WebAuthn attestation per L3 6.5 + FIDO Authenticator Allowed Cryptography List. Attestation provides assurance about the authenticator's origin + characteristics. ATTESTATION FORMATS: packed (most common, FIDO Alliance default - uses authenticator attestation certificate + AAGUID + signature); fido-u2f (legacy U2F format, ECDSA P-256 with x.509); tpm (Trusted Platform Module attestation with AIK certificate + tpmsAttestation); android-key (Android Keystore attestation with key attestation chain); android-safetynet (legacy SafetyNet attestation deprecated 2023 replaced by Play Integrity); apple (Apple anonymous attestation for Touch ID / Face ID); apple-appattest (App Attest for iOS apps); none (no attestation - anonymous). ATTESTATION TYPES: Basic (manufacturer per-batch key); Self (key-pair self-signed); AttCA (Privacy CA model with separate AIK); ECDAA (Elliptic Curve Direct Anonymous Attestation - deprecated); None (anonymous). VERIFICATION STEPS: (1) parse attestation statement per format; (2) verify attestation signature over authenticatorData + clientDataHash; (3) for x.509-bearing formats verify certificate chain to trusted root (FIDO MDS3 trust anchors); (4) verify AAGUID consistency between authenticatorData + certificate; (5) verify policy compliance (allowlist + status indicator); (6) for enterprise attestation verify enterprise attestation flag + identifying material per policy.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.