LargeBlob implementation

[Praveen PPT]

Assuming LargeBlob is authenticator specific data with each credential specific data as array item, can RP/Platform update value of any other RP/Platform? How do we prevent data corruption as anybody can update the LargeBlob array

The ‘maxSerializedLargeBlobArray’ returned in AuthenticatorGetInfo is it max size of complete large blob array or per credential large blob array?

[Adam Langley]

On Tuesday, June 25, 2024 at 7:54:07 AM UTC-7 Praveen PPT wrote:

Assuming LargeBlob is authenticator specific data with each credential specific data as array item, can RP/Platform update value of any other RP/Platform? How do we prevent data corruption as anybody can update the LargeBlob array

Yes, any platform can update it and, if it wants, write invalid data. That's the way that the extension works.

The ‘maxSerializedLargeBlobArray’ returned in AuthenticatorGetInfo is it max size of complete large blob array or per credential large blob array?

It is the size of the serialized largeBlob array, i.e. the full blob containing all the CBOR and including the trailing 16 bytes of SHA-256.

Cheers

AGL