Google Titan Key: Attestation data

Question

We are using passkeys in our application. The issue is once we create the credentails using the window.navigator.credentials.create API. After getting the response which has attestation data the we decode it using the CBOR then we get authData which we decode again using CBOR decoder but in case Google Titan Key it's not able to decode the auth data. Getting error - Additional info not implemented: 29

Answer 1

Additional Information value of 29 is reserved in the CBOR specification and in the current version of CBOR it would mean the data is malformed. In your case the parsing will have hit a value indicating a major type with the lower 5 bits set as 11101.

As you say, your create command from WebAuthn gives you back an object in CBOR you decode. This has an authData entry however as per the Webauthn specification, 'authData' itself is not a CBOR object, only a part of it.

The structure of authData is as follows

• 32 byte SHA-256 RP ID
• 1 byte flag indicating if User is Present, User is Verified, AttestedCredentialData or Extensions is included
• 4 byte Signature counter
• Variable length AttestedCredentialData if present
• Variable length Extensions as a CBOR map if present

The AttestedCredentialData is then structured as

• 16 bytes aaguid
• 2 bytes for CredentialIdLength
• CredentialIdLength bytes CredentialID
• Variable length COSE key in CBOR format

As you can see only 2 potential objects in authData would be in CBOR formatting while the rest is not. So to parse the authData you would first need to parse it based on the definition above and then parse any CBOR object if they are present.

For more details the definition of authData can be found in the Webauthn Specification