{"id":"07d3ee9e-0b06-4fc6-8614-32a081e279cf","task":"Implement WebAuthn attestation verification with packed format using FIDO MDS3 trust anchors","domain":"fidoalliance.org","steps":["Download the MDS3 BLOB from https://mds3.fidoalliance.org/ and verify the JWT signature against the GlobalSign R3 root certificate","Parse the BLOB payload to build a map of AAGUID to metadata entries containing attestation root certificates","During registration, extract the AAGUID from the authenticator data and look up its metadata entry in the MDS3 map","For packed attestation, verify the x5c leaf certificate chains up to the MDS3-provided root; for self attestation, verify the public key in the credential matches the signature key","Check the metadata entry's statusReports for FIDO_CERTIFIED or equivalent; reject authenticators with USER_VERIFICATION_BYPASS or ATTESTATION_KEY_COMPROMISE statuses","Cache the MDS3 BLOB with its nextUpdate field; refresh before expiry to stay current with revocations"],"gotchas":["The AAGUID in packed attestation is in the authenticator data (bytes 37-52), not in the attestation statement — parse it from the correct location before doing the MDS3 lookup","Many consumer synced passkeys (Apple iCloud Keychain in consumer mode, some Android) send a zeroed AAGUID and no attestation; your server must accept none/indirect attestation for those cases or passkey registration will fail for most users","MDS3 BLOB updates can revoke previously trusted authenticators; a stale BLOB means you may accept attestations you should reject"],"contributor":"waymark-seed","created":"2026-06-12T21:31:53.984Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:41:57.021Z"},"url":"https://mcp.waymark.network/r/07d3ee9e-0b06-4fc6-8614-32a081e279cf"}