From 15dad79c988638a1f1a89c2d3a0defed9195ef69 Mon Sep 17 00:00:00 2001 From: Adam Langley Date: Wed, 15 Nov 2023 11:56:26 -0800 Subject: [PATCH 1/3] Drop assertion-time attestation. We don't believe that there's a use for it now. The cases that wish to plumb this sort of data back can do so via other means. --- index.bs | 92 ++------------------------------------------------------ 1 file changed, 2 insertions(+), 90 deletions(-) diff --git a/index.bs b/index.bs index 564e2529d..834f49620 100644 --- a/index.bs +++ b/index.bs @@ -2513,10 +2513,6 @@ When this method is invoked, the user agent MUST execute the following algorithm :: If the [=authenticator=] returned a [=user handle=], set the value of [=userHandleResult=] to be the bytes of the returned [=user handle=]. Otherwise, set the value of [=userHandleResult=] to null. - : assertionAttestation - :: If the [=authenticator=] returned an [=attestation=], set the value of [=assertionAttestation=] to be the bytes of - the [=attestation statement=]. Otherwise set it to null. - : clientExtensionResults :: whose value is an {{AuthenticationExtensionsClientOutputs}} object containing [=extension identifier=] → [=client extension output=] entries. The entries are created by running each extension's @@ -2561,12 +2557,6 @@ When this method is invoked, the user agent MUST execute the following algorithm [=%ArrayBuffer%=], containing the bytes of |assertionCreationData|.[=assertionCreationData/userHandleResult=]. - : {{AuthenticatorAssertionResponse/attestationObject}} - :: If |assertionCreationData|.[=assertionCreationData/assertionAttestation=] is null, set this - field to null. Otherwise, set this field to a new {{ArrayBuffer}}, created using |global|'s - [=%ArrayBuffer%=], containing the bytes of - |assertionCreationData|.[=assertionCreationData/assertionAttestation=]. - : {{PublicKeyCredential/[[clientExtensionsResults]]}} :: A new {{ArrayBuffer}}, created using |global|'s [=%ArrayBuffer%=], containing the bytes of |assertionCreationData|.[=assertionCreationData/clientExtensionResults=]. @@ -2649,30 +2639,6 @@ The steps for [=issuing a credential request to an authenticator=] are as follow - 1. Let |enterpriseAttestationPossible| be a Boolean value, as follows. If - |pkOptions|.{{PublicKeyCredentialRequestOptions/attestation}} - -
- - : is set to {{AttestationConveyancePreference/enterprise}} - :: Let |enterpriseAttestationPossible| be [TRUE] if the user agent wishes to support enterprise attestation for |rpId| (see [Step 7](#GetAssn-DetermineRpId) of [[#sctn-discover-from-external-source]]). Otherwise [FALSE]. - - : otherwise - :: Let |enterpriseAttestationPossible| be [FALSE]. - -
- - 1. Let |attestationFormats| be a list of strings, initialized to the value of |pkOptions|.{{PublicKeyCredentialRequestOptions/attestationFormats}}. - - 1. If |pkOptions|.{{PublicKeyCredentialRequestOptions/attestation}} - -
- - : is set to {{AttestationConveyancePreference/none}} - :: Set |attestationFormats| be the single-element list containing the string “none” - -
- 1. If |pkOptions|.{{PublicKeyCredentialRequestOptions/allowCredentials}}
@@ -2710,23 +2676,19 @@ The steps for [=issuing a credential request to an authenticator=] are as follow Then, using |transport|, invoke the [=authenticatorGetAssertion=] operation on |authenticator|, with |rpId|, |clientDataHash|, |allowCredentialDescriptorList|, |userVerification|, - |enterpriseAttestationPossible|, - |attestationFormats|, and |authenticatorExtensions| as parameters. : [=list/is empty=] :: Using local configuration knowledge of the appropriate transport to use with |authenticator|, invoke the [=authenticatorGetAssertion=] operation on |authenticator| with |rpId|, |clientDataHash|, |allowCredentialDescriptorList|, |userVerification|, - |enterpriseAttestationPossible|, |attestationFormats|, and |authenticatorExtensions| as parameters. + and |authenticatorExtensions| as parameters.
