Authenticator Attestation Global Unique Identifier (AAGUID) for Passkeys in iOS App and Safari from mac

Hi, The Authenticator Attestation Global Unique Identifier (AAGUID) for Safari and also, from iOS App is zero’ed out, is this expected to stay this way, can this be considered an ideal differentiator between Passkeys from Apps in iOS/Safari from Mac and other webAuth N Credentials generated from other platform Authenticators as Chrome/Yubico and other vendors happen to send different values. is this value expected to change in future?

Answered by Systems Engineer in 747208022

The WebAuthn spec createCredential algorithm step 20 "If any authenticator indicates success" 3.1 says to set the AAGUID to all zeroes if "none" attestation is used. Passkeys generally, including those in iCloud Keychain, don't support attestation as it exists today; one of my previous explanations for why is here. So this is expected behavior and is the same for most (all?) synced WebAuthn credentials currently.

Accepted Answer

The WebAuthn spec createCredential algorithm step 20 "If any authenticator indicates success" 3.1 says to set the AAGUID to all zeroes if "none" attestation is used. Passkeys generally, including those in iCloud Keychain, don't support attestation as it exists today; one of my previous explanations for why is here. So this is expected behavior and is the same for most (all?) synced WebAuthn credentials currently.

Authenticator Attestation Global Unique Identifier (AAGUID) for Passkeys in iOS App and Safari from mac
 
 
Q