diff --git a/index.bs b/index.bs index 4319fc955..c9bc1b150 100644 --- a/index.bs +++ b/index.bs @@ -6206,7 +6206,7 @@ if the [=authenticator=] does not support [=attestation=]. attStmt: emptyMap ) - emptyMap = {} + compound = {} ``` : Signing procedure @@ -6264,6 +6264,36 @@ This attestation statement format is exclusively used by Apple for certain types 5. Verify that the [=credential public key=] equals the Subject Public Key of |credCert|. 6. If successful, return implementation-specific values representing attestation type [=Anonymization CA=] and attestation trust path |x5c|. +## Compound Attestation Statement Format ## {#sctn-compound-attestation} + +The "compound" attestation statement format is used to pass multiple, self-contained attestation statements in a single ceremony. + +: Attestation statement format identifier +:: compound + +: Attestation types supported +:: [=Basic=], [=AttCA=], [=Anonymization CA=] + +: Syntax +:: The syntax of a compound attestation statement is defined as follows: + + ``` + $$attStmtType //= ( + fmt: "compound", + attStmt: compoundAttStmts + ) + + compoundAttStmts = [] + ``` + +`compoundAttStmts` MUST NOT contain additional compound attestation statements. + +: Signing procedure +:: Not applicable + +: Verification procedure +:: For every element in the array, validate the attestation statement based on the verification procedure specified for that format (using the `fmt` identifier). + # WebAuthn Extensions # {#sctn-extensions} The mechanism for generating [=public key credentials=], as well as requesting and generating Authentication assertions, as