: [=list/is empty=] :: Using local configuration knowledge of the appropriate transport to use with |authenticator|, invoke the [=authenticatorGetAssertion=] operation on |authenticator| with |rpId|, |clientDataHash|, |userVerification|, - |enterpriseAttestationPossible|, - |attestationFormats|, and |authenticatorExtensions| as parameters. Note: In this case, the [=[RP]=] did not supply a list of acceptable credential descriptors. Thus, the @@ -2918,8 +2880,6 @@ value and terminate the operation. sequence allowCredentials = []; DOMString userVerification = "preferred"; sequence hints = []; - DOMString attestation = "none"; - sequence attestationFormats = []; AuthenticationExtensionsClientInputsJSON extensions; }; @@ -3026,7 +2986,6 @@ optionally evidence of [=user consent=] to a specific transaction. [SameObject] readonly attribute ArrayBuffer authenticatorData; [SameObject] readonly attribute ArrayBuffer signature; [SameObject] readonly attribute ArrayBuffer? userHandle; - [SameObject] readonly attribute ArrayBuffer? attestationObject; };
@@ -3047,9 +3006,6 @@ optionally evidence of [=user consent=] to a specific transaction. [=user handle=]. See [[#sctn-op-get-assertion]]. The authenticator MUST always return a [=user handle=] if the {{PublicKeyCredentialRequestOptions/allowCredentials}} option used in the [=authentication ceremony=] is [=list/is empty|empty=], and MAY return one otherwise. - - : attestationObject - :: This OPTIONAL attribute contains an [=attestation object=], if the [=authenticator=] supports attestation in assertions. The [=attestation object=], if present, includes an [=attestation statement=]. Unlike the {{AuthenticatorAttestationResponse/attestationObject}} in an {{AuthenticatorAttestationResponse}}, it does not contain an `authData` key because the [=authenticator data=] is provided directly in an {{AuthenticatorAssertionResponse}} structure. For more details on attestation, see [[#sctn-attestation]], [[#sctn-attestation-in-assertions]], [[#sctn-generating-an-attestation-object]], and [Figure 6](#fig-attStructs).
## Parameters for Credential Generation (dictionary PublicKeyCredentialParameters) ## {#dictionary-credential-params} @@ -3490,8 +3446,6 @@ an assertion. Its {{PublicKeyCredentialRequestOptions/challenge}} member MUST be sequence allowCredentials = []; DOMString userVerification = "preferred"; sequence hints = []; - DOMString attestation = "none"; - sequence attestationFormats = []; AuthenticationExtensionsClientInputs extensions; }; @@ -3556,21 +3510,6 @@ an assertion. Its {{PublicKeyCredentialRequestOptions/challenge}} member MUST be : hints :: This OPTIONAL member contains zero or more elements from {{PublicKeyCredentialHints}} to guide the user agent in interacting with the user. Note that the elements have type `DOMString` despite being taken from that enumeration. See [[#sct-domstring-backwards-compatibility]]. - : attestation - :: The [=[RP]=] MAY use this OPTIONAL member to specify a preference regarding [=attestation conveyance=]. - Its value SHOULD be a member of {{AttestationConveyancePreference}}. - [=Client platforms=] MUST ignore unknown values, treating an unknown value as if the [=map/exist|member does not exist=]. - - The default value is {{AttestationConveyancePreference/none}}. - - : attestationFormats - :: The [=[RP]=] MAY use this OPTIONAL member to specify a preference regarding the [=attestation=] statement format used by the [=authenticator=]. - Values SHOULD be taken from the IANA "WebAuthn Attestation Statement Format Identifiers" registry [[!IANA-WebAuthn-Registries]] established by [[!RFC8809]]. - Values are ordered from most preferable to least preferable. - This parameter is advisory and the [=authenticator=] MAY use an attestation statement not enumerated in this parameter. - - The default value is the empty list, which indicates no preference. - : extensions :: The [=[RP]=] MAY use this OPTIONAL member to provide [=client extension inputs=] requesting additional processing by the [=client=] and [=authenticator=]. @@ -5057,24 +4996,13 @@ The privacy, security and operational characteristics of [=attestation=] depend operating environment, and so on. The [=attestation type=] and [=attestation statement format=] is chosen by the [=authenticator=]; -[=[RPS]=] can only signal their preferences by setting the {{PublicKeyCredentialCreationOptions/attestation}} and {{PublicKeyCredentialCreationOptions/attestationFormats}} parameters, or those with the same names in {{PublicKeyCredentialRequestOptions}}. +[=[RPS]=] can only signal their preferences by setting the {{PublicKeyCredentialCreationOptions/attestation}} and {{PublicKeyCredentialCreationOptions/attestationFormats}} parameters. It is expected that most [=authenticators=] will support a small number of [=attestation types=] and [=attestation statement formats=], while [=[RPS]=] will decide what [=attestation types=] are acceptable to them by policy. [=[RPS]=] will also need to understand the characteristics of the [=authenticators=] that they trust, based on information they have about these [=authenticators=]. For example, the FIDO Metadata Service [[FIDOMetadataService]] provides one way to access such information. -### Attestation in assertions ### {#sctn-attestation-in-assertions} - -Attestation is most commonly provided during credential creation. However, if supported by the authenticator and requested by the [=[RP]=] using the {{PublicKeyCredentialRequestOptions/attestation}} parameter, attestation MAY be provided in [=assertions=]. - -Attestations in [=assertions=] could