attestationFormats = [];
AuthenticationExtensionsClientInputsJSON extensions;
};
@@ -3019,7 +2978,6 @@ optionally evidence of [=user consent=] to a specific transaction.
[SameObject] readonly attribute ArrayBuffer authenticatorData;
[SameObject] readonly attribute ArrayBuffer signature;
[SameObject] readonly attribute ArrayBuffer? userHandle;
- [SameObject] readonly attribute ArrayBuffer? attestationObject;
};
@@ -3040,9 +2998,6 @@ optionally evidence of [=user consent=] to a specific transaction.
[=user handle=]. See [[#sctn-op-get-assertion]]. The authenticator MUST always return a [=user handle=] if
the {{PublicKeyCredentialRequestOptions/allowCredentials}} option used in the [=authentication ceremony=] is [=list/is empty|empty=],
and MAY return one otherwise.
-
- : attestationObject
- :: This OPTIONAL attribute contains an [=attestation object=], if the [=authenticator=] supports attestation in assertions. The [=attestation object=], if present, includes an [=attestation statement=]. Unlike the {{AuthenticatorAttestationResponse/attestationObject}} in an {{AuthenticatorAttestationResponse}}, it does not contain an `authData` key because the [=authenticator data=] is provided directly in an {{AuthenticatorAssertionResponse}} structure. For more details on attestation, see [[#sctn-attestation]], [[#sctn-attestation-in-assertions]], [[#sctn-generating-an-attestation-object]], and [Figure 6](#fig-attStructs).
## Parameters for Credential Generation (dictionary PublicKeyCredentialParameters) ## {#dictionary-credential-params}
@@ -3483,8 +3438,6 @@ an assertion. Its {{PublicKeyCredentialRequestOptions/challenge}} member MUST be
sequence allowCredentials = [];
DOMString userVerification = "preferred";
sequence hints = [];
- DOMString attestation = "none";
- sequence attestationFormats = [];
AuthenticationExtensionsClientInputs extensions;
};
@@ -3549,21 +3502,6 @@ an assertion. Its {{PublicKeyCredentialRequestOptions/challenge}} member MUST be
: hints
:: This OPTIONAL member contains zero or more elements from {{PublicKeyCredentialHints}} to guide the user agent in interacting with the user. Note that the elements have type `DOMString` despite being taken from that enumeration. See [[#sct-domstring-backwards-compatibility]].
- : attestation
- :: The [=[RP]=] MAY use this OPTIONAL member to specify a preference regarding [=attestation conveyance=].
- Its value SHOULD be a member of {{AttestationConveyancePreference}}.
- [=Client platforms=] MUST ignore unknown values, treating an unknown value as if the [=map/exist|member does not exist=].
-
- The default value is {{AttestationConveyancePreference/none}}.
-
- : attestationFormats
- :: The [=[RP]=] MAY use this OPTIONAL member to specify a preference regarding the [=attestation=] statement format used by the [=authenticator=].
- Values SHOULD be taken from the IANA "WebAuthn Attestation Statement Format Identifiers" registry [[!IANA-WebAuthn-Registries]] established by [[!RFC8809]].
- Values are ordered from most preferable to least preferable.
- This parameter is advisory and the [=authenticator=] MAY use an attestation statement not enumerated in this parameter.
-
- The default value is the empty list, which indicates no preference.
-
: extensions
:: The [=[RP]=] MAY use this OPTIONAL member to provide [=client extension inputs=]
requesting additional processing by the [=client=] and [=authenticator=].
@@ -4788,10 +4726,6 @@ It takes the following input parameters:
wish to make a [=test of user presence=] optional although WebAuthn does not.
: |requireUserVerification|
:: The [=effective user verification requirement for assertion=], a Boolean value provided by the client.
-: |enterpriseAttestationPossible|
-:: A Boolean value that indicates that individually-identifying attestation MAY be returned by the authenticator.
-: |attestationFormats|
-:: A sequence of strings that expresses the [=[RP]=]'s preference for attestation statement formats, from most to least preferable. If the [=authenticator=] returns [=attestation=], then it makes a best-effort attempt to use the most preferable format that it supports.
: |extensions|
:: A [=CBOR=] [=map=] from [=extension identifiers=] to their [=authenticator extension inputs=], created by the client based on
the extensions requested by the [=[RP]=], if any.
@@ -4837,17 +4771,9 @@ a numbered step. If outdented, it (today) is rendered as a bullet in the midst o
which approach is implemented by the [=authenticator=], by some positive value.
If the [=authenticator=] does not implement a [=signature counter=], let the [=signature counter=] value remain constant at
zero.
-1. If |attestationFormats|:
-
- : is [=list/is not empty|not empty=]
- :: let |attestationFormat| be the first supported [=attestation statement format=] from |attestationFormats|, taking into account |enterpriseAttestationPossible|. If none are supported, fallthrough to:
-
- : is [=list/is empty|empty=]
- :: let |attestationFormat| be the [=attestation statement format=] most preferred by this authenticator. If it does not support attestation during assertion then let this be `none`.
-
1. Let |authenticatorData| [=perform the following steps to generate an authenticator data structure|be the byte array=]
specified in [[#sctn-authenticator-data]] including |processedExtensions|, if any, as
- the [=authData/extensions=] and excluding [=attestedCredentialData=]. This |authenticatorData| MUST include [=attested credential data=] if, and only if, |attestationFormat| is not `none`.
+ the [=authData/extensions=] and excluding [=attestedCredentialData=].
1. Let |signature| be the [=assertion signature=] of the concatenation |authenticatorData| || |hash| using the
[=public key credential source/privateKey=] of |selectedCredential| as shown in Figure , below. A simple,
undelimited
@@ -4859,11 +4785,8 @@ a numbered step. If outdented, it (today) is rendered as a bullet in the midst o
Generating an [=assertion signature=].
-1. The |attestationFormat| is not `none` then create an [=attestation object=] for the new credential using the procedure specified in
- [[#sctn-generating-an-attestation-object]], the [=attestation statement format=] |attestationFormat|, and the values |authenticatorData|
- and |hash|, as well as {{enterprise|taking into account}} the value of |enterpriseAttestationPossible|. For more details on attestation, see [[#sctn-attestation]].
-
-1. If any error occurred then return an error code equivalent to "{{UnknownError}}" and terminate the operation.
+1. If any error occurred while generating the [=assertion signature=], return an error code equivalent to "{{UnknownError}}" and
+ terminate the operation.