Need to add two more properties to AttestationVerificationSuccess

[aseigler]

Attestation type:

From https://www.w3.org/TR/webauthn/#attestation-type

Based on https://www.w3.org/TR/webauthn/#sctn-attestation-types, seems like string, one of "Basic", "Self", "AttCA", "ECDAA", or "None"

Trust path:

https://www.w3.org/TR/webauthn/#attestation-trust-path
Seems like could be empty, a byte array (ECDAA) or a number of byte arrays (x5c where x5c has multiple values).

[abergs]

Why do we need them? Are they needed as parameters to the assertion step?

[aseigler]

Yes. If you look at the last step in verification procedures:

https://www.w3.org/TR/webauthn/#packed-attestation
https://www.w3.org/TR/webauthn/#tpm-cert-requirements
https://www.w3.org/TR/webauthn/#android-key-attestation
https://www.w3.org/TR/webauthn/#android-safetynet-attestation
https://www.w3.org/TR/webauthn/#fido-u2f-attestation
https://www.w3.org/TR/webauthn/#none-attestation

They all say "If successful, return attestation type (ATT_TYPE) and attestation trust path (TRUST_PATH) ." Currently we only return credential ID, public key, and user.

[abergs]

Alright. But there doesn't seem to be very defined values.

I guess we could use a TypedString with values from the paranthesis is https://www.w3.org/TR/webauthn/#sctn-attestation-types

• Basic
• Self
• None
• AttCa
• etc..

Should the trustpath be an array of byte arrays maybe?

[abergs]

Made some improvements, but still unsure on how to best return the trustpath since it's not always x509 keys?

6653392

[aseigler]

I don't know what the trust path is supposed to look like either. Definitely something that will need to be researched.

[aseigler]

I now have a better understanding of the wording used. We do not need these after all in AttestationVerificationSuccess, but they are needed for step 16 in VerifyAsync. This can be closed out as well.