s
(content and format is specific to attestation type)
Obtain user�consent,�generate:�key kpub �key kpriv�cred.id;�Marshall authenticatorData (aD),
store kpriv and rpId;
Derive rpId from callerOrigin (cO), �normalize cP, �process cE into extResult, �obtain TokenBindingID (TBID):
Authenticator
User Agent�WebAuthn API
Relying Party
attestationChallenge (aC), �cryptoParameters (cP),
accountInformation (aInfo), �credentialExtensions (cE), ...
aC, cO, cP.alg, TBID, extResult, rpID, aInfo, cP.type, etc...
c
cred{ id, type }, kpub, attstn{ atType, c, { aD, cert, sig(..., kpub, ...) } }
cred{ id, type }, kpub, attstn{ atType, c, { aD, cert, s } }
Verify signed objects as approp; store:�key kpub cred.id
Registration
( possibly plus ambient authn, e.g., a cookie )