# Unknown COSE algorithm encountered. alg: -257

**URL:** https://meta.discourse.org/t/unknown-cose-algorithm-encountered-alg-257/180104
**Category:** Support
**Created:** [February 17, 2021, 9:05pm UTC](https://meta.discourse.org/t/unknown-cose-algorithm-encountered-alg-257/180104 "2021-02-17T21:05:58Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![SystemZ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/systemz/32/88354_2.png) [@SystemZ](https://meta.discourse.org/u/SystemZ)
#### Post date: [February 17, 2021, 9:05pm UTC](https://meta.discourse.org/t/unknown-cose-algorithm-encountered-alg-257/180104/1 "2021-02-17T21:05:58Z")

</div>

Hi,

One of my users can’t login with 2FA using hardware key.

After pressing button on key during login, Windows 10 is asking for a PIN.  
After entering PIN he is receiving error “The algorithm used for the security key is not recognized.”. I checked, it’s i18n key `webauthn.validation.unknown_cose_algorithm_error`.

Server logs this as an error:

```plaintext
Unknown COSE algorithm encountered. alg: -257. user_id: <redacted>. params: <ActionController::Parameters {"signature"=>"<redacted>", "clientData"=>"<redacted>", "authenticatorData"=>"<redacted>", "credentialId"=>"<redacted>"} permitted: false>

```

Quick google search only found this:  
[https://review.discourse.org/t/fix-catch-error-when-unknown-cose-algorithm-is-supplied-for-security-key-8649/8074](https://review.discourse.org/t/fix-catch-error-when-unknown-cose-algorithm-is-supplied-for-security-key-8649/8074)

So probably it need to be implemented but strangely somehow user managed to set it on account?  
Not sure if I can fix it from forum’s admin side without code change.

I’m using recommended, standalone Docker install with version `2.7.0.beta3`. I rebuilt forum and updated it less than 1h before creating this thread.

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [February 18, 2021, 12:48am UTC](https://meta.discourse.org/t/unknown-cose-algorithm-encountered-alg-257/180104/2 "2021-02-18T00:48:57Z")

</div>

That’s strange. Can they login with 2FA and this hardware key on other webapps? Any ideas @dan?

---

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [February 18, 2021, 12:52am UTC](https://meta.discourse.org/t/unknown-cose-algorithm-encountered-alg-257/180104/3 "2021-02-18T00:52:43Z")

</div>

Can you share the security key model and browser version?

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [February 18, 2021, 4:59am UTC](https://meta.discourse.org/t/unknown-cose-algorithm-encountered-alg-257/180104/4 "2021-02-18T04:59:53Z")

</div>

Will be interesting to see which algorithm is missing from:

> **[cose-ruby/lib/cose/algorithm at master · cedarcode/cose-ruby](https://github.com/cedarcode/cose-ruby/tree/master/lib/cose/algorithm)**
>
> master/lib/cose/algorithm

I am guessing this one: [Support EdDSA · Issue #48 · cedarcode/cose-ruby · GitHub](https://github.com/cedarcode/cose-ruby/issues/48) EdDSA.

If we have the model and OS of the dev.

Maybe it is this thing? [https://blockchain2fa.io/](https://blockchain2fa.io/)

I guess you can use blockchains for anything.

---

<div class="post-metadata">

### Author: ![dan](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/dan/32/101549_2.png) [@dan](https://meta.discourse.org/u/dan)
#### Post date: [February 18, 2021, 11:00am UTC](https://meta.discourse.org/t/unknown-cose-algorithm-encountered-alg-257/180104/5 "2021-02-18T11:00:16Z")

</div>

This is a limitation of [cose-ruby](https://github.com/cedarcode/cose-ruby) library we use as @sam pointed out. It supports only these algorithms:

> <https://github.com/cedarcode/cose-ruby/blob/master/lib/cose/algorithm.rb#L29-L39>

According to the error message, that security key is using algorithm “-257” which stands for [RS256](https://www.iana.org/assignments/cose/cose.xhtml#algorithms) and is not recommended. That is probably the reason why the library does not implement it.

What device are you trying to use for authentication?