Verification
| Check | Library | Application |
|---|---|---|
| Signature |
fido_assert_verify()[WebAuthn]
with stored public key
|
Select the correct credential and key. |
| RP and UP/UV flags | Checked against configured assertion parameters | Enforce the required flags. |
| Challenge | Uses supplied client data hash | Generate unpredictable fresh challenges and reject replay. |
| Attestation | Verifies supported attestation signatures | Decide certificate trust and acceptable authenticators. |
| Account mapping | Not a device primitive | Bind credential IDs to local accounts. |
Persist the registered credential ID, public key, and RP. Verify each assertion against the matching account and challenge. Successful device I/O alone does not authenticate an account.