fix: actually write the secret key into largeBlob

The keystore record carried:

    secretKey: sk, // Will be moved to largeBlob

Nothing ever moved it. That was the only occurrence of the field in all of
src/, and storeEncryptedKeystore() serialises a fixed whitelist which does not
include it — so the key was dropped at persist time. Choosing largeBlob
produced a keystore that worked for exactly the session that created it and
could never be unlocked afterwards: the next load called
retrieveSKFromLargeBlob(), read a blob nobody had written, and failed with "No
largeBlob data found in credential".

Worth stating plainly, because the first suspicion was worse: the key never
reached disk in the clear. The whitelist that dropped it also kept it out of
localStorage. The feature was inert, not leaky.

writeSKToLargeBlob() now performs the assertion that stores it — a blob can
only be written during an assertion, never at registration, which is why
addLargeBlobToCredentialOptions() alone persists nothing and why this costs one
extra prompt. It throws unless the authenticator reports `written: true`.
Failing there beats persisting a record that cannot be opened, and it is the
same lesson as the rest of this branch: read what happened, do not trust what
was requested.

Tests: 5 new cases covering confirmed write, declined write, absent result, a
truthy-but-not-true value, and a refused assertion. 63 node tests pass.

One wrinkle worth recording: Node defines globalThis.navigator as a getter-only
accessor, so the obvious `globalThis.navigator = stub` throws
TypeError: Cannot set property navigator. The stub swaps the property
descriptor and restores the original afterwards.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: NiKrause

CHANGELOG.md

@@ -4,6 +4,23 @@
 
 ### Fixed
 
+- Actually write the secret key into `largeBlob`. The keystore record carried
+  `secretKey: sk, // Will be moved to largeBlob` — and nothing ever moved it.
+  That was the only occurrence of the field in `src/`, and
+  `storeEncryptedKeystore()` serialises a fixed whitelist that does not include
+  it, so the key was dropped at persist time. Choosing largeBlob therefore
+  produced a keystore that worked for the session that created it and could
+  never be unlocked again: on the next load `retrieveSKFromLargeBlob()` read a
+  blob nobody had written and failed with "No largeBlob data found in
+  credential".
+
+  The key never reached disk in the clear — the whitelist saw to that — but the
+  feature was inert. `writeSKToLargeBlob()` now performs the assertion that
+  stores it (a blob can only be written during an assertion, never at
+  registration, so this costs one extra prompt) and **throws unless the
+  authenticator reports `written: true`**. Failing there beats persisting a
+  record that cannot be opened.
+
 - Carry the authenticator's own answer on the credential. `createCredential()`
   now records `extensionSupport` — what the authenticator agreed to during the
   ceremony — because the raw `PublicKeyCredential` does not survive past that

src/index.js

@@ -277,6 +277,7 @@ export {
   decryptWithAESGCM,
   addLargeBlobToCredentialOptions,
   addPRFToCredentialOptions,
+  writeSKToLargeBlob,
   retrieveSKFromLargeBlob,
   addHmacSecretToCredentialOptions,
   wrapSKWithPRF,

src/keystore/encryption.js

@@ -213,6 +213,67 @@ export function addPRFToCredentialOptions(
   };
 }
 
+/**
+ * Write the secret key into the credential's largeBlob.
+ *
+ * A blob can only be written during an assertion, never at registration — so
+ * this costs one extra WebAuthn prompt after the credential exists. That is
+ * why `addLargeBlobToCredentialOptions()` alone does not persist anything.
+ *
+ * Throws unless the authenticator reports `written: true`. Silence here would
+ * leave a keystore whose key exists only in memory: it works for the current
+ * session and can never be unlocked again, because
+ * {@link retrieveSKFromLargeBlob} would read a blob nobody wrote.
+ *
+ * @param {Uint8Array} credentialId - WebAuthn credential ID (raw bytes).
+ * @param {Uint8Array} sk - Secret key to store.
+ * @param {string} rpId - Relying party ID (domain).
+ * @returns {Promise<void>}
+ */
+export async function writeSKToLargeBlob(credentialId, sk, rpId) {
+  log('Writing secret key to largeBlob');
+
+  let assertion;
+  try {
+    assertion = await navigator.credentials.get(
+      buildCredentialRequestOptions({
+        challenge: crypto.getRandomValues(new Uint8Array(32)),
+        credentialId,
+        rpId,
+        userVerification: 'required',
+        extensions: {
+          largeBlob: {
+            write: sk,
+          },
+        },
+      })
+    );
+  } catch (error) {
+    log.error('largeBlob write assertion failed: %s', error.message);
+    throw new KeystoreEncryptionError(
+      `Failed to write secret key to largeBlob: ${error.message}`,
+      { cause: error }
+    );
+  }
+
+  // The authenticator answers whether it took the blob. Accepting the
+  // assertion without reading this is how a write that never happened passes
+  // for a success.
+  const written = assertion?.getClientExtensionResults?.()?.largeBlob?.written;
+
+  if (written !== true) {
+    log.error(
+      'Authenticator did not write the largeBlob (written: %o)',
+      written
+    );
+    throw new KeystoreEncryptionError(
+      'Authenticator did not store the secret key in largeBlob'
+    );
+  }
+
+  log('Secret key written to largeBlob');
+}
+
 /**
  * Retrieve secret key from WebAuthn credential using largeBlob extension
  * @param {Uint8Array} credentialId - WebAuthn credential ID
@@ -734,6 +795,7 @@ export default {
   encryptWithAESGCM,
   decryptWithAESGCM,
   addLargeBlobToCredentialOptions,
+  writeSKToLargeBlob,
   retrieveSKFromLargeBlob,
   addHmacSecretToCredentialOptions,
   wrapSKWithHmacSecret,

