metadata statements for Windows Hello and Android

[ryden54]

First, thanks for you work, it's usefull & clean!

Is your feature request related to a problem? Please describe.
I have to check authenticator metadata during the attestation ceremony (ATTESTATION_CONVEYANCE_PREFERENCE_DIRECT).
I used your library in version 3.2 "symfony style", as showed in your demo.
The UpdateMetadataStatementRepositoryCommand does work, but at already stated by you & others, the Fido MDS is not quite complete, and thus breaking attestation ceremonies with the 2 most widespread authenticators: "windows 10 Hello" and "Android"

Describe the solution you'd like
A git repository for reference of authenticator's constructor's MDS?
in addition to the Fido MDS you've referenced here in your demo app

Describe alternatives you've considered
For Windows Hello, microsoft manually references the possible aaguid in Microsoft Edge documentation (last point of "Special considerations for Windows Hello")
One could try to make MetadataStatementRepository instanciate a MetadataStatement if based on one of these aaguid, but we miss a certificate to match the authenticator's response, check it's certificate chain against the metadata, and let the ceremony complete properly

For Android, I was not able to find out documentation on where to get their MetadataStatements

Thank you in advance for any info/tips you have about that!

Additional context

[Spomky]

Hi @ryden54,

The current situation is not ideal. The specifications for the MDS/communication with the MDS servers are drafts and, as you already know, main ones (such as Google, Microsoft, Yubico) are absent from the FIDO Alliance API.
Therefore we all have to deal with our own repositories. I hope in the future the FIDO Alliance repository will reference most of the metadata statements, but for the moment let's create the missing ones.

• For Android, it is quite easy to have a custom made MDS. You will find the root certificates at https://pki.goog/. If you don't want to dig into the documentation to know which certificate to use, you can use all of them.
• For Yubico, you can use the one from the tests (derived from this file)
• For Solokeys, the MDS is available on their website
• For Windows Hello... I will ask some of my contacts working at MS.

Maybe I should write a page on the documentation to have a clear view of these major manufacturers? Or an independent service that aggregates serveral MDS sources? TBD.

[ryden54]

Thank you for your answer.
To build these "singleStatements", from what I understand, we need at least the aaguids and the root certificates.
You mentionned the references for the certificates.
For the aaguids, I've found:

• Yubico

• SoloKeys as you mentioned it

• Windows Hello: as mentionned earlier

• Android: I can check my own phone's aaguid, but how to get a complete list of aaguid corresponding to android phones? If you have any clues

Also, what about the other properties of the metadata attestations. Is it safe to just leave them absent?
For example in your test:

  "protocolFamily": "fido2",
  "authenticatorVersion": 2,
  "upv": [
    {
      "major": 1,
      "minor": 0
    }
  ],
  "assertionScheme": "FIDOV2",
  "authenticationAlgorithm": 1,
  "publicKeyAlgAndEncoding": 260,
  "attestationTypes": [
    15879,
    15880
  ],
  "userVerificationDetails": [
    [
      {
        "userVerification": 1
      }
    ]
  ],
  "keyProtection": 10,
  "matcherProtection": 4,
  "cryptoStrength": 128,
  "operatingEnv": "Secure Element (SE)",
  "attachmentHint": 2,
  "isSecondFactorOnly": false,
  "tcDisplay": 0,

[ryden54]

for Windows Hello, I was was pointed to this comment passwordless-lib/fido2-net-lib#166 (comment)
providing 3 static metadata statements, but one without "root certificate"

[ryden54]

The Fido MDS2 was updated during the month of august, and the Windows Hello & Android Authenticator are now present
everything's ok

[Spomky]

Thank you for letting me know.
I will update my repository cache.

BR

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.