Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add packed attestation optional firmware version attribute #1953

Merged
merged 6 commits into from
Mar 13, 2024
Merged

Add packed attestation optional firmware version attribute #1953

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
872589a
Add packed attestation descriotion of the firmware version attribute.…
dwaite Aug 30, 2023
8298b63
Update to "...[an] Authority Information Access..."
dwaite Sep 6, 2023
6853232
Change unsigned INTEGER to an INTEGER with a non-negative value
dwaite Sep 6, 2023
2c7874e
Add example for review.
dwaite Oct 11, 2023
36d2fd4
Update to signed certificate and hex attribute examples
dwaite Jan 3, 2024
27a8614
Trailing whitespace fix, example comment-number fix
dwaite Feb 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5840,10 +5840,13 @@ The attestation certificate MUST have the following fields/extensions:

- The Basic Constraints extension MUST have the CA component set to [FALSE].

- An Authority Information Access (AIA) extension with entry `id-ad-ocsp` and a CRL Distribution Point extension [[RFC5280]]
are both OPTIONAL as the status of many attestation certificates is available through authenticator metadata services.
See, for example, the FIDO Metadata Service [[FIDOMetadataService]].
Additionally, Authority Information Access (AIA) extension with entry `id-ad-ocsp` and a CRL Distribution Point extension
dwaite marked this conversation as resolved.
Show resolved Hide resolved
[[RFC5280]] are both OPTIONAL as the status of many attestation certificates is available through authenticator metadata
services. See, for example, the FIDO Metadata Service [[FIDOMetadataService]].

The firmware of a particular authenticator model MAY be differentiated using the Extension OID `1.3.6.1.4.1.45724.1.1.5`
(`id-fido-gen-ce-fw-version`). When present, this attribute contains an unsigned INTEGER which is incremented for new
dwaite marked this conversation as resolved.
Show resolved Hide resolved
firmware release versions. The extension MUST NOT be marked as critical.
dwaite marked this conversation as resolved.
Show resolved Hide resolved

## TPM Attestation Statement Format ## {#sctn-tpm-attestation}

Expand Down
Loading