`none` attestation verifier

(no submodules)

Purpose

Implements the W3C WebAuthn L3 §8.7 none attestation format. This format is used when the RP requests attestation: "none" on registration — the authenticator returns the credential public key inside the authData segment but emits no attestation statement (no signature, no certificate chain). The verifier asserts the contract: an empty attStmt map. A non-empty map fails closed because it indicates protocol drift between the browser, authenticator, and RP.

Features

Empty-attStmt check rejects with WEBAUTHN.MALFORMED_RESPONSE on any non-empty payload.
Reports attestationType: "none" and trustPath: [] so consumers know there is no trust anchor for policy decisions.
Synchronous — the verifier does no IO and no cryptography.

Usage: Basic Example

import { verifyNoneAttestation } from "@suaveplan/webauthn/attestation/none";

const result = verifyNoneAttestation({
    attestationObject,
    clientDataHash,
    expectedRpIdHash,
});
// result.trusted === true, result.attestationType === "none"

Usage: Advanced Example

import {
    type AttestationFormatRegistry,
    verifyNoneAttestation,
} from "@suaveplan/webauthn";

function customRegistry(): AttestationFormatRegistry {
    const r = new Map();
    r.set("none", verifyNoneAttestation);
    return r;
}

API Reference

verifyNoneAttestation: AttestationFormatVerifier — the format verifier.

Implementation Notes

W3C §8.7 specifies the attStmt SHALL be the empty CBOR map; emitting any key constitutes a protocol violation and we reject rather than silently accepting. Production authenticators do conform; we have not observed any wild-emission.
trustPath: [] is significant — relying parties that require a trust anchor (FIDO MDS lookup) cannot satisfy the policy here and must reject the registration at a higher layer.
The verifier is the simplest of the seven and serves as the reference implementation pattern for the others: read attestationObject, optionally do crypto, return { trusted, attestationType, trustPath }.

2.1 KiB Raw Blame History

none attestation verifier