iOS passkey-provider

testuser7 271 Reputation points
2024-06-27T12:48:01.8066667+00:00

Hello,

Is it correct that right now, when any passkey-provider like our MS-authenticator-app prepares the passkey registration ceremony response with attestation, iOS strips off the attestation before handing over response-assertion to the client.

Does this stripping off of attestation have to do anything with the BS and BE flags that are populated by passkey-provider ? Meaning, is it correct statement that iOS removes the attestation blob from the response if the BE and BS flags are set to zero ??

Thanks.

Microsoft Intune iOS
Microsoft Intune iOS
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.iOS: An Apple mobile operating system.
201 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,287 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Raja Pothuraju 960 Reputation points Microsoft Vendor
    2024-06-28T10:39:04.1933333+00:00

    Hello @testuser7,

    Thank you for posting your query on Microsoft Q&A.

    It is correct that iOS devices strip off the attestation from the response-assertion provided by passkey providers, such as the Microsoft Authenticator app, as part of their privacy-preserving measures. Currently, for passkeys in Microsoft Authenticator, we do not support attestation.

    Regarding the BS and BE flags, these flags indicate whether the passkey registration ceremony is being performed in a secure environment. If the BS and BE flags are set to zero, it means that the passkey registration ceremony is not being performed in a secure environment. However, this does not necessarily mean that the attestation blob will be stripped from the response-assertion.

    In summary, iOS devices do not support attestation for passkey registration ceremonies, and the removal of attestation from the response-assertion is not directly related to the BS and BE flags.

    Please refer to the following documentation for more information:

    Hope this includes all the information that you were looking for.

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    Thanks,
    Raja Pothuraju.

    0 comments
  2. testuser7 271 Reputation points
    2024-06-28T14:26:53.22+00:00

    Excellent @Raja Pothuraju I think you are to the point so no question except that the two links that you suggested are not opening up.