[webauthn] Consider portable evidence manifests for attestation auditability (#2436)

GXP53 has just created a new issue for https://github.com/w3c/webauthn:

== Consider portable evidence manifests for attestation auditability ==
This is an exploratory use case discussion rather than a proposal for an immediate normative specification change.

I would like to ask whether the Working Group would consider a lightweight, non-normative implementation note or future extension discussion around portable evidence manifests for WebAuthn attestation-related events.

The goal is not to change WebAuthn’s cryptographic trust model, authenticator behavior, or relying party decision logic.

The goal is to improve auditability and evidence portability for environments where WebAuthn credentials participate in procurement, compliance, enterprise identity, regulated infrastructure, or long-term stewardship workflows.

A minimal evidence package could include:

artifact.zip
artifact.zip.ots
evidence-index.json
attestation-event.json

The evidence-index.json could reference:

{
  "artifact_sha256": "...",
  "event_type": "attestation-review",
  "created_at": "2026-06-23T00:00:00Z",
  "rfc3161_timestamp": "...",
  "rekor_log_entry": "...",
  "opentimestamps_proof": "...",
  "related_webauthn_context": {
    "ceremony": "registration",
    "attestation_conveyance": "...",
    "relying_party_id": "..."
  }
}

Questions for the Working Group:

Is there existing work or prior discussion on portable evidence manifests for attestation review?

Would a non-normative implementation note be appropriate?

Would this be better handled outside WebAuthn, for example in procurement profiles, FIDO guidance, OSCAL mappings, or another standards venue?

Are there implementers interested in testing a small evidence bundle pattern?

I am exploring this through Ari-Labs / Proof of Trust as a stewardship and auditability pattern.

I would be glad to prepare a small reference evidence bundle if the Working Group believes this is useful.


Please view or discuss this issue at https://github.com/w3c/webauthn/issues/2436 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Wednesday, 24 June 2026 05:53:34 UTC