Packed Attestation Format

[Spomky]

Q	A
Bug report?	no
Feature request?	yes
BC Break report?	no
RFC? / Specification	https://www.w3.org/TR/webauthn/#packed-attestation
Version	1.x

Add support for packed attestionation format.

• Basic (mandatory)
• AttCA (mandatory)
• Self Attestation (mandatory)
• ECDAA (optional) -- Will be done at a later stage

[francislavoie]

Thanks for working on this! I'll be following the progress, I'll likely be implementing this in some systems at some point.

I just wanted to bring this up: https://paragonie.com/blog/2018/08/security-concerns-surrounding-webauthn-don-t-implement-ecdaa-yet just in case you weren't aware. Not sure if there's been new developments on the topic since then, I haven't been following the FIDO2 progress in the past few months.

[Spomky]

Hi @francislavoie,

I read that blog post few months ago (I usually follow what Scott writes).
ECDAA has not moved so far and the spec is still in review so wait and see. This is not a priority for me as no security device use it.
I prefer spend my time on Android SafetyNet/Android Key and TPM attestations.

[Spomky]

Done. Available in v1.0 (Basic/AttCa). Self is available in v1.1.
See #27 for ECDAA attestation type follow-up.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.