Describe the issue
V14.0.0 will include support for verifying responses from passkeys ML-DSA 44, 65, and 87 for their public key algorithms. I want to go one step further with this release and include ML-DSA 44 in the list of default pub key algorithms. Almost nothing on the market will actually use the algorithm so it'll be pretty harmless right now. And when PQC solutions start coming onto the market then RPs won't have to change anything to start leveraging them.
Based on conversations I've had with others in the cryptography space, it sounds like ML-DSA 44 will be an acceptable default for most "consumer" RPs. And of course RPs using SimpleWebAuthn that need to request ML-DSA 65 or 87 public keys can still manually set that up with the current features of the registration-related methods.
Describe the issue
V14.0.0 will include support for verifying responses from passkeys ML-DSA 44, 65, and 87 for their public key algorithms. I want to go one step further with this release and include ML-DSA 44 in the list of default pub key algorithms. Almost nothing on the market will actually use the algorithm so it'll be pretty harmless right now. And when PQC solutions start coming onto the market then RPs won't have to change anything to start leveraging them.
Based on conversations I've had with others in the cryptography space, it sounds like ML-DSA 44 will be an acceptable default for most "consumer" RPs. And of course RPs using SimpleWebAuthn that need to request ML-DSA 65 or 87 public keys can still manually set that up with the current features of the registration-related methods.