WebAuthn - byte length of the “credential public key”

Question

In WebAuthn, the authenticator data contains the variable length attested credential data followed by the extensions, if any:

The attest

Answer 1

From what I understand there is no way to know in advance without using a CBOR decoder (or COSE Key parser) supporting "extra bytes" first, to determine where the "credential public key data" ends and where "extension data" starts.

There is an extra note discussing exactly this in the WebAuthn Level 2 Draft.

Determining attested credential data's length, which is variable, involves determining credentialPublicKey’s beginning location given the preceding credentialId’s length, and then determining the credentialPublicKey’s length (see also Section 7 of [RFC8152]).

FWIW, discussed in WebAuthn spec's GitHub issue also https://github.com/w3c/webauthn/issues/1012