Credential creation
| Input or setting | API | Notes |
|---|---|---|
| Credential type |
fido_cred_set_type()[WebAuthn]
|
Specify the COSE algorithm (for example, ES256). |
| Relying party |
fido_cred_set_rp()
|
The RP ID scopes the credential. |
| User identity |
fido_cred_set_user()
|
Use a stable application-defined user ID. |
| Challenge binding |
fido_cred_set_clientdata_hash()
|
Set the hash of client data associated with the request. |
| Discoverability |
fido_cred_set_rk()
|
Request a discoverable credential where required. |
| User verification |
fido_cred_set_uv()
|
Set the user-verification requirement. |
| Exclude list |
fido_cred_exclude()
|
Exclude credential IDs already registered. |
Allocate with
fido_cred_new()[library], configure it, then call
fido_dev_make_cred(). On success, retrieve the credential ID and public key using the corresponding
fido_cred_*_ptr()[WebAuthn]
and fido_cred_*_len()[WebAuthn]
accessors.
Store the credential ID, public key, COSE algorithm, and RP association in your
application. The authenticator retains the private key. Free the request object with
fido_cred_free()[library].
Attestation verification
fido_cred_verify()[WebAuthn]
verifies attestation signatures and covered attributes, but
does not validate the X.509 attestation certificate. Device provenance
requires separate certificate trust evaluation.
fido_cred_verify_self()[WebAuthn]
handles supported self-attestation formats.