() picks a method
+    // from the browser's view alone — running it second would undo that.
     await checkEncryptionSupport();
+    await initializeWebAuthn();
   });
 
   onDestroy(() => {
     resetWorkerClient();
   });
 
-  // Three states, not two: an extension we know is missing reads differently
-  // from one the browser would not tell us about.
-  function supportLabel(flag) {
-    if (flag) return '✅ Supported';
+  // The method values and the support-object keys do not spell the extension
+  // the same way; keep the translation in one place rather than at each use.
+  const SUPPORT_KEY = {
+    prf: 'prf',
+    largeBlob: 'largeBlob',
+    'hmac-secret': 'hmacSecret',
+  };
+  const METHOD_PREFERENCE = ['prf', 'largeBlob', 'hmac-secret'];
+
+  // Four states. Once a credential exists its answer overrules the browser's:
+  // the browser saying yes only means it would pass the request along.
+  function supportLabel(name) {
+    if (credentialSupport) {
+      if (credentialSupport[name]) return '✅ Supported';
+      if (extensionSupport[name]) return '⚠️ Browser yes, this passkey no';
+      return '❌ Not supported';
+    }
+    if (extensionSupport[name]) return '✅ Supported';
     return extensionSupport.known ? '❌ Not supported' : '❓ Unknown';
   }
 
+  // May the method be offered at all? Before a credential exists we go by the
+  // browser and keep anything it cannot vouch for selectable. Afterwards the
+  // authenticator decides, because it is the one that has to deliver.
+  function methodAvailable(method) {
+    const name = SUPPORT_KEY[method];
+    if (credentialSupport) return credentialSupport[name] === true;
+    return !extensionSupport.known || extensionSupport[name] === true;
+  }
+
+  /**
+   * Adopt what the authenticator agreed to, and step off a method it refused.
+   *
+   * Without this the UI keeps promising a method the ceremony will not honour —
+   * which is how "hmac-secret ✅ Supported" ends in "No hmac-secret output from
+   * credential" (issue #9).
+   */
+  function applyCredentialSupport(support) {
+    if (!support) return;
+    credentialSupport = support;
+    console.log('Authenticator extension support:', support);
+
+    if (methodAvailable(encryptionMethod)) return;
+
+    const fallback = METHOD_PREFERENCE.find((method) =>
+      methodAvailable(method)
+    );
+
+    if (fallback) {
+      console.warn(
+        `Authenticator does not support ${encryptionMethod}; falling back to ${fallback}`
+      );
+      encryptionMethod = fallback;
+    } else {
+      console.warn(
+        'Authenticator supports none of the encryption extensions; keystore encryption disabled'
+      );
+      useEncryption = false;
+    }
+  }
+
   async function checkEncryptionSupport() {
     try {
       extensionSupport = await KeystoreEncryption.checkExtensionSupport();
@@ -211,6 +274,9 @@
       // Load stored credential
       credential = loadStoredCredential();
       if (credential) {
+        // Credentials registered before this was recorded carry no answer, so
+        // the browser's view stands until the next registration.
+        applyCredentialSupport(credential.extensionSupport);
         status = 'Credential found, ready to authenticate!';
       }
     } catch (error) {
@@ -376,6 +442,9 @@
         keystoreEncryptionMethod: encryptionMethod,
       });
 
+      // The ceremony has now answered what the browser could only guess at.
+      applyCredentialSupport(credential.extensionSupport);
+
       // Store credential for future use
       storeCredential(credential);
 
@@ -935,8 +1004,7 @@
                     type="radio"
                     bind:group={encryptionMethod}
                     value="prf"
-                    disabled={loading ||
-                      (extensionSupport.known && !extensionSupport.prf)}
+                    disabled={loading || !methodAvailable('prf')}
                     style="cursor: pointer;"
                   />
                   <span style="color: var(--cds-text-primary);">PRF</span>
@@ -953,8 +1021,7 @@
                     type="radio"
                     bind:group={encryptionMethod}
                     value="largeBlob"
-                    disabled={loading ||
-                      (extensionSupport.known && !extensionSupport.largeBlob)}
+                    disabled={loading || !methodAvailable('largeBlob')}
                     style="cursor: pointer;"
                   />
                   <span style="color: var(--cds-text-primary);">largeBlob</span>
@@ -971,8 +1038,7 @@
                     type="radio"
                     bind:group={encryptionMethod}
                     value="hmac-secret"
-                    disabled={loading ||
-                      (extensionSupport.known && !extensionSupport.hmacSecret)}
+                    disabled={loading || !methodAvailable('hmac-secret')}
                     style="cursor: pointer;"
                   />
                   <span style="color: var(--cds-text-primary);"

examples/ed25519-encrypted-keystore-demo/src/lib/libp2p.js

@@ -206,9 +206,15 @@ export async function setupOrbitDB(credential, options = {}) {
     didType: options.useKeystoreDID
       ? `${options.keystoreKeyType} (from keystore)`
       : 'P-256 (from WebAuthn)',
-    encrypted: options.encryptKeystore
-      ? `Yes (${options.encryptionMethod})`
-      : 'No',
+    // Deliberately worded as a request, not a result. This line used to read
+    // "Yes (largeBlob)" whether or not the authenticator had honoured
+    // largeBlob, which made a failed write look like a success in the console.
+    // The second field is what the authenticator actually agreed to, so a
+    // mismatch between the two is visible rather than hidden.
+    encryptionRequested: options.encryptKeystore
+      ? options.encryptionMethod
+      : 'none',
+    authenticatorSupports: credential?.extensionSupport ?? 'not recorded',
   });
 
   // Try to verify our identity is in the identities store

src/index.js

@@ -277,6 +277,7 @@ export {
   decryptWithAESGCM,
   addLargeBlobToCredentialOptions,
   addPRFToCredentialOptions,
+  writeSKToLargeBlob,
   retrieveSKFromLargeBlob,
   addHmacSecretToCredentialOptions,
   wrapSKWithPRF,

src/keystore/encryption.js

@@ -213,6 +213,67 @@ export function addPRFToCredentialOptions(
   };
 }
 
+/**
+ * Write the secret key into the credential's largeBlob.
+ *
+ * A blob can only be written during an assertion, never at registration — so
+ * this costs one extra WebAuthn prompt after the credential exists. That is
+ * why `addLargeBlobToCredentialOptions()` alone does not persist anything.
+ *
+ * Throws unless the authenticator reports `written: true`. Silence here would
+ * leave a keystore whose key exists only in memory: it works for the current
+ * session and can never be unlocked again, because
+ * {@link retrieveSKFromLargeBlob} would read a blob nobody wrote.
+ *
+ * @param {Uint8Array} credentialId - WebAuthn credential ID (raw bytes).
+ * @param {Uint8Array} sk - Secret key to store.
+ * @param {string} rpId - Relying party ID (domain).
+ * @returns {Promise<void>}
+ */
+export async function writeSKToLargeBlob(credentialId, sk, rpId) {
+  log('Writing secret key to largeBlob');
+
+  let assertion;
+  try {
+    assertion = await navigator.credentials.get(
+      buildCredentialRequestOptions({
+        challenge: crypto.getRandomValues(new Uint8Array(32)),
+        credentialId,
+        rpId,
+        userVerification: 'required',
+        extensions: {
+          largeBlob: {
+            write: sk,
+          },
+        },
+      })
+    );
+  } catch (error) {
+    log.error('largeBlob write assertion failed: %s', error.message);
+    throw new KeystoreEncryptionError(
+      `Failed to write secret key to largeBlob: ${error.message}`,
+      { cause: error }
+    );
+  }
+
+  // The authenticator answers whether it took the blob. Accepting the
+  // assertion without reading this is how a write that never happened passes
+  // for a success.
+  const written = assertion?.getClientExtensionResults?.()?.largeBlob?.written;
+
+  if (written !== true) {
+    log.error(
+      'Authenticator did not write the largeBlob (written: %o)',
+      written
+    );
+    throw new KeystoreEncryptionError(
+      'Authenticator did not store the secret key in largeBlob'
+    );
+  }
+
+  log('Secret key written to largeBlob');
+}
+
 /**
  * Retrieve secret key from WebAuthn credential using largeBlob extension
  * @param {Uint8Array} credentialId - WebAuthn credential ID
@@ -734,6 +795,7 @@ export default {
   encryptWithAESGCM,
   decryptWithAESGCM,
   addLargeBlobToCredentialOptions,
+  writeSKToLargeBlob,
   retrieveSKFromLargeBlob,
   addHmacSecretToCredentialOptions,
   wrapSKWithHmacSecret,

src/keystore/provider.js

@@ -408,15 +408,24 @@ export class OrbitDBWebAuthnIdentityProvider {
       } else if (
         this.keystoreEncryptionMethod === KEYSTORE_ENCRYPTION_METHODS.LARGE_BLOB
       ) {
-        // For largeBlob, we need to store SK during next authentication
-        // Store it temporarily for wrapping
+        // Write the key into the authenticator before recording anything.
+        // This used to be `secretKey: sk, // Will be moved to largeBlob` — and
+        // nothing ever moved it: the field was dropped at serialization, so
+        // the key survived only in memory and the keystore could never be
+        // unlocked again. Throws if the authenticator refuses, which is better
+        // than persisting a record that cannot be opened.
+        await KeystoreEncryption.writeSKToLargeBlob(
+          this.credential.rawCredentialId,
+          sk,
+          window.location.hostname
+        );
+
         encryptedData = {
           ciphertext,
           iv,
           credentialId: this.credential.credentialId,
           publicKey: publicKeyBytes,
           keyType,
-          secretKey: sk, // Will be moved to largeBlob
           encryptionMethod: KEYSTORE_ENCRYPTION_METHODS.LARGE_BLOB,
         };
       } else if (

src/webauthn/provider.js

@@ -228,6 +228,17 @@ export class WebAuthnDIDProvider {
         hasY: !!publicKey.y,
       });
 
+      // What the authenticator actually agreed to, as opposed to what the
+      // browser said it could negotiate. Only the ceremony settles this, and
+      // the raw PublicKeyCredential does not survive past this function — so
+      // read it here or lose the answer. Callers that offer a choice of
+      // keystore encryption method need it: a client can support largeBlob
+      // while the key in front of it does not.
+      const extensionSupport =
+        KeystoreEncryption.extensionSupportFromCredential(credential);
+
+      webauthnLog('Authenticator extension support: %o', extensionSupport);
+
       const result = {
         credentialId: WebAuthnDIDProvider.arrayBufferToBase64url(
           credential.rawId
@@ -240,6 +251,7 @@ export class WebAuthnDIDProvider {
           credential.response.attestationObject
         ),
         prfInput: prfInput || undefined,
+        extensionSupport,
       };
 
       webauthnLog('Credential creation completed successfully');