Re: [webauthn] AttestationResponse vs AssertionResponse

Even without blinding, clients must parse and rewrite attestation objects because authenticators return CBOR maps with integer keys, which are defined in CTAP but not allowed by WebAuthn, and thus would not be understood by an RP.

https://github.com/fido-alliance/fido-2-specs/issues/501

-- 
GitHub Notification of comment by arnar
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/854#issuecomment-376903543 using your GitHub account

Received on Wednesday, 28 March 2018 14:18:40 UTC