SELF "packed" attestation validation failing

[suren-khatana]

I’m working on FIDO2 certification for my server and Currently, I’m handling attestation scenarios but encountering a test case failure. The tool expects a success , but my server (using Yubico WebAuthn libraries) rejects the attestation response, causing the failure.

For some reason, the signature validation is failing in case of SELF ATTESTATION. I have created a minimal code to test this out.

Please check the Github repo to run the test case.
https://github.com/suren-khatana/yubico-fido2-test/blob/main/src/main/java/com/example/FidoOperations.java

Please run the FidoOperations class to see the results.

Sample Run Logs :

Fetching Fido Metadata Service...
Successfully loaded metadata from https://mds3.fido.tools/execute/0e88691e4d9612e0040e3fb65e586c0cebd2947e4d5d69b4655112406c3ca754
Failed to process MDS: https://mds3.fido.tools/execute/281f65ffc9c84251b7ebe04b0fb3b1812392cd3354ac25eab04a59b4c73953d6
Reason = JWT signature verification failed
Successfully loaded metadata from https://mds3.fido.tools/execute/c4e9999467fcfe635d88af0126a8ed843d4b0d9cb06f3936482f24484ea23185
Successfully loaded metadata from https://mds3.fido.tools/execute/70ca87e4e27466f8efc0da76e31b6c159ed4c7393845b3a913adf55001874810
Successfully loaded metadata from https://mds3.fido.tools/execute/83defb8814c6be643ecdf13a78323377e2dd50e5d0939aff3c1e131fe1fd7091
Total valid metadata entries loaded (MDS + local) = 822


2025-03-26 06:45:42 [main] DEBUG com.yubico.webauthn.OriginMatcher - Exact match: https://localhost:8443 == https://localhost:8443

Registration Result: Is Attestation Trusted? = false
Registration Result: Attestation Type = SELF_ATTESTATION
Registration Result: Attestation Format = packed
Registration Result: Attested Credential AAGUID = ByteArray(9debdbfd14dd4e8d877b4a6e35ddb375)
Registration Result: Attestation Statement = {"alg":-257,"sig":"Nx78v3cXWUGPXpBnwHH0nMwmSYc6T4yQOgdaAvVvvUe02FyKeZ+2yXL79E/g/C8EbaoIg4fVPMBo38XBlSc4tyfuUeK0/DN3ry0w7LXRa1AUP9ju7FvRl0Lj1uEaR/zyLW7oVrTkGZZPTQcKqXJPW2ICTEJ5KZ7tLoLcb1kCrffXcIZby41kZDIaXIUW982KKz6KN+ZyTcMKgWeQigH3xbr8Sd5es7/ufuKXwKS+MnUZZg6gCDmU9XLg1ZYPj7vS9/JsemdPBg+m5Ad3IxqDiW3N8RGp7K1nDDIpE3T3XSlqwifJAwrXIEINnYKafXC/BT1Shq0xqERGRYnG1WIvqA=="}
No attestation trust path found

