It is important that the server validates the attributes of the Attestation Key when it receives the AKpub to verify that if it is loaded in the TPM, it is a genuine attestation key.
If not, the client could load an externally generated key with a well-known private key in the TPM and use it to sign externally a fake quote. Then, because it is loaded in the TPM, it would pass the Make/Activate_credential.
I was reading the Attestation Protocols and I didn't find anything related to it in the Readme.
It is important that the server validates the attributes of the Attestation Key when it receives the AKpub to verify that if it is loaded in the TPM, it is a genuine attestation key.
If not, the client could load an externally generated key with a well-known private key in the TPM and use it to sign externally a fake quote. Then, because it is loaded in the TPM, it would pass the Make/Activate_credential.
I was reading the Attestation Protocols and I didn't find anything related to it in the Readme.