> The authenticator data is a CBOR structure defined in the WebAuthn Level 3 specification, is returned by the getAuthenticatorData() method of the AuthenticatorAttestationResponse

From TFA,

> The payload is the authenticator data, a CTAP2 CBOR encoding of most of the credential record fields that is already specified by WebAuthn

Both link to the same section of the WebAuthn spec, §6.1 Authenticator Data[1]. Unless I'm missing something, that section is describing a custom binary format, not a CBOR encoding of data. (Though n.b. that one of the items contained by the outer custom binary format is CBOR, but the 37(ish) byte array itself is not CBOR.)

(…and it's stuff like that that just makes all of WebAuthn so impenetrable.)

[1]: https://www.w3.org/TR/webauthn-3/#sctn-authenticator-data

PRF for example, takes salts as inputs, if extensions are taken into consideration then it would need to capture input & client extension results too.

You know what it's called when you store a secret string in your password manager?

A password.