Attestation and Metadata Statement

Search…
Disclaimer: you should not ask for the Attestation Statement unless you are working on an application that requires a high level of trust (e.g. Banking/Financial Company, Government Agency...).
Receiving Attestation Statement
Attestation Metadata Repository
First of all, you must prepare an Attestation Metadata Repository. This service will manage all Metadata Statements depending on their sources (local storage or distant service).
Your Metadata Statement Repository must implement the interface Webauthn\MetadataService\MetadataStatementRepository that has two methods:
findOneByAAGUID(string $aaguid): this method retrieves the MetadataStatement object with AAGUID. It shall return null in case of the absence of the MDS.
The library does not provide any Metadata Statement Repository. It is up to you to select the MDS suitable for your application and store them in your database.
There are few steps to acheive. First, you have to add support classes for all attestation statement types into your Attestation Metatdata Manager.
The Android SafetyNet Attestation Statement is a JWT that can be verified by the library, but can also be checked online by hitting the Google API. This method drastically increase the security for the attestation type but requires a PSR-18 compatible HTTP Client and an API key.
1
<?php
2
​
3
declare(strict_types=1);
4
​
5
use Cose\Algorithm\Manager;
6
use Cose\Algorithm\Signature\ECDSA;
7
use Cose\Algorithm\Signature\EdDSA;
8
use Cose\Algorithm\Signature\RSA;
9
use Webauthn\AttestationStatement\AndroidSafetyNetAttestationStatementSupport;
10
use Webauthn\AttestationStatement\AndroidKeyAttestationStatementSupport;
11
use Webauthn\AttestationStatement\AttestationStatementSupportManager;
12
use Webauthn\AttestationStatement\FidoU2FAttestationStatementSupport;
13
use Webauthn\AttestationStatement\NoneAttestationStatementSupport;
14
use Webauthn\AttestationStatement\PackedAttestationStatementSupport;
15
use Webauthn\AttestationStatement\TPMAttestationStatementSupport;
16
use Webauthn\AttestationStatement\AppleAttestationStatementSupport;
17
​
18
// You normally already do this
19
$attestationStatementSupportManager = new AttestationStatementSupportManager();
20
$attestationStatementSupportManager->add(new NoneAttestationStatementSupport());
21
​
22
// Additional classes to add
23
$attestationStatementSupportManager->add(new FidoU2FAttestationStatementSupport());
24
$attestationStatementSupportManager->add(new AppleAttestationStatementSupport());
25
$attestationStatementSupportManager->add(new AndroidSafetyNetAttestationStatementSupport());
26
$attestationStatementSupportManager->add(new AndroidKeyAttestationStatementSupport(
27
    $psr18Client,         // Can be null if you don’t want to use the Google API
28
    $googleApiKey,        // Can be null if you don’t want to use the Google API
29
    $psr17RequestFactory  // Can be null if you don’t want to use the Google API
30
));
31
$attestationStatementSupportManager->add(new TPMAttestationStatementSupport());
32
​
33
// Cose Algorithm Manager
34
// The list of algorithm depends on the algorithm list you defined in your options
35
// You should use at least ES256 and RS256 algorithms that are widely used.
36
$coseAlgorithmManager = new Manager();
37
$coseAlgorithmManager->add(new ECDSA\ES256());
38
$coseAlgorithmManager->add(new RSA\RS256());
39
​
40
$attestationStatementSupportManager->add(new PackedAttestationStatementSupport($coseAlgorithmManager));
Copied!
Next, you must inject the Metadata Statement Repository to your Attestation Object Loader.
1
$attestationObjectLoader = new AttestationObjectLoader($attestationStatementSupportManager, $metadataStatementRepository);
Copied!
Credential Creation Options
By default, no Attestation Statement is asked to the Authenticators (type = none). To change this behavior, you just have to set the corresponding parameter in the Webauthn\PublicKeyCredentialCreationOptions object.
There are 3 conveyance modes available using PHP constants provided by the class Webauthn\PublicKeyCredentialCreationOptions:
ATTESTATION_CONVEYANCE_PREFERENCE_NONE: the Relying Party is not interested in authenticator attestation (default)
ATTESTATION_CONVEYANCE_PREFERENCE_INDIRECT: the Relying Party prefers an attestation conveyance yielding verifiable attestation statements, but allows the client to decide how to obtain such attestation statements.
ATTESTATION_CONVEYANCE_PREFERENCE_DIRECT: the Relying Party wants to receive the attestation statement as generated by the authenticator.
The Hard Way
1
<?php
2
​
3
use Webauthn\PublicKeyCredentialCreationOptions;
4
​
5
$publicKeyCredentialCreationOptions = new PublicKeyCredentialCreationOptions(
6
    $relyingParty
7
    $userEntity,
8
    $challenge,
9
    $pubKeyCredParams,
10
    $timeout, 
11
    $excludeCredentials,
12
    $authenticatorSelection,
13
    PublicKeyCredentialCreationOptions::ATTESTATION_CONVEYANCE_PREFERENCE_DIRECT
14
);
Copied!
Authenticator Selection Criteria
Authentication without username
Last modified 1mo ago
Export as PDF
Copy link
Edit on GitHub
Contents
Receiving Attestation Statement
Attestation Metadata Repository
Credential Creation Options