- From: Adam Langley via GitHub <sysbot+gh@w3.org>
- Date: Tue, 20 Aug 2019 22:27:43 +0000
- To: public-webauthn@w3.org
> Other implementers have grabbed the hash algorithm from the auth_data => attested_credential_data => credential_public_key map and then done a lookup based on COSE. This seems to me like an unnecessary step, but I am not 100% sure. You're talking about verifying the attestation signature? If so, then looking at the [credential public key](https://w3c.github.io/webauthn/#credentialpublickey) is wrong because that's the public key that has just been _generated_ by the authenticator. It's not the key that's embedded into the authenticator and used to sign the (transformed) [attested credential data](https://w3c.github.io/webauthn/#sctn-attested-credential-data). The attestation certificate is an X.509 certificate and thus contains a [Subject Public Key Info](https://tools.ietf.org/html/rfc5280#section-4.1) which describes the public key but not the signature hash function. The hash function is just SHA-256 by convention and we should nail that down in the spec. -- GitHub Notification of comment by agl Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1279#issuecomment-523219367 using your GitHub account
Received on Tuesday, 20 August 2019 22:27:45 UTC