src/keystore/provider.js

@@ -408,15 +408,24 @@ export class OrbitDBWebAuthnIdentityProvider {
       } else if (
         this.keystoreEncryptionMethod === KEYSTORE_ENCRYPTION_METHODS.LARGE_BLOB
       ) {
-        // For largeBlob, we need to store SK during next authentication
-        // Store it temporarily for wrapping
+        // Write the key into the authenticator before recording anything.
+        // This used to be `secretKey: sk, // Will be moved to largeBlob` — and
+        // nothing ever moved it: the field was dropped at serialization, so
+        // the key survived only in memory and the keystore could never be
+        // unlocked again. Throws if the authenticator refuses, which is better
+        // than persisting a record that cannot be opened.
+        await KeystoreEncryption.writeSKToLargeBlob(
+          this.credential.rawCredentialId,
+          sk,
+          window.location.hostname
+        );
+
         encryptedData = {
           ciphertext,
           iv,
           credentialId: this.credential.credentialId,
           publicKey: publicKeyBytes,
           keyType,
-          secretKey: sk, // Will be moved to largeBlob
           encryptionMethod: KEYSTORE_ENCRYPTION_METHODS.LARGE_BLOB,
         };
       } else if (

tests/webauthn-extension-support.test.js

@@ -14,8 +14,46 @@ import { test, expect } from '@playwright/test';
 import {
   checkExtensionSupport,
   extensionSupportFromCredential,
+  writeSKToLargeBlob,
 } from '../src/keystore/encryption.js';
 
+const CREDENTIAL_ID = new Uint8Array(32).fill(0x11);
+const SECRET_KEY = new Uint8Array(32).fill(0x22);
+
+// Node defines globalThis.navigator as a getter-only accessor, so a plain
+// assignment throws. Swap the property descriptor and put the original back.
+const ORIGINAL_NAVIGATOR = Object.getOwnPropertyDescriptor(
+  globalThis,
+  'navigator'
+);
+
+/**
+ * Stand in for navigator.credentials.get, answering with whatever the
+ * authenticator is meant to have reported back.
+ */
+function installCredentialsGet(extensionResults, { rejectWith } = {}) {
+  Object.defineProperty(globalThis, 'navigator', {
+    configurable: true,
+    writable: true,
+    value: {
+      credentials: {
+        get: async () => {
+          if (rejectWith) throw rejectWith;
+          return { getClientExtensionResults: () => extensionResults };
+        },
+      },
+    },
+  });
+}
+
+function restoreNavigator() {
+  if (ORIGINAL_NAVIGATOR) {
+    Object.defineProperty(globalThis, 'navigator', ORIGINAL_NAVIGATOR);
+  } else {
+    delete globalThis.navigator;
+  }
+}
+
 /**
  * The real interface: extensions do not appear here, only these six members.
  */
@@ -237,3 +275,51 @@ test.describe('per-credential extension support', () => {
     });
   });
 });
+
+test.describe('writing the secret key to largeBlob', () => {
+  test.afterEach(() => {
+    restoreNavigator();
+  });
+
+  test('resolves when the authenticator confirms the write', async () => {
+    installCredentialsGet({ largeBlob: { written: true } });
+
+    await expect(
+      writeSKToLargeBlob(CREDENTIAL_ID, SECRET_KEY, 'example.com')
+    ).resolves.toBeUndefined();
+  });
+
+  test('throws when the authenticator declines the write', async () => {
+    // The regression this exists for. Ignoring `written` leaves a keystore
+    // whose key lives only in memory: usable this session, unopenable after.
+    installCredentialsGet({ largeBlob: { written: false } });
+
+    await expect(
+      writeSKToLargeBlob(CREDENTIAL_ID, SECRET_KEY, 'example.com')
+    ).rejects.toThrow(/did not store the secret key/i);
+  });
+
+  test('throws when there is no largeBlob result at all', async () => {
+    installCredentialsGet({});
+
+    await expect(
+      writeSKToLargeBlob(CREDENTIAL_ID, SECRET_KEY, 'example.com')
+    ).rejects.toThrow(/did not store the secret key/i);
+  });
+
+  test('does not accept a truthy non-true value as a write', async () => {
+    installCredentialsGet({ largeBlob: { written: 'yes' } });
+
+    await expect(
+      writeSKToLargeBlob(CREDENTIAL_ID, SECRET_KEY, 'example.com')
+    ).rejects.toThrow(/did not store the secret key/i);
+  });
+
+  test('surfaces a refused or failed assertion', async () => {
+    installCredentialsGet(null, { rejectWith: new Error('user cancelled') });
+
+    await expect(
+      writeSKToLargeBlob(CREDENTIAL_ID, SECRET_KEY, 'example.com')
+    ).rejects.toThrow(/Failed to write secret key to largeBlob/i);
+  });
+});