be helpful in at least the following situations: - -1. For [=multi-device credentials=], the [=generating authenticator=] may have returned a meaningfully different attestation than the authenticator currently exercising the credential. Thus returning an attestation for each use of the credential allows the [=[RP]=] to observe these changes. -1. If the [=attestation statement format=] involves a 3rd-party attesting to the state of the authenticator, then returning an attestation with each use of the credential allows for the continued good health of the authenticator to be attested. - -[=Attestation objects=] provided in an {{AuthenticatorAttestationResponse}} structure (i.e. as the result of a {{CredentialsContainer/create()|create()}} operation) contain at least the three keys shown in [the previous figure](#fig-attStructs): `fmt`, `attStmt`, and `authData`. The `authData` key is not included when an [=attestation object=] is provided in an {{AuthenticatorAssertionResponse}} (i.e. as the result of a {{CredentialsContainer/get()|get()}} operation). That is because the [=authenticator data=] is provided directly in the {{AuthenticatorAssertionResponse/authenticatorData}} member of the {{AuthenticatorAssertionResponse}}. Otherwise, processing of the [=attestation object=] is identical. - ### Attested Credential Data ### {#sctn-attested-credential-data} Attested credential data is a variable-length byte array added to the [=authenticator data=] when generating an [=attestation @@ -5122,8 +5050,6 @@ object=] for a credential. Its format is shown in Update |credentialRecord| with new state values: From d3bbf9ae64b698aeba8e8097eb3693e9133be0c3 Mon Sep 17 00:00:00 2001 From: Adam Langley Date: Tue, 2 Jan 2024 12:39:09 -0800 Subject: [PATCH 2/3] Update to reflect comments on the PR. --- index.bs | 34 ++++++++-------------------------- 1 file changed, 8 insertions(+), 26 deletions(-) diff --git a/index.bs b/index.bs index de366a567..0b8093de3 100644 --- a/index.bs +++ b/index.bs @@ -1662,7 +1662,6 @@ that are returned to the caller when a new credential is created, or a new asser required Base64URLString authenticatorData; required Base64URLString signature; Base64URLString userHandle; - Base64URLString attestationObject; }; dictionary AuthenticationExtensionsClientOutputsJSON { @@ -4727,10 +4726,6 @@ It takes the following input parameters: wish to make a [=test of user presence=] optional although WebAuthn does not. : |requireUserVerification| :: The [=effective user verification requirement for assertion=], a Boolean value provided by the client. -: |enterpriseAttestationPossible| -:: A Boolean value that indicates that individually-identifying attestation MAY be returned by the authenticator. -: |attestationFormats| -:: A sequence of strings that expresses the [=[RP]=]'s preference for attestation statement formats, from most to least preferable. If the [=authenticator=] returns [=attestation=], then it makes a best-effort attempt to use the most preferable format that it supports. : |extensions| :: A [=CBOR=] [=map=] from [=extension identifiers=] to their [=authenticator extension inputs=], created by the client based on the extensions requested by the [=[RP]=], if any. @@ -4776,17 +4771,9 @@ a numbered step. If outdented, it (today) is rendered as a bullet in the midst o which approach is implemented by the [=authenticator=], by some positive value. If the [=authenticator=] does not implement a [=signature counter=], let the [=signature counter=] value remain constant at zero. -1. If |attestationFormats|: -
- : is [=list/is not empty|not empty=] - :: let |attestationFormat| be the first supported [=attestation statement format=] from |attestationFormats|, taking into account |enterpriseAttestationPossible|. If none are supported, fallthrough to: - - : is [=list/is empty|empty=] - :: let |attestationFormat| be the [=attestation statement format=] most preferred by this authenticator. If it does not support attestation during assertion then let this be `none`. -
1. Let |authenticatorData| [=perform the following steps to generate an authenticator data structure|be the byte array=] specified in [[#sctn-authenticator-data]] including |processedExtensions|, if any, as - the [=authData/extensions=] and excluding [=attestedCredentialData=]. This |authenticatorData| MUST include [=attested credential data=] if, and only if, |attestationFormat| is not `none`. + the [=authData/extensions=] and excluding [=attestedCredentialData=]. 1. Let |signature| be the [=assertion signature=] of the concatenation |authenticatorData| || |hash| using the [=public key credential source/privateKey=] of |selectedCredential| as shown in Figure , below. A simple, undelimited @@ -4798,11 +4785,8 @@ a numbered step. If outdented, it (today) is rendered as a bullet in the midst o
Generating an [=assertion signature=].
-1. The |attestationFormat| is not `none` then create an [=attestation object=] for the new credential using the procedure specified in - [[#sctn-generating-an-attestation-object]], the [=attestation statement format=] |attestationFormat|, and the values |authenticatorData| - and |hash|, as well as {{enterprise|taking into account}} the value of |enterpriseAttestationPossible|. For more details on attestation, see [[#sctn-attestation]]. - -1. If any error occurred then return an error code equivalent to "{{UnknownError}}" and terminate the operation. +1. If any error occurred while generating the [=assertion signature=], return an error code equivalent to "{{UnknownError}}" and + terminate the operation.