Re: [webauthn] Explicitly restrict NONE aaguid to none attestation only (#1588)

Right, I thought I remembered something about the [`fido-u2f` attestation statement format](https://www.w3.org/TR/2021/PR-webauthn-2-20210225/#sctn-fido-u2f-attestation) also using zero AAGUID but couldn't find it in the spec. We should probably elaborate in the signing procedure that this particular format usually involves the client rearranging the raw U2F response into the WebAuthn attestation object format. A U2F authenticator doesn't return a zero AAGUID, rather the client inserts that as part of constructing the _attested credential data_ structure.

-- 
GitHub Notification of comment by emlun
Please view or discuss this issue at https://github.com/w3c/webauthn/pull/1588#issuecomment-806824406 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Thursday, 25 March 2021 14:11:10 UTC