open-passkey

Hybrid Post-Quantum Support

open-passkey implements ML-DSA-65-ES256 hybrid composite signatures (draft-ietf-jose-pq-composite-sigs), combining a NIST-standardized post-quantum algorithm with classical ECDSA in a single credential. Both signature components must verify independently, if either is broken, the other still protects you.

How it works: During registration, the server advertises preferred algorithms in pubKeyCredParams. During authentication, the core libraries read the COSE alg field from the stored credential and dispatch to the correct verifier automatically. ES256, ML-DSA-65, or the composite ML-DSA-65-ES256 path. No application code changes needed.

Architecture

open-passkey separates concerns into two layers. The core protocol is pure WebAuthn/FIDO2 verification logic with no framework dependencies. Framework bindings are thin adapters that wire the core into specific frameworks. Adding passkey support to a new framework only requires writing an adapter, not reimplementing cryptography.

open-passkey/
├── spec/vectors/        # Shared JSON test vectors
├── packages/
│   ├── core-go/         # Go core protocol
│   ├── server-go/       # Go HTTP bindings
│   ├── core-ts/         # TypeScript core protocol
│   └── angular/         # Angular components
└── tools/vecgen/        # Test vector generation

Code Examples

import "github.com/locke-inc/open-passkey/packages/server-go"

p, _ := passkey.New(passkey.Config{
    RPID:            "example.com",
    RPDisplayName:   "My App",
    Origin:          "https://example.com",
    ChallengeStore:  passkey.NewMemoryChallengeStore(),
    CredentialStore: myDBCredentialStore,
})

mux := http.NewServeMux()
mux.HandleFunc("POST /passkey/register/begin",  p.BeginRegistration)
mux.HandleFunc("POST /passkey/register/finish", p.FinishRegistration)
mux.HandleFunc("POST /passkey/login/begin",     p.BeginAuthentication)
mux.HandleFunc("POST /passkey/login/finish",    p.FinishAuthentication)

import "github.com/locke-inc/open-passkey/packages/core-go/webauthn"

// Registration
result, err := webauthn.VerifyRegistration(webauthn.RegistrationInput{
    RPID:              "example.com",
    ExpectedChallenge: challengeB64URL,
    ExpectedOrigin:    "https://example.com",
    ClientDataJSON:    credential.Response.ClientDataJSON,
    AttestationObject: credential.Response.AttestationObject,
})
// result.CredentialID, result.PublicKeyCOSE -- store for future auth

// Authentication: dispatches to ES256, ML-DSA-65, or ML-DSA-65-ES256
result, err := webauthn.VerifyAuthentication(webauthn.AuthenticationInput{
    RPID:                "example.com",
    ExpectedChallenge:   challengeB64URL,
    ExpectedOrigin:      "https://example.com",
    StoredPublicKeyCOSE: storedKeyBytes,
    StoredSignCount:     storedCount,
    ClientDataJSON:      credential.Response.ClientDataJSON,
    AuthenticatorData:   credential.Response.AuthenticatorData,
    Signature:           credential.Response.Signature,
})

webauthn.AlgES256                  // -7  (ECDSA P-256)
webauthn.AlgMLDSA65                // -49 (ML-DSA-65 / Dilithium3)
webauthn.AlgCompositeMLDSA65ES256  // -52 (hybrid composite)

import {
  verifyRegistration,
  verifyAuthentication,
  COSE_ALG_ES256,                    // -7
  COSE_ALG_MLDSA65,                  // -49
  COSE_ALG_COMPOSITE_MLDSA65_ES256,  // -52
} from "@open-passkey/core";

import { providePasskey } from "@open-passkey/angular";

export const appConfig = {
  providers: [
    provideHttpClient(),
    providePasskey({ baseUrl: "/passkey" }),
  ],
};

<!-- Registration -->
<passkey-register [userId]="userId" [username]="username"
                  (registered)="onRegistered($event)"
                  (error)="onError($event)" #reg>
  <button (click)="reg.register()" [disabled]="reg.loading()">
    Register Passkey
  </button>
</passkey-register>

<!-- Authentication -->
<passkey-login [userId]="userId"
               (authenticated)="onAuthenticated($event)"
               (error)="onError($event)" #login>
  <button (click)="login.login()" [disabled]="login.loading()">
    Sign in with Passkey
  </button>
</passkey-login>

import { PasskeyService } from "@open-passkey/angular";

@Component({ ... })
class MyComponent {
  private passkey = inject(PasskeyService);

  register() {
    this.passkey.register(userId, username).subscribe(result => { ... });
  }
  login() {
    this.passkey.authenticate(userId).subscribe(result => { ... });
  }
}

Packages

Cross-Language Testing

Every implementation runs against the same JSON test vectors in spec/vectors/. These contain real WebAuthn payloads generated by a software authenticator, covering both happy paths and failure modes. When a bug is found in any language, a new vector is added and all implementations gain the test case automatically.

# Go core
cd packages/core-go && go test ./... -v

# Go server
cd packages/server-go && go test ./... -v

# TypeScript core
cd packages/core-ts && npm test

# Angular
cd packages/angular && npm test

Roadmap

Contributing

Strict TDD. To add a new test case:

1. Add a vector to spec/vectors/ (or update tools/vecgen/main.go and regenerate)
2. Run tests in all languages, the new vector should fail
3. Implement the fix in each language
4. All vectors pass = done

New language implementation: Create packages/core-{lang}/, write a test runner that loads spec/vectors/*.json, implement until all 16 vectors pass.