W3C home > Mailing lists > Public > public-webauthn@w3.org > June 2018

Re: [webauthn] SafetyNet Attestation Clarifications

From: Ackermann Yuriy via GitHub <sysbot+gh@w3.org>
Date: Sat, 23 Jun 2018 21:12:40 +0000
To: public-webauthn@w3.org
Message-ID: <issue_comment.created-399710981-1529788358-sysbot+gh@w3.org>
@apowers313 

2.  SafetyNet uses google root certificates https://pki.goog/. Needs to be clarified in specs. Needs metadata.

3. That's actually clear in specs: 

> Concatenate authenticatorData and clientDataHash, perform SHA-256 hash of the concatenated string, and let the result of the hash form attToBeSigned.
> Request a SafetyNet attestation, providing attToBeSigned as the nonce value. Set response to the result, and ver to the version of Google Play Services running in the authenticator.

>  Verify that the nonce in the response is identical to the SHA-256 hash of the concatenation of authenticatorData and clientDataHash.



-- 
GitHub Notification of comment by herrjemand
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/968#issuecomment-399710981 using your GitHub account
Received on Saturday, 23 June 2018 21:12:48 UTC

This archive was generated by hypermail 2.4.0 : Tuesday, 5 July 2022 07:26:33 UTC