Changes:
- A new
require_user_presence
argument has been added toverify_registration_response()
to enable verification of WebAuthn responses generated through use of conditional create where theup
bit inauthData.flags
will beFalse
(#236, h/t @bschoenmaeckers) verify_authentication_response()
has been updated to returnuser_verified
as well to indicate whether or not the user performed user verification (#235, h/t @ggirol-rc)- Verification of
"android-key"
attestation statements has been modernized in light of Android's latest observable behavior (#240) - Verification of
"android-safetynet"
attestation statements now enforces the"basicIntegrity"
flag instead of the"ctsProfileMatch"
flag when determining device integrity (#241) - The list of known TPM manufacturers has been updated (#242)