feat(webauthn): emit SubjectPublicKeyInfo from getPublicKey() (#230)

WebAuthn L3 §5.2.1.1 says
`AuthenticatorAttestationResponse.getPublicKey()` returns DER-encoded
SubjectPublicKeyInfo for credentials using ES256, EdDSA Ed25519 and
RS256, and null for any algorithm the user agent does not implement.
libwebauthn was emitting raw COSE bytes there instead, which relying
parties could not feed into `SubtleCrypto` or standard X.509 parsers.

A new converter produces SPKI for the WebAuthn L3 floor plus ESP256,
which is equivalent to ES256 per RFC 9864. Algorithms outside the
supported set return null per spec. Malformed keys for understood
algorithms surface as an error.

The conversion uses the `spki` and `der` crates from RustCrypto, both
already in the transitive dependency tree via `p256`, so no new external
runtime crates land. Adding new algorithm support later is a small
per-algorithm addition.

Stacked on top of #229.

Author: AlfioEmanueleFresta

Cargo.lock

@@ -69,6 +69,8 @@ rand = "0.8.5"
 p256 = { version = "0.13.2", features = ["ecdh", "arithmetic", "serde"] }
 heapless = "0.7"
 cosey = "0.3.2"
+spki = { version = "0.7", default-features = false, features = ["alloc"] }
+der = { version = "0.7", default-features = false, features = ["alloc", "derive", "oid"] }
 aes = "0.8.2"
 hmac = "0.12.1"
 cbc = { version = "0.1", features = ["alloc"] }

libwebauthn/Cargo.toml

@@ -91,9 +91,12 @@ impl WebAuthnIDLResponse for MakeCredentialResponse {
                 .map_err(|e| ResponseSerializationError::PublicKeyError(e.to_string()))?,
         );
 
-        let public_key = Some(Base64UrlString::from(
-            attested.credential_public_key.clone(),
-        ));
+        // SubjectPublicKeyInfo per WebAuthn L3 §5.2.1.1. `to_spki` returns
+        // `Ok(None)` for algorithms libwebauthn does not implement, which
+        // surfaces as `getPublicKey() === null` to the relying party.
+        let public_key = cose::to_spki(&attested.credential_public_key)
+            .map_err(|e| ResponseSerializationError::PublicKeyError(e.to_string()))?
+            .map(Base64UrlString::from);
 
         // Build attestation object (CBOR map with authData, fmt, attStmt)
         let attestation_object_bytes = self.build_attestation_object(&authenticator_data_bytes)?;
@@ -1161,6 +1164,35 @@ mod tests {
         assert!(model.response.transports.is_empty());
     }
 
+    #[test]
+    fn test_response_emits_spki_for_es256() {
+        // The test fixture builds an ES256 P-256 credential, so getPublicKey()
+        // must return DER-encoded SubjectPublicKeyInfo per WebAuthn L3 §5.2.1.1.
+        // The SPKI for ES256 starts with the SEQUENCE / SEQUENCE / OID prefix
+        // 30 59 30 13 06 07 2A 86 48 CE 3D 02 01 (id-ecPublicKey), followed
+        // by the secp256r1 OID and the uncompressed point.
+        let response = create_test_response();
+        let request = create_test_request();
+        let model = response.to_idl_model(&request).unwrap();
+
+        let public_key_bytes = model
+            .response
+            .public_key
+            .expect("ES256 must produce SPKI")
+            .0;
+        assert_eq!(public_key_bytes.len(), 91, "ES256 SPKI is 91 bytes");
+        // SEQUENCE tag + length, then nested SEQUENCE for AlgorithmIdentifier.
+        assert_eq!(&public_key_bytes[..2], &[0x30, 0x59]);
+        // id-ecPublicKey OID: 1.2.840.10045.2.1
+        let id_ec_public_key = [0x06, 0x07, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01];
+        assert!(
+            public_key_bytes
+                .windows(id_ec_public_key.len())
+                .any(|w| w == id_ec_public_key),
+            "SPKI must contain id-ecPublicKey OID"
+        );
+    }
+
     #[test]
     fn test_response_attestation_object_format() {
         let response = create_test_response();