wolfCOSE has added new COSE_Key and CBOR APIs that make it safer and easier to build embedded credential, attestation, WebAuthn, and provisioning systems. The update preserves wolfCOSE’s lightweight, allocation-free design while addressing practical integration gaps around key publication, fixed-size buffers, and nested protocol data.
What is Included
- Public-only COSE_Key encoding that prevents private scalars, seeds, or RSA private components from being included when publishing a key.
- Exact encoded-size queries for sizing buffers and rejecting oversized keys before serialization.
- Raw EC2 coordinate encoding for applications that already hold public-point data.
- Key metadata inspection before decoding, including key type, algorithm, curve, and key ID.
- CBOR context initializers, nested-item skipping with zero-copy byte ranges, and support for both integer and text labels.
- Strict RFC 8949 preferred-serialization checks to help prevent alternate encodings from undermining signature or MAC verification.
These capabilities support WebAuthn and CTAP2 authenticators, device attestation, firmware-signing metadata, secure provisioning, key registries, and hardware-backed signing interfaces.
Daniele Lacamera’s Fidelio project is an early example of the use case. It turns a Raspberry Pi Pico into a FIDO2/U2F security key, using wolfCOSE for WebAuthn credentials and wolfCrypt PUF reconstruction so the master key is not stored in flash. Credential metadata is protected with authenticated encryption, demonstrating how compact hardware can provide a practical, unclonable-by-design second factor.
The new APIs are under review in wolfCOSE PR #66.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now