Yeah, this isn't quite ideal. Indeed x5c contains not only the certificate for the signing key of the JWS response, but the whole chain - which is definitely not limited to one cert. This may be new, since the SafetyNet response format changes from time to time, hence the version field. But I'm not quite sure actually. So yes, the trust path should include the whole chain. Additionally, the instructions should clarify that the hostname to check is in the leaf cert, and that (importantly) the verifier should actually verify the certificate chain. That implies verifying its signatures and that the root is trusted by the RP. I wonder if it's best to simply refer to [SafetyNet documentation](https://developer.android.com/training/safetynet/attestation#verify-compat-check) on this, rather than chasing any potential changes there. -- GitHub Notification of comment by arnar Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1132#issuecomment-454998300 using your GitHub accountReceived on Thursday, 17 January 2019 00:40:19 UTC
This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 18:59:00 UTC