Return public key in attestedCredentialData on authenticatorGetAssertion

[hariria]

Proposed Change

I was curious why the attestedCredentialData in the authenticatorGetAssertion never included the public key of the credential.

It includes the credential ID, but not the public key, which is arguably much more important for verifying the signature. Is there some way to perhaps force bit 6 of the flags to be true so as to require the public key to be returned in the Attested credential data?

[timcappalli]

The server (RP) stores the public key (along with the credential ID) after a registration ceremony. There is no need to include it an authentication ceremony as the server has everything it needs to validate the signature.

[emlun]

In fact it would be very bad to include the public key along with the assertion signature, because that would create an opportunity for confusing an RP with a valid signature by a different key than the one originally associated with the credential ID. The RP really should retrieve the public key from its own storage, to ensure that the mapping between credential ID and public key remains correct.

[emlun]

The WG believes we've answered the question, and there seems to be nothing more to discuss here. Please let us know if there is more to discuss.