3 ms·
Can you clarify whether you mean only the `attestationObject` should be sent to the server or that everything should be encoded as a single CBOR object and then
by adyavanapalli 7y ago
Can you clarify whether you mean only the `attestationObject` should be sent to the server or that everything should be encoded as a single CBOR object and then sent to the server?
- thayne 7y agoI mean why are ther multiple objects that have to be sent instead of a single cbor object. And why is some of it cbor and some of it json?
- arianvanp 7y agoGets worse. Some of it is ASN.1 inside CBOR too. Some of it is custom binary format containing CBOR The answer is as far as I know: Backwards compatibility with bad decisions made in U2F Also; relying on base64url is odd as there are no built in functions in JavaScript to encode and decode it.
- tomashubelbauer 7y ago> Also; relying on base64url is odd as there are no built in functions in JavaScript to encode and decode it. I'm probably missing something, but aren't window.atob and window.btoa just that? It's not available in Node though.
- thayne 7y agobtoa is base64 not base64url. And even if it was base64url, it takes a "binary string", so using it on, say, a Uint8Array is non-trivial.
- tomashubelbauer 7y agoThank you, I didn't realize the URL safe variant of Base64 had a name and that it was this!
- adyavanapalli 7y agoThere are two complementary parts participating in the registration and authentication ceremonies, WebAuthn and CTAP. The response from the authenticator, as per the CTAP protocol standard, is encoded as CBOR. We need the JSON parts from the WebAuthn browser API for the parts in the ceremony that talk to the relying party (particularly for relaying the challenge responses, and allowed authenticator algorithms and behaviors).