Simplifying attestation, take two

[vijaybh]

Some colleagues and I have spent a fair bit of time with attestation recently, thinking through implementation issues. It became apparent to us that a browser implementation has to do significant parsing of the attestation data returned from the authenticator even though the client really should not care about the contents of this.

Strawman suggestion that we came up with:

• Reduce WebAuthnAttestation to { ArrayBuffer clientData; ArrayBuffer attestation; }
• Have attestation be a CBOR map containing
  • Format
  • authenticatorData
  • format-specific content (different for packed vs. TPM and so on)
• Perhaps this will become obsolete if we implement the above, but any place we insert the algorithm of the attestation signature, we could remove that field for the case of self attestation

The above CBOR map would not be parsed at all on the client, only at the server. This might also simplify the IDL a little bit.

[rlin1]

+1: It is an important goal to make the object opaque for platforms

[leshi]

👍

[leshi]

We like this -- this means that Browsers won't need to be updated when an additional attestation format is defined -- yay!

[leshi]

Let me take a crack at this...

[equalsJeffH]

see also #226 and #233