odoo/odoo · error · InvalidRegistrationResponse

Attestation statement was missing algorithm (Android Key)

Error message

Attestation statement was missing algorithm (Android Key)

What it means

Raised by the vendored py_webauthn Android Key attestation verifier when the attStmt map from the authenticator has no 'alg' entry. Per WebAuthn Level 2 sctn-android-key-attestation, the algorithm identifier is mandatory because the RP must know which COSE algorithm the attestation signature uses. The library rejects the response before any crypto work since it cannot pick a verification algorithm.

Source

Thrown at addons/auth_passkey/_vendor/webauthn/registration/formats/android_key.py:59

    attestation_statement: AttestationStatement,
    attestation_object: bytes,
    client_data_json: bytes,
    credential_public_key: bytes,
    pem_root_certs_bytes: List[bytes],
) -> bool:
    """Verify an "android-key" attestation statement

    See https://www.w3.org/TR/webauthn-2/#sctn-android-key-attestation

    Also referenced: https://source.android.com/security/keystore/attestation
    """
    if not attestation_statement.sig:
        raise InvalidRegistrationResponse(
            "Attestation statement was missing signature (Android Key)"
        )

    if not attestation_statement.alg:
        raise InvalidRegistrationResponse(
            "Attestation statement was missing algorithm (Android Key)"
        )

    if not attestation_statement.x5c:
        raise InvalidRegistrationResponse("Attestation statement was missing x5c (Android Key)")

    # Validate certificate chain
    try:
        # Include known root certificates for this attestation format
        pem_root_certs_bytes.append(google_hardware_attestation_root_1)
        pem_root_certs_bytes.append(google_hardware_attestation_root_2)

        validate_certificate_chain(
            x5c=attestation_statement.x5c,
            pem_root_certs_bytes=pem_root_certs_bytes,
        )
    except InvalidCertificateChain as err:
        raise InvalidRegistrationResponse(f"{err} (Android Key)")

View on GitHub (pinned to 1e661df964)

Solutions

1. Inspect the raw attestation_object CBOR and confirm attStmt contains 'alg' alongside 'sig' and 'x5c'
2. Regenerate the registration response from a real Android device with hardware key attestation enabled (strongbox/TEE)
3. If you build test fixtures, include alg: -7 (ES256) or -257 (RS256) as produced by the device
4. If the authenticator consistently omits alg, report an authenticator bug and consider accepting 'none'/self-attestation instead of requesting android-key attestation

Example fix

# before: fixture missing alg
att_stmt = {"sig": sig_bytes, "x5c": [der_cert]}

# after: include the COSE algorithm the device used
att_stmt = {"alg": -7, "sig": sig_bytes, "x5c": [der_cert]}

# Before verify_registration_response(), sanity-check attStmt keys
import cbor2

def att_stmt_has_required_keys(attestation_object: bytes, fmt: str) -> bool:
    att = cbor2.loads(attestation_object)
    if att.get("fmt") != fmt:
        return False
    stmt = att.get("attStmt", {})
    required = {"sig", "alg", "x5c"} if fmt == "android-key" else set()
    return required.issubset(stmt)

def is_complete_android_key_stmt(att: dict) -> bool:
    stmt = att.get("attStmt") or {}
    return (
        att.get("fmt") == "android-key"
        and isinstance(stmt.get("sig"), bytes)
        and isinstance(stmt.get("alg"), int)
        and isinstance(stmt.get("x5c"), list)
        and len(stmt["x5c"]) > 0
    )

try:
    verify_registration_response(...)
except InvalidRegistrationResponse as e:
    if "missing algorithm (Android Key)" in str(e):
        log.security("malformed android-key attestation", att_stmt_keys=sorted(stmt))
    raise

When it happens

Trigger: verify_android_key_attestation() (or register_credentials()/verify_registration_response() with attestation format 'android-key') receives an attestation_object whose CBOR attStmt lacks the key 'alg' (e.g. attStmt = {'sig': ..., 'x5c': [...]} only). Typical of malformed hand-crafted responses or authenticators/emulators emitting non-conforming android-key statements.

Common situations: Testing with recorded/static registration responses that were truncated; x5c copied from key attestation docs but alg omitted; intermediate proxies or CBOR re-encoders dropping zero/optional-looking fields; authenticator firmware bugs.

Related errors

• Attestation statement was missing signature (Android Key)
• Attestation statement was missing x5c (Android Key)
• Certificate chain could not be validated
• None attestation had unexpected attestation statement
• Unsupported attestation type "{attestation_object.fmt}"

AI-assisted analysis of odoo/odoo@1e661df964 (2026-08-15). Data as JSON: /api/errors/14b3cd0e9d7b427e. Report an issue: GitHub.