John Bradley

DPK attestation may create possible side channel attack on the batch key.

1

For a normal attestation during make credential the batch key is always signing over a new public key, preventing an attacker from controlling the output. In the DPK case the...

Platform Errors for attestations.

3

RP currently have 4 options for requesting attestation. enum [AttestationConveyancePreference] { ["none"], ["indirect"], ["direct"], ["enterprise"] }; In general, we want a RP to be able to request any one of...

Requesting properties of created credentials.

16

In conversations with some government RP around [national ID (aka "eID") programs](https://www.thalesgroup.com/en/markets/digital-identity-and-security/government/identity), there seems to be a requirement that keys not be exportable or shared. That may or not be...

Adding info about HSTS for the RPID to client Data.

3

We have never allowed WebAuthn to non TLS origins. HSTS adds another property of prohibiting user recourse to invalid certificates. We should be using the existing token binding mechanism, but...

Enterprise attestaion is a bool in WebAuthn and an Int in CTAP2.1

2

## Proposed Change Describe your proposed change. If you have suggested text, please file a corresponding Pull Request. The current WebAuthn text uses options enterprise to set enterpriseAttestationPossible state to...

How will new passkey providers impact SPC

2

We now have password providers. like 1Password and Dashlane that intercept Webauthn on desktop not making credentials created in them available to SPC. Over Hybrid there may be changes required...

uv option key true to an authenticator that is not advertising uv in getInfo option ID will fail with CTAP2_ERR_UNSUPPORTED_OPTION

2

{ "description": "Tests is user verification set to true is accepted in MakeCredential.", "error_message": "The user verification option (true) was not accepted.", "id": "make_credential_option_uv_true", "observations": [ "A prompt was expected,...

client_pin_new_requirements_set_pin and client_pin_new_requirements_change_pin pin padding is to 64 bytes not 32

5

In CTAP2.1 the max pin length is 63 bytes and is padded out to 64 bytes. In CTAP2.0 "The decrypted padded newPin should be of at least 64 bytes length"...

1.17.20 error on all NFC tests

1

By submitting this issue you are acknowledging that any information regarding this issue will be publicly available. If you have privacy concerns, please email [[email protected]](mailto:[email protected]) ## FIRST PRE CHECK -...

Test tool not ignoring unknown transports.

2

By submitting this issue you are acknowledging that any information regarding this issue will be publicly available. If you have privacy concerns, please email [[email protected]](mailto:[email protected]) ## FIRST PRE CHECK -...