Clarity 4 Proposal: New builtins for vital ecosystem projects

friedger · September 4, 2025, 2:52pm

Can we add webauthn support? Or is it too late

Add Native P-256 (secp256r1) Signature Verification to Clarity for WebAuthn Support

opened 08:25PM - 19 Feb 25 UTC

clarity-4-candidate new-builtin

**Title:** Add Native P-256 (secp256r1) Signature Verification to Clarity for …WebAuthn Support --- **Summary** I’m building a non-custodial wallet using WebAuthn (passkeys/biometric authentication) and have encountered a major compatibility obstacle: - **WebAuthn** uses **P-256 (secp256r1)** for signatures - **Clarity** only supports `secp256k1-verify` Because Clarity cannot directly verify P-256 signatures, I must resort to complex workarounds that diminish security and user experience. --- **Current Workaround** 1. Store an encrypted secp256k1 key in the user’s browser storage. 2. Use WebAuthn to decrypt that key. 3. Sign using secp256k1. 4. Finally, verify in the contract with `secp256k1-verify`. This introduces extra complexity, additional steps, and more potential attack surfaces. Ideally, WebAuthn keys should remain in the device’s secure enclave without handling alternative keys or manual encryption/decryption logic. --- **Proposed Solution** Add **native P-256 signature verification** to Clarity. This would let developers: 1. Keep the WebAuthn key (P-256) in the secure enclave. 2. Store only the corresponding public key on-chain. 3. Sign transactions/messages directly with WebAuthn. 4. Verify those signatures in Clarity using a new `p256-verify` or similar function. --- **Questions** 1. **Feasibility**: Is adding P-256 verification (secp256r1) to Clarity possible within the current architecture? 2. **Code References**: Could someone point me toward the relevant code (e.g., the secp256k1 implementation) so I can explore how to contribute this feature? https://github.com/stacks-network/clarity-wasm/blob/main/clar2wasm/src/words/secp256k1.rs 3. **Contribution Process**: What is the formal process for proposing and implementing changes to the Clarity language? --- **Real-World Impact & Mass Adoption** Enabling WebAuthn natively in Clarity would significantly lower the barrier for mainstream users: - A user can buy sBTC or other assets with a credit card. - Assets land in a contract wallet. - Users access/control assets with their device’s biometric (Touch ID / Face ID), no seed phrases needed. - The experience feels like Apple Pay or a banking app, but remains fully non-custodial. - Security is backed by hardware enclaves rather than browser storage or additional keys. This approach could greatly enhance Stacks’ adoption by reducing user friction—especially for newcomers wary of traditional crypto key management. --- **Conclusion** Supporting P-256 in Clarity would remove complex, less-secure workarounds and enable truly seamless, non-custodial WebAuthn wallets. Any guidance, pointers, or thoughts on adding this functionality would be greatly appreciated. Thank you in advance for your feedback and for considering this feature!