Skip to main content
P
passkeyin
August 8, 2025
Question

Passkey algorithm support

  • August 8, 2025
  • 1 reply
  • 135 views

Recently I began a passkey integration and I'm using 1password to test things out.

There are a great deal of passkey algorithms that exist: https://www.iana.org/assignments/cose/cose.xhtml#algorithms

Unfortunately it seems like if I remove all the "Recommended: No" and "Recommended: Deprecated" ones, I am unable to get 1password to generate a passkey. It gives me a somewhat opaque "1password encountered a problem" in the passkey dialogue after I click Save, and it seems to fall back to the browser which prompts me for a security key.

I see this in the console log:

PortOpener: passkey-save-prompt/XXXXXX received error: "create-passkey-failed"

The algorithms I chose in order to be more secure based on the recommendations on that page and what I'm able to support in my server:

  • PS384
  • PS512
  • RS256
  • RS384
  • RS512

The "deprecated" algorithm I added to make the error go away, and allow 1password to correctly function:

  • ES256

Is there anywhere to find the full list of passkey algorithms 1password supports so I can try to come up with a good list to use on the server-side? Ideally it wouldn't contain deprecated ones.

    1 reply

    1P_Dave
    1P_Dave
    1Password Employee
    August 11, 2025

    Hello @passkeyin! 👋

    Thanks for the question! I want to start by clarifying that ES256 has not been deprecated for passkey use due to weaknesses. The WebAuthn spec continues to include ES256 (alg: -7) as a valid option in pubKeyCredParams: 

    The following COSEAlgorithmIdentifier values are NOT RECOMMENDED in pubKeyCredParams: -9 (ESP256); use -7 (ES256) instead or in addition.

    The ‘deprecated’ label in the IANA registry refers only to the numeric identifier, not the reliability or security of the algorithm, which remains strong and is widely supported by both websites and authenticator apps. Crucially, if you'd like your passkey implementation to also work with security keys shipped before 2025 or with Windows 10, not just authenticator apps like 1Password, you'll need to include support for ES256 (-7). New identifiers for algorithms like ESP256 (-9) are being proposed here:: draft-ietf-jose-fully-specified-algorithms

    At the moment, 1Password supports ES256 for passkey use. I'll forward your request that other algorithms be supported to our team so that they can look into this for the future. 

    -Dave 

    #39581

      Terms & ConditionsAccessibility statement

      ©2026 1Password. All rights reserved.
      4711 Yonge St, 10th Floor, Toronto Ontario, M2N 6K8, Canada