W3C home > Mailing lists > Public > public-webauthn@w3.org > December 2017

[webauthn] FIDO U2F Attestation Statement Format needs to clarify that user handle will be empty

From: J.C. Jones via GitHub <sysbot+gh@w3.org>
Date: Thu, 07 Dec 2017 15:00:41 +0000
To: public-webauthn@w3.org
Message-ID: <issues.opened-280161012-1512658840-sysbot+gh@w3.org>
jcjones has just created a new issue for https://github.com/w3c/webauthn:

== FIDO U2F Attestation Statement Format needs to clarify that user handle will be empty ==
FIDO U2F devices have no mechanism to store a `userHandle` field, so if an RP passes a user handle to `make credential` and gets back a U2F attestation type, the RP must be prepared that subsequent calls to `get assertion` will not have a user handle.

I recommend modifing the last step of **Verification procedure** to:
> If successful, return attestation type Basic with the attestation trust path set to `x5c` _and the user handle set to an empty buffer_.


Please view or discuss this issue at https://github.com/w3c/webauthn/issues/715 using your GitHub account
Received on Thursday, 7 December 2017 15:00:53 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 18:58:45 UTC