Signature field clarification in attestation statement

index.bs

@@ -2797,6 +2797,35 @@ the [=authenticator=] MUST:
     attStmtTemplate .within $$attStmtType
     ```
 
+### Signature Formats for Packed Attestation, FIDO U2F Attestation, and Assertion Signatures ### {#signature-attestation-types}
+    - For COSEAlgorithmIdentifier -7 (ES256),  and other ECDSA-based algorithms,
+        a signature value is encoded as an ASN.1 DER Ecdsa-Sig-Value, as defined in [[RFC3279]] section 2.2.3.
+
+        ```
+        Example:
+        30 44                                ; SEQUENCE (68 Bytes)
+            02 20                            ; INTEGER (32 Bytes)
+            |  3d 46 28 7b 8c 6e 8c 8c  26 1c 1b 88 f2 73 b0 9a
+            |  32 a6 cf 28 09 fd 6e 30  d5 a7 9f 26 37 00 8f 54
+            02 20                            ; INTEGER (32 Bytes)
+            |  4e 72 23 6e a3 90 a9 a1  7b cf 5f 7a 09 d6 3a b2
+            |  17 6c 92 bb 8e 36 c0 41  98 a2 7b 90 9b 6e 8f 13
+        ```
+
+        Note: As CTAP1/U2F devices are already producing signatures values in this format, CTAP2
+        devices will also produce signatures values in same format, for consistency reasons.
+        It is recommended that any new attestation formats defined not use ASN.1 encodings,
+        but instead represent signatures as equivalent fixed-length byte arrays without internal structure,
+        using the same representations as used by COSE signatures as defined in [[!RFC8152]] and [[!RFC8230]].
+
+    - For COSEAlgorithmIdentifier -257 (RS256), `sig` contains the signature generated using the
+        RSASSA-PKCS1-v1_5 signature scheme defined in section 8.2.1 in [[RFC8017]] with SHA-256 as the hash function.
+        The signature is not ASN.1 wrapped.
+
+    - For COSEAlgorithmIdentifier -37 (PS256), `sig` contains the signature generated using the
+        RSASSA-PSS signature scheme defined in section 8.1.1 in [[RFC8017]] with SHA-256 as the hash function.
+        The signature is not ASN.1 wrapped.
+
 # [=[RP]=] Operations # {#rp-operations}
 
 Upon successful execution of {{CredentialsContainer/create()}} or {{CredentialsContainer/get()}}, the [=[RP]=]'s script receives
@@ -4969,5 +4998,6 @@ for their contributions as our W3C Team Contacts.
     "href": "https://www.internet2.edu/media/medialibrary/2013/09/04/internet2-mace-dir-eduperson-200604.html",
     "date": "May 15, 2007"
   }
+
 }
 </pre>