1

WebAuthN seems to provide essentially two different ways of not performing verifiable attestation: Either by the Relying Party requesting none or by the authenticator choosing self attestation.

Is this purely a protocol design choice for the sake of symmetry (allowing the invariant of "if attestation is requested, it is always supplied"), is it to support specific legacy use cases (if so, what are they?), or are there any security implications/differences between self and none?

Improve this question

1 Answer 1

Reset to default
2

This is most likely for backwards compatibility. Chrome 67 started using self attestation for U2F (the U2F spec doesn't allow for "none") for specific keys that were discovered to not meet the 100,000 batch requirement to preserve privacy.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .