MakeCredential

MakeCredential is a CTAP2 command in the FIDO2/WebAuthn stack used to create a new public-key credential on an authenticator for a specific relying party. It is the CTAP2 counterpart to the U2F Register operation and is invoked during the WebAuthn registration flow when a user enrolls a credential.

Input and flow: The host builds a MakeCredential request that includes the relying party identity (rp.id and rp.name), a user object (id, name, displayName), a clientDataHash (the SHA-256 hash of the serialized clientDataJSON), a list of acceptable public-key parameters (pubKeyCredParams, typically containing algorithms such as ES256 and RS256), and optional options (rk for resident keys, uv for user verification). The authenticator may require user presence or verification and, if granted, creates a new credential associated with the RP. It returns a response containing an AttestationObject and related data.

Output details: The AttestationObject wraps an authData structure and an attestation statement (attStmt). The authData includes a rpIdHash, a flags byte, and a signature counter. If a new credential is created, AttestedCredentialData is included, containing the AAGUID, credentialIdLength, credentialId, and the CredentialPublicKey (encoded as a COSE key). The attestation statement covers attestation format and provenance. The client then presents a PublicKeyCredential with an id, rawId, and a response carrying clientDataJSON and the attestationObject to the WebAuthn API.

Relationship to WebAuthn: MakeCredential underpins navigator.credentials.create() during registration. GetAssertion uses the stored credential for future authentications. Privacy and security considerations include the handling of attestation data and the potential for privacy leakage if attestation is not suppressed.