odoo/odoo · error · InvalidRegistrationResponse

Attestation statement was missing signature (Android Key)

Error message

Attestation statement was missing signature (Android Key)

What it means

While verifying an 'android-key' attestation statement, the sig component is absent. Per the Android Key attestation format, sig (the signature over the verification data) is mandatory; without it there is nothing to verify and the registration is rejected.

Source

Thrown at addons/auth_passkey/_vendor/webauthn/registration/formats/android_key.py:54

from ....webauthn.helpers.structs import AttestationStatement


def verify_android_key(
    *,
    attestation_statement: AttestationStatement,
    attestation_object: bytes,
    client_data_json: bytes,
    credential_public_key: bytes,
    pem_root_certs_bytes: List[bytes],
) -> bool:
    """Verify an "android-key" attestation statement

    See https://www.w3.org/TR/webauthn-2/#sctn-android-key-attestation

    Also referenced: https://source.android.com/security/keystore/attestation
    """
    if not attestation_statement.sig:
        raise InvalidRegistrationResponse(
            "Attestation statement was missing signature (Android Key)"
        )

    if not attestation_statement.alg:
        raise InvalidRegistrationResponse(
            "Attestation statement was missing algorithm (Android Key)"
        )

    if not attestation_statement.x5c:
        raise InvalidRegistrationResponse("Attestation statement was missing x5c (Android Key)")

    # Validate certificate chain
    try:
        # Include known root certificates for this attestation format
        pem_root_certs_bytes.append(google_hardware_attestation_root_1)
        pem_root_certs_bytes.append(google_hardware_attestation_root_2)

        validate_certificate_chain(

View on GitHub (pinned to 1e661df964)

Solutions

1. Send the authenticatorObject verbatim from cred.response.attestationObject (cred.toJSON())
2. In tests, generate realistic android-key attestations via a virtual authenticator rather than hand-building the CBOR
3. Confirm base64url decoding of attestationObject produces parseable CBOR before verification

Example fix

// before: hand-built attestation
body.response.attestationObject = btoa(JSON.stringify({fmt: 'android-key', attStmt: {alg: -7, x5c: [...]}}));
// after: pass through the real object
const body = cred.toJSON(); // attestationObject untouched base64url CBOR

import base64, cbor2  # type: ignore

def android_key_attestation_wellformed(att_obj_b64: str) -> bool:
    try:
        att = cbor2.loads(base64.urlsafe_b64decode(att_obj_b64 + '=='))
        stmt = att.get('attStmt', {})
        return bool(stmt.get('sig')) and bool(stmt.get('alg')) and bool(stmt.get('x5c'))
    except Exception:
        return False

try:
    verify_android_key_format(...)
except InvalidRegistrationResponse as e:
    if 'missing signature (Android Key)' in str(e):
        logger.warning('incomplete android-key attStmt received — client likely hand-built it')
        return json_response({'error': 'invalid_attestation'}, 400)

When it happens

Trigger: Calling verify_android_key_format with an attestation_object whose attStmt lacks 'sig' — hand-built attestation objects in tests, a truncated CBOR attestation, or an authenticator/compatibility layer that emits incomplete android-key statements.

Common situations: Test fixtures hand-crafting attStmt dicts and forgetting 'sig'; clients sending base64 (not base64url) attestationObject so CBOR parsing partially fails; non-Google devices emitting malformed android-key statements.

Related errors

• Attestation statement was missing algorithm (Android Key)
• Attestation statement was missing x5c (Android Key)
• Certificate chain could not be validated
• None attestation had unexpected attestation statement
• Unsupported attestation type "{attestation_object.fmt}"

AI-assisted analysis of odoo/odoo@1e661df964 (2026-08-15). Data as JSON: /api/errors/a4845d52d87f4b4e. Report an issue: GitHub.