Metadata Service Matched Entries Size = 0


Self Attestation Validation : Signature Algorithm = RS256
Self Attestation Validation : Key Algorithm = RS256
Self Attestation Validation : sigAlgId  = -257
Self Attestation Validation : authenticatorData: SZYN5YgOjGh0NBcPZHZgW4/krrmihjLHmVzzuoMdl2PBAAAAbJ3r2/0U3U6Nh3tKbjXds3UAIP1UuEqzM7qw0bnMQ3e++dlgNnqQ7VWJS+BOyDbYeF79pAEDAzkBACBZAQCd0X/ELke5zLydXuWmyafrTHQDiif9Y7YjATvdIONQ/ZNA/Y4MtiXZ49B93mO0c0uUls8x1t6CgYbFUGaRxoeTCZZMfKbndQkTTR9jMfz5JakpM4xwZMlslPV207XI1NOUbkj2sLV4LPpwfAG4zuVtJd2qEzLHi1Q7jj6jJQgCcXaT/JnzCPbCjMvSJB6x2VDehH4U1EJOknpadDf05bvffU+EQlBlsTzmA1R3wXj/L8dmeJvv6Jii6oKcyjy0+Iy1XbnAN4FTrMpzZ4JjUHRLxSxdwgY8E17jiT4KQup1z0PLo3rVkqCK1IuhfqzkIgNxqKeUYB4gXSbBycFf8pArIUMBAAGg
Self Attestation Validation : clientDataJSON: eyJvcmlnaW4iOiJodHRwczovL2xvY2FsaG9zdDo4NDQzIiwiY2hhbGxlbmdlIjoiblRMbEQtcjlNNHhQY3I0Y3lXcnU3T1ExQ2FHZ0JnS2NSTGdva2ZDclhfSSIsInR5cGUiOiJ3ZWJhdXRobi5jcmVhdGUifQ==
Self Attestation Validation : signedData: SZYN5YgOjGh0NBcPZHZgW4/krrmihjLHmVzzuoMdl2PBAAAAbJ3r2/0U3U6Nh3tKbjXds3UAIP1UuEqzM7qw0bnMQ3e++dlgNnqQ7VWJS+BOyDbYeF79pAEDAzkBACBZAQCd0X/ELke5zLydXuWmyafrTHQDiif9Y7YjATvdIONQ/ZNA/Y4MtiXZ49B93mO0c0uUls8x1t6CgYbFUGaRxoeTCZZMfKbndQkTTR9jMfz5JakpM4xwZMlslPV207XI1NOUbkj2sLV4LPpwfAG4zuVtJd2qEzLHi1Q7jj6jJQgCcXaT/JnzCPbCjMvSJB6x2VDehH4U1EJOknpadDf05bvffU+EQlBlsTzmA1R3wXj/L8dmeJvv6Jii6oKcyjy0+Iy1XbnAN4FTrMpzZ4JjUHRLxSxdwgY8E17jiT4KQup1z0PLo3rVkqCK1IuhfqzkIgNxqKeUYB4gXSbBycFf8pArIUMBAAGgeyJvcmlnaW4iOiJodHRwczovL2xvY2FsaG9zdDo4NDQzIiwiY2hhbGxlbmdlIjoiblRMbEQtcjlNNHhQY3I0Y3lXcnU3T1ExQ2FHZ0JnS2NSTGdva2ZDclhfSSIsInR5cGUiOiJ3ZWJhdXRobi5jcmVhdGUifQ==
Self Attestation Validation : signature: Nx78v3cXWUGPXpBnwHH0nMwmSYc6T4yQOgdaAvVvvUe02FyKeZ+2yXL79E/g/C8EbaoIg4fVPMBo38XBlSc4tyfuUeK0/DN3ry0w7LXRa1AUP9ju7FvRl0Lj1uEaR/zyLW7oVrTkGZZPTQcKqXJPW2ICTEJ5KZ7tLoLcb1kCrffXcIZby41kZDIaXIUW982KKz6KN+ZyTcMKgWeQigH3xbr8Sd5es7/ufuKXwKS+MnUZZg6gCDmU9XLg1ZYPj7vS9/JsemdPBg+m5Ad3IxqDiW3N8RGp7K1nDDIpE3T3XSlqwifJAwrXIEINnYKafXC/BT1Shq0xqERGRYnG1WIvqA==
Self Attestation Validation : COSE Key Data: {1: 3, 3: -257, -1: h'9DD17FC42E47B9CCBC9D5EE5A6C9A7EB4C74038A27FD63B623013BDD20E350FD9340FD8E0CB625D9E3D07DDE63B4734B9496CF31D6DE828186C5506691C6879309964C7CA6E77509134D1F6331FCF925A929338C7064C96C94F576D3B5C8D4D3946E48F6B0B5782CFA707C01B8CEE56D25DDAA1332C78B543B8E3EA3250802717693FC99F308F6C28CCBD2241EB1D950DE847E14D4424E927A5A7437F4E5BBDF7D4F84425065B13CE6035477C178FF2FC766789BEFE898A2EA829CCA3CB4F88CB55DB9C0378153ACCA7367826350744BC52C5DC2063C135EE3893E0A42EA75CF43CBA37AD592A08AD48BA17EACE4220371A8A794601E205D26C1C9C15FF2902B', -2: h'010001'}
Is Signature Valid (SELF_ATTESTATION) ? = false

[suren-khatana]

False Alarm :/