attestationFormats = [];
AuthenticationExtensionsClientInputsJSON extensions;
};
@@ -3026,7 +2986,6 @@ optionally evidence of [=user consent=] to a specific transaction.
[SameObject] readonly attribute ArrayBuffer authenticatorData;
[SameObject] readonly attribute ArrayBuffer signature;
[SameObject] readonly attribute ArrayBuffer? userHandle;
- [SameObject] readonly attribute ArrayBuffer? attestationObject;
};
@@ -3047,9 +3006,6 @@ optionally evidence of [=user consent=] to a specific transaction.
[=user handle=]. See [[#sctn-op-get-assertion]]. The authenticator MUST always return a [=user handle=] if
the {{PublicKeyCredentialRequestOptions/allowCredentials}} option used in the [=authentication ceremony=] is [=list/is empty|empty=],
and MAY return one otherwise.
-
- : attestationObject
- :: This OPTIONAL attribute contains an [=attestation object=], if the [=authenticator=] supports attestation in assertions. The [=attestation object=], if present, includes an [=attestation statement=]. Unlike the {{AuthenticatorAttestationResponse/attestationObject}} in an {{AuthenticatorAttestationResponse}}, it does not contain an `authData` key because the [=authenticator data=] is provided directly in an {{AuthenticatorAssertionResponse}} structure. For more details on attestation, see [[#sctn-attestation]], [[#sctn-attestation-in-assertions]], [[#sctn-generating-an-attestation-object]], and [Figure 6](#fig-attStructs).
## Parameters for Credential Generation (dictionary PublicKeyCredentialParameters) ## {#dictionary-credential-params}
@@ -3490,8 +3446,6 @@ an assertion. Its {{PublicKeyCredentialRequestOptions/challenge}} member MUST be
sequence allowCredentials = [];
DOMString userVerification = "preferred";
sequence hints = [];
- DOMString attestation = "none";
- sequence attestationFormats = [];
AuthenticationExtensionsClientInputs extensions;
};
@@ -3556,21 +3510,6 @@ an assertion. Its {{PublicKeyCredentialRequestOptions/challenge}} member MUST be
: hints
:: This OPTIONAL member contains zero or more elements from {{PublicKeyCredentialHints}} to guide the user agent in interacting with the user. Note that the elements have type `DOMString` despite being taken from that enumeration. See [[#sct-domstring-backwards-compatibility]].
- : attestation
- :: The [=[RP]=] MAY use this OPTIONAL member to specify a preference regarding [=attestation conveyance=].
- Its value SHOULD be a member of {{AttestationConveyancePreference}}.
- [=Client platforms=] MUST ignore unknown values, treating an unknown value as if the [=map/exist|member does not exist=].
-
- The default value is {{AttestationConveyancePreference/none}}.
-
- : attestationFormats
- :: The [=[RP]=] MAY use this OPTIONAL member to specify a preference regarding the [=attestation=] statement format used by the [=authenticator=].
- Values SHOULD be taken from the IANA "WebAuthn Attestation Statement Format Identifiers" registry [[!IANA-WebAuthn-Registries]] established by [[!RFC8809]].
- Values are ordered from most preferable to least preferable.
- This parameter is advisory and the [=authenticator=] MAY use an attestation statement not enumerated in this parameter.
-
- The default value is the empty list, which indicates no preference.
-
: extensions
:: The [=[RP]=] MAY use this OPTIONAL member to provide [=client extension inputs=]
requesting additional processing by the [=client=] and [=authenticator=].
@@ -5057,24 +4996,13 @@ The privacy, security and operational characteristics of [=attestation=] depend
operating environment, and so on.
The [=attestation type=] and [=attestation statement format=] is chosen by the [=authenticator=];
-[=[RPS]=] can only signal their preferences by setting the {{PublicKeyCredentialCreationOptions/attestation}} and {{PublicKeyCredentialCreationOptions/attestationFormats}} parameters, or those with the same names in {{PublicKeyCredentialRequestOptions}}.
+[=[RPS]=] can only signal their preferences by setting the {{PublicKeyCredentialCreationOptions/attestation}} and {{PublicKeyCredentialCreationOptions/attestationFormats}} parameters.
It is expected that most [=authenticators=] will support a small number of [=attestation types=] and [=attestation statement
formats=], while [=[RPS]=] will decide what [=attestation types=] are acceptable to them by policy. [=[RPS]=] will also need to
understand the characteristics of the [=authenticators=] that they trust, based on information they have about these
[=authenticators=]. For example, the FIDO Metadata Service [[FIDOMetadataService]] provides one way to access such information.
-### Attestation in assertions ### {#sctn-attestation-in-assertions}
-
-Attestation is most commonly provided during credential creation. However, if supported by the authenticator and requested by the [=[RP]=] using the {{PublicKeyCredentialRequestOptions/attestation}} parameter, attestation MAY be provided in [=assertions=].
-
-Attestations in [=assertions=] could be helpful in at least the following situations:
-
-1. For [=multi-device credentials=], the [=generating authenticator=] may have returned a meaningfully different attestation than the authenticator currently exercising the credential. Thus returning an attestation for each use of the credential allows the [=[RP]=] to observe these changes.
-1. If the [=attestation statement format=] involves a 3rd-party attesting to the state of the authenticator, then returning an attestation with each use of the credential allows for the continued good health of the authenticator to be attested.
-
-[=Attestation objects=] provided in an {{AuthenticatorAttestationResponse}} structure (i.e. as the result of a {{CredentialsContainer/create()|create()}} operation) contain at least the three keys shown in [the previous figure](#fig-attStructs): `fmt`, `attStmt`, and `authData`. The `authData` key is not included when an [=attestation object=] is provided in an {{AuthenticatorAssertionResponse}} (i.e. as the result of a {{CredentialsContainer/get()|get()}} operation). That is because the [=authenticator data=] is provided directly in the {{AuthenticatorAssertionResponse/authenticatorData}} member of the {{AuthenticatorAssertionResponse}}. Otherwise, processing of the [=attestation object=] is identical.
-
### Attested Credential Data ### {#sctn-attested-credential-data}
Attested credential data is a variable-length byte array added to the [=authenticator data=] when generating an [=attestation
@@ -5122,8 +5050,6 @@ object=] for a credential. Its format is shown in
Update |credentialRecord| with new state values: