GetAssertion

GetAssertion is a protocol operation used in FIDO U2F and Web Authentication to obtain an authentication assertion from a registered credential on a hardware authenticator in response to a challenge from a relying party (RP). In CTAP1 (the U2F transport), the operation is commonly referred to as the getAssertion command and is invoked during user authentication.

In the typical flow, the RP issues a challenge and specifies an application parameter (a hash of the RP ID). The client communicates with a compatible authenticator, and the user is prompted to interact with the device (often via a touch or button press). The authenticator verifies that the challenge corresponds to the RP, ensures user presence (and, if required, user verification), and then signs a data structure that binds the challenge to the credential. The response includes the credential identifier (or key handle), a user handle if provided, a signature over the signed data, and information about the authenticator state (such as a signature counter). The RP uses the stored public key associated with the credential to verify the signature and authenticate the user.

With WebAuthn, GetAssertion corresponds to the assertion generated by navigator.credentials.get for an assertion-based authentication. The authenticator returns an assertion consisting of the credential id, the user handle (if any), a signature, and the authenticator data along with the clientDataJSON. The server verifies the signature against the public key registered during initial credential creation, using the clientDataHash and the RP ID binding to validate the response.

Security considerations focus on correct binding to the RP ID, protection against replay, and ensuring proper user presence or verification before releasing an assertion.