Added changes to the PIV documentation based on Ben's feedback - #410
Conversation
There was a problem hiding this comment.
The attestation certificate _can_be restored, but of course this is only meaningful if the original key hasn't been overwritten. The reason is that the key and certificate are two separate objects in PIV, and the slot is actually for the key. There is a corresponding certificate data object with it's own id, mapped according to the PIV spec by the tooling, so you never see this id. The certificate could either be saved before being overwritten, or taken from another YubiKey from the same attestation batch (i.e. with the same default attestation key). This technicality doesn't change much, just for accuracy.
qpernil
left a comment
qpernil
left a comment
There was a problem hiding this comment.
It is probably worth mentioning that an attestation is in fact an x.509 certificate for that slot, containing the correct public key even if the certificate object for that slot has not been properly provisioned.
qpernil
left a comment
qpernil
left a comment
There was a problem hiding this comment.
Im not sure, but perhaps the metadata service should be mentioned, as it provides a complementary function - you can use metadata to get information (including the public key) about a key slot for imported keys, for which attestations are not available.
3 participants
@beneichorst provided feedback to the developer program on changes to the PIV attestation documentation on the DYC - The changes reflect the changes provided to us
This request is related to the PR open for the DYC: Yubico/developers.yubico.com#513