createAttestationProof

Creates a signed CSR or unsigned TBS CSR from this challenge, according to AttestationChallenge.dataAuth. Key creation follows AttestationChallenge.keyConstraints. Hence, if no constraints are set, this method will always fail!

DataAuthentication.Signature signs the completed TBS CSR and proves possession of the attested private key. DataAuthentication.Hash hashes an AttestationHashInput containing the subject, extensions, and attributes, feeds that digest into platform attestation, and returns the completed but unsigned TBS CSR. The verifier separately checks that its public key is the attested key.

Encodes the challenge's nonce into a KnownOIDs.serialNumber subjectName and the attestation statement into a Pkcs10CertificationRequestAttribute with AttestationChallenge.proofOID. Signing may require user authentication. Hash authentication performs no CSR signing.

Usually, you'll want to use pass AlternativeNames into additionalCsrExtensions, not a subject name! By default, the RDN used for this CSR will only contain KnownOIDs.serialNumber containing the nonce from the passed nonce. Hence, the values passed to this parameter containing a KnownOIDs.serialNumber will be overwritten.

Parameters