Does Apple allow packed format attestation in passkey credential provider approach?

I am trying to implement a third party passkey credential provider and I have been able to successfully setup the project for that. Below is a sample code which I am using -

let passkeyRegistrationCredential = ASPasskeyRegistrationCredential(relyingParty: self.request?.credentialIdentity.serviceIdentifier.identifier ?? "", clientDataHash: self.request?.clientDataHash ?? Data(), credentialID: Data(credentialId), attestationObject: Data(attestationBytes)

self.extensionContext.completeRegistrationRequest(using: passkeyRegistrationCredential)

The attestationBytes object that I am generating and sending back to RP seems to work only if I set the "fmt" to "none", which basically requires "attStmt" to be sent as an empty value as per WebAuthn spec - https://www.w3.org/TR/webauthn-2/#sctn-none-attestation

When trying to set the "fmt" to "packed" in attestation object and creating a self signed "attStmt" consisting of "alg" and "sig" key-values referring - https://www.w3.org/TR/webauthn-2/#sctn-packed-attestation, it does not seem to work. The RP throws an error. I do not have "x5c" object as that supposedly is not mandatory in case of self attestation. I have "authData" also as part of the response properly setup.

Is it not possible to use packed attestation or am I missing something in creating the attestation object? Also, does Apple modify the response being sent in the background before sending to RP if packed fmt is used?

Up vote post of letsbondiway1986 Down vote post of letsbondiway1986
512 views
Posted by
letsbondiway1986
Reply
Add a Comment

Replies

Attestation for passkeys isn't defined in the spec yet. The existing attestation formats were designed before credentials could sync, and they don't really make sense in a syncing credential world. For example, you can't meaningfully attest to security properties of a device when that device can change over time.

Defining attestation formats for passkeys is currently being worked on in the FIDO Alliance.

Posted by
garrett-davidson
Post not yet marked as solved Up vote reply of garrett-davidson Down vote reply of garrett-davidson

  • Thanks @garrett-davidson . So from what I understand, since the attestation formats for passkeys are not defined in the specs yet, Apple doesnt support or rather doesnt need the attestation statement to be sent as part of passkey registration response to the Relying Party. Is that understanding correct? On a curious note, can you please throw some light on as to by when we can expect attestation formats for passkeys to be part of the specs which is currently being worked on in the FIDO Alliance?

    —
    letsbondiway1986
Add a Comment