5 ms·
> The Client Device should sign the sent public key with its own Attestation Certificate. The certificate is used to attest to the manufacturer and its capabili
by ryukafalz 3y ago
> The Client Device should sign the sent public key with its own Attestation Certificate. The certificate is used to attest to the manufacturer and its capabilities.
A nitpick: should is a value judgment here. Quite a few of us would rather they do not, to avoid websites taking advantage of this to require specific proprietary hardware to authenticate.
Thankfully my understanding is that Apple's passkeys do not provide attestation, which is likely to make this kind of hardware requirement uncommon.
- JohnFen 3y agoYes, I consider attestation a bit of a poison pill, personally. I'm very ambivalent about passkeys as it is, if attestation throws a monkey wrench into the works, my ambivalence would become active resistance.
- woodruffw 3y ago> Apple's passkeys do not provide attestation Apple has their own anonymous attestation format[1] that some (unclear which?) of their WebAuthn authenticators support. In principle the relying party could use this to verify the authenticity of the authenticator back up to Apple's WebAuthn root CA[2]. In practice, I'm not sure if that attestation is included by default (or whether significant portions of users opt out of it, when prompted by their browser). [1]: https://github.com/w3c/webauthn/pull/1491 https://github.com/w3c/webauthn/pull/1491 [2]: https://www.apple.com/certificateauthority/Apple_WebAuthn_Root_CA.pem https://www.apple.com/certificateauthority/Apple_WebAuthn_Ro...
- sowbug 3y agoIt makes sense in an enterprise context, where the company might want to make sure no employee clones a client device key. In that case, they would require remote attestation to authorize only private keys living in secure elements (and thus less accessible to the employee).