webauthn.me
webauthn.me copied to clipboard
CredentialId is not zero-padded
Description
The attestationObject.authData.credentialId hex value in the debugger is not zero padded, so it can appear to be a nibble or byte short of the credentialIdLength field.
Reproduction

Register a key and attempt to convert it from hex to binary:
echo 7f9a74798aa5199b39ea57bdbf3ebbbf897356a319bd50192969c7877bb27987c7ddb4edc7fa3856ebb2d5e6c9af32bdfaac72ddefce597f24be88ac4c1a04a \
| xxd -p -r | xxd -g1
00000000: 7f 9a 74 79 8a a5 19 9b 39 ea 57 bd bf 3e bb bf ..ty....9.W..>..
00000010: 89 73 56 a3 19 bd 50 19 29 69 c7 87 7b b2 79 87 .sV...P.)i..{.y.
00000020: c7 dd b4 ed c7 fa 38 56 eb b2 d5 e6 c9 af 32 bd ......8V......2.
00000030: fa ac 72 dd ef ce 59 7f 24 be 88 ac 4c 1a 04 ..r...Y.$...L..
Since there is no leading 0, the resulting value is offset by four bits and the 64th byte